WordPress, one switch at a time.
Plain guides to the settings WordPress ships with: what they do, what they cost you, and how to turn them off, with or without a plugin.
-
Maintenance
How to Put WordPress in Maintenance Mode (Without Breaking Anything)
Need to work on your WordPress site without visitors seeing a broken layout? Here's how to enable maintenance mode properly — with correct HTTP status codes.
-
Tracking
How to Add Google Tag Manager to WordPress Without a Plugin
Adding GTM to WordPress shouldn't require a plugin. Here's how to add your container code properly — in the head and body — with just a few lines of code.
-
Performance
Remove Query Strings from Static Resources in WordPress
Query strings like ?ver=6.5 on your CSS and JS files prevent CDN caching and hurt your GTmetrix score. Here's how to remove them in WordPress.
-
Security
How to Limit Login Attempts in WordPress (Stop Brute Force Attacks)
WordPress allows unlimited login attempts by default. That's an open invitation for brute force attacks. Here's how to add a lockout in under a minute.
-
Security
How to Hide Your WordPress Login Page from Bots and Hackers
Your WordPress login page at /wp-admin is the #1 target for bots. Here's how to hide it behind a custom URL and stop brute force attacks cold.
-
Cleanup
How to Completely Disable Comments in WordPress (Without a Plugin Mess)
Most business sites don't need WordPress comments. Here's how to fully disable them — menus, templates, feeds, and all — without installing 5 plugins.
-
Security
What Is XML-RPC in WordPress and Why You Should Disable It
XML-RPC in WordPress is a legacy feature that hackers exploit for brute force and DDoS attacks. Here's what it does and how to safely disable it.
-
Performance
WordPress Loads Emoji Scripts on Every Page — Here’s How to Stop It
WordPress loads a 10.5 KB emoji script on every page — even if you never use emojis. Here's how to remove it and speed up your site in under 60 seconds.
-
WordPress Tips
You don’t need 12 plugins to clean up WordPress admin
Every WordPress site accumulates single-purpose admin plugins. One to remove emojis, one to disable XML-RPC, one to hide the version number. Here is why that is a problem — and a better approach.
-
Security
Five WordPress hardening rules that won’t break your site
Most WordPress hardening guides don't tell you which rules are safe and which will break WooCommerce. Here are five that work on virtually every site.