Headache

An easy-to-swallow painkiller plugin for WordPress.

The plugin removes a lot of default WordPress stuff you just can't wait to get rid of. It removes meta tags such as feeds, version numbers and emojis.

Installation

Require the package, with Composer, in the root directory of your project.

composer require vinkla/headache

The plugin will be installed as a must-use plugin.

Features

All features are activated by default when the plugin is activated.

Security Features

• Disable default users API endpoints for security
  Prevents unauthorized enumeration of usernames through REST API endpoints, enhancing site security against username discovery attacks.

• Disable XML RPC for security
  Disables XML-RPC functionality which is often targeted by brute force attacks and is rarely needed in modern WordPress sites.

Comment & Feed Management

• Disable comments
  Turns off the commenting system entirely, useful for sites that don't need user interaction or want to prevent spam.

• Disable comments feeds
  Removes RSS feeds for comments, reducing unnecessary feed endpoints.

• Disable feeds
  Redirects all RSS/Atom feeds to the homepage, eliminating content syndication endpoints that may not be needed.

• Disable pings
  Closes pingbacks and trackbacks in every environment, not just the non-production ones WordPress 7.1 covers by default.

Content & Attachment Management

• Disable attachment pages
  Prevents direct access to attachment pages and redirects them to 404, reducing potential SEO issues and security vulnerabilities.

• Remove reserved attachment slugs
  Uses UUIDs for attachment slugs instead of predictable names, preventing slug reservation conflicts and improving security.

Gutenberg & Editor Cleanup

• Disable loading separate core block assets
  Disables the loading of separate core block assets to prevent unstyled content and ensure proper style removal.

• Disable font library
  Disables WordPress 6.5+ font library feature in the block editor, reducing interface complexity for sites that don't need custom fonts.

• Disable auto-sizes for lazy-loaded images
  Turns off the WordPress 6.7 auto-sizes feature, removing both the sizes="auto" attributes and the inline contain styles it prints.

• Remove Gutenberg's front-end block styles
  Removes default block styling to prevent style conflicts and reduce CSS bloat.

• Remove Gutenberg's core block styles
  Removes core block support styles for cleaner CSS output.

• Remove Gutenberg's global styles
  Removes global theme styles added by Gutenberg to prevent theme conflicts.

• Remove Gutenberg's SVG filters
  Removes SVG filters primarily used in Full Site Editing that add unnecessary markup.

• Remove classic theme styles
  Removes backwards compatibility styles for classic themes when using block themes.

• Remove blocked HTML elements from TinyMCE when pasting text
  Sanitizes pasted content in the classic editor by removing unwanted HTML tags and attributes.

Performance & Cleanup

• Remove JPEG compression
  Sets JPEG quality to 100% to prevent WordPress from compressing uploaded images.

SEO & Indexing

• Discourage search engines from indexing in non-production environments
  Automatically discourages search engine indexing in development, staging, and testing environments.

User Role Management

• Remove contributor, subscriber and author roles
  Removes unnecessary user roles for sites that only need administrators and editors.

Meta Tag & Link Cleanup

• Remove all extra RSS feed links
  Removes extra RSS feed discovery links from the HTML head section.

• Remove emojis
  Removes emoji detection scripts and styles, reducing page load times and preventing emoji-related issues.

• Remove generated icons
  Removes automatically generated site icon links from the HTML head, on the front end and on the login screen.

• Remove language dropdown on login screen
  Hides the language selector on the login page for cleaner login experience.

• Remove meta rel=dns-prefetch href=//s.w.org
  Removes DNS prefetch hint for WordPress.org servers on the front end and on the login screen, improving privacy and reducing external requests.

• Remove oEmbeds
  Removes oEmbed discovery links and scripts, preventing automatic embedding of external content.

• Remove Really Simple Discovery link
  Removes RSD link used by blog clients, which is rarely needed in modern WordPress sites.

• Remove relational links for the posts
  Removes prev/next post links from HTML head to reduce clutter.

• Remove REST API link tag from <head> and HTML headers
  Removes REST API discovery links for cleaner HTML output.

• Remove RSS feed links
  Removes main RSS feed discovery links from the HTML head.

• Remove shortlink tag from <head> and HTML headers
  Removes shortlink meta tags and HTTP headers for cleaner output.

• Remove WordPress version
  Removes WordPress version meta tag for security through obscurity.

Login Page Customization

• Update login page image link URL
  Changes the login page logo link to point to your site instead of WordPress.org.

• Update login page link title
  Updates the login page logo title attribute to show your site name instead of "WordPress".

Tips

Here are some additional tips for customizing WordPress, which can be added to your theme's functions.php file:

• Remove admin menu items
  Removes unnecessary admin menu items such as Comments, Posts, and Dashboard from the sidebar.

• Remove admin toolbar menu items
  Cleans up the admin toolbar by removing items like WordPress logo, updates, comments, and customizer links.

• Remove admin dashboard widgets
  Removes default dashboard widgets such as Activity, Site Health, WordPress Events and News, and Quick Draft.

• Add custom login logo
  Replaces the default WordPress logo on the login page with your own custom logo.

• Update permalink structure
  Automatically sets the permalink structure to /%postname%/ for cleaner URLs.