CodingCush Tweaks

CodingCush Tweaks collects the fixes most WordPress sites end up needing and puts them behind clean on/off switches. Every tweak is a separate class that is only loaded when it is switched on, so the plugin costs nothing for the things you do not use.

Each tweak can be switched on or off from Settings → Tweaks . Nothing changes on your site until you turn a tweak on.

Security

• Disable XML-RPC – switch off the XML-RPC API, the X-Pingback header and the RSD link
• Require login for the REST API – visitors get a 401 from /wp-json/
• Hide the WordPress version – generator tag, feed version and ?ver= on core assets
• Disable the file editor – no theme or plugin code editing from the admin
• Stop user enumeration – blocks ?author=1 scans and the public users endpoint
• Generic login errors – never confirm whether a username exists

Performance

• Heartbeat control – slow the interval, or disable it on the dashboard, outside the editor, or everywhere
• Disable emoji scripts
• Disable oEmbed (wp-embed script and discovery links)
• Limit post revisions – keep only the last N
• Disable self-pingbacks
• Remove Dashicons for visitors
• Disable RSS feeds

Media & Uploads

• Change the maximum upload size – with your real server limits shown next to it
• Allow SVG uploads – for administrators and editors only, every file sanitised on upload
• Allow extra file types – add extension mime/type pairs; executables, scripts, web documents (HTML, CSS, SVG, XML) and other risky types are always refused