xspeed / includes / modules / Bloat / BloatModule.php

BloatModule.php in xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN 1.0.3, at includes/modules/Bloat/BloatModule.php

228 lines 7.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Bloat — disable WordPress features site owners rarely use but every
4	* frontend pays for in bytes / requests / attack surface.
5	*
6	* Each setting is a single toggle that adds (or doesn't add) one or
7	* two filters. Per the SETTINGS.md standard, every toggle ships with a
8	* label + description that names the actual ergonomic value.
9	*
10	* Six toggles, all opt-in (default false). The defaults are
11	* conservative because every site has at least one plugin that quietly
12	* depends on the surface this module strips — better to make the user
13	* choose than to break themes on activation.
14	*
15	* Tier: Free (FEATURES.md "Others" §10-§15 — declared in commit
16	* `4e36051` before this implementation).
17	*
18	* @package XSpeed
19	*/
20
21	declare(strict_types=1);
22
23	namespace XSpeed\Modules\Bloat;
24
25	use XSpeed\Module;
26	use XSpeed\Settings_Manager;
27
28	final class BloatModule extends Module {
29
30	public const SLUG = 'bloat';
31	public const TIER = self::TIER_FREE;
32	public const VERSION = '1.0.0';
33
34	public function ui_metadata(): array {
35	return array(
36	'label' => 'Disable Bloat',
37	'icon' => 'Sliders',
38	'description' => 'Turn off WordPress defaults you do not use — saves bytes, requests, and attack surface.',
39	);
40	}
41
42	public function settings_schema(): array {
43	return array(
44	'disable_dashicons_frontend' => array(
45	'type' => 'bool',
46	'default' => false,
47	'label' => 'Disable Dashicons on Frontend',
48	'description' => 'Drop the dashicons stylesheet from non-admin pages. Most themes do not need it. Saves ~45 KB per visitor.',
49	),
50	'disable_oembed' => array(
51	'type' => 'bool',
52	'default' => false,
53	'label' => 'Disable oEmbed Discovery + wp-embed.min.js',
54	'description' => 'Strip the auto-embed handlers + the embed script. Posts that paste a YouTube URL will no longer auto-render the player — embed it via a block instead. Saves a request per page.',
55	),
56	'disable_rss_feeds' => array(
57	'type' => 'bool',
58	'default' => false,
59	'label' => 'Disable RSS Feeds',
60	'description' => 'Return a 404 on /feed/ and similar endpoints. Useful for sites that do not publish feeds and want to cut feed-fetcher traffic.',
61	),
62	'disable_xmlrpc' => array(
63	'type' => 'bool',
64	'default' => false,
65	'label' => 'Disable XML-RPC',
66	'description' => 'Disable the legacy xmlrpc.php endpoint. Cuts pingback brute-force noise; safe to disable unless you use a remote WP client (Jetpack, WordPress mobile app).',
67	),
68	'strip_jquery_migrate' => array(
69	'type' => 'bool',
70	'default' => false,
71	'label' => 'Strip jQuery Migrate on Frontend',
72	'description' => 'Remove the jquery-migrate compatibility shim from non-admin pages. Saves ~10 KB; safe on modern themes / plugins.',
73	),
74	'restrict_rest_to_authed' => array(
75	'type' => 'bool',
76	'default' => false,
77	'label' => 'Restrict REST API to Logged-In Users',
78	'description' => 'Block /wp-json/ for anonymous requests. WooCommerce checkout, contact-form submissions, and many block-editor previews need anonymous REST — keep this off unless you know your site does not depend on it.',
79	),
80	);
81	}
82
83	public function boot(): void {
84	$opts = Settings_Manager::get( self::SLUG );
85
86	if ( ! empty( $opts['disable_dashicons_frontend'] ) ) {
87	add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_dashicons' ), 100 );
88	}
89
90	if ( ! empty( $opts['disable_oembed'] ) ) {
91	add_action( 'init', array( __CLASS__, 'disable_oembed' ), 9 );
92	}
93
94	if ( ! empty( $opts['disable_rss_feeds'] ) ) {
95	add_action( 'do_feed', array( __CLASS__, 'block_feed' ), 1 );
96	add_action( 'do_feed_rdf', array( __CLASS__, 'block_feed' ), 1 );
97	add_action( 'do_feed_rss', array( __CLASS__, 'block_feed' ), 1 );
98	add_action( 'do_feed_rss2', array( __CLASS__, 'block_feed' ), 1 );
99	add_action( 'do_feed_atom', array( __CLASS__, 'block_feed' ), 1 );
100	add_action( 'do_feed_rss2_comments', array( __CLASS__, 'block_feed' ), 1 );
101	add_action( 'do_feed_atom_comments', array( __CLASS__, 'block_feed' ), 1 );
102	}
103
104	if ( ! empty( $opts['disable_xmlrpc'] ) ) {
105	add_filter( 'xmlrpc_enabled', '__return_false' );
106	add_filter( 'wp_headers', array( __CLASS__, 'strip_xmlrpc_header' ) );
107	add_filter( 'pings_open', '__return_false' );
108	}
109
110	if ( ! empty( $opts['strip_jquery_migrate'] ) ) {
111	add_action( 'wp_default_scripts', array( __CLASS__, 'strip_jquery_migrate' ) );
112	}
113
114	if ( ! empty( $opts['restrict_rest_to_authed'] ) ) {
115	add_filter( 'rest_authentication_errors', array( __CLASS__, 'restrict_rest' ) );
116	}
117	}
118
119	public static function dequeue_dashicons(): void {
120	if ( is_admin_bar_showing() \|\| is_user_logged_in() ) {
121	return; // the admin bar uses dashicons; only strip on truly anonymous pages.
122	}
123	wp_dequeue_style( 'dashicons' );
124	wp_deregister_style( 'dashicons' );
125	}
126
127	public static function disable_oembed(): void {
128	// Strip discovery <link> from <head>.
129	remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );
130	remove_action( 'wp_head', 'wp_oembed_add_host_js' );
131	// Drop the auto-embed filter (paste-a-URL-becomes-embed).
132	remove_filter( 'the_content', array( $GLOBALS['wp_embed'] ?? null, 'autoembed' ), 8 );
133	// Drop wp-embed.min.js + the rewrite rule.
134	add_action(
135	'wp_footer',
136	static function () {
137	wp_dequeue_script( 'wp-embed' );
138	},
139	1
140	);
141	add_filter(
142	'rewrite_rules_array',
143	static function ( $rules ) {
144	if ( ! is_array( $rules ) ) {
145	return $rules;
146	}
147	foreach ( $rules as $rule => $rewrite ) {
148	if ( false !== strpos( (string) $rewrite, 'embed=true' ) ) {
149	unset( $rules[ $rule ] );
150	}
151	}
152	return $rules;
153	}
154	);
155	}
156
157	public static function block_feed(): void {
158	wp_die(
159	esc_html__( 'Feeds are disabled.', 'xspeed' ),
160	'',
161	array( 'response' => 404 )
162	);
163	}
164
165	/**
166	* @param array $headers
167	* @return array
168	*/
169	public static function strip_xmlrpc_header( $headers ) {
170	if ( is_array( $headers ) ) {
171	unset( $headers['X-Pingback'] );
172	}
173	return $headers;
174	}
175
176	/**
177	* @param \WP_Scripts $scripts
178	*/
179	public static function strip_jquery_migrate( $scripts ): void {
180	if ( is_admin() \|\| ! isset( $scripts->registered['jquery'] ) ) {
181	return;
182	}
183	$jquery = $scripts->registered['jquery'];
184	if ( is_array( $jquery->deps ?? null ) ) {
185	$jquery->deps = array_values( array_diff( $jquery->deps, array( 'jquery-migrate' ) ) );
186	}
187	}
188
189	/**
190	* Block anonymous /wp-json/ access. Logged-in users + already-errored
191	* requests pass through untouched.
192	*
193	* @param \WP_Error\|null\|true $result
194	* @return \WP_Error\|null\|true
195	*/
196	public static function restrict_rest( $result ) {
197	if ( ! empty( $result ) ) {
198	return $result; // upstream auth already decided.
199	}
200	if ( is_user_logged_in() ) {
201	return $result;
202	}
203	return new \WP_Error(
204	'rest_forbidden_anonymous',
205	__( 'Anonymous REST access is disabled on this site.', 'xspeed' ),
206	array( 'status' => 401 )
207	);
208	}
209
210	public function cli_commands(): array {
211	return array(
212	array(
213	'name' => 'xspeed bloat',
214	'callback' => array( $this, 'cli_handler' ),
215	'shortdesc' => 'Show which bloat-removal toggles are active.',
216	'synopsis' => array(),
217	),
218	);
219	}
220
221	public function cli_handler( array $args, array $assoc ): void {
222	$opts = Settings_Manager::get( self::SLUG );
223	foreach ( $opts as $key => $value ) {
224	\WP_CLI::log( sprintf( '%-30s %s', $key, $value ? 'on' : 'off' ) );
225	}
226	}
227	}
228