The Off Switch (formerly WP Avoid Slow)
| 开发者 |
Abhishek
deshabhishek007 fitehal |
|---|---|
| 更新时间 | 2026年4月21日 01:07 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
WordPress prioritises backwards compatibility.
That's a feature. It also means every install ships with things you didn't ask for.
An emoji CDN script. An oEmbed script. A Windows Live Writer manifest (discontinued 2017).
Dashicons loaded for logged-out visitors. Heartbeat polling every 15 seconds.
A version tag that tells the world exactly which WordPress you're running.
None of these are bugs. They're just not needed on most sites.
Disable what you don't need. Keep what you do.
The Off Switch lets you disable each one, individually.
The Off Switches
- Emoji script - ~15 KB + 1 HTTP request. Browsers handle emoji natively.
- Embed script - ~4 KB + oEmbed discovery links in
<head>. - RSD link - Really Simple Discovery. Only needed for legacy XML-RPC clients.
- WLW manifest - Windows Live Writer has been discontinued since 2017.
- WP version tag - Stops advertising your WordPress version to the world.
- Shortlink - Removes
<link rel="shortlink">from<head>and HTTP headers. Search engines ignore it. - Asset query strings - Strips
?ver=from scripts, styles, and WP 6.5+ Script Modules so CDNs and proxies cache correctly. - XML-RPC - Closes a common brute-force attack vector.
- XML-RPC Kill Requests - Goes further than disabling: hard-kills any incoming xmlrpc.php request with a 403 before WordPress loads at all.
- Heartbeat API - Reduces admin polling from every 15 s to every 60 s.
- Dashicons (frontend) - ~35 KB (CSS + font) saved for every logged-out visitor.
- REST API Discovery Link - Removes
<link rel="https://api.w.org/">from<head>. Safe to remove on standard sites. - RSS Feed Links - Removes feed autodiscovery
<link>tags from<head>. Modern browsers no longer act on them. Leave enabled if you publish an RSS feed. - Speculation Rules (WP 6.8+) - Disables the WP 6.8+ Speculation Rules API that prefetches links before users click. Can inflate analytics, increase server bandwidth, and trigger consent flows on unfetched pages.
- Disable All Feeds - Redirects all RSS and Atom feed URLs to the homepage. For sites with no RSS subscribers.
- Comment Auto-Links - Stops WordPress from converting plain-text URLs in comments into clickable links.
- Editor Autosave - Deregisters the autosave script that POSTs editor content to the server every 60 seconds. For teams that prefer explicit saves.
- DNS Prefetch - Removes all
<link rel="dns-prefetch">hints from<head>. Redundant when Emojis and Embeds are already disabled. - Recent Comments Inline CSS - WordPress outputs a small inline
<style>block in<head>whenever the Recent Comments widget is active. Remove it if your theme already styles the widget.
- jQuery Migrate - ~30 KB. Modern themes don't need it.
- Block Library CSS - ~7 KB loaded on every page, even with no Gutenberg blocks.
- Global Styles (theme.json CSS) - 10-50 KB inline CSS from block themes.
- SVG Duotone Filters - Hidden SVG blob injected on every page, even with no duotone images.
- Script/Style type attributes -
type="text/javascript"andtype="text/css"are redundant in HTML5. - Defer non-critical JavaScript - Adds
deferso scripts don't block HTML parsing. jQuery is never deferred. - Move scripts to footer - Relocates enqueued scripts from
<head>to just before</body>. jQuery is never moved.
- Self-pingbacks - WordPress pings your own posts when you link between them - a wasted HTTP request that creates an unwanted comment on the target post.
- Capital P filter - WordPress corrects "Wordpress" to "WordPress" on every rendered string. Remove if you don't need the autocorrect.
- Limit post revisions - WordPress stores unlimited revisions per post. Caps revisions at 3 to prevent silent database growth on active editorial sites.
- Attachment pages - WordPress creates a full template page for every uploaded file. These waste crawl budget on most sites. Sends a 301 redirect to the parent post instead.
- Comments - Closes all comments and pingbacks site-wide, hides existing comments on the frontend, and removes comment-related UI from wp-admin (Comments menu, admin bar node, dashboard widget). Enable only if your site does not use comments.
- Search - Redirects all WordPress search queries (
/?s=) to the homepage with a 301, preventing bots from triggering repeated database queries. Also removes search forms rendered viaget_search_form(). Hardcoded forms in theme templates are not affected. - oEmbed Provider - WordPress registers a REST endpoint at
/wp-json/oembed/1.0/embedso other sites can embed your content via the oEmbed protocol. Remove it if you don't want your content embeddable externally. Does not affect your ability to embed others' content. - Post via Email - Removes the Post via Email configuration from Writing Settings and disables the feature. Almost no modern site uses email-to-post.
- Update Services (Ping-o-Matic) - Removes Update Services from Writing Settings and stops outbound pings to weblog ping services on every published post.
- Native XML Sitemap (WP 5.5+) - Disables WordPress's built-in XML sitemap generator. Most sites use external SEO plugins (Yoast, Rank Math) for sitemaps instead. Removes unnecessary redirects and reduces crawl overhead (default OFF).
- oEmbed Auto-Embed - Disables WordPress from regex-scanning post content for [embed] shortcodes and oEmbed patterns on every frontend page load. For sites that do not embed external content, removing this filter saves processing overhead (default OFF).
- Expired Transients - Schedules a daily cleanup of expired transient rows in wp_options. Useful on low-traffic sites where WP-Cron can go days without firing.
- Abandoned Auto-Drafts - WordPress creates an auto-draft every time the post editor opens. Abandoned sessions leave these rows permanently. Runs a daily sweep to delete auto-drafts older than 30 days.
- Skip Row Count on Singles - On every single post or page, MySQL runs SQL_CALC_FOUND_ROWS to count total matching rows - a full index scan only needed for paginated archives. Removes that sub-query on all singular views.
- Adjacent Post Links - WordPress queries the previous and next post on every single post page to output
<link rel="prev/next">in<head>. Two extra DB queries per page load. Google dropped support for these SEO hints in 2019. - Reduce Trash Retention - WordPress keeps trashed items for 30 days before permanent deletion. Reducing to 7 days keeps wp_posts leaner on active editorial sites without affecting normal recovery workflows.
- Google Fonts display:swap - Without
font-display:swap, the browser hides text while your Google Font downloads (FOIT). Addsdisplay=swapto every Google Fonts URL so visitors see text immediately. - Add missing image dimensions - Images without
widthandheightattributes cause layout shifts (CLS). Reads dimensions from attachment metadata and injects them automatically. - LCP image priority - Adds
fetchpriority="high"to the first content image so the browser loads it before lower-priority resources. Addsfetchpriority="low"anddecoding="async"to all others. - Lazy load images - Adds
loading="lazy"to images below the fold. The first image is never lazy-loaded - it is the LCP candidate and must load immediately. - Disable PDF thumbnails - WordPress generates thumbnail previews for every uploaded PDF when ImageMagick is available. Rarely used on the frontend; adds significant upload processing time.
- Disable scaled images - WordPress 5.3+ creates a downsized -scaled copy of any image whose longest side exceeds 2560 px on upload. On most sites this extra file is never served. Disabling it stores the original as-uploaded. Applies to new uploads only.
- Disable extra image sizes - WordPress 5.3 added 1536×1536 and 2048×2048 intermediate sizes to every image upload. These oversized copies are rarely requested and waste disk space. Theme and plugin image sizes are not affected. Applies to new uploads only.
- Block User Enumeration - WordPress redirects
?author=1to/author/username/, exposing registered usernames. Intercepts those requests and redirects to the homepage before the username is revealed. - Disable Author Archives - Redirects all
/author/username/pages to the homepage. For sites with no author profile pages. - Disable File Editor - Defines
DISALLOW_FILE_EDITto remove the plugin and theme code editor from wp-admin. Eliminates a code-injection surface a compromised admin account could exploit. - Disable Application Passwords - Removes the Application Passwords UI and stops all tokens from being accepted. For sites that don't use REST API or XML-RPC integrations.
- Suppress Admin Email Check - Disables the periodic full-screen prompt asking admins to confirm their email address. One less interruption, no functional change.
- Remove X-Pingback Header - Strips
X-Pingback:from every HTTP response, stopping the site from advertising its XML-RPC endpoint URL to scanners. - Clean Admin Bar - Removes the WordPress logo dropdown, the duplicate "Visit Site" link, and the admin bar search for a less cluttered editing environment.
- Hide Update Nag for Non-Admins - Hides the core update notice from editors and contributors who cannot action it. Administrators still see it normally.
- Restrict REST API to Logged-In Users - The REST API is publicly accessible by default, allowing unauthenticated enumeration of posts, users, and other data. Restricting access to authenticated users reduces the attack surface. Will break public REST consumers such as headless frontends.
- Redirect Unauthenticated Admin Access - By default, visiting /wp-admin/ without being logged in redirects to the login page, confirming a WordPress admin area exists. This redirects unauthenticated requests to the homepage instead, reducing information disclosure to scanners. AJAX, Cron, WP-CLI, and admin-post.php requests are never affected.
- Hide Author Sitemap - WordPress 5.5 added a built-in XML sitemap that includes a users file listing the author archive URL for every user with published posts — up to 2,000 usernames, publicly accessible. Removes the users entry from the sitemap index entirely (WP 5.5+, default ON).
- Remove X-Redirect-By Header - WordPress 5.1+ adds an X-Redirect-By: WordPress header on every redirect, openly advertising that the site runs WordPress. Removes it from all redirects (default ON).
- Hide PHP Version Header - PHP sends an X-Powered-By: PHP/x.x.x header on every response, exposing your exact PHP version to every visitor and scanner. Removes it from all responses (default ON).
- Generic PHP Error Messages - WordPress fatal error messages can include internal file paths and line numbers. Replaces them with a generic response that reveals nothing about server structure (default ON).
- Hide Admin Bar on Frontend - Removes the WordPress admin toolbar from the public-facing site for all logged-in users. Reduces frontend CSS/JS overhead for logged-in sessions (default OFF).
- Remove Dashboard Welcome Panel - Removes the "Welcome to WordPress" panel from the dashboard home screen for all users (default OFF).
- Remove Default Dashboard Widgets - Removes four default dashboard widgets including WordPress Events and News, which makes an outbound HTTP request to api.wordpress.org on every dashboard load (default OFF).
- Remove Admin Footer Text - Removes the "Thank you for creating with WordPress" text and WordPress version number from the wp-admin footer (default OFF).
- Disable REST Users Endpoint - WordPress's REST API exposes
/wp-json/wp/v2/userspublicly, returning usernames and slugs for all users with published posts. Removes this endpoint for unauthenticated requests only — Gutenberg and plugins that need it while logged in are unaffected (default ON). - Disable Email Change Notifications - WordPress sends emails to users when their email address or password changes. On agency-managed sites these are noise. Suppresses both notification types (default OFF).
- Disable Auto-Update Emails - WordPress emails after every automatic core, plugin (WP 5.5+), and theme (WP 5.5+) update. On sites where auto-updates are routine these arrive constantly (default OFF).
- Auto-Update Emails: Errors Only - A middle ground: suppresses core auto-update success emails only. Failure emails still arrive so you know when action is needed (default OFF).
- Skip Bundled Themes on Upgrade - Defines
CORE_UPGRADE_SKIP_NEW_BUNDLEDto stop WordPress installing a new default theme on every core upgrade. Existing themes are not affected (default OFF). - Disable Site Health - Disables WordPress Site Health checks entirely. Site Health runs a 12-hour background cron job and makes REST API calls on every admin page load, fetching a list of ~20 WordPress.org API endpoints. On managed hosting with automated updates, these checks are redundant and add unnecessary server load (default OFF).
- Remote Block Patterns - WordPress fetches patterns from api.wordpress.org on every editor load. An outbound HTTP request that adds latency even if editors never use the Pattern inserter. Local patterns from themes and plugins are unaffected.
- Core Block Patterns - Removes WordPress's built-in block patterns (headers, galleries, CTAs) from the Pattern inserter. For sites using custom patterns or none at all.
- Block Directory - The editor includes a live search of wordpress.org that lets users install new blocks without leaving the editor. Remove it to keep block installation under your control.
- Font Library (WP 6.5+) - WordPress 6.5 added a Font Library panel for uploading custom fonts and browsing Google Fonts in the Site Editor. Remove it if fonts are managed through your theme or code.
- Widget Block Editor (WP 5.8+) - WordPress 5.8 replaced the classic Widgets screen with a block-based editor. Restores the classic screen for classic themes, sidebar widgets, and page builders.
- Cart Fragments - wc-cart-fragments.js fires an AJAX request to keep mini-cart counts accurate when the Cart Widget is rendered (~3 KB + 1 request). Disable on stores where the Cart Widget is not used, or where real-time cart accuracy across tabs is not needed.
- WooCommerce Generator Tag - Removes
<meta name="generator" content="WooCommerce x.x.x">from<head>. Same reason as the WordPress version tag: stops advertising which version of WooCommerce you're running. - WC Scripts on Non-WC Pages - WooCommerce loads ~114 KB of CSS and JS on every page (woocommerce-general, woocommerce-layout, woocommerce-smallscreen, woocommerce.js, wc-add-to-cart.js, and woocommerce-blocktheme on block themes). Dequeues them all on non-shop, non-cart, non-checkout, and non-account pages. Up to ~30 KB gzipped saved per non-WooCommerce page.
- Password Strength Meter - WooCommerce already restricts wc-password-strength-meter to checkout and My Account pages where a password is required. This toggle is a secondary safety net for themes or plugins that enqueue the script more broadly, removing zxcvbn (~80 KB gzipped) wherever it loads unnecessarily.
- Status Dashboard Widget - Removes the WooCommerce Status meta box from the WordPress admin dashboard. For stores managed from the WooCommerce screens directly.
- WC Block Patterns - WooCommerce registers its own block patterns in the editor inserter. Remove them if your store does not use WooCommerce-provided patterns for page design - declutters the inserter and removes a small init overhead.
- WC Legacy Widgets - WooCommerce registers 12 legacy widgets on every page load even on block-based themes. Unregistering them removes the initialisation overhead and hides them from Appearance -> Widgets.
- WC Version Header - Removes the X-WooCommerce-Version HTTP response header that some WooCommerce extensions inject, closing the same version-leakage vector as the generator tag toggle.
- Stripe Gateway Scripts - Prevents the WooCommerce Stripe Gateway from loading Stripe.js on product and cart pages when the Payment Request Button (Apple Pay / Google Pay) is disabled in the Stripe settings.
- Related Products - On every product page WooCommerce queries products sharing the same categories or tags. On large catalogues this is a slow JOIN query. Removes both the query and the "Related products" section. Up-sells and cross-sells are not affected.
- Hide Login Error Details - WordPress returns different errors for "unknown username" vs "incorrect password", letting attackers confirm which usernames exist. Replaces all messages with a single generic response. Enabled by default.
- Disable Email Login - WordPress 4.5+ allows login with an email address. On sites where emails are publicly visible this widens the brute-force surface. Enforces username-only login.
- Remove Register Link - Removes the "Register" link from the login page without disabling registration itself. Useful for invite-only setups with a direct registration URL.
- Remove Language Switcher - WordPress 5.9+ adds a locale switcher to the login form. Removes it on single-language sites.
- Disable Password Reset - Disables the lost-password flow entirely and removes the "Lost your password?" link from the login form. For sites where passwords are managed externally or by admins only (default OFF).
- Require Login - Redirects all non-logged-in visitors to the WordPress login page. For staging sites, intranets, or any site that should not be publicly accessible. AJAX, REST API, WP-CLI, and WP-Cron requests are never affected (default OFF).
- No caching - use a dedicated caching plugin for that.
- No CDN - use Cloudflare, BunnyCDN, or your host's CDN.
- No .htaccess writes - pure PHP hooks, works on any host including managed hosting.
- No upsell. No Pro version. No phone-home.
- WebTNG – The Off Switch review — David McCan enabled 59 of 66 available options on a live test site and covers performance, security, WooCommerce, and login hardening toggles.
安装:
- Upload
wp-avoid-slowto/wp-content/plugins/ - Activate through the Plugins menu
- Go to Settings -> Off Switch
- Turn off what you don't need
常见问题:
Will this break my site?
Each toggle is independent. Safe defaults are on. Risky ones (jQuery Migrate, defer JS, scripts to footer) are off by default. If something breaks - turn that toggle off. Nothing is written to disk.
Does it work on managed hosting (WP Engine, Kinsta, Pressable)?
Yes. Pure PHP hooks, no .htaccess required.
Should I disable XML-RPC?
Only if you don't use Jetpack, the WordPress mobile app, or any XML-RPC client. When in doubt, leave it off.
Should I enable "Defer non-critical JavaScript" or "Move scripts to footer"?
Test on staging first. These two are the most likely to cause issues on complex sites - some themes and plugins rely on scripts being available synchronously in <head>.
Does it cache pages?
No. This plugin removes unused WordPress features. For page caching, use a dedicated plugin.
Does it work on WordPress Multisite?
Not currently. The plugin is designed and tested for single-site WordPress installs. Multisite support is planned for a future release.
Does it work with WooCommerce?
Yes. When WooCommerce is active, a WooCommerce section appears in Settings -> Off Switch with 9 dedicated toggles for removing WooCommerce frontend overhead. None of the core toggles touch WooCommerce - each module is independent.
How do I disable emojis in WordPress?
Enable the Emoji Script toggle under The Off Switches. It removes the emoji CDN script (~15 KB + 1 HTTP request) — modern browsers render emoji natively without it.
How do I disable the Heartbeat API in WordPress?
Enable the Heartbeat API toggle. It reduces admin polling from every 15 seconds to every 60 seconds. For most sites the difference is invisible to editors.
Does it work alongside caching plugins like WP Rocket, LiteSpeed Cache, or W3 Total Cache?
Yes. This plugin removes features at the WordPress hook level before caching plugins run. Use both — they do different jobs. This plugin removes unnecessary output; a caching plugin stores and serves the result.
How is this different from other performance plugins?
Most performance plugins add things - caching layers, CDN routing, minification pipelines. This one removes things. It's a different job.
更新日志:
1.9.11
- Patch release to refresh WordPress.org package generation for the latest stable version.
- Fix: Reset to Defaults now correctly restores OFF toggles — previously every toggle was written as ON due to isset() treating 0 as present
- Fix: PHPDoc return types on all field_definitions() methods corrected to array
- Fix: PHPDoc param types on disable_emojis_tinymce() and remove_query_strings() updated to mixed to reflect their defensive type guards
- New: XML-RPC Kill Requests — hard-kills incoming xmlrpc.php requests with a 403 before WordPress loads, stopping server resources being spent on blocked requests (default OFF)
- New: Post via Email — removes the Post via Email configuration from Writing Settings and disables the feature entirely (default OFF)
- New: Update Services (Ping-o-Matic) — removes Update Services from Writing Settings and stops outbound pings on every published post (default OFF)
- New: Auto-Update Emails: Errors Only — suppresses WordPress core auto-update success emails only; failure emails still arrive (default OFF)
- New: Skip Bundled Themes on Upgrade — defines CORE_UPGRADE_SKIP_NEW_BUNDLED to stop WordPress installing a new Twenty-Something theme on every core upgrade (default OFF)
- New: Require Login — redirects all non-logged-in visitors to the login page; AJAX, REST API, WP-CLI, and WP-Cron requests are never affected (default OFF)
- Total: 91 independent toggles across 9 modules
- Tweak: Limit Post Revisions — if
WP_POST_REVISIONSis already defined in wp-config.php, the plugin now detects it, shows the toggle as active with the configured value, and skips the filter (WordPress core handles it natively). Hint added to description explaining how to set a custom revision count via wp-config.php.
- New: Reset to Defaults button — one click restores all 85 switches to their plugin defaults, with a confirmation prompt before saving
- New: Disable oEmbed Provider — removes the /wp-json/oembed/1.0/embed REST endpoint so other sites cannot embed your content via WordPress oEmbed (default OFF)
- New: Disable REST Users Endpoint — removes /wp-json/wp/v2/users for unauthenticated requests, closing the REST username enumeration vector without affecting Gutenberg or authenticated REST use (default ON)
- New: Disable Email Change Notifications — suppresses the emails WordPress sends when a user's email address or password changes (default OFF)
- New: Disable Auto-Update Emails — suppresses WordPress core, plugin (WP 5.5+), and theme (WP 5.5+) auto-update notification emails (default OFF)
- New (WooCommerce): Disable Related Products — removes the related products query and section from every product page; up-sells and cross-sells are unaffected (default OFF)
- Total: 85 independent toggles across 9 modules (75 core + 10 WooCommerce)
- New: Disable Comments — closes all comments and pingbacks site-wide, hides existing comments on the frontend, and removes comment-related UI from wp-admin (Comments menu, admin bar node, dashboard widget) (default OFF)
- New: Disable Search — redirects all /?s= search queries to the homepage with a 301 and removes search forms rendered via get_search_form(); prevents bot-driven DB queries on sites that don't use search (default OFF)
- New: Disable Scaled Images — stops WordPress creating a -scaled copy of large uploaded images (WP 5.3+, applies to new uploads only, default OFF)
- New: Disable Extra Image Sizes — stops generating the 1536×1536 and 2048×2048 sizes WordPress 5.3 added on every upload; theme and plugin sizes are unaffected (applies to new uploads only, default OFF)
- Total: 80 independent toggles across 9 modules (71 core + 9 WooCommerce)
- Improvement: Added Settings link to the plugin row on the Plugins screen for quicker access
- New: Hide Admin Bar on Frontend — remove the admin toolbar from the public site for all logged-in users (default OFF)
- New: Remove Dashboard Welcome Panel — remove the "Welcome to WordPress" panel from the dashboard (default OFF)
- New: Remove Default Dashboard Widgets — remove At a Glance, Activity, Quick Draft, and WordPress Events and News (default OFF)
- New: Remove Admin Footer Text — remove WordPress version number and footer text from wp-admin screens (default OFF)
- New: Disable Password Reset — disable the lost-password flow and remove the login page link (default OFF)
- Total: 76 independent toggles across 9 modules (67 core + 9 WooCommerce)
- New: Hide Author Sitemap — remove /wp-sitemap-users-1.xml from the sitemap index, preventing username enumeration via the built-in WordPress sitemap (WP 5.5+, default ON)
- New: Remove X-Redirect-By Header — remove the X-Redirect-By: WordPress header WordPress adds on every redirect (default ON)
- New: Hide PHP Version Header — remove X-Powered-By: PHP/x.x.x from all HTTP responses (default ON)
- New: Generic PHP Error Messages — replace fatal error output with a generic message that does not reveal file paths or line numbers (default ON)
- Total: 71 independent toggles across 9 modules (62 core + 9 WooCommerce)
- Improvement: LCP Image Priority toggle description clarified — only affects content images (featured image and post content); site logo and theme header images are not affected
- New: Redirect Unauthenticated Admin Access - redirect unauthenticated /wp-admin/ requests to the homepage instead of the login page; AJAX, Cron, WP-CLI, and admin-post.php unaffected (default OFF)
- Total: 67 independent toggles across 9 modules (58 core + 9 WooCommerce)
- New module: Login Page - 4 toggles for hardening the WordPress login page (Module 9)
- New: Hide Login Error Details - replace specific error messages with a generic response to prevent username enumeration (default ON)
- New: Disable Email Login - enforce username-only login, reject email addresses as login identifiers (default OFF)
- New: Remove Register Link - remove the "Register" link from the login page without disabling registration (default OFF)
- New: Remove Language Switcher - remove the locale dropdown from the login form on single-language sites (WP 5.9+, default OFF)
- Total: 66 independent toggles across 9 modules (57 core + 9 WooCommerce)
- New: Recent Comments Inline CSS - remove the inline
<style>block the Recent Comments widget outputs in<head>(default OFF) - New: Reduce Trash Retention - reduce trash retention from 30 days to 7 via the empty_trash_days filter (default OFF)
- New: Restrict REST API to Logged-In Users - block unauthenticated REST API access; third-party auth methods unaffected (default OFF)
- Total: 62 independent toggles across 8 modules (53 core + 9 WooCommerce)
- New: WC Block Patterns - unregister WooCommerce block patterns from the editor inserter (default OFF)
- New: WC Legacy Widgets - unregister 12 default WooCommerce legacy widgets on every page load (default OFF)
- New: WC Version Header - remove X-WooCommerce-Version from HTTP response headers (default ON)
- New: Stripe Gateway Scripts - prevent Stripe.js loading when Payment Request Button is disabled (default OFF)
- Total: 59 independent toggles across 8 modules (50 core + 9 WooCommerce)
- New module: WooCommerce - 5 toggles for removing WooCommerce frontend overhead (only visible when WooCommerce is active)
- New: Cart Fragments - removes wc-cart-fragments when the Cart Widget renders (default OFF)
- New: WooCommerce Generator Tag - removes WooCommerce version from <meta name="generator"> via correct get_the_generator_html filter (default ON)
- New: WC Scripts on Non-WC Pages - dequeues WooCommerce CSS/JS including wc-add-to-cart and woocommerce-blocktheme (block themes) on non-shop pages (default OFF)
- New: Password Strength Meter - secondary safety net removing wc-password-strength-meter outside checkout and My Account (default OFF)
- New: Status Dashboard Widget - removes WooCommerce Status widget from wp-admin dashboard (default OFF)
- Improvement: plugin boot now runs at plugins_loaded priority 20 so WooCommerce is always loaded before the boot function fires
- Total: 55 independent toggles across 8 modules (50 core + 5 WooCommerce)
- New module: Block Editor - 5 toggles for controlling what Gutenberg loads
- New: Remote Block Patterns - disables api.wordpress.org pattern fetch on editor load (default ON)
- New: Core Block Patterns - removes built-in patterns from the Pattern inserter (default OFF)
- New: Block Directory - removes block search and install from the editor (default ON)
- New: Font Library - disables Font Library panel in Site Editor (WP 6.5+, default OFF)
- New: Widget Block Editor - restores classic Widgets screen instead of block-based editor (WP 5.8+, default OFF)
- Total: 50 independent toggles across 7 modules
- New module: Admin Hardening - 8 security and admin cleanup toggles across a new dedicated section
- New: Block User Enumeration - intercepts ?author=N redirects that expose usernames (default ON)
- New: Disable Author Archives - redirects /author/username/ pages to homepage (default OFF)
- New: Disable File Editor - defines DISALLOW_FILE_EDIT to remove plugin/theme code editor (default OFF)
- New: Disable Application Passwords - removes Application Passwords UI and token acceptance (default OFF)
- New: Suppress Admin Email Check - disables the periodic admin email confirmation nag (default ON)
- New: Remove X-Pingback Header - strips X-Pingback from all HTTP responses (default ON)
- New: Clean Admin Bar - removes WP logo, Visit Site link, and admin bar search (default OFF)
- New: Hide Update Nag for Non-Admins - hides core update notices from editors and contributors (default OFF)
- Total: 45 independent toggles across 6 modules
- New: Disable All Feeds toggle - redirects /feed/ and all feed URLs to homepage (default OFF)
- New: Comment Auto-Links toggle - removes make_clickable() pass on every comment (default OFF)
- New: Editor Autosave toggle - deregisters autosave script in post editor (default OFF)
- New: DNS Prefetch toggle - removes all wp_resource_hints from <head> (default OFF)
- Total: 37 independent toggles across 5 modules
- Rebrand: plugin display name changed to "The Off Switch" (slug, code, and all settings are unchanged - no migration needed for existing installs)
- New: live search / filter box on the settings page - type to instantly filter toggles across all modules
- New: "NEW" badge on the 3 toggles added in 1.2.0 (REST API Discovery Link, RSS Feed Links, Speculation Rules)
- New: WordPress version gating - the Speculation Rules toggle is automatically disabled with a notice on WordPress older than 6.8
- Total: 33 independent toggles across 5 modules
- New: REST API Discovery Link toggle - removes
<link rel="https://api.w.org/">from<head>(default ON) - New: RSS Feed Links toggle - removes RSS autodiscovery
<link>tags from<head>(default OFF) - New: Speculation Rules toggle - disables WP 6.8+ prefetch/prerender JSON output (default OFF)
- Improvement: Asset Query Strings now also covers WP 6.5+ Script Modules (
script_module_loader_srcfilter) - no new toggle needed - Fix:
customize-supportscript handle added to protected list - was incorrectly deferred or moved to footer when Defer JS or Move Scripts to Footer were enabled - Reviewed against WordPress 6.9.1 source - all new default frontend outputs assessed; no other unaddressed bloat found
- Total: 33 independent toggles across 5 modules
- Fix: new toggles introduced in 1.1.0 were showing as off after upgrading from an older version instead of their correct defaults
- Fix: activation hook now merges new option keys into existing settings on upgrade - existing user choices are never overwritten
- Fix: settings page now merges with defaults before rendering so new toggles always display their intended state even if the stored option row is from an older version
- Fix: active switch counter in the page header now counts correctly after an upgrade
- New module: WordPress Behaviour Tweaks - disable self-pingbacks, remove Capital P filter, limit post revisions to 3, redirect attachment pages to parent post
- New module: Image Performance - Google Fonts display:swap, auto-add missing image dimensions (fixes CLS), LCP fetchpriority, lazy load images, disable PDF thumbnail generation
- readme: added multisite FAQ (not yet supported)
- readme: added tribute to YSlow philosophy
- Tested up to WordPress 6.9.1
- Total: 26 independent toggles across 4 modules
- Complete rewrite - no longer depends on .htaccess
- 17 independent toggles across two modules, pure PHP hooks
- Module 1: The Off Switches - emoji, embeds, RSD, WLW manifest, version tag, shortlink, query strings, XML-RPC, Heartbeat, Dashicons
- Module 2: Script & Style Control - jQuery Migrate, Block Library CSS, Global Styles, SVG Duotone, type attributes, defer JS, move scripts to footer
- Admin UI: CSS toggle switches replacing checkboxes
- Works on any host including managed hosting
- Ships with safe defaults - risky toggles are off until you opt in
- Settings -> Avoid Slow admin page
- Minor fixes
- Minor fixes
- Expire cache fix
- Initial release - .htaccess Expires headers + ETags