JPKCom Harden & Trim

Plugin Name: JPKCom Harden & Trim
Plugin URI: https://github.com/JPKCom/jpkcom-harden-trim
Description: Secure, private & lean WordPress: hardening, privacy and performance tweaks with safe defaults.
Version: 1.1.1
Author: Jean Pierre Kolb jpk@jpkc.com
Author URI: https://www.jpkc.com
Contributors: JPKCom
Tags: Security, Privacy, Performance, Hardening, Cleanup
Requires at least: 7.1
Tested up to: 7.1
Requires PHP: 8.3
Stable tag: 1.1.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Text Domain: jpkcom-harden-trim
Domain Path: /languages
Update URI: https://github.com/JPKCom/jpkcom-harden-trim

Secure, private & lean WordPress: hardening, privacy and performance tweaks with safe defaults.

Description

A collection of small switches that make a WordPress site more secure, leak less information and load less unnecessary code. Every switch lives on one settings page under Settings → Harden & Trim and can also be set with a PHP constant in wp-config.php. The constant always wins and locks the field on the settings page.

Harmless defaults

Activating the plugin and touching nothing must not visibly change your site: no layout change, no broken editor workflow, no broken integration. Everything that has a concrete way to break something ships off, with a warning next to the switch. The defaults only remove things nobody sees (generator tags, fingerprint headers, an emoji script, user enumeration paths) and add headers that match what browsers already do.

One deliberate exception: XML-RPC. The XML-RPC switch is on by default and in every preset, so xmlrpc.php is refused on every site that runs this plugin unless you switch it off. Jetpack, the WordPress mobile apps and incoming pingbacks stop working while it is on; see the Security table and the changelog of 1.1.0.

Three presets on the settings page (Harmless, Recommended, Strict) apply a whole set of switches at once. A preset only assigns the keys it manages, never touches a locked key, and can never switch on the risky switches below.

Performance

Clean up <head>

All of these are global; the role exemption does not apply.

The RSD and REST link removal is deliberately global: a version that only hid them from some requests would make Site Health's HTTPS check report a mismatching response.

Why there is no switch for next/previous links or the Windows Live Writer manifest: WordPress 7.1 no longer prints either of them. A switch for them would pretend to do something.

Privacy

This is not GDPR compliance. The privacy switches reduce the data your site sends to third parties and exposes about its users. They do not replace a privacy policy, a consent tool, a data processing agreement or legal advice. The embed switch in particular is no consent solution.

Security

Page caches and headers: headers are sent by PHP on front-end HTML responses and skipped when PHP already set a header of that name (WordPress or another plugin). Headers added by the web server (nginx add_header, Apache mod_headers), a proxy or a CDN are invisible to PHP, so the same header would be sent twice. Set each header in one place: either switch it on here, or set it in the server configuration and switch it off here. Two Strict-Transport-Security headers are the worst case, because browsers only use the first one and hstspreload.org rejects such responses. A page served straight from a page cache may not carry PHP headers at all; the server configuration is the more reliable place for them.

Role exemption

On multisite a super admin counts as administrator on every site, also where they hold no role there. The exemption covers only those six switches. Everything else is global by nature (cron, anonymous requests, headers, constants, <head> output), and the settings page marks each switch accordingly. The filter jpkcom_harden_trim_is_exempt can change the decision per user.

Presets

XML-RPC is refused in every preset (Harmless, Recommended and Strict all list it as on), so applying a preset never reopens it. The flip side: applying a preset switches it on again, also on a site where you had turned it off (for example for Jetpack). A wp-config.php constant keeps it off regardless.

Never touched by any preset: disabling comments, block library CSS, global styles, HSTS, feed link removal, application password settings and the role lists. Every other switch gets the preset's value or its default, so a preset never switches heartbeat off or removes asset versions, but it does reset a disabled heartbeat or removed asset versions. Applying a preset asks for confirmation and lists the keys that changed.

Import and export

Export downloads the stored settings as a JSON file. It contains no site URL and no user data. Import accepts a file (up to 64 KB; JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES in wp-config.php changes the limit) or pasted JSON, accepts known keys only, runs every value through the same sanitiser as the settings form and reports how many keys were applied and which were rejected. A key locked by a constant is stored, but the constant still wins.

Kill switch

define( 'JPKCOM_HARDEN_TRIM_DISABLE_ALL', true ); registers no feature hooks at all. The settings page stays reachable and shows a notice. The value is read like every boolean constant: 'false', 'off' or 0 keep the features on, and a value that is no boolean is ignored and named on the settings page.

Filters for developers

• jpkcom_harden_trim_settings (array) changes the effective settings; values are validated again. It runs once, on plugins_loaded, so add it in a plugin or mu-plugin, not in a theme's functions.php. The settings page marks fields it changes and keeps saving the stored values.
• jpkcom_harden_trim_is_exempt (bool, user) changes the role exemption.
• jpkcom_harden_trim_author_enum_exempt (bool, query vars, Accept header, REQUEST_URI, requested URL as core rebuilds it) lets an anonymous ?author=N request through.

Privacy of the plugin itself

No remote requests, no telemetry, no tracking. The one exception is the plugin updater, which fetches a manifest from GitHub Pages whenever WordPress reads its list of plugin updates: in wp-admin, on the front end for logged-in users who can update plugins (the toolbar's update counter), and in WordPress's own update cron. The manifest is cached for a day, a failed fetch for an hour.

Documentation

API Documentation: Complete PHPDoc-generated API documentation is available at: https://jpkcom.github.io/jpkcom-harden-trim/docs/

Installation

1. In your admin panel, go to 'Plugins' > and click the 'Add New' button.
2. Click Upload Plugin and 'Choose File', then select the Plugin's .zip file. Click 'Install Now'.
3. Click 'Activate' to use the plugin right away, then review Settings → Harden & Trim.

FAQ

How do I set options in wp-config.php?

Define the constant before the "That's all, stop editing" line. The constant wins over the stored value and locks the field on the settings page:

define( 'JPKCOM_HARDEN_TRIM_EMOJI', true );
define( 'JPKCOM_HARDEN_TRIM_HEARTBEAT', 'optimized' );
define( 'JPKCOM_HARDEN_TRIM_POST_REVISIONS', 20 );
define( 'JPKCOM_HARDEN_TRIM_EXEMPT_ROLES', 'editor,author' );

Booleans take true/false, enums an exact value from the table, integers a value from the allowed list, role lists an array or a comma separated string. An invalid value is ignored and the settings page names the constant.

WP_POST_REVISIONS, AUTOSAVE_INTERVAL, DISALLOW_FILE_EDIT and WP_AI_SUPPORT in wp-config.php win over this plugin, including its constants: WordPress follows them, the matching field is locked and its disabled control shows their value the way WordPress reads it (WP_POST_REVISIONS true or -1 as "WordPress default", a number outside the list as an extra entry), and a JPKCOM_HARDEN_TRIM_* constant for the same setting is marked as ignored.

Something broke. How do I switch everything off?

Add define( 'JPKCOM_HARDEN_TRIM_DISABLE_ALL', true ); to wp-config.php. No feature runs while it is defined. Deactivating the plugin does the same.

Does it work with block themes?

Yes. Block library CSS and global styles are unavailable with block themes (the switches are disabled and do nothing there), because a block theme depends on those styles.

Does it overlap with Rank Math, caching plugins or Defender?

Possibly. SEO plugins may remove the same <head> links or replace the core sitemaps (then the sitemap switch has nothing to do). Caching and optimisation plugins may offer emoji, embed or heartbeat switches. Security plugins may send the same headers; this plugin skips a header another plugin already set in PHP, but cannot see headers from the web server or a CDN. Run each switch in one place only.

What about XML-RPC, comments and the login URL?

XML-RPC and comments are built in since 1.1.0 (the two switches in the Security table) and behave like the standalone plugins JPKCom Disable XML-RPC and JPKCom Disable Comments, hook for hook. Those plugins remain available and maintained, and running one of them next to the matching switch is harmless: the same hooks fire twice, and the settings page notes that the plugin is already active. One exception: JPKCom Disable Comments up to 1.0.10 removes the REST comment routes, which breaks block editor Notes even with this switch; update it to 1.0.11 or later. Hiding the login URL stays with JPKCom Hide Login; this plugin does not duplicate it.

Does it make my site GDPR compliant?

No. See the note in the description.

What happens when I uninstall it?

Deleting the plugin removes its settings option and its cached data (on multisite, from every site). Deactivating keeps them.

Changelog

1.1.1

• Changed: the German translations call the defaults "Standardwerte"; "Voreinstellungen" now only means the presets, so the settings page no longer uses one word for both

1.1.0

• Changed: XML-RPC is blocked on every site right after this update, because the new "Disable XML-RPC" switch is on by default and the stored settings of an earlier version do not contain it. Jetpack, the WordPress mobile apps and incoming pingbacks stop working until you untick the switch in Settings → Harden & Trim or set define( 'JPKCOM_HARDEN_TRIM_XMLRPC', false ); in wp-config.php. Every preset keeps it on, so applying a preset also switches it on again
• Added: "Disable XML-RPC" switch, mirroring JPKCom Disable XML-RPC 1.0.10: xmlrpc.php answers 403 with an XML-RPC fault, the endpoint is no longer advertised, trackbacks are refused
• Added: "Disable comments" switch (off by default, never part of a preset), mirroring JPKCom Disable Comments 1.0.11: comments and pings closed on every post type, existing comments hidden, every post reports zero comments (no comment links or counts in /feed/ and the Atom feed, no "N comments" in themes), comment screens and feeds removed. The REST comment routes answer every request that is not a block editor Notes request with the rest_no_route 404 a missing route gives (OPTIONS too, which a missing route answers with an empty 200); a note's route whose id parameter names a different comment is not a Notes request. Notes keep working, and WordPress' own permission checks decide who may read or write them. Because the routes stay registered for Notes, the REST index at /wp-json/ lists them. The query-string comment feeds (?feed=comments-rss2, ?p=123&feed=rss2) answer 404 directly instead of redirecting to a pretty URL that would 404 as well; this is deliberate
• Added: a hint on the settings page while the matching standalone plugin is active
• Added: German translations of the new texts (de_DE, de_DE_formal)

1.0.1

• Changed: the updater keeps its manifest cache, its failure marker and its fetch lock in site transients. On multisite the network now fetches the manifest once instead of once per site; on a single site nothing changes
• Changed: uninstalling also removes the updater's network-wide cache entries, and still the per-site ones 1.0.0 wrote

1.0.0

• Added: Initial release.
• Added: performance switches (emoji, self pingbacks, asset versions, post embeds, comment reply, dashicons, block library CSS, global styles, heartbeat, revisions, autosave interval)
• Added: <head> cleanup, privacy and security switches with harmless defaults
• Added: role exemption (off by default), presets, JSON import/export, wp-config.php constants and a kill switch
• Added: German translations (de_DE, de_DE_formal)