CodingCush Tweaks

CodingCush Tweaks collects the fixes most WordPress sites end up needing and puts them behind clean on/off switches. Every tweak is a separate class that is only loaded when it is switched on, so the plugin costs nothing for the things you do not use.

Each tweak can be switched on or off from Settings → Tweaks. Nothing changes on your site until you turn a tweak on.

Security

• Disable XML-RPC – switch off the XML-RPC API, the X-Pingback header and the RSD link
• Require login for the REST API – visitors get a 401 from /wp-json/
• Hide the WordPress version – generator tag, feed version and ?ver= on core assets
• Disable the file editor – no theme or plugin code editing from the admin
• Stop user enumeration – blocks ?author=1 scans and the public users endpoint
• Generic login errors – never confirm whether a username exists

Performance

• Heartbeat control – slow the interval, or disable it on the dashboard, outside the editor, or everywhere
• Disable emoji scripts
• Disable oEmbed (wp-embed script and discovery links)
• Limit post revisions – keep only the last N
• Disable self-pingbacks
• Remove Dashicons for visitors
• Disable RSS feeds

Media & Uploads

• Change the maximum upload size – with your real server limits shown next to it
• Allow SVG uploads – for administrators and editors only, every file sanitised on upload
• Allow extra file types – add extension mime/type pairs; executables, scripts, web documents (HTML, CSS, SVG, XML) and other risky types are always refused
• Keep original image size – turn off the 2560px big-image scaling

Admin & Editor

• Disable comments everywhere
• Use the classic editor for selected post types
• Stop automatic update emails
• Hide the admin bar for non-admins
• Clean up the dashboard
• Remove head clutter – wlwmanifest, shortlink, REST link, adjacent-post links

Built to stay out of your way

• One autoloaded option, no extra database tables
• No admin notices, no upsells, no tracking, no external requests
• Settings page CSS and JS load on that page only
• Export and import your setup as JSON to reuse it on other sites
• Clean uninstall: removes its single option and nothing else

Made by CodingCush

Tutorials, project walkthroughs and more plugins at codingcush.com.