=== Site Cleanup Controls ===
Contributors: devabhisheksinha
Tags: performance, security, disable, cleanup, hardening
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Selectively disable WordPress features to improve performance, security, and cleanliness. Toggle each feature individually from a single settings page.

== Description ==

Site Cleanup Controls gives developers and site owners fine-grained control over 35+ WordPress features that are often unnecessary. Each feature has a simple on/off toggle, organised into five logical groups inside **Settings -> Site Cleanup Controls**.

No features are enabled by default — activate only what you need.

= Security =
* **User Enumeration** — Block ?author=N redirect attacks that expose usernames.
* **Author Archives** — Return 404 for author archive pages.
* **XML-RPC + Pingback** — Fully disable the XML-RPC endpoint and remove the X-Pingback header.
* **Plugin and Theme Editor** — Set DISALLOW_FILE_EDIT to prevent in-admin file editing.
* **Application Passwords** — Disable the Application Passwords feature.
* **REST API** — Restrict REST API access to authenticated users only.
* **Right Click** — Disable the browser context menu on the frontend.

= Performance =
* **Emojis** — Remove all emoji scripts, styles, and DNS prefetch hints.
* **Embed Objects** — Disable WordPress oEmbed and embed scripts.
* **Dashicons** — Prevent Dashicons from loading for non-logged-in visitors.
* **Heartbeat** — Deregister the Heartbeat API script.
* **Block Library CSS** — Remove wp-block-library and global-styles stylesheets on the frontend.
* **Version Var (?ver=)** — Strip ?ver= query strings from enqueued asset URLs.
* **PDF Thumbnails** — Skip thumbnail generation for uploaded PDF files.
* **oEmbed** — Remove oEmbed discovery links and disable autoembed.
* **Remote Block Patterns** — Stop WordPress fetching patterns from api.wordpress.org.

= Head Cleanup =
* **Generator Meta Tag** — Remove the WordPress version meta tag from head.
* **WLW Manifest** — Remove the Windows Live Writer manifest link.
* **Really Simple Discovery (RSD)** — Remove the RSD link tag.
* **Short Link** — Remove the shortlink tag and HTTP header.
* **Adjacent Posts Links** — Remove prev/next link tags from single post heads.
* **RSS Feeds** — Redirect all feed URLs to the homepage.

= Admin Cleanup =
* **capital_P_dangit** — Remove WordPress forced capitalisation filter.
* **Screen Options and Help Tabs** — Hide Screen Options and Help dropdowns.
* **Howdy to Welcome** — Replace "Howdy," with "Welcome," in the admin bar.
* **Navigation Items in Admin Bar** — Remove WP logo, site name, updates, and comments.
* **Clean Dashboard** — Remove all default dashboard widgets.
* **Privacy Tools** — Hide Export/Erase Personal Data from the Tools menu.
* **Site Health Page** — Hide Site Health from the Tools menu.
* **WP Login Logo and Favicon** — Hide the WordPress logo on the login page.
* **Admin Email Verification Prompt** — Disable the admin email confirm interstitial.
* **Empty Trash (1 week)** — Shorten automatic trash-emptying from 30 days to 7 days.

= Content =
* **Comments** — Disable comments sitewide.
* **Post Revisions** — Disable revision storage.
* **Search** — Redirect all search queries to the homepage.

== Installation ==

1. Upload the `abhishek-site-cleanup-controls` folder to `/wp-content/plugins/`.
2. Activate the plugin through the Plugins menu in WordPress.
3. Go to **Settings -> Site Cleanup Controls**.
4. Toggle the features you want to disable and click **Save Changes**.

== Frequently Asked Questions ==

= Do any features activate automatically? =

No. Every feature is off by default. You choose exactly what to enable.

= Will disabling the REST API break the block editor? =

No. The toggle only blocks unauthenticated requests. Logged-in users and the block editor are unaffected.

= Post Revisions or the Plugin/Theme Editor toggle is not working — why? =

WP_POST_REVISIONS and DISALLOW_FILE_EDIT are core constants that work most reliably when defined in wp-config.php before WordPress loads. The plugin sets them at runtime as a convenience, but for guaranteed effect add them to wp-config.php directly.

= Will my settings be deleted if I deactivate the plugin? =

No. Settings are only removed when you delete the plugin. An uninstall.php file handles clean removal.

== Screenshots ==

1. The main settings page with all features grouped by category.
2. The Security group with individual feature toggles.
3. The Performance group with individual feature toggles.

== Changelog ==

= 1.0.1 =
* Initial release with 35 toggleable features across 5 categories.

== Upgrade Notice ==

= 1.0.1 =
Initial release.