← All changes | includes/modules/Bloat/BloatModule.php +249 -16 1.0.3 → 1.3.6 View file →

		@@ -6,9 +6,9 @@
6	6	* Each setting is a single toggle that adds (or doesn't add) one or
7	7	* two filters. Per the SETTINGS.md standard, every toggle ships with a
8	8	* label + description that names the actual ergonomic value.
9	9	*
10		- * Six toggles, all opt-in (default false). The defaults are
	10	+ * Every toggle is opt-in (default false). The defaults are
11	11	* conservative because every site has at least one plugin that quietly
12	12	* depends on the surface this module strips — better to make the user
13	13	* choose than to break themes on activation.
14	14	*
		@@ -21,8 +21,10 @@
21	21	declare(strict_types=1);
22	22
23	23	namespace XSpeed\Modules\Bloat;
24	24
	25	+defined( 'ABSPATH' ) || exit;
	26	+
25	27	use XSpeed\Module;
26	28	use XSpeed\Settings_Manager;
27	29
28	30	final class BloatModule extends Module {
		@@ -32,58 +34,123 @@
32	34	public const VERSION = '1.0.0';
33	35
34	36	public function ui_metadata(): array {
35	37	return array(
36		- 'label' => 'Disable Bloat',
	38	+ 'label' => __( 'Bloat Control', 'xspeed' ),
37	39	'icon' => 'Sliders',
38		- 'description' => 'Turn off WordPress defaults you do not use — saves bytes, requests, and attack surface.',
	40	+ 'description' => __( 'Turn off WordPress defaults you do not use — saves bytes, requests, and attack surface.', 'xspeed' ),
39	41	);
40	42	}
41	43
42	44	public function settings_schema(): array {
43	45	return array(
	46	+ 'disable_emojis' => array(
	47	+ 'type' => 'bool',
	48	+ 'default' => false,
	49	+ 'label' => __( 'Disable Emojis', 'xspeed' ),
	50	+ 'description' => __( 'Remove the emoji detection script and its inline styles from every page. Modern browsers draw emojis natively, so visitors still see them. Saves a script and an inline stylesheet per page.', 'xspeed' ),
	51	+ ),
44	52	'disable_dashicons_frontend' => array(
45	53	'type' => 'bool',
46	54	'default' => false,
47		- 'label' => 'Disable Dashicons on Frontend',
48		- 'description' => 'Drop the dashicons stylesheet from non-admin pages. Most themes do not need it. Saves ~45 KB per visitor.',
	55	+ 'label' => __( 'Disable Dashicons on Frontend', 'xspeed' ),
	56	+ 'description' => __( 'Drop the dashicons stylesheet from non-admin pages. Most themes do not need it. Saves ~45 KB per visitor.', 'xspeed' ),
49	57	),
50	58	'disable_oembed' => array(
51	59	'type' => 'bool',
52	60	'default' => false,
53		- 'label' => 'Disable oEmbed Discovery + wp-embed.min.js',
54		- 'description' => 'Strip the auto-embed handlers + the embed script. Posts that paste a YouTube URL will no longer auto-render the player — embed it via a block instead. Saves a request per page.',
	61	+ 'label' => __( 'Disable oEmbed Discovery + wp-embed.min.js', 'xspeed' ),
	62	+ 'description' => __( 'Strip the auto-embed handlers + the embed script. Posts that paste a YouTube URL will no longer auto-render the player — embed it via a block instead. Saves a request per page.', 'xspeed' ),
55	63	),
56	64	'disable_rss_feeds' => array(
57	65	'type' => 'bool',
58	66	'default' => false,
59		- 'label' => 'Disable RSS Feeds',
60		- 'description' => 'Return a 404 on /feed/ and similar endpoints. Useful for sites that do not publish feeds and want to cut feed-fetcher traffic.',
	67	+ 'label' => __( 'Disable RSS Feeds', 'xspeed' ),
	68	+ 'description' => __( 'Return a 404 on /feed/ and similar endpoints. Useful for sites that do not publish feeds and want to cut feed-fetcher traffic.', 'xspeed' ),
61	69	),
62	70	'disable_xmlrpc' => array(
63	71	'type' => 'bool',
64	72	'default' => false,
65		- 'label' => 'Disable XML-RPC',
66		- 'description' => 'Disable the legacy xmlrpc.php endpoint. Cuts pingback brute-force noise; safe to disable unless you use a remote WP client (Jetpack, WordPress mobile app).',
	73	+ 'label' => __( 'Disable XML-RPC', 'xspeed' ),
	74	+ 'description' => __( 'Disable the legacy xmlrpc.php endpoint. Cuts pingback brute-force noise; safe to disable unless you use a remote WP client (Jetpack, WordPress mobile app).', 'xspeed' ),
67	75	),
68	76	'strip_jquery_migrate' => array(
69	77	'type' => 'bool',
70	78	'default' => false,
71		- 'label' => 'Strip jQuery Migrate on Frontend',
72		- 'description' => 'Remove the jquery-migrate compatibility shim from non-admin pages. Saves ~10 KB; safe on modern themes / plugins.',
	79	+ 'label' => __( 'Strip jQuery Migrate on Frontend', 'xspeed' ),
	80	+ 'description' => __( 'Remove the jquery-migrate compatibility shim from non-admin pages. Saves ~10 KB; safe on modern themes / plugins.', 'xspeed' ),
73	81	),
	82	+ 'strip_editor_styles' => array(
	83	+ 'type' => 'bool',
	84	+ 'default' => false,
	85	+ 'label' => __( 'Strip Block-Editor Styles on Frontend', 'xspeed' ),
	86	+ 'description' => __( 'Drop editor-only stylesheets (wp-editor, wp-components, and friends) from anonymous pages. A plugin that enqueues them on the frontend usually does so by accident — they can add hundreds of KB of render-blocking CSS. Frontend block styles (wp-block-library) are never touched.', 'xspeed' ),
	87	+ ),
	88	+ 'remove_rsd_link' => array(
	89	+ 'type' => 'bool',
	90	+ 'default' => false,
	91	+ 'label' => __( 'Remove RSD Link', 'xspeed' ),
	92	+ 'description' => __( 'Drop the Really Simple Discovery link from the page head. Only old desktop blogging clients read it.', 'xspeed' ),
	93	+ ),
	94	+ 'remove_shortlink' => array(
	95	+ 'type' => 'bool',
	96	+ 'default' => false,
	97	+ 'label' => __( 'Remove Shortlink', 'xspeed' ),
	98	+ 'description' => __( 'Drop the ?p=123 shortlink tag and header from posts and pages. The shortlinks keep working; they are just no longer advertised.', 'xspeed' ),
	99	+ ),
	100	+ 'remove_rest_api_links' => array(
	101	+ 'type' => 'bool',
	102	+ 'default' => false,
	103	+ 'label' => __( 'Remove REST API Links', 'xspeed' ),
	104	+ 'description' => __( 'Drop the /wp-json/ discovery link tag and Link header. The REST API itself stays on; to block it, use the setting below.', 'xspeed' ),
	105	+ ),
	106	+ 'hide_wp_version' => array(
	107	+ 'type' => 'bool',
	108	+ 'default' => false,
	109	+ 'label' => __( 'Hide WordPress Version', 'xspeed' ),
	110	+ 'description' => __( 'Remove the WordPress generator tag from pages and feeds, so it no longer states the WordPress version. Other plugins print their own tags; those stay. Script and style URLs still carry ?ver= numbers.', 'xspeed' ),
	111	+ ),
	112	+ 'disable_self_pingbacks' => array(
	113	+ 'type' => 'bool',
	114	+ 'default' => false,
	115	+ 'label' => __( 'Disable Self-Pingbacks', 'xspeed' ),
	116	+ 'description' => __( 'Stop WordPress from sending a pingback to your own site when a post links to another of your posts. Pingbacks to other sites are not affected.', 'xspeed' ),
	117	+ ),
74	118	'restrict_rest_to_authed' => array(
75	119	'type' => 'bool',
76	120	'default' => false,
77		- 'label' => 'Restrict REST API to Logged-In Users',
78		- 'description' => 'Block /wp-json/ for anonymous requests. WooCommerce checkout, contact-form submissions, and many block-editor previews need anonymous REST — keep this off unless you know your site does not depend on it.',
	121	+ 'label' => __( 'Restrict REST API to Logged-In Users', 'xspeed' ),
	122	+ 'description' => __( 'Block /wp-json/ for anonymous requests. WooCommerce checkout, contact-form submissions, and many block-editor previews need anonymous REST — keep this off unless you know your site does not depend on it.', 'xspeed' ),
79	123	),
80	124	);
81	125	}
82	126
83	127	public function boot(): void {
	128	+ /*
	129	+ * Deferred to `init` priority 0. This reads the module's settings,
	130	+ * which builds settings_schema(), whose labels go through __(), and
	131	+ * boot() runs on `plugins_loaded` — before `after_setup_theme`, the
	132	+ * earliest point WordPress 6.7+ treats as safe to translate.
	133	+ *
	134	+ * Priority 0 (not the default 10) because the body itself registers
	135	+ * an `init` callback at priority 9: adding a hook to the action that
	136	+ * is currently running only takes effect if the new priority is still
	137	+ * ahead of the running position, so we have to be first. Every other
	138	+ * hook it registers fires later than `init`.
	139	+ */
	140	+ add_action( 'init', array( $this, 'boot_on_init' ), 0 );
	141	+ }
	142	+
	143	+ /**
	144	+ * The real boot body — see boot() for why it runs on `init`.
	145	+ */
	146	+ public function boot_on_init(): void {
84	147	$opts = Settings_Manager::get( self::SLUG );
85	148
	149	+ if ( ! empty( $opts['disable_emojis'] ) ) {
	150	+ self::disable_emojis();
	151	+ }
	152	+
86	153	if ( ! empty( $opts['disable_dashicons_frontend'] ) ) {
87	154	add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_dashicons' ), 100 );
88	155	}
89	156
		@@ -110,8 +177,37 @@
110	177	if ( ! empty( $opts['strip_jquery_migrate'] ) ) {
111	178	add_action( 'wp_default_scripts', array( __CLASS__, 'strip_jquery_migrate' ) );
112	179	}
113	180
	181	+ if ( ! empty( $opts['strip_editor_styles'] ) ) {
	182	+ // Late, so anything enqueued at normal priority is already queued.
	183	+ add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_editor_styles' ), PHP_INT_MAX );
	184	+ }
	185	+
	186	+ if ( ! empty( $opts['remove_rsd_link'] ) ) {
	187	+ remove_action( 'wp_head', 'rsd_link' );
	188	+ }
	189	+
	190	+ if ( ! empty( $opts['remove_shortlink'] ) ) {
	191	+ remove_action( 'wp_head', 'wp_shortlink_wp_head' );
	192	+ remove_action( 'template_redirect', 'wp_shortlink_header', 11 );
	193	+ }
	194	+
	195	+ if ( ! empty( $opts['remove_rest_api_links'] ) ) {
	196	+ remove_action( 'wp_head', 'rest_output_link_wp_head' );
	197	+ remove_action( 'template_redirect', 'rest_output_link_header', 11 );
	198	+ remove_action( 'xmlrpc_rsd_apis', 'rest_output_rsd' );
	199	+ }
	200	+
	201	+ if ( ! empty( $opts['hide_wp_version'] ) ) {
	202	+ remove_action( 'wp_head', 'wp_generator' );
	203	+ add_filter( 'the_generator', '__return_empty_string' );
	204	+ }
	205	+
	206	+ if ( ! empty( $opts['disable_self_pingbacks'] ) ) {
	207	+ add_action( 'pre_ping', array( __CLASS__, 'strip_self_pings' ) );
	208	+ }
	209	+
114	210	if ( ! empty( $opts['restrict_rest_to_authed'] ) ) {
115	211	add_filter( 'rest_authentication_errors', array( __CLASS__, 'restrict_rest' ) );
116	212	}
117	213	}
		@@ -123,8 +219,42 @@
123	219	wp_dequeue_style( 'dashicons' );
124	220	wp_deregister_style( 'dashicons' );
125	221	}
126	222
	223	+ /**
	224	+ * The front-end hooks live in default-filters.php, which loads before
	225	+ * `init`, so removing them here works. The admin ones are added by
	226	+ * wp-admin/includes/admin-filters.php, which loads after `init`; they
	227	+ * are removed on `admin_init` instead. wp_enqueue_emoji_styles is the
	228	+ * WP 6.4+ path; print_emoji_styles is kept for older cores.
	229	+ */
	230	+ public static function disable_emojis(): void {
	231	+ remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
	232	+ remove_action( 'embed_head', 'print_emoji_detection_script' );
	233	+ remove_action( 'wp_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	234	+ remove_action( 'enqueue_embed_scripts', 'wp_enqueue_emoji_styles' );
	235	+ remove_action( 'wp_print_styles', 'print_emoji_styles' );
	236	+ remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
	237	+ remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );
	238	+ remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
	239	+ add_filter( 'tiny_mce_plugins', array( __CLASS__, 'strip_tinymce_emoji' ) );
	240	+ add_action( 'admin_init', array( __CLASS__, 'disable_admin_emojis' ) );
	241	+ }
	242	+
	243	+ public static function disable_admin_emojis(): void {
	244	+ remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
	245	+ remove_action( 'admin_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	246	+ remove_action( 'admin_print_styles', 'print_emoji_styles' );
	247	+ }
	248	+
	249	+ /**
	250	+ * @param mixed $plugins
	251	+ * @return mixed
	252	+ */
	253	+ public static function strip_tinymce_emoji( $plugins ) {
	254	+ return is_array( $plugins ) ? array_values( array_diff( $plugins, array( 'wpemoji' ) ) ) : $plugins;
	255	+ }
	256	+
127	257	public static function disable_oembed(): void {
128	258	// Strip discovery <link> from <head>.
129	259	remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );
130	260	remove_action( 'wp_head', 'wp_oembed_add_host_js' );
		@@ -153,8 +283,99 @@
153	283	}
154	284	);
155	285	}
156	286
	287	+ /**
	288	+ * Editor-only style handles that have no business on an anonymous
	289	+ * frontend page. Deliberately NOT wp-block-library /
	290	+ * wp-block-library-theme / global-styles — those style the blocks
	291	+ * visitors actually see. Observed live: a plugin pulled wp-editor +
	292	+ * wp-components (and their deps) onto a marketing homepage, several
	293	+ * hundred KB of render-blocking CSS nothing on the page used.
	294	+ */
	295	+ private const EDITOR_STYLE_HANDLES = array(
	296	+ 'wp-editor',
	297	+ 'wp-block-editor',
	298	+ 'wp-block-directory',
	299	+ 'wp-components',
	300	+ 'wp-preferences',
	301	+ 'wp-media-utils',
	302	+ 'wp-reusable-blocks',
	303	+ 'wp-patterns',
	304	+ 'wp-edit-blocks',
	305	+ 'wp-edit-post',
	306	+ 'wp-edit-site',
	307	+ 'wp-edit-widgets',
	308	+ 'wp-format-library',
	309	+ 'wp-list-reusable-blocks',
	310	+ 'wp-nux',
	311	+ );
	312	+
	313	+ public static function dequeue_editor_styles(): void {
	314	+ // Logged-in views legitimately reach editor surfaces (front-end
	315	+ // editing, admin bar flows), and a builder editing screen is a
	316	+ // front-end URL — same guard set as the other frontend strips.
	317	+ if ( is_user_logged_in() || is_admin() || \XSpeed\Builder_Editor::is_active() ) {
	318	+ return;
	319	+ }
	320	+ $styles = wp_styles();
	321	+ foreach ( self::EDITOR_STYLE_HANDLES as $handle ) {
	322	+ wp_dequeue_style( $handle );
	323	+ }
	324	+ // Dequeue alone is not enough: dependencies are resolved again at
	325	+ // print time, so any queued sheet that lists one of these as a dep
	326	+ // pulls it straight back. Strip the handles from every registered
	327	+ // sheet's deps too — same technique strip_jquery_migrate() uses.
	328	+ foreach ( $styles->registered as $dependency ) {
	329	+ if ( is_array( $dependency->deps ?? null ) && array_intersect( $dependency->deps, self::EDITOR_STYLE_HANDLES ) ) {
	330	+ $dependency->deps = array_values( array_diff( $dependency->deps, self::EDITOR_STYLE_HANDLES ) );
	331	+ }
	332	+ }
	333	+ }
	334	+
	335	+ /**
	336	+ * `pre_ping` passes the link list by reference.
	337	+ *
	338	+ * @param array $links
	339	+ */
	340	+ public static function strip_self_pings( &$links ): void {
	341	+ if ( ! is_array( $links ) ) {
	342	+ return;
	343	+ }
	344	+ $links = array_values(
	345	+ array_filter(
	346	+ $links,
	347	+ static function ( $link ): bool {
	348	+ return ! self::is_own_url( (string) $link );
	349	+ }
	350	+ )
	351	+ );
	352	+ }
	353	+
	354	+ /**
	355	+ * Same host (any scheme, any case, with or without www.) and a path
	356	+ * inside the home path. A plain prefix check missed http:// links on
	357	+ * an https site, which migrated sites still carry, and matched
	358	+ * example.test.evil.test as home.
	359	+ */
	360	+ public static function is_own_url( string $url ): bool {
	361	+ $home_parts = wp_parse_url( (string) home_url() );
	362	+ $parts = wp_parse_url( $url );
	363	+ if ( ! is_array( $home_parts ) || ! is_array( $parts ) || empty( $parts['host'] ) || empty( $home_parts['host'] ) ) {
	364	+ return false;
	365	+ }
	366	+ $strip = static function ( string $host ): string {
	367	+ $host = strtolower( $host );
	368	+ return 0 === strpos( $host, 'www.' ) ? substr( $host, 4 ) : $host;
	369	+ };
	370	+ if ( $strip( $parts['host'] ) !== $strip( $home_parts['host'] ) ) {
	371	+ return false;
	372	+ }
	373	+ $home_path = rtrim( (string) ( $home_parts['path'] ?? '' ), '/' );
	374	+ $path = (string) ( $parts['path'] ?? '' );
	375	+ return '' === $home_path || $path === $home_path || 0 === strpos( $path, $home_path . '/' );
	376	+ }
	377	+
157	378	public static function block_feed(): void {
158	379	wp_die(
159	380	esc_html__( 'Feeds are disabled.', 'xspeed' ),
160	381	'',
		@@ -176,9 +397,12 @@
176	397	/**
177	398	* @param \WP_Scripts $scripts
178	399	*/
179	400	public static function strip_jquery_migrate( $scripts ): void {
180		- if ( is_admin() || ! isset( $scripts->registered['jquery'] ) ) {
	401	+ // Builders and their add-ons still rely on jQuery Migrate shims; a
	402	+ // builder editing screen is a front-end URL, so is_admin() misses it
	403	+ // and the editor loses methods it calls. (#281)
	404	+ if ( is_admin() || \XSpeed\Builder_Editor::is_active() || ! isset( $scripts->registered['jquery'] ) ) {
181	405	return;
182	406	}
183	407	$jquery = $scripts->registered['jquery'];
184	408	if ( is_array( $jquery->deps ?? null ) ) {
		@@ -212,8 +436,9 @@
212	436	array(
213	437	'name' => 'xspeed bloat',
214	438	'callback' => array( $this, 'cli_handler' ),
215	439	'shortdesc' => 'Show which bloat-removal toggles are active.',
	440	+ 'ai_hint' => 'What unnecessary WordPress output is being stripped (emojis, embeds, jQuery Migrate, dashicons)? Use when asked why extra scripts still load on the frontend, or before recommending bloat removal.',
216	441	'synopsis' => array(),
217	442	),
218	443	);
219	444	}
		@@ -222,6 +447,14 @@
222	447	$opts = Settings_Manager::get( self::SLUG );
223	448	foreach ( $opts as $key => $value ) {
224	449	\WP_CLI::log( sprintf( '%-30s %s', $key, $value ? 'on' : 'off' ) );
225	450	}
	451	+ }
	452	+
	453	+ /**
	454	+ * Bloat has no master switch -- it is on when any of its boolean
	455	+ * flags is set. (#363)
	456	+ */
	457	+ public function is_active(): ?bool {
	458	+ return $this->any_bool_flag_on();
226	459	}
227	460	}