← All changes | includes/modules/Bloat/BloatModule.php +144 -3 1.3.4 → 1.3.6 View file →

		@@ -6,9 +6,9 @@
6	6	* Each setting is a single toggle that adds (or doesn't add) one or
7	7	* two filters. Per the SETTINGS.md standard, every toggle ships with a
8	8	* label + description that names the actual ergonomic value.
9	9	*
10		- * Six toggles, all opt-in (default false). The defaults are
	10	+ * Every toggle is opt-in (default false). The defaults are
11	11	* conservative because every site has at least one plugin that quietly
12	12	* depends on the surface this module strips — better to make the user
13	13	* choose than to break themes on activation.
14	14	*
		@@ -42,8 +42,14 @@
42	42	}
43	43
44	44	public function settings_schema(): array {
45	45	return array(
	46	+ 'disable_emojis' => array(
	47	+ 'type' => 'bool',
	48	+ 'default' => false,
	49	+ 'label' => __( 'Disable Emojis', 'xspeed' ),
	50	+ 'description' => __( 'Remove the emoji detection script and its inline styles from every page. Modern browsers draw emojis natively, so visitors still see them. Saves a script and an inline stylesheet per page.', 'xspeed' ),
	51	+ ),
46	52	'disable_dashicons_frontend' => array(
47	53	'type' => 'bool',
48	54	'default' => false,
49	55	'label' => __( 'Disable Dashicons on Frontend', 'xspeed' ),
		@@ -78,8 +84,38 @@
78	84	'default' => false,
79	85	'label' => __( 'Strip Block-Editor Styles on Frontend', 'xspeed' ),
80	86	'description' => __( 'Drop editor-only stylesheets (wp-editor, wp-components, and friends) from anonymous pages. A plugin that enqueues them on the frontend usually does so by accident — they can add hundreds of KB of render-blocking CSS. Frontend block styles (wp-block-library) are never touched.', 'xspeed' ),
81	87	),
	88	+ 'remove_rsd_link' => array(
	89	+ 'type' => 'bool',
	90	+ 'default' => false,
	91	+ 'label' => __( 'Remove RSD Link', 'xspeed' ),
	92	+ 'description' => __( 'Drop the Really Simple Discovery link from the page head. Only old desktop blogging clients read it.', 'xspeed' ),
	93	+ ),
	94	+ 'remove_shortlink' => array(
	95	+ 'type' => 'bool',
	96	+ 'default' => false,
	97	+ 'label' => __( 'Remove Shortlink', 'xspeed' ),
	98	+ 'description' => __( 'Drop the ?p=123 shortlink tag and header from posts and pages. The shortlinks keep working; they are just no longer advertised.', 'xspeed' ),
	99	+ ),
	100	+ 'remove_rest_api_links' => array(
	101	+ 'type' => 'bool',
	102	+ 'default' => false,
	103	+ 'label' => __( 'Remove REST API Links', 'xspeed' ),
	104	+ 'description' => __( 'Drop the /wp-json/ discovery link tag and Link header. The REST API itself stays on; to block it, use the setting below.', 'xspeed' ),
	105	+ ),
	106	+ 'hide_wp_version' => array(
	107	+ 'type' => 'bool',
	108	+ 'default' => false,
	109	+ 'label' => __( 'Hide WordPress Version', 'xspeed' ),
	110	+ 'description' => __( 'Remove the WordPress generator tag from pages and feeds, so it no longer states the WordPress version. Other plugins print their own tags; those stay. Script and style URLs still carry ?ver= numbers.', 'xspeed' ),
	111	+ ),
	112	+ 'disable_self_pingbacks' => array(
	113	+ 'type' => 'bool',
	114	+ 'default' => false,
	115	+ 'label' => __( 'Disable Self-Pingbacks', 'xspeed' ),
	116	+ 'description' => __( 'Stop WordPress from sending a pingback to your own site when a post links to another of your posts. Pingbacks to other sites are not affected.', 'xspeed' ),
	117	+ ),
82	118	'restrict_rest_to_authed' => array(
83	119	'type' => 'bool',
84	120	'default' => false,
85	121	'label' => __( 'Restrict REST API to Logged-In Users', 'xspeed' ),
		@@ -109,8 +145,12 @@
109	145	*/
110	146	public function boot_on_init(): void {
111	147	$opts = Settings_Manager::get( self::SLUG );
112	148
	149	+ if ( ! empty( $opts['disable_emojis'] ) ) {
	150	+ self::disable_emojis();
	151	+ }
	152	+
113	153	if ( ! empty( $opts['disable_dashicons_frontend'] ) ) {
114	154	add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_dashicons' ), 100 );
115	155	}
116	156
		@@ -142,8 +182,32 @@
142	182	// Late, so anything enqueued at normal priority is already queued.
143	183	add_action( 'wp_enqueue_scripts', array( __CLASS__, 'dequeue_editor_styles' ), PHP_INT_MAX );
144	184	}
145	185
	186	+ if ( ! empty( $opts['remove_rsd_link'] ) ) {
	187	+ remove_action( 'wp_head', 'rsd_link' );
	188	+ }
	189	+
	190	+ if ( ! empty( $opts['remove_shortlink'] ) ) {
	191	+ remove_action( 'wp_head', 'wp_shortlink_wp_head' );
	192	+ remove_action( 'template_redirect', 'wp_shortlink_header', 11 );
	193	+ }
	194	+
	195	+ if ( ! empty( $opts['remove_rest_api_links'] ) ) {
	196	+ remove_action( 'wp_head', 'rest_output_link_wp_head' );
	197	+ remove_action( 'template_redirect', 'rest_output_link_header', 11 );
	198	+ remove_action( 'xmlrpc_rsd_apis', 'rest_output_rsd' );
	199	+ }
	200	+
	201	+ if ( ! empty( $opts['hide_wp_version'] ) ) {
	202	+ remove_action( 'wp_head', 'wp_generator' );
	203	+ add_filter( 'the_generator', '__return_empty_string' );
	204	+ }
	205	+
	206	+ if ( ! empty( $opts['disable_self_pingbacks'] ) ) {
	207	+ add_action( 'pre_ping', array( __CLASS__, 'strip_self_pings' ) );
	208	+ }
	209	+
146	210	if ( ! empty( $opts['restrict_rest_to_authed'] ) ) {
147	211	add_filter( 'rest_authentication_errors', array( __CLASS__, 'restrict_rest' ) );
148	212	}
149	213	}
		@@ -155,8 +219,42 @@
155	219	wp_dequeue_style( 'dashicons' );
156	220	wp_deregister_style( 'dashicons' );
157	221	}
158	222
	223	+ /**
	224	+ * The front-end hooks live in default-filters.php, which loads before
	225	+ * `init`, so removing them here works. The admin ones are added by
	226	+ * wp-admin/includes/admin-filters.php, which loads after `init`; they
	227	+ * are removed on `admin_init` instead. wp_enqueue_emoji_styles is the
	228	+ * WP 6.4+ path; print_emoji_styles is kept for older cores.
	229	+ */
	230	+ public static function disable_emojis(): void {
	231	+ remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
	232	+ remove_action( 'embed_head', 'print_emoji_detection_script' );
	233	+ remove_action( 'wp_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	234	+ remove_action( 'enqueue_embed_scripts', 'wp_enqueue_emoji_styles' );
	235	+ remove_action( 'wp_print_styles', 'print_emoji_styles' );
	236	+ remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
	237	+ remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );
	238	+ remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
	239	+ add_filter( 'tiny_mce_plugins', array( __CLASS__, 'strip_tinymce_emoji' ) );
	240	+ add_action( 'admin_init', array( __CLASS__, 'disable_admin_emojis' ) );
	241	+ }
	242	+
	243	+ public static function disable_admin_emojis(): void {
	244	+ remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
	245	+ remove_action( 'admin_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	246	+ remove_action( 'admin_print_styles', 'print_emoji_styles' );
	247	+ }
	248	+
	249	+ /**
	250	+ * @param mixed $plugins
	251	+ * @return mixed
	252	+ */
	253	+ public static function strip_tinymce_emoji( $plugins ) {
	254	+ return is_array( $plugins ) ? array_values( array_diff( $plugins, array( 'wpemoji' ) ) ) : $plugins;
	255	+ }
	256	+
159	257	public static function disable_oembed(): void {
160	258	// Strip discovery <link> from <head>.
161	259	remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );
162	260	remove_action( 'wp_head', 'wp_oembed_add_host_js' );
		@@ -233,8 +331,51 @@
233	331	}
234	332	}
235	333	}
236	334
	335	+ /**
	336	+ * `pre_ping` passes the link list by reference.
	337	+ *
	338	+ * @param array $links
	339	+ */
	340	+ public static function strip_self_pings( &$links ): void {
	341	+ if ( ! is_array( $links ) ) {
	342	+ return;
	343	+ }
	344	+ $links = array_values(
	345	+ array_filter(
	346	+ $links,
	347	+ static function ( $link ): bool {
	348	+ return ! self::is_own_url( (string) $link );
	349	+ }
	350	+ )
	351	+ );
	352	+ }
	353	+
	354	+ /**
	355	+ * Same host (any scheme, any case, with or without www.) and a path
	356	+ * inside the home path. A plain prefix check missed http:// links on
	357	+ * an https site, which migrated sites still carry, and matched
	358	+ * example.test.evil.test as home.
	359	+ */
	360	+ public static function is_own_url( string $url ): bool {
	361	+ $home_parts = wp_parse_url( (string) home_url() );
	362	+ $parts = wp_parse_url( $url );
	363	+ if ( ! is_array( $home_parts ) || ! is_array( $parts ) || empty( $parts['host'] ) || empty( $home_parts['host'] ) ) {
	364	+ return false;
	365	+ }
	366	+ $strip = static function ( string $host ): string {
	367	+ $host = strtolower( $host );
	368	+ return 0 === strpos( $host, 'www.' ) ? substr( $host, 4 ) : $host;
	369	+ };
	370	+ if ( $strip( $parts['host'] ) !== $strip( $home_parts['host'] ) ) {
	371	+ return false;
	372	+ }
	373	+ $home_path = rtrim( (string) ( $home_parts['path'] ?? '' ), '/' );
	374	+ $path = (string) ( $parts['path'] ?? '' );
	375	+ return '' === $home_path || $path === $home_path || 0 === strpos( $path, $home_path . '/' );
	376	+ }
	377	+
237	378	public static function block_feed(): void {
238	379	wp_die(
239	380	esc_html__( 'Feeds are disabled.', 'xspeed' ),
240	381	'',
		@@ -309,10 +450,10 @@
309	450	}
310	451	}
311	452
312	453	/**
313		- * Bloat has no master switch -- it is on when any of its disable_* /
314		- * strip_* / restrict_* flags is set. (#363)
	454	+ * Bloat has no master switch -- it is on when any of its boolean
	455	+ * flags is set. (#363)
315	456	*/
316	457	public function is_active(): ?bool {
317	458	return $this->any_bool_flag_on();
318	459	}