James Robinson

JMR.codes

A self-hosted site manager’s toolkit: the security hardening, performance tuning, admin cleanup, content controls and email handling you’d otherwise install half a dozen micro-plugins for — as independent modules on a single settings page (Settings → Site Toolkit). Every module is off by default and registers no hooks while disabled, so the plugin changes nothing until you opt in.
🔐 Security — disable XML-RPC, hide the WordPress version, disable user enumeration (author scans, sitemaps, oEmbed, author archives), block the REST users endpoint, disable the file editors, block readme/license files, security headers (with optional HSTS), disable application passwords, session management, and an admin audit log.
🔓 Login Page — change the login URL, login rate limiting, hide detailed login errors, username-only sign-in, disable the language switcher, record each user’s last login, and login screen branding (use your site identity automatically or a custom logo from the media library).
🚀 Performance — control autosave and post revisions, remove asset version query strings, throttle the Heartbeat API, remove wp_head bloat and generator tags, dequeue unused default assets (emoji, jQuery Migrate, Block Library CSS), disable self-pings, scheduled database maintenance, DNS prefetch/preconnect hints, and manage generated image sizes.
🛠️ Admin / UX — hide the front-end toolbar, change the WordPress greeting, replace the account menu with a logout button, dashboard widget manager, custom admin footer, maintenance mode, media library user isolation, environment indicator, suppress update notices on non-production, trim the WordPress toolbar menu, and an “All Settings” menu item.
📝 Content & Editorial — customize excerpts, disable the block editor per post type, disable trackbacks, targeted comment controls (media comments, plain-text links, minimum length), disable comments entirely, disable oEmbed, and restore the Links Manager.
📧 Email & Notifications — disable selected notification emails, and redirect or block all outgoing email on non-production environments.
If you have further suggestions, please contact us via the <a href="https://wordpress.org/support/plugin/wp-performance-security" rel="ugc">plugin support page</a>.
If this plugin is useful for managing your WordPress settings, please <a href="https://wordpress.org/support/view/plugin-reviews/wp-performance-security" rel="ugc">leave a review</a>.
Developed by <a href="https://jmr.codes" rel="nofollow ugc">JMR.codes</a>.

Performance & Security

A site manager's toolkit. Settings to modify WordPress and improve performance and security.

Performance & Security vs XT Corporate ToolKit