Snippet library
WordPress code snippets, ready to use.
707 free & Pro snippets and modules. Copy-paste-ready, or import in one click with SnipCraft.
Remove Query Strings from Static Assets
Strips version query strings from enqueued CSS and JS URLs to improve caching at proxies and CDNs.
Disable Emoji Scripts and Styles
Removes all WordPress emoji detection scripts, inline styles, TinyMCE plugin, and DNS prefetch entries to reduce HTTP requests.
Remove Unnecessary Head Links
Removes RSD, WLW Manifest, shortlink, and REST API discovery link tags from the HTML head to reduce information leakage.
Disable Pingbacks and Trackbacks
Removes the X-Pingback header, strips pingback XML-RPC methods, and disables trackback support on all post types.
Block Author URL Enumeration
Redirects ?author=N query string requests to the homepage to prevent user account enumeration.
Remove WordPress Version from Head and Feeds
Removes the WordPress generator meta tag from the HTML head and strips the version string from all RSS/Atom feeds.
Disable XML-RPC
Completely disables the WordPress XML-RPC interface to reduce the attack surface.
Disable Login Field Autofocus
Removes the automatic focus on the username input at wp-login.php to prevent browsers from surfacing stored credentials unsolicited.
Serve a security.txt File
Responds to requests for /.well-known/security.txt with a standards-compliant plain-text file containing your security contact and expiry date.
Email Admin After Repeated Failed Logins
Tracks failed login attempts per IP using transients and emails the site admin when a configurable attempt threshold is crossed within a rolling window.
Add Google reCAPTCHA v3 to the Login Form
Integrates Google reCAPTCHA v3 into wp-login.php to silently score submissions and block likely-bot login attempts.
Remove REST API Link Tag from Head
Removes the REST API discovery link from the HTML head and HTTP Link header to reduce information exposure to scanners.
Block Comments Containing Links
Automatically marks as spam any new comment that contains a URL, reducing link-spam without requiring CAPTCHA.
Allow Login by Email Address Only
Restricts the WordPress login form to email addresses only, rejecting plain username attempts with a friendly error message.
Disable Login with Email Address (Username Only)
Rejects login attempts that use an email address, forcing users to enter their WordPress username instead.
Disable PHP Error Display on the Front End
Suppresses PHP error, warning, and notice output on the public site so internal details are never leaked to visitors.
Block Visitors by IP Address
Denies access at the WordPress init stage to any visitor whose IP matches a configurable blocklist, returning a 403 Forbidden response.
Limit WooCommerce Action Scheduler Retention
Reduces how long Action Scheduler retains completed and failed actions in the database, keeping the table small and cleanup queries fast.
Set oEmbed Maximum Width
Caps the maximum width of embedded media such as YouTube and Vimeo via the embed_defaults filter to fit your content column.
Set fetchpriority=high on the Hero Image
Adds fetchpriority="high" and removes lazy-loading from the post thumbnail on singular views to boost Largest Contentful Paint.
Lazy-Load Gravatars in Comments
Adds the native loading="lazy" attribute to all Gravatar img tags in the comments section to defer off-screen avatar network requests.
Disable Dashicons for Logged-Out Visitors
Dequeues the Dashicons stylesheet on the public front end for visitors who are not logged in, saving an HTTP request and ~30 KB.
Disable WooCommerce Cart Fragments AJAX
Dequeues the wc-cart-fragments script that fires an admin-ajax.php request on every page load, improving time to first byte on WooCommerce stores.
Self-Host Google Fonts Locally
Dequeues Google Fonts requests added by themes or plugins and enqueues a self-hosted fonts.css from the active theme instead.