What is WordPress bloat?
WordPress ships with legacy features designed for compatibility: emoji detection scripts, XML-RPC endpoints, RSS feed links, embed handlers, REST API discovery tags, and RSD/WLW headers. If you don't use these features, they still execute on every page load.
All 11 Bloat Removal Toggles
| # | Feature Toggle | Default | What it disables & Performance impact |
|---|---|---|---|
| 1 | Disable Emojis | ON | Removes wp-emoji-release.min.js script, inline styles, and DNS prefetch calls. Saves 1 HTTP request and 15KB JS payload. |
| 2 | Disable Embeds | ON | Removes wp-embed.min.js and disables external oEmbed endpoints to prevent cross-site embedding overhead. |
| 3 | Disable XML-RPC | OFF | Blocks access to xmlrpc.php API endpoint to protect against brute-force DDoS attacks and pingback spam. |
| 4 | Disable RSS Feeds | OFF | 301-redirects RSS feed URLs back to parent pages to reduce automated crawler load. |
| 5 | Disable Shortlinks | ON | Strips <link rel="shortlink"> tags from HTML headers. |
| 6 | Disable REST API Links | ON | Removes REST API discovery links (<link rel="https://api.w.org/">) from <head> without breaking API endpoints. |
| 7 | Disable RSD & WLW Manifest | ON | Removes Really Simple Discovery (RSD) and Windows Live Writer (WLW) manifest header links. |
| 8 | Remove Generator Metadata | ON | Strips <meta name="generator"> tags (WordPress, WooCommerce, page builders) to hide version numbers from security bots. |
| 9 | Limit Post Revisions | ON | Caps WordPress post revision saves to a maximum of 3 per post to prevent database bloat over time. |
| 10 | Disable Dashicons (Frontend) | ON | Dequeues Dashicons font stylesheets on the frontend for non-logged-in visitors. Saves 30KB CSS payload. |
| 11 | Reduce Heartbeat Frequency | ON | Throttles WordPress Heartbeat API execution frequency to 60 seconds to cut CPU load and admin-ajax.php calls. |