Luiz Bills

<p>Several opinionated WordPress tweaks focused in security and performance.</p>
<h4>FEATURES</h4>
<ul>
<li>Produces clean filenames for uploads</li>
<li>Change admin footer text</li>
<li>Disable author page and author search by url</li>
<li>Disable emoji mess</li>
<li>Disable “meta widget”</li>
<li>Disable WP REST API public access</li>
<li>Disable “website” field from comment form</li>
<li>Disable wp embed</li>
<li>Disable xmlrpc.php</li>
<li>Show admin bar for admin users only</li>
<li>Hide WordPress update nag to all but admins</li>
<li>Remove “WordPress logo” from admin bar</li>
<li>Remove “+ New” button from admin bar</li>
<li>Remove some dashboard widgets</li>
<li>Remove query strings from scripts (JavaScript and CSS)</li>
<li>Remove <link rel=”shortlink” ></li>
<li>Remove dashboard “welcome panel”</li>
<li>Remove WordPress version number in <head></li>
<li>and more…</li>
</ul>
<p><strong>Note</strong>: is possible disable any feature.</p>
<h4>Contribuitions</h4>
<p>For bugs, suggestions or contribuitions, open a issue in our <a href="https://github.com/luizbills/wp-tweaks/issues" rel="nofollow ugc">Github Repository</a> or create a topic in <a href="https://wordpress.org/support/plugin/wp-tweaks/" rel="ugc">WordPress Plugin Forum</a>.</p>
<h4>Donations</h4>
<p>Support this plugin on <a href="https://luizpb.com/donate/" rel="nofollow ugc">https://luizpb.com/donate/</a></p>


WP Tweaks

Several opinionated WordPress tweaks focused in security and performance.

Luis Celadita

<p><strong>This plugin is fully compatible with Autoptimize and any cache plugin (Cache Enabler or Wp Super Cache by example)</strong></p>
<p>Some of the tweaks that this plugin automatically applies securely are the following:</p>
<h4>SET HTTP SECURITY HEADERS</h4>
<ul>
<li>X-Frame-Options: SAMEORIGIN</li>
<li>X-XSS-Protection: 1;mode=block</li>
<li>Referrer-Policy: no-referrer-when-downgrade</li>
<li>X-Content-Type-Options: nosniff</li>
<li>Strict-Transport-Security: max-age=15552000</li>
<li>Content-Security-Policy</li>
</ul>
<h4>REMOVE THIS</h4>
<ul>
<li>Remove Really Simple Discovery link from header</li>
<li>Remove wlwmanifest.xml (Windows Live Writer) from header</li>
<li>Remove Shortlink URL from header</li>
<li>Remove WordPress Generator Version from header</li>
<li>Remove s.w.org DNS Prefetch</li>
<li>Remove generator name from RSS Feeds</li>
<li>Remove Capital P Dangit filter</li>
<li>Remove WordPress and WooCommerce meta generator tags</li>
<li>Remove Jquery_migrate</li>
<li>Remove Dashicons in admin bar (only for non logged users)</li>
<li>Remove Post oEmbed</li>
</ul>
<h4>AND MORE AUTO SETTINGS</h4>
<ul>
<li>Change Control Heartbeat API interval (60 seconds)</li>
<li>Disable the XML-RPC interface</li>
<li>Disable PDF thumbnails preview</li>
<li>Disable Self Pingbacks</li>
<li>Limit Post Revisions to 1</li>
<li>Add IDs to posts, pages, and categories</li>
</ul>
<p>Just activate the plugin and test your site’s speed in your favourite tool (GTMetrix, Pingdom Tools, Securityheaders.com, etc.)</p>


AutoTweaks

WP Classic Setup: Removes WP version, dashicons, oEmbed, Jquery Migrate, XMLRPC. Set Http security headers, heartbeat to 60s, Post revisions to 1, etc

WP Tweaks vs AutoTweaks