Prunekit

WordPress ships with features many sites never use. Each one adds requests, database rows or attack surface. Prunekit lets you switch them off with simple toggles, without touching code.

Nothing changes when you activate Prunekit. You choose what to turn off, or click “Apply recommended” to switch on only the options that are safe on every site. Every option shows a badge: Safe, Check after enabling or May break plugins.

Performance

• Slow down the Heartbeat API or switch it off outside the post editor
• Limit post revisions
• Change the autosave interval

Security

• Disable XML-RPC and pingbacks
• Hide the WordPress version
• Hide the user list in the REST API (stops username enumeration via the REST API)
• Restrict the REST API to logged-in users

Clean-up

• Remove emoji scripts and styles
• Stop other sites from embedding your posts
• Disable RSS feeds
• Remove RSD and shortlink tags
• Load Dashicons for logged-in users only

Comments

• Disable comments everywhere, including comment feeds and the REST comments endpoint (existing comments are kept, just hidden)

Prunekit uses only WordPress’ own hooks. No external services, no tracking, no ads, no upsell nags.

Prunekit Pro

Prunekit Pro is an optional add-on with AI crawler rules, database cleanup, export/import of settings and REST route rules. Prunekit itself is complete and free; you don’t need Pro.