James Robinson

JMR.codes

A self-hosted site manager’s toolkit: the security hardening, performance tuning, admin cleanup, content controls and email handling you’d otherwise install half a dozen micro-plugins for — as independent modules on a single settings page (Settings → Site Toolkit). Every module is off by default and registers no hooks while disabled, so the plugin changes nothing until you opt in.
🔐 Security — disable XML-RPC, hide the WordPress version, disable user enumeration (author scans, sitemaps, oEmbed, author archives), block the REST users endpoint, disable the file editors, block readme/license files, security headers (with optional HSTS), disable application passwords, session management, and an admin audit log.
🔓 Login Page — change the login URL, login rate limiting, hide detailed login errors, username-only sign-in, disable the language switcher, record each user’s last login, and login screen branding (use your site identity automatically or a custom logo from the media library).
🚀 Performance — control autosave and post revisions, remove asset version query strings, throttle the Heartbeat API, remove wp_head bloat and generator tags, dequeue unused default assets (emoji, jQuery Migrate, Block Library CSS), disable self-pings, scheduled database maintenance, DNS prefetch/preconnect hints, and manage generated image sizes.
🛠️ Admin / UX — hide the front-end toolbar, change the WordPress greeting, replace the account menu with a logout button, dashboard widget manager, custom admin footer, maintenance mode, media library user isolation, environment indicator, suppress update notices on non-production, trim the WordPress toolbar menu, and an “All Settings” menu item.
📝 Content & Editorial — customize excerpts, disable the block editor per post type, disable trackbacks, targeted comment controls (media comments, plain-text links, minimum length), disable comments entirely, disable oEmbed, and restore the Links Manager.
📧 Email & Notifications — disable selected notification emails, and redirect or block all outgoing email on non-production environments.
If you have further suggestions, please contact us via the <a href="https://wordpress.org/support/plugin/wp-performance-security" rel="ugc">plugin support page</a>.
If this plugin is useful for managing your WordPress settings, please <a href="https://wordpress.org/support/view/plugin-reviews/wp-performance-security" rel="ugc">leave a review</a>.
Developed by <a href="https://jmr.codes" rel="nofollow ugc">JMR.codes</a>.

Performance & Security

A site manager's toolkit. Settings to modify WordPress and improve performance and security.

Xylus Themes

Dharmesh Patel

The Xylus Toolkit provides support for portfolio items, testimonials, services, team members and more to supported Xylus themes. Simply install the plugin and the theme will determine which features to activate.

Xylus Toolkit

The Xylus Toolkit extends functionality to Xylus Themes, providing custom post types and more.

Performance & Security vs Xylus Toolkit