⬇️ Download minimal-disable.zip
What the plug‑in switches off (and why it matters)
| Feature disabled | Purpose | Key hook/filter used |
| Emojis & SVGs | Shaves HTTP requests and a small JS file. | print_emoji_detection_script, print_emoji_styles |
| Embeds / oEmbed | Removes auto‑embedding JS, discovery links, REST routes. | wp_oembed_* family + tiny_mce_plugins |
| WP REST API (front‑end) | Eliminates public JSON endpoints attackers love to probe. | rest_authentication_errors |
| XML‑RPC | Blocks legacy pingbacks / remote publishing hole. | xmlrpc_enabled, X‑Pingback header |
| Feeds (RSS/Atom) | Kills auto‑generated feeds if you don’t publish them. | do_feed* callbacks |
| Comments everywhere | Removes UI, closes existing threads, hides admin page. | remove_post_type_support, comments_open |
| Block/Gutenberg editor | Restores Classic Editor for all post types. | use_block_editor_for_post_type |
| Front‑end admin bar | Gives visitors (and yourself) a cleaner view. | show_admin_bar |
| Misc. <head> bloat | Strips RSD, WLW, shortlink, version, & feed tags. | remove_action( ‘wp_head’, … ) |
(Every change is reversed cleanly on de‑activation; no database tables are touched.)
Installation
- Download the file above—it’s a standard WordPress plugin ZIP.
- In your WP admin, go to Plugins → Add New → Upload Plugin, choose the ZIP, and click Install Now.
- Hit Activate. That’s it—features listed above vanish instantly.
Need to roll anything back? Just deactivate or delete the plugin and WordPress will behave as normal.
Customising the behaviour
Open the single PHP file inside the plugin:
- Comment‑out any block you want to keep (mwd_disable_embeds(), mwd_disable_feeds(), etc.).
- Extend it: for example, uncomment wp_deregister_script( ‘jquery’ ); to strip jQuery, or add define( ‘DISALLOW_FILE_EDIT’, true ); to prevent theme/plugin editing from the dashboard.
- Rename the functions or folder if you intend to run multiple custom hardening snippets to avoid name collisions.
Tested stack & compatibility
- WordPress 5.0 → 6.5 (latest as of 27 Jul 2025)
- PHP 7.4 → 8.3
- Multisite‑safe (network‑activate to affect every sub‑site)
- No third‑party dependencies, no Composer/autoloader fuss.
Final pep‑talk 🌟
Locking down WordPress doesn’t have to be overwhelming—sometimes a single, tidy plugin is all it takes. Install Minimal WP Disable, shed the weight, shrink your attack surface, and give your site the lean, mean edge it deserves. Stay secure and keep creating! 🎉