=== CodingCush Tweaks ===
Contributors: codingcush
Tags: disable xml-rpc, heartbeat control, upload limit, disable comments, disable emojis
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

20+ one-click fixes in one light plugin: disable XML-RPC, control Heartbeat, raise the upload limit, limit revisions, allow extra file types and more.

== Description ==

**One small plugin instead of ten abandoned ones.**

CodingCush Tweaks collects the fixes most WordPress sites end up needing and puts them behind clean on/off switches. Every tweak is a separate class that is only loaded when it is switched on, so the plugin costs nothing for the things you do not use.

It is a maintained replacement for several popular plugins that are no longer updated, including **Disable REST API**, **Heartbeat Control**, **Increase Maximum Upload File Size** and **WP Extra File Types**.

= Security =

* **Disable XML-RPC** – switch off the XML-RPC API, the X-Pingback header and the RSD link
* **Require login for the REST API** – visitors get a 401 from `/wp-json/`
* **Hide the WordPress version** – generator tag, feed version and `?ver=` on core assets
* **Disable the file editor** – no theme or plugin code editing from the admin
* **Stop user enumeration** – blocks `?author=1` scans and the public users endpoint
* **Generic login errors** – never confirm whether a username exists

= Performance =

* **Heartbeat control** – slow the interval, or disable it on the dashboard, outside the editor, or everywhere
* **Disable emoji scripts**
* **Disable oEmbed** (wp-embed script and discovery links)
* **Limit post revisions** – keep only the last N
* **Disable self-pingbacks**
* **Remove Dashicons for visitors**
* **Disable RSS feeds**

= Media & Uploads =

* **Change the maximum upload size** – with your real server limits shown next to it
* **Allow SVG uploads** – for administrators and editors only, every file sanitised on upload
* **Allow extra file types** – add any `extension mime/type` pair; executables are always refused
* **Keep original image size** – turn off the 2560px big-image scaling

= Admin & Editor =

* **Disable comments everywhere**
* **Use the classic editor for selected post types**
* **Stop automatic update emails**
* **Hide the admin bar for non-admins**
* **Clean up the dashboard**
* **Remove head clutter** – wlwmanifest, shortlink, REST link, adjacent-post links

= Built to stay out of your way =

* One autoloaded option, no extra database tables
* No admin notices, no upsells, no tracking, no external requests
* Settings page CSS and JS load on that page only
* Export and import your setup as JSON to reuse it on other sites
* Clean uninstall: removes its single option and nothing else

= Made by CodingCush =

Tutorials, project walkthroughs and more plugins at [codingcush.com](https://codingcush.com/).

== Installation ==

1. Upload the `codingcush-tweaks` folder to `/wp-content/plugins/`, or install it from Plugins → Add New.
2. Activate the plugin.
3. Go to **Settings → Tweaks**, switch on what you need, and save.

== Frequently Asked Questions ==

= Does this slow my site down? =

No. A tweak that is switched off is never loaded. The plugin reads one autoloaded option and registers only the hooks for enabled tweaks.

= I enabled "Require login for the REST API" and my contact form stopped working. =

Some form plugins, block themes and page builders call the REST API for visitors. Switch that tweak off, or keep it off on sites that depend on those plugins.

= The upload limit did not increase. =

WordPress can only enforce a limit up to what PHP allows (`upload_max_filesize` and `post_max_size`). The settings page shows your server's current values. Raising them needs a change in `php.ini`, `.htaccess` or `.user.ini`, or a request to your host.

= Is allowing SVG uploads safe? =

The tweak only allows SVG for users who can already post unfiltered HTML (administrators and editors), and every file is sanitised on upload: scripts, event handlers, external references, `foreignObject` and `use` elements are removed. Do not enable it on sites where you do not trust every editor.

= Can I move my settings to another site? =

Yes. Settings → Tweaks → Tools has Export and Import.

= Where do I report a bug or ask for a tweak? =

Use the support forum here on WordPress.org, or open an issue on GitHub.

== Screenshots ==

1. Security tweaks with a single switch each
2. Heartbeat control with per-screen options
3. Media & Uploads: upload limit with the real server limits shown, sanitised SVG, extra file types
4. Tools: export, import and a list of what is active

== Changelog ==

= 1.0.0 =
* First release with 23 tweaks across Security, Performance, Media & Uploads and Admin & Editor.

== Upgrade Notice ==

= 1.0.0 =
First release.
