WordPress, one switch at a time.
Plain guides to the settings WordPress ships with: what they do, what they cost you, and how to turn them off, with or without a plugin.
-
Security
WordPress Application Passwords: Do You Need Them?
WordPress 5.6 added Application Passwords for REST API authentication. If you don't use external apps, it's an attack surface you don't need. Here's how to disable it.
-
Security
Why the WordPress Theme/Plugin Editor Is a Security Risk
WordPress ships with a built-in code editor that lets anyone with admin access edit PHP files live. Here's why that's dangerous and how to disable it.
-
Security
Your WordPress REST API Is Leaking User Data — Here’s the Fix
The WordPress REST API exposes your user list at /wp-json/wp/v2/users — no login required. Here's how to restrict it without breaking your site.
-
Security
How Hackers Find Your WordPress Username (and How to Stop Them)
Typing ?author=1 on any WordPress site reveals the admin username. Attackers use this for brute force login. Here's how to block author enumeration.
-
Security
WordPress Security Headers: What They Are and How to Add Them
Most WordPress sites are missing security headers that protect against XSS, clickjacking, and MIME attacks. Here's what they are and how to add them.
-
Cleanup
WordPress Keeps Pinging Itself — How to Stop Self-Pingbacks
Every time you link to your own posts, WordPress sends itself a pingback. That means extra HTTP requests and spam comments on your own content. Here's the fix.
-
Performance
Is jQuery Migrate Still Needed in WordPress? (Spoiler: Probably Not)
WordPress loads jquery-migrate.min.js on every page for backward compatibility with old plugins. Here's how to check if you need it — and remove it if not.
-
Performance
WordPress Heartbeat API Is Eating Your Server Resources
The WordPress Heartbeat API sends a request every 15 seconds while you edit posts. On shared hosting, this can max out your CPU. Here's how to control it.
-
Cleanup
Does Your WordPress Site Need RSS? Probably Not — Here’s How to Disable It
WordPress generates multiple RSS feeds by default. Most business sites don't need them. Here's how to disable RSS and clean up your site's output.
-
Security
Why You Should Hide Your WordPress Version Number
WordPress broadcasts your version number in the HTML source, RSS feed, and REST API. Here's why that helps attackers and how to hide it in 30 seconds.