WordPress清理和安全加固代码

wptutor WordPress清理和安全加固代码已关闭评论 65 浏览量

// Disable responsive image srcset
add_filter('wp_calculate_image_srcset_meta', '__return_null');
add_filter('wp_calculate_image_srcset', '__return_false');
add_filter('wp_calculate_image_sizes', '__return_false');

// Optional: prevent big image scaling (WordPress 5.3+ feature)
add_filter('big_image_size_threshold', '__return_false');





// Remove version from <meta> generator tag
add_filter( 'the_generator', '__return_empty_string' );

// Remove version query parameter from enqueued CSS/JS
function remove_wp_version_param( $src ) {
    if ( strpos( $src, 'ver=' ) ) {
        $src = remove_query_arg( 'ver', $src );
    }
    return $src;
}
add_filter( 'style_loader_src',  'remove_wp_version_param' );
add_filter( 'script_loader_src', 'remove_wp_version_param' );



// Completely disable XML-RPC
add_filter( 'xmlrpc_enabled', '__return_false' );

// Optionally block access at .htaccess:
// <Files xmlrpc.php>
//     Order Deny,Allow
//     Deny from all
// </Files>

add_filter( 'rest_authentication_errors', function( $result ) {
    if ( ! empty( $result ) ) {
        return $result;
    }
    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            'rest_not_logged_in',
            'You must be logged in to access the REST API.',
            array( 'status' => 401 )
        );
    }
    return $result;
});

// In wp-config.php, set:
define( 'DISALLOW_FILE_EDIT', true );

function disable_wp_emojicons() {
    remove_action( 'wp_head',      'print_emoji_detection_script', 7 );
    remove_action( 'wp_print_styles', 'print_emoji_styles' );
    remove_filter( 'the_content',  'wp_staticize_emoji' );
    remove_filter( 'the_excerpt','wp_staticize_emoji' );
    remove_filter( 'comment_text','wp_staticize_emoji_for_comment' );
}
add_action( 'init', 'disable_wp_emojicons' );
add_filter( 'emoji_svg_url', '__return_false' );
add_filter( 'emoji_src', '__return_false' );
add_filter( 'wp_resource_hints', function( $urls, $relation_type ) {
    if ( 'dns-prefetch' === $relation_type ) {
        return array_diff( $urls, array( 'https://s.w.org/' ) );
    }
    return $urls;
}, 10, 2 );


function disable_wp_embeds() {
    remove_action( 'rest_api_init',        'wp_oembed_register_route' );
    remove_filter( 'oembed_dataparse',     'wp_filter_oembed_result' );
    remove_action( 'wp_head',              'wp_oembed_add_discovery_links' );
    remove_action( 'wp_head',              'wp_oembed_add_host_js' );
    add_filter( 'embed_oembed_discover',  '__return_false' );
    add_filter( 'tiny_mce_plugins', function( $plugins ) {
        return array_diff( $plugins, ['wpembed'] );
    });
}
add_action( 'init', 'disable_wp_embeds', 9999 );


function dequeue_unused_assets() {
    if ( ! is_admin() ) {
        // Example: remove Gutenberg block front-end CSS
        wp_dequeue_style( 'wp-block-library' );
        wp_dequeue_style( 'wp-block-library-theme' );
    }
}
add_action( 'wp_enqueue_scripts', 'dequeue_unused_assets', 100 );


add_filter( 'wp_get_attachment_image_attributes', function( $attr ) {
    $attr['loading'] = 'lazy';
    return $attr;
});
add_filter( 'iframe_embed_html', function( $html ) {
    return str_replace( '<iframe', '<iframe loading="lazy"', $html );
});

// In wp-config.php:
// define( 'WP_POST_REVISIONS', 3 );
// define( 'AUTOSAVE_INTERVAL', 300 );  // seconds

// Throttle Heartbeat API:
add_filter( 'heartbeat_settings', function( $settings ) {
    $settings['interval'] = 60; // seconds
    return $settings;
});
add_action( 'shutdown', function() {
    global $wpdb;
    $wpdb->query(
        "DELETE FROM {$wpdb->options}
         WHERE option_name LIKE '\_transient\_%'
           AND option_name NOT LIKE '\_transient\_timeout\_%'"
    );
});



// disable email 

// 2. Core updates
add_filter( 'auto_core_update_send_email',    '__return_false' );

// 3. Plugin updates
add_filter( 'auto_plugin_update_send_email',  '__return_false' );

// 4. Theme updates
add_filter( 'auto_theme_update_send_email',   '__return_false' );