x3mgroup

<p>This will add site-wide tweaks to the FUNCTIONS.PHP of any wp-theme, and increases the security of a WordPress Site.<br />
The creation of this plugin was based on Webfactory’s Ninja Security Plugin!</p>
<p>There is no setup or configuration screen on the current version, but it’s easy enough to edit the plugin. Supports WP Multisite installations</p>
<p>These are the tweaks:</p>
<p>Removes WordPress<br />
META HEADER version info, so hackers can’t find  which version of WP is running!</p>
<p>Replaces the login information  so hackers will not know if the USERNAME or the PASSWORD was wrong!</p>
<p>Disables the EDITING of Themes and Plugins by NON ADMIN users!</p>
<p>Removes<br />
WLW (Windows Live Writer) link is present in the header,<br />
which is only needed if Winodws Live Writer needs to be used!</p>
<p>Please feel free to add your own tweaks. If you do, please be so kind and leave a message at support!</p>


X3M Site-Wide Ninja Tweaks

Luis Celadita

<p><strong>This plugin is fully compatible with Autoptimize and any cache plugin (Cache Enabler or Wp Super Cache by example)</strong></p>
<p>Some of the tweaks that this plugin automatically applies securely are the following:</p>
<h4>SET HTTP SECURITY HEADERS</h4>
<ul>
<li>X-Frame-Options: SAMEORIGIN</li>
<li>X-XSS-Protection: 1;mode=block</li>
<li>Referrer-Policy: no-referrer-when-downgrade</li>
<li>X-Content-Type-Options: nosniff</li>
<li>Strict-Transport-Security: max-age=15552000</li>
<li>Content-Security-Policy</li>
</ul>
<h4>REMOVE THIS</h4>
<ul>
<li>Remove Really Simple Discovery link from header</li>
<li>Remove wlwmanifest.xml (Windows Live Writer) from header</li>
<li>Remove Shortlink URL from header</li>
<li>Remove WordPress Generator Version from header</li>
<li>Remove s.w.org DNS Prefetch</li>
<li>Remove generator name from RSS Feeds</li>
<li>Remove Capital P Dangit filter</li>
<li>Remove WordPress and WooCommerce meta generator tags</li>
<li>Remove Jquery_migrate</li>
<li>Remove Dashicons in admin bar (only for non logged users)</li>
<li>Remove Post oEmbed</li>
</ul>
<h4>AND MORE AUTO SETTINGS</h4>
<ul>
<li>Change Control Heartbeat API interval (60 seconds)</li>
<li>Disable the XML-RPC interface</li>
<li>Disable PDF thumbnails preview</li>
<li>Disable Self Pingbacks</li>
<li>Limit Post Revisions to 1</li>
<li>Add IDs to posts, pages, and categories</li>
</ul>
<p>Just activate the plugin and test your site’s speed in your favourite tool (GTMetrix, Pingdom Tools, Securityheaders.com, etc.)</p>


AutoTweaks

WP Classic Setup: Removes WP version, dashicons, oEmbed, Jquery Migrate, XMLRPC. Set Http security headers, heartbeat to 60s, Post revisions to 1, etc

X3M Site-Wide Ninja Tweaks vs AutoTweaks