Disable Emojis (GDPR friendly) vs Performance & Security

This plugin disables the WordPress emoji functionality, removing unnecessary code bloat that adds support for emojis in older browsers. What it does Removes the emoji detection script from wp_head and the admin Removes emoji styles from wp_print_styles and admin Removes emoji DNS prefetching, preventing connections to s.w.org Removes the wpemoji TinyMCE plugin Strips emoji CDN hostname from DNS prefetch hints Performance & Privacy Emojis will still display in modern browsers that have built-in support. This plugin simply removes the extra HTTP requests and JavaScript overhead for browsers that don’t need it. Additionally, it prevents DNS prefetching to WordPress.org’s emoji CDN, improving privacy. Note: Emoticons like :) will continue to work as expected. Requirements PHP 7.4+ WordPress 5.0+ GDPR compliancy This plugin does not send any data to external servers. It disables DNS prefetching of emojis within WordPress, which should ensure improved privacy. To determine if your site is GDPR compliant, please seek legal advice. I have done my best to ensure the plugin is 100% GDPR compliant, but I am not a lawyer so cannot guarantee anything. Architecture The plugin uses: Quality All code uses declare(strict_types=1) and follows PSR-12. The plugin runs the following tooling: PHP_CodeSniffer (run via composer phpcs) — sniffs for PSR-12 violations PHP-CS-Fixer (run via composer cs) — dry-run style check PHPStan at level 6 (run via composer phpstan) — static analysis

A self-hosted site manager’s toolkit: the security hardening, performance tuning, admin cleanup, content controls and email handling you’d otherwise install half a dozen micro-plugins for — as independent modules on a single settings page (Settings → Site Toolkit). Every module is off by default and registers no hooks while disabled, so the plugin changes nothing until you opt in. 🔐 Security — disable XML-RPC, hide the WordPress version, disable user enumeration (author scans, sitemaps, oEmbed, author archives), block the REST users endpoint, disable the file editors, block readme/license files, security headers (with optional HSTS), disable application passwords, session management, and an admin audit log. 🔓 Login Page — change the login URL, login rate limiting, hide detailed login errors, username-only sign-in, disable the language switcher, record each user’s last login, and login screen branding (use your site identity automatically or a custom logo from the media library). 🚀 Performance — control autosave and post revisions, remove asset version query strings, throttle the Heartbeat API, remove wp_head bloat and generator tags, dequeue unused default assets (emoji, jQuery Migrate, Block Library CSS), disable self-pings, scheduled database maintenance, DNS prefetch/preconnect hints, and manage generated image sizes. 🛠️ Admin / UX — hide the front-end toolbar, change the WordPress greeting, replace the account menu with a logout button, dashboard widget manager, custom admin footer, maintenance mode, media library user isolation, environment indicator, suppress update notices on non-production, trim the WordPress toolbar menu, and an “All Settings” menu item. 📝 Content & Editorial — customize excerpts, disable the block editor per post type, disable trackbacks, targeted comment controls (media comments, plain-text links, minimum length), disable comments entirely, disable oEmbed, and restore the Links Manager. 📧 Email & Notifications — disable selected notification emails, and redirect or block all outgoing email on non-production environments. If you have further suggestions, please contact us via the plugin support page. If this plugin is useful for managing your WordPress settings, please leave a review. Developed by JMR.codes.