← All changes | includes/modules/Bloat/BloatModule.php +203 -3 1.3.1 → 1.3.6 View file →

		@@ -6,9 +6,9 @@
6	6	* Each setting is a single toggle that adds (or doesn't add) one or
7	7	* two filters. Per the SETTINGS.md standard, every toggle ships with a
8	8	* label + description that names the actual ergonomic value.
9	9	*
10		- * Six toggles, all opt-in (default false). The defaults are
	10	+ * Every toggle is opt-in (default false). The defaults are
11	11	* conservative because every site has at least one plugin that quietly
12	12	* depends on the surface this module strips — better to make the user
13	13	* choose than to break themes on activation.
14	14	*
		@@ -42,8 +42,14 @@
42	42	}
43	43
44	44	public function settings_schema(): array {
45	45	return array(
	46	+ 'disable_emojis' => array(
	47	+ 'type' => 'bool',
	48	+ 'default' => false,
	49	+ 'label' => __( 'Disable Emojis', 'xspeed' ),
	50	+ 'description' => __( 'Remove the emoji detection script and its inline styles from every page. Modern browsers draw emojis natively, so visitors still see them. Saves a script and an inline stylesheet per page.', 'xspeed' ),
	51	+ ),
46	52	'disable_dashicons_frontend' => array(
47	53	'type' => 'bool',
48	54	'default' => false,
49	55	'label' => __( 'Disable Dashicons on Frontend', 'xspeed' ),
		@@ -72,8 +78,44 @@
72	78	'default' => false,
73	79	'label' => __( 'Strip jQuery Migrate on Frontend', 'xspeed' ),
74	80	'description' => __( 'Remove the jquery-migrate compatibility shim from non-admin pages. Saves ~10 KB; safe on modern themes / plugins.', 'xspeed' ),
75	81	),
	82	+ 'strip_editor_styles' => array(
	83	+ 'type' => 'bool',
	84	+ 'default' => false,
	85	+ 'label' => __( 'Strip Block-Editor Styles on Frontend', 'xspeed' ),
	86	+ 'description' => __( 'Drop editor-only stylesheets (wp-editor, wp-components, and friends) from anonymous pages. A plugin that enqueues them on the frontend usually does so by accident — they can add hundreds of KB of render-blocking CSS. Frontend block styles (wp-block-library) are never touched.', 'xspeed' ),
	87	+ ),
	88	+ 'remove_rsd_link' => array(
	89	+ 'type' => 'bool',
	90	+ 'default' => false,
	91	+ 'label' => __( 'Remove RSD Link', 'xspeed' ),
	92	+ 'description' => __( 'Drop the Really Simple Discovery link from the page head. Only old desktop blogging clients read it.', 'xspeed' ),
	93	+ ),
	94	+ 'remove_shortlink' => array(
	95	+ 'type' => 'bool',
	96	+ 'default' => false,
	97	+ 'label' => __( 'Remove Shortlink', 'xspeed' ),
	98	+ 'description' => __( 'Drop the ?p=123 shortlink tag and header from posts and pages. The shortlinks keep working; they are just no longer advertised.', 'xspeed' ),
	99	+ ),
	100	+ 'remove_rest_api_links' => array(
	101	+ 'type' => 'bool',
	102	+ 'default' => false,
	103	+ 'label' => __( 'Remove REST API Links', 'xspeed' ),
	104	+ 'description' => __( 'Drop the /wp-json/ discovery link tag and Link header. The REST API itself stays on; to block it, use the setting below.', 'xspeed' ),
	105	+ ),
	106	+ 'hide_wp_version' => array(
	107	+ 'type' => 'bool',
	108	+ 'default' => false,
	109	+ 'label' => __( 'Hide WordPress Version', 'xspeed' ),
	110	+ 'description' => __( 'Remove the WordPress generator tag from pages and feeds, so it no longer states the WordPress version. Other plugins print their own tags; those stay. Script and style URLs still carry ?ver= numbers.', 'xspeed' ),
	111	+ ),
	112	+ 'disable_self_pingbacks' => array(
	113	+ 'type' => 'bool',
	114	+ 'default' => false,
	115	+ 'label' => __( 'Disable Self-Pingbacks', 'xspeed' ),
	116	+ 'description' => __( 'Stop WordPress from sending a pingback to your own site when a post links to another of your posts. Pingbacks to other sites are not affected.', 'xspeed' ),
	117	+ ),
76	118	'restrict_rest_to_authed' => array(
77	119	'type' => 'bool',
78	120	'default' => false,
79	121	'label' => __( 'Restrict REST API to Logged-In Users', 'xspeed' ),
		@@ -103,8 +145,12 @@
103	145	*/
104	146	public function boot_on_init(): void {
105	147	$opts = Settings_Manager::get( self::SLUG );
106	148
	149	+ if ( ! empty( $opts['disable_emojis'] ) ) {
	150	+ self::disable_emojis();
	151	+ }
	152	+
107	153	if ( ! empty( $opts['disable_dashicons_frontend'] ) ) {
108	154	add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_dashicons' ), 100 );
109	155	}
110	156
		@@ -131,8 +177,37 @@
131	177	if ( ! empty( $opts['strip_jquery_migrate'] ) ) {
132	178	add_action( 'wp_default_scripts', array( __CLASS__, 'strip_jquery_migrate' ) );
133	179	}
134	180
	181	+ if ( ! empty( $opts['strip_editor_styles'] ) ) {
	182	+ // Late, so anything enqueued at normal priority is already queued.
	183	+ add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_editor_styles' ), PHP_INT_MAX );
	184	+ }
	185	+
	186	+ if ( ! empty( $opts['remove_rsd_link'] ) ) {
	187	+ remove_action( 'wp_head', 'rsd_link' );
	188	+ }
	189	+
	190	+ if ( ! empty( $opts['remove_shortlink'] ) ) {
	191	+ remove_action( 'wp_head', 'wp_shortlink_wp_head' );
	192	+ remove_action( 'template_redirect', 'wp_shortlink_header', 11 );
	193	+ }
	194	+
	195	+ if ( ! empty( $opts['remove_rest_api_links'] ) ) {
	196	+ remove_action( 'wp_head', 'rest_output_link_wp_head' );
	197	+ remove_action( 'template_redirect', 'rest_output_link_header', 11 );
	198	+ remove_action( 'xmlrpc_rsd_apis', 'rest_output_rsd' );
	199	+ }
	200	+
	201	+ if ( ! empty( $opts['hide_wp_version'] ) ) {
	202	+ remove_action( 'wp_head', 'wp_generator' );
	203	+ add_filter( 'the_generator', '__return_empty_string' );
	204	+ }
	205	+
	206	+ if ( ! empty( $opts['disable_self_pingbacks'] ) ) {
	207	+ add_action( 'pre_ping', array( __CLASS__, 'strip_self_pings' ) );
	208	+ }
	209	+
135	210	if ( ! empty( $opts['restrict_rest_to_authed'] ) ) {
136	211	add_filter( 'rest_authentication_errors', array( __CLASS__, 'restrict_rest' ) );
137	212	}
138	213	}
		@@ -144,8 +219,42 @@
144	219	wp_dequeue_style( 'dashicons' );
145	220	wp_deregister_style( 'dashicons' );
146	221	}
147	222
	223	+ /**
	224	+ * The front-end hooks live in default-filters.php, which loads before
	225	+ * `init`, so removing them here works. The admin ones are added by
	226	+ * wp-admin/includes/admin-filters.php, which loads after `init`; they
	227	+ * are removed on `admin_init` instead. wp_enqueue_emoji_styles is the
	228	+ * WP 6.4+ path; print_emoji_styles is kept for older cores.
	229	+ */
	230	+ public static function disable_emojis(): void {
	231	+ remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
	232	+ remove_action( 'embed_head', 'print_emoji_detection_script' );
	233	+ remove_action( 'wp_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	234	+ remove_action( 'enqueue_embed_scripts', 'wp_enqueue_emoji_styles' );
	235	+ remove_action( 'wp_print_styles', 'print_emoji_styles' );
	236	+ remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
	237	+ remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );
	238	+ remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
	239	+ add_filter( 'tiny_mce_plugins', array( __CLASS__, 'strip_tinymce_emoji' ) );
	240	+ add_action( 'admin_init', array( __CLASS__, 'disable_admin_emojis' ) );
	241	+ }
	242	+
	243	+ public static function disable_admin_emojis(): void {
	244	+ remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
	245	+ remove_action( 'admin_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	246	+ remove_action( 'admin_print_styles', 'print_emoji_styles' );
	247	+ }
	248	+
	249	+ /**
	250	+ * @param mixed $plugins
	251	+ * @return mixed
	252	+ */
	253	+ public static function strip_tinymce_emoji( $plugins ) {
	254	+ return is_array( $plugins ) ? array_values( array_diff( $plugins, array( 'wpemoji' ) ) ) : $plugins;
	255	+ }
	256	+
148	257	public static function disable_oembed(): void {
149	258	// Strip discovery <link> from <head>.
150	259	remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );
151	260	remove_action( 'wp_head', 'wp_oembed_add_host_js' );
		@@ -174,8 +283,99 @@
174	283	}
175	284	);
176	285	}
177	286
	287	+ /**
	288	+ * Editor-only style handles that have no business on an anonymous
	289	+ * frontend page. Deliberately NOT wp-block-library /
	290	+ * wp-block-library-theme / global-styles — those style the blocks
	291	+ * visitors actually see. Observed live: a plugin pulled wp-editor +
	292	+ * wp-components (and their deps) onto a marketing homepage, several
	293	+ * hundred KB of render-blocking CSS nothing on the page used.
	294	+ */
	295	+ private const EDITOR_STYLE_HANDLES = array(
	296	+ 'wp-editor',
	297	+ 'wp-block-editor',
	298	+ 'wp-block-directory',
	299	+ 'wp-components',
	300	+ 'wp-preferences',
	301	+ 'wp-media-utils',
	302	+ 'wp-reusable-blocks',
	303	+ 'wp-patterns',
	304	+ 'wp-edit-blocks',
	305	+ 'wp-edit-post',
	306	+ 'wp-edit-site',
	307	+ 'wp-edit-widgets',
	308	+ 'wp-format-library',
	309	+ 'wp-list-reusable-blocks',
	310	+ 'wp-nux',
	311	+ );
	312	+
	313	+ public static function dequeue_editor_styles(): void {
	314	+ // Logged-in views legitimately reach editor surfaces (front-end
	315	+ // editing, admin bar flows), and a builder editing screen is a
	316	+ // front-end URL — same guard set as the other frontend strips.
	317	+ if ( is_user_logged_in() || is_admin() || \XSpeed\Builder_Editor::is_active() ) {
	318	+ return;
	319	+ }
	320	+ $styles = wp_styles();
	321	+ foreach ( self::EDITOR_STYLE_HANDLES as $handle ) {
	322	+ wp_dequeue_style( $handle );
	323	+ }
	324	+ // Dequeue alone is not enough: dependencies are resolved again at
	325	+ // print time, so any queued sheet that lists one of these as a dep
	326	+ // pulls it straight back. Strip the handles from every registered
	327	+ // sheet's deps too — same technique strip_jquery_migrate() uses.
	328	+ foreach ( $styles->registered as $dependency ) {
	329	+ if ( is_array( $dependency->deps ?? null ) && array_intersect( $dependency->deps, self::EDITOR_STYLE_HANDLES ) ) {
	330	+ $dependency->deps = array_values( array_diff( $dependency->deps, self::EDITOR_STYLE_HANDLES ) );
	331	+ }
	332	+ }
	333	+ }
	334	+
	335	+ /**
	336	+ * `pre_ping` passes the link list by reference.
	337	+ *
	338	+ * @param array $links
	339	+ */
	340	+ public static function strip_self_pings( &$links ): void {
	341	+ if ( ! is_array( $links ) ) {
	342	+ return;
	343	+ }
	344	+ $links = array_values(
	345	+ array_filter(
	346	+ $links,
	347	+ static function ( $link ): bool {
	348	+ return ! self::is_own_url( (string) $link );
	349	+ }
	350	+ )
	351	+ );
	352	+ }
	353	+
	354	+ /**
	355	+ * Same host (any scheme, any case, with or without www.) and a path
	356	+ * inside the home path. A plain prefix check missed http:// links on
	357	+ * an https site, which migrated sites still carry, and matched
	358	+ * example.test.evil.test as home.
	359	+ */
	360	+ public static function is_own_url( string $url ): bool {
	361	+ $home_parts = wp_parse_url( (string) home_url() );
	362	+ $parts = wp_parse_url( $url );
	363	+ if ( ! is_array( $home_parts ) || ! is_array( $parts ) || empty( $parts['host'] ) || empty( $home_parts['host'] ) ) {
	364	+ return false;
	365	+ }
	366	+ $strip = static function ( string $host ): string {
	367	+ $host = strtolower( $host );
	368	+ return 0 === strpos( $host, 'www.' ) ? substr( $host, 4 ) : $host;
	369	+ };
	370	+ if ( $strip( $parts['host'] ) !== $strip( $home_parts['host'] ) ) {
	371	+ return false;
	372	+ }
	373	+ $home_path = rtrim( (string) ( $home_parts['path'] ?? '' ), '/' );
	374	+ $path = (string) ( $parts['path'] ?? '' );
	375	+ return '' === $home_path || $path === $home_path || 0 === strpos( $path, $home_path . '/' );
	376	+ }
	377	+
178	378	public static function block_feed(): void {
179	379	wp_die(
180	380	esc_html__( 'Feeds are disabled.', 'xspeed' ),
181	381	'',
		@@ -250,10 +450,10 @@
250	450	}
251	451	}
252	452
253	453	/**
254		- * Bloat has no master switch -- it is on when any of its disable_* /
255		- * strip_* / restrict_* flags is set. (#363)
	454	+ * Bloat has no master switch -- it is on when any of its boolean
	455	+ * flags is set. (#363)
256	456	*/
257	457	public function is_active(): ?bool {
258	458	return $this->any_bool_flag_on();
259	459	}