Snippet library
PHP snippets for WordPress.
467 free & Pro snippets and modules. Copy-paste-ready, or import in one click with SnipCraft.
Selective Heartbeat API Control
Disables the Heartbeat API everywhere except the post editor, and reduces its interval to 30 seconds on edit screens to minimise AJAX overhead.
Lazy-Load Iframes in Post Content
Adds the loading="lazy" attribute to all iframe tags found in post content and widget text to defer off-screen iframe loading.
Add DNS Preconnect Hints for External Resources
Outputs preconnect and dns-prefetch link tags in the head for commonly used external domains to reduce connection latency.
Remove Google Fonts Enqueue from Theme
Dequeues Google Fonts stylesheets registered by popular themes and catches any remaining enqueue whose src points to fonts.googleapis.com.
Defer Non-Critical JavaScript
Adds the defer attribute to all non-critical frontend script tags, skipping jQuery and scripts that already carry async.
Disable Theme and Plugin File Editors
Hides the theme and plugin file editor menu items and redirects direct access attempts to prevent in-browser code editing.
Add HSTS and Content Security Policy Headers
Sends HTTP Strict Transport Security and a Content-Security-Policy header on HTTPS responses to enforce secure resource loading.
Send Basic Security Headers
Adds X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, and Permissions-Policy headers to all frontend responses.
Restrict REST API to Authenticated Users
Returns a 401 WP_Error for all unauthenticated REST API requests, blocking public access to the entire REST API.
Block REST API User Enumeration
Removes the /wp/v2/users REST endpoints for unauthenticated requests to prevent public user account listing.
Reduce Heartbeat API Frequency
Increases the WordPress Heartbeat API polling interval to 60 seconds site-wide to lower AJAX request load on the server.
Disable WordPress Embeds
Removes oEmbed discovery links, deregisters wp-embed.min.js, and disables embed rewrite rules to prevent the site from being embedded via the WP oEmbed provider.
Limit Post Revisions
Caps stored revisions per post to five to prevent unlimited revision growth in the database.
Disable jQuery Migrate
Removes the jquery-migrate script dependency from the jQuery registration to reduce frontend JavaScript payload.
Dequeue Block Library CSS on Frontend
Removes the Gutenberg block library stylesheet on the frontend for themes that do not use core block styles.
Remove Query Strings from Static Assets
Strips version query strings from enqueued CSS and JS URLs to improve caching at proxies and CDNs.
Disable Emoji Scripts and Styles
Removes all WordPress emoji detection scripts, inline styles, TinyMCE plugin, and DNS prefetch entries to reduce HTTP requests.
Remove Unnecessary Head Links
Removes RSD, WLW Manifest, shortlink, and REST API discovery link tags from the HTML head to reduce information leakage.
Disable Pingbacks and Trackbacks
Removes the X-Pingback header, strips pingback XML-RPC methods, and disables trackback support on all post types.
Block Author URL Enumeration
Redirects ?author=N query string requests to the homepage to prevent user account enumeration.
Remove WordPress Version from Head and Feeds
Removes the WordPress generator meta tag from the HTML head and strips the version string from all RSS/Atom feeds.
Disable XML-RPC
Completely disables the WordPress XML-RPC interface to reduce the attack surface.
Disable Login Field Autofocus
Removes the automatic focus on the username input at wp-login.php to prevent browsers from surfacing stored credentials unsolicited.
Serve a security.txt File
Responds to requests for /.well-known/security.txt with a standards-compliant plain-text file containing your security contact and expiry date.