Title: Performance & Security Author: JMR.codes Published: October 20, 2014 Last modified: سبتمبر 25, 2026 --- Search plugins ![](https://ps.w.org/wp-performance-security/assets/banner-772x250.png?rev=3568221) ![](https://ps.w.org/wp-performance-security/assets/icon.svg?rev=3568221) # Performance & Security By [JMR.codes](https://profiles.wordpress.org/jmrcodes/) [Download](https://downloads.wordpress.org/plugin/wp-performance-security.1.2.1.zip) * [Details](https://arq.wordpress.org/plugins/wp-performance-security/#description) * [Reviews](https://arq.wordpress.org/plugins/wp-performance-security/#reviews) * [Installation](https://arq.wordpress.org/plugins/wp-performance-security/#installation) * [Development](https://arq.wordpress.org/plugins/wp-performance-security/#developers) [Support](https://wordpress.org/support/plugin/wp-performance-security/) ## Description A self-hosted site manager’s toolkit: the security hardening, performance tuning, admin cleanup, content controls and email handling you’d otherwise install half a dozen micro-plugins for — as independent modules on a single settings page (Settings Site Toolkit). Every module is off by default and registers no hooks while disabled, so the plugin changes nothing until you opt in. 🔐 **Security** — disable XML-RPC, hide the WordPress version, disable user enumeration( author scans, sitemaps, oEmbed, author archives), block the REST users endpoint, disable the file editors, block readme/license files, security headers (with optional HSTS), disable application passwords, session management, a failed login log (with optional file logging for fail2ban), and an admin audit log. 🔓 **Login Page** — change the login URL, login rate limiting, hide detailed login errors, username-only sign-in, disable the language switcher, record each user’s last login, and login screen branding (use your site identity automatically or a custom logo from the media library). 🚀 **Performance** — control autosave and post revisions, remove asset version query strings, throttle the Heartbeat API, remove wp_head bloat and generator tags, dequeue unused default assets (emoji, jQuery Migrate, Block Library CSS), disable self-pings, scheduled database maintenance, DNS prefetch/preconnect hints, and manage generated image sizes. 🛠️ **Admin / UX** — hide the front-end toolbar, change the WordPress greeting, replace the account menu with a logout button, dashboard widget manager, custom admin footer, maintenance mode, media library user isolation, environment indicator, suppress update notices on non-production, control the admin email verification screen, trim the WordPress toolbar menu, and an “All Settings” menu item. 📝 **Content & Editorial** — customize excerpts, disable the block editor per post type, disable trackbacks, targeted comment controls (media comments, plain-text links, minimum length), disable comments entirely, disable oEmbed, and restore the Links Manager. 📧 **Email & Notifications** — disable selected notification emails, and redirect or block all outgoing email on non-production environments. If you have further suggestions, please contact us via the [plugin support page](https://wordpress.org/support/plugin/wp-performance-security). If this plugin is useful for managing your WordPress settings, please [leave a review](https://wordpress.org/support/view/plugin-reviews/wp-performance-security). Developed by [JMR.codes](https://jmr.codes). ## Installation 1. Unzip the plugin and copy the `wp-performance-security` folder to the `/wp-content/ plugins/` directory 2. Activate the plugin through the ‘Plugins’ menu in WordPress ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Performance & Security” is open source software. The following people have contributed to this plugin. Contributors * [ JMR.codes ](https://profiles.wordpress.org/jmrcodes/) [Translate “Performance & Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/wp-performance-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wp-performance-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/wp-performance-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wp-performance-security/) by [RSS](https://plugins.trac.wordpress.org/log/wp-performance-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.1 **New** * Email & Notifications: **Disable email notifications** can now stop the “New User Registration” email WordPress sends the site admin. The new user still receives their own welcome email. Off by default, so existing sites keep getting it until they opt in. **Fixed** * The “jQuery Migrate” option under Dequeue unused default assets now drops the dependency on the front end only. Admin screens keep it, because the post editor and other admin scripts can still rely on APIs jQuery Migrate restores — with the option enabled on WordPress 7.1, opening Add New Post could render a blank screen. #### 1.2.0 This release adds a failed login log, a module to control the admin email confirmation screen, a plugin-wide visitor IP setting for sites behind a proxy or CDN, and bundled translations for the English variants WordPress supports. **New** * Security: **Failed login log** — records failed login attempts (username, IP address, time, and whether the username belongs to a real account) to a database table for review under **Tools Failed Logins**, with filtering by username, source and date and a summary of recent activity. Covers the login form, XML- RPC and application passwords, and notes attempts already blocked by login rate limiting. Old entries are purged daily and the table size is capped. Optional plain-text file logging for fail2ban and similar tools: the file is size-rotated so it stays bounded, and a reachability check switches file logging off (with an admin notice) if the log file turns out to be publicly downloadable — with an advanced option to write to a custom path outside the web root instead. * Admin / UX: **Admin email verification screen** — controls how often WordPress shows the “Is this admin email correct?” confirmation after login: never, once a year, every two years, or a custom interval in months. * **Visitor IP address** setting — one plugin-wide choice of where the visitor’s IP address is read from (the direct connection, or a proxy header such as X-Forwarded- For or CF-Connecting-IP), shared by login rate limiting and the failed login log, with a readout of the headers your server is actually sending to help you pick the right one. * **English-variant translations** — the plugin now ships translations for regional English: Australia, New Zealand, UK, South Africa and Canada. Provided as both. mo files and the faster .l10n.php format that WordPress 6.5+ prefers. **Fixed** * If the audit log database table goes missing — dropped by a migration, a partial restore or a “cleanup” plugin — it is now rebuilt automatically on the next request, and a failed log write now surfaces the database error as an admin notice. Previously, if the table went missing, the audit log failed silently and simply read as empty. * The audit log date filter now rejects impossible calendar dates (e.g. a month of 99) instead of erroring and showing an empty list. * Disabling a module that owns a scheduled task from outside the admin (via WP- CLI or a direct database edit) now clears its cron event on the next page load instead of leaving it scheduled forever. Affected the audit log and database maintenance modules. #### 1.1.1 Version bump due to Subversion issues #### 1.1.0 This is a major release. The plugin has been rebuilt around a modular framework: every feature is now an independent module on a single **Settings Toolkit** page(“ Performance & Security Toolkit”), and each module is off by default and adds no overhead until you switch it on. The old “Performance & Security” settings page has been retired, and your existing 1.0 settings are migrated to the equivalent modules automatically when you upgrade. **Requirements** * Now requires WordPress 6.2 or later (the audit log uses the `%i` SQL identifier placeholder added in WordPress 6.2). * Now requires PHP 7.4 or later. **New — 49 modules across six sections** * Security: Disable XML-RPC; Hide WordPress version; Disable user enumeration ( blocks author scans, with optional removal from XML sitemaps and oEmbed, author- archive redirect and author-link unlinking); Block REST API user endpoint; Disable theme/plugin file editor; Block access to readme/license files; Add security headers (duplicate detection, optional HSTS gated on HTTPS); Disable application passwords; Session management (log out other sessions on password change, optional session-lifetime cap); Admin audit log (Tools Audit Log) with a daily retention purge. * Login Page: Change login URL; Login rate limiting; Hide detailed login errors( with a custom message); Disable login via email address (username-only sign-in); Disable the login language switcher; Record user last login time (adds a sortable“ Last Login” column to the Users screen); Customize login screen branding (use your site identity automatically, or set a custom logo from the media library, link and title). * Performance: Disable autosave or increase the autosave interval; Limit post revisions; Remove version query strings from assets; Control the Heartbeat API; Remove additional wp_head bloat (including per-source generator tags for WordPress, WooCommerce, Google Site Kit, Performance Lab, Modern Image Formats and Speculative Loading); Dequeue unused default assets (emoji, jQuery Migrate, Block Library CSS and more); Disable self-pings; Database maintenance (scheduled cleanup with a “Run now” button); DNS prefetch / preconnect hints; Manage generated image sizes. * Admin / UX: Hide the toolbar on the front end; Change the WordPress greeting; Replace the account menu with a logout button; Dashboard widget manager; Custom admin footer text (with optional database statistics); Maintenance / coming soon mode; Media library user isolation; Environment indicator; Suppress update notices on non-production environments; Remove the WordPress toolbar menu; Add an “All Settings” menu item. * Content & Editorial: Disable the block editor (Gutenberg) per post type; Disable trackbacks and pingbacks; Disable oEmbed; Disable comments (thorough, with granular keep-toggles); Disable comments on media files; Disable active links in comments; Minimum comment length; Customize excerpts (word length and “more” text); Enable the Links Manager. * Email & Notifications: Disable email notifications (auto-update, background-update, successful-core-update and password-reset emails, each individually toggleable); Redirect outgoing email on non-production environments (to a catch-all address, or block it entirely). **Changed** * Settings have moved to Settings Toolkit (titled “Performance & Security Toolkit”); the “Settings” link on the Plugins screen now points there. Your existing settings are migrated automatically — no reconfiguration needed. **Removed** * GZIP compression — removed with no in-plugin replacement. Compression belongs at the server or CDN level (enable it in cPanel/Plesk or ask your host): that is more reliable, avoids conflicts with caching plugins, and supports Brotli. * Several niche legacy options were retired because they need theme code to be useful or duplicate settings handled better elsewhere: excerpts on Pages, the“ Read more” anchor tweak, content/excerpt auto-formatting toggles, custom post types in search and RSS, tags on pages and in queries, and HTML5 markup support. The comment-form URL-field removal was also dropped, as it cannot be done reliably across both classic and block themes. **Fixed** * The “WordPress greeting” option now works — and in every language. The previous version hooked too early to ever modify the toolbar greeting, so it had no effect. * “Disable self-ping” can now be saved. The legacy checkbox was missing from the settings whitelist and never persisted. **Security** * Login rate limiting now reads the proxy-appended client IP instead of the spoofable left-most X-Forwarded-For value, and the lockout window no longer extends on already-blocked attempts (which could permanently lock out everyone sharing an IP). * Maintenance mode now also returns a 503 for anonymous REST API requests, so posts and pages are not readable via /wp-json while the site is hidden. * Media library user isolation now covers the list view and the REST media endpoint, not only the grid view. * The login-screen logo URL is quoted inside its CSS to prevent CSS injection, and author-enumeration blocking also catches the array form (?author[]=1). #### 1.0.0 * Security: settings are now saved through the WordPress Settings API with a dedicated nonce and a `manage_options` capability check * Security: all stored settings are sanitised against a whitelist of known options( unknown keys are discarded) * Security: all settings and URLs are escaped on output * Fixed fatal errors on PHP 8 caused by `create_function()` * Fixed the custom login logo, login URL, login title and minimum comment length options, which previously referenced settings out of scope * Fixed reactivation overwriting saved settings * Custom post types in search results now use `pre_get_posts` so the option works as described * The settings page now lists all options on a single page, grouped into fieldsets by feature type #### 0.9.2 * Removed Google Analytics section now that Universal Analytics are no longer supported #### 0.9.1 * Fixed a bug on the login screen #### 0.9 * Fixed a bug with comments being disabled by default * Remove oEmbed support option * Remove jQuery migrate option * Improved emoji removal to include dns-prefetch of image sources #### 0.8 * Tested against WP 5.0.1 * Open Sans was dropped from WP 4.6 in favour of system fonts – so this option will only show for older versions of WP * Updated Google Analytics to support Google Tag Manager (gtag.js) * Added the ability to hide existing comments * Jetpack devicepx option only shown if Jetpack is active * Improved handling of custom post type options * Added support for enabling (and disabling) the Links Manager * Removed SVG support due to changes in WP since 4.7 * Minor code improvements #### 0.7 * Added new feature to remove the styles and scripts that make up emoji support, which was added in WP 4.2 #### 0.6 * Fixed a range of alerts that appear in debug mode #### 0.5 * Fixed issue where plugin might conflict with WP Super Cache #### 0.4.1 * Minor changes to plugin settings in WP #### 0.4 Minor code changes * JS only loaded on plugin page * Changed default settings, all plugin options set to the WordPress defaults #### 0.3 * Updated plugin to allow for internationalization * Added icon #### 0.2 * Added support for adding Google Analytics tracking code * Added a toggle to remove the admin bar from front-facing pages * Added a setting to enforce and set the minimum number of characters required in a comment #### 0.1 * Initial launch ## Meta * Version **1.2.1** * Last updated **2 hours ago** * Active installations **50+** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/wp-performance-security/) * Tags * [performance](https://arq.wordpress.org/plugins/tags/performance/)[security](https://arq.wordpress.org/plugins/tags/security/) [toolkit](https://arq.wordpress.org/plugins/tags/toolkit/) * [Advanced View](https://arq.wordpress.org/plugins/wp-performance-security/advanced/) ## Ratings 5 out of 5 stars. * [ 2 5-star reviews ](https://wordpress.org/support/plugin/wp-performance-security/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/wp-performance-security/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/wp-performance-security/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/wp-performance-security/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/wp-performance-security/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/wp-performance-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wp-performance-security/reviews/) ## Contributors * [ JMR.codes ](https://profiles.wordpress.org/jmrcodes/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wp-performance-security/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://buymeacoffee.com/jmrcodes)