RefiTune – Site refiner toolkit vs Performance Optimization

Did you ever read about Optimization of website/blog through ordering styles and Scripts in head section? If you like your website load in browser as quickly as possible then you may have read in performance optimization tips that you should move all CSS files on top and script at last in HTML head section . How do you order those calls? If you are manually putting CSS and JavaScript files in head section ( ), then you can do this very easily. Just modify once and optimization for this is over. What if you are using plugins and that are adding calls to JavaScript and CSS files dynamically. This is case of WordPress blog, where we use many plugins and those plugins add various Styles and Script files dynamically from wp_head() call. If above lines, do not makes much sense to you then probably you have not read this documentation on Google. The plugin will also collect different inline scripts to one place. Thus making the source code look better. To check, if the plugin is doing anything or not, compare the Head section before and after activating the plugin. (For reading more details discussion, follow the Plugin link on right side.) Author (satya61229) About page on WP

Hungarian: Magyar nyelvű bővítmény leírás RefiTune – Site refiner toolkit is a modular Swiss Army knife for WordPress. Clean up unnecessary front-end code, harden login and uploads, tune Heartbeat and updates, or brand wp-login – each module is opt-in. Enable or disable features individually. A clean dashboard shows what is active. In-plugin Help pages document behaviour, trade-offs, and requirements. What’s Inside? (35 Modules) Performance: * Header Cleanup – Strip unnecessary wp_head output for leaner pages. * Feed Management – Control RSS/Atom feed link tags in the document head. * Disable Emoji – Remove WordPress emoji scripts and styles. * Disable jQuery Migrate – Drop legacy jquery-migrate when your stack does not need it. * Disable oEmbed – Stop automatic embeds from pasted YouTube, Vimeo, Twitter/X, and similar URLs. * Remove Asset Version Query Strings – Strip ?ver= from front-end CSS/JS (can break cache busting; prefer CDN purge or hashed filenames). * Post Revisions Limit – Cap stored revisions per post. * Auto-save Interval – Change how often the editor auto-saves. * Trash Auto-Delete – Set trash retention; expired items are removed in batches so large queues stay memory-safe. * Convert Uploads to WebP – Convert JPEG/PNG to WebP on upload, optional max size resize, then remove the original (GD or Imagick with WebP; uses unique filenames and refuses unsafe overwrites). * Heartbeat API Control – Tune or disable Heartbeat in admin, front end, and the post editor. Security: * Hide Generator Tags – Remove WordPress (and WooCommerce, when active) version meta tags. * Disable XML-RPC – Respond to XML-RPC with 404 and remove RSD discovery. * Disable Trackback/Pingback – Close pings and strip pingback methods/headers. * Disable File Editor – Set DISALLOW_FILE_EDIT so theme/plugin editors stay off. * Automatic Updates Control – Tri-state plugin, theme, translation, and core updates; reschedule update checks. Respects AUTOMATIC_UPDATER_DISABLED and WP_AUTO_UPDATE_CORE when defined. * Login Error Messages – Generic login errors to reduce username enumeration. * Restrict Admin Access – Choose which roles may open wp-admin UI. Users with manage_options always keep access. Front-end admin-ajax.php is intentionally not blocked. * REST API Restrictions – Limit selected core REST routes to users with manage_options. * Login Limit – Rate-limit failed logins by IP and IP+username pair (REMOTE_ADDR only). Optional IP whitelist (one address per line). Covers wp-login.php and other wp_signon() paths (including WooCommerce). * Verified Upload – Block disguised uploads: double extensions, MIME/magic mismatches, and script markers. Visual: * Hide Admin Bar – Hide the admin bar for selected roles. * Block Visibility (Mobile) – Show/hide blocks by device via wp_is_mobile(); sends Vary: User-Agent (full-page caches must honour it). * Login Page Customization – Brand wp-login.php with logo and colours. Email: * Email Notifications – Disable or redirect selected WordPress system emails. * Email sending – SMTP with encrypted password storage, or disable all site emails. In production, disabling TLS/certificate verification is blocked. Miscellaneous: * Disable Comments – Site-wide comments off (optional WooCommerce review keep). * External Links in New Window – Open external links in a new tab with safe rel attributes. * Enable Page Excerpt – Excerpt support for pages. * Clean Upload Filenames – Sanitize upload filenames (accents, spaces, special characters). * SVG Upload – Role-gated SVG uploads with allowlist-based sanitization (XXE-safe parse). * AVIF Upload – Role-gated AVIF uploads (full core AVIF support needs WordPress 6.5+). * Role Redirects – Per-role login and logout redirect URLs. * Maintenance Mode – 503 maintenance page for guests; chosen roles keep access. Admin, AJAX, and cron stay available so staff can work. * Dynamic Year Shortcodes – [refi-year] and [refi-year from="2006"]. More plugins: rotistudio.com Author site: rottenbacher.hu GitHub: github.com/rotisoft/refitune Translations English (default – source strings in code and refitune.pot) Hungarian (Magyar) – refitune-hu_HU.po (compile to .mo for WordPress to load) Contribute translations under /wp-content/plugins/refitune/languages/. Text Domain: refitune.