• Get application security done the right way! Detect, Protect, Monitor, Accelerate, and more…
  • When it comes to website performance, every byte and millisecond count.

    WordPress core is not heavy, but the themes, plugin you use may slow down the overall page load time. There are many techniques to speed up your WordPress website.

    For example:

    However, do you know there are many things included in WordPress core which you may not use it and take necessary action on them may cut down fa ew bytes to load the website faster.

    The following can be done in two ways, first, by using some plugin and second, by adding a few lines of code in functions.php.I prefer not to use a plugin if things can be done with the code addition/modification in an existing file.

    Best Practice

    Take a backup of the respective file you are going to modify so if something goes wrong; you can roll-back quickly.

    All the below codes to be added in functions.php unless specified differently.

    Remove Query Strings

    If you have analyzed your website for load time, then you might have come across a recommendation to eliminate query strings from static resources (CSS, JS files).

    Having query strings in the files may cause CDN not to cache the files; hence you may not be utilizing all caching benefits provided.

    To remove the query strings, add the following code.

    function remove_cssjs_ver( $src ) {
    if( strpos( $src, '?ver=' ) )
     $src = remove_query_arg( 'ver', $src );
    return $src;
    add_filter( 'style_loader_src', 'remove_cssjs_ver', 10, 2 );
    add_filter( 'script_loader_src', 'remove_cssjs_ver', 10, 2 );

    Remove RSD Links

    RSD (Really Simple Discovery) is needed if you intend to use XML-RPC client, pingback, etc. However, if you don’t need pingback or remote client to manage post then get rid of this unnecessary header by adding the following code.

    remove_action( 'wp_head', 'rsd_link' ) ;

    Disable Emoticons

    Remove extra code related to emojis from WordPress which was added recently to support emoticons in an older browser.

    remove_action('wp_head', 'print_emoji_detection_script', 7);
    remove_action('wp_print_styles', 'print_emoji_styles');
    remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
    remove_action( 'admin_print_styles', 'print_emoji_styles' );

    Remove Shortlink

    Starting from version 3, WordPress added shortlink (shorter link of web page address) in header code. For ex:

    <link rel='shortlink' href='https://geekflare.com/?p=187' />

    If not using shortlink for any functionality then you can remove them by adding below.

    remove_action('wp_head', 'wp_shortlink_wp_head', 10, 0);

    Disable Embeds

    WordPress introduced oEmbed features in 4.4 which allows any site to embed WordPress post remotely and it looks like this.

    By adding the following code, it will prevent others from embedding your blog post and disable loading related JS file.

    function disable_embed(){
    wp_dequeue_script( 'wp-embed' );
    add_action( 'wp_footer', 'disable_embed' );

    Disable XML-RPC

    Do you have a requirement to use WordPress API (XML-RPC) to publish/edit/delete a post, edit/list comments, upload file? Also having XML-RPC enabled and not hardened properly may lead to DDoS & brute force attacks.

    If you don’t need then disable it by adding below.

    add_filter('xmlrpc_enabled', '__return_false');

    Hide WordPress Version

    This doesn’t help in performance but more to mitigate information leakage vulnerability. By default, WordPress adds meta name generator with the version details which is visible in source code and HTTP header.

    To remove the WP version, add below code.

    remove_action( 'wp_head', 'wp_generator' ) ;

    Remove WLManifest Link

    Do you use tagging support with Windows live writer? If not remove it by adding below.

    remove_action( 'wp_head', 'wlwmanifest_link' ) ;

    Remove JQuery Migrate

    WordPress added JQuery migration from version 3.6. This is not needed if you are using the latest version of JQuery and themes/plugin are compatible with it. To remove jquery-migrate.min.js from loading, add below code.

    function deregister_qjuery() { 
     if ( !is_admin() ) {
    add_action('wp_enqueue_scripts', 'deregister_qjuery');

    Disable Self Pingback

    I don’t know why you need the self-pingback details on your blog post and I know it’s not just I get annoyed. If you are too then below code will help.

    function disable_pingback( &$links ) {
     foreach ( $links as $l => $link )
     if ( 0 === strpos( $link, get_option( 'home' ) ) )
    add_action( 'pre_ping', 'disable_pingback' );

    Disable or Limit Post Revisions

    Post revisions in WordPress are not new and helpful to restore the post if browser crash or lose the network. But ask yourself, how many times did it happen?

    By default, WordPress will save revisions for each draft or published a post, and this can bloat the database. You may either choose to disable it entirely or limit the number of revisions to be saved.

    Add the following in wp-config.php file

    To disable post revisions

    define('WP_POST_REVISIONS', false);

    To limit the number

    Let’s say limit to keep max two revisions

    define('WP_POST_REVISIONS', 2);

    Note: this must be above ABSPATH line else it won’t work.

    Disable Heartbeat

    WordPress use heartbeat API to communicate with a browser to a server by frequently calling admin-ajax.php. This may slow down the overall page load time and increase CPU utilization if on shared hosting.

    If you don’t have a requirement to use heartbeat API, then you can disable it by adding below.

    add_action( 'init', 'stop_heartbeat', 1 );
    function stop_heartbeat() {

    Disable Dashicons on Front-end

    Dashicons are utilized in the admin console, and if not using them to load any icons on front-end then you may want to disable it. By adding below, dashicons.min.css will stop loading on front-end.

    function wpdocs_dequeue_dashicon() {
            if (current_user_can( 'update_core' )) {
    add_action( 'wp_enqueue_scripts', 'wpdocs_dequeue_dashicon' );

    Disable Contact Form 7 JS/CSS

    Using Contact Form 7 and noticed their CSS/JavaScript files are getting loaded on every page? Well, you are not alone.

    The good news is you can stop loading it with below code.

    add_filter( 'wpcf7_load_js', '__return_false' );
    add_filter( 'wpcf7_load_css', '__return_false' );


    Above will help to reduce a few HTTP request and overall page size. All the codes are available on Github. If you are looking for a premium caching and performance optimization plugin, then check out WP Rocket.