Header Junk Remover
Header Junk Remover is a lightweight, no-settings plugin that cleans up the <head> section and headers of your WordPress site.
It removes outdated tags, redundant links, bloated scripts, and unnecessary headers that WordPress adds by default. The result: cleaner source code, faster page loads, less information leakage, and fewer HTTP requests.
What gets removed (and why it matters):
-
RSD Link remove_action(‚wp_head‘, ‚rsd_link‘); Used for Really Simple Discovery (old remote editing). Not needed anymore.
-
WordPress Generator remove_action(‚wp_head‘, ‚wp_generator‘); Hides your WP version. Avoids advertising it to bots/hackers.
-
Feed Links remove_action(‚wp_head‘, ‚feed_links‘, 2); remove_action(‚wp_head‘, ‚feed_links_extra‘, 3); Removes auto-added RSS/Atom feed links. If you don’t use feeds, these are pointless.
-
Relational Links (index, start, parent, adjacent posts) remove_action(‚wp_head‘, ‚index_rel_link‘); remove_action(‚wp_head‘, ’start_post_rel_link‘, 10, 0); remove_action(‚wp_head‘, ‚parent_post_rel_link‘, 10, 0); remove_action(‚wp_head‘, ‚adjacent_posts_rel_link‘, 10, 0); remove_action(‚wp_head‘, ‚adjacent_posts_rel_link_wp_head‘, 10, 0); Removes old “previous/next” link metadata almost no browsers or crawlers use.
-
Windows Live Writer Manifest remove_action(‚wp_head‘, ‚wlwmanifest_link‘); Dead tool support. Safe to remove.
-
Shortlink Tags/Headers remove_action(‚wp_head‘, ‚wp_shortlink_wp_head‘, 10, 0); remove_action(‚template_redirect‘, ‚wp_shortlink_header‘, 11); Shortlink system is obsolete. Removing reduces clutter.
-
REST API Discovery Link remove_action(‚wp_head‘, ‚rest_output_link_wp_head‘, 10); REST API still works, but no longer broadcast in headers.
-
oEmbed Discovery + Scripts remove_action(‚wp_head‘, ‚wp_oembed_add_discovery_links‘, 10); remove_action(‚wp_head‘, ‚wp_oembed_add_host_js‘); Prevents WordPress from advertising oEmbed endpoints and loading extra JS.
-
Resource Hints (dns-prefetch, preconnect) remove_action(‚wp_head‘, ‚wp_resource_hints‘, 2); Stops WP from auto-inserting DNS hints you may not control.
-
Emoji Scripts and Styles remove_action(‚wp_head‘, ‚print_emoji_detection_script‘, 7); remove_action(‚wp_print_styles‘, ‚print_emoji_styles‘); Removes redundant emoji JS/CSS. Browsers already handle emojis natively.
-
Global Styles (Block Editor/Gutenberg) remove_action(‚wp_head‘, ‚wp_enqueue_global_styles‘, 1); Prevents WP from injecting default CSS that bloats your source.
Extra Hardening:
-
Disable XML-RPC add_filter(‚xmlrpc_enabled‘, ‚__return_false‘); Blocks XML-RPC protocol (commonly abused in brute force/DDoS attacks).
-
Remove X-Pingback Header add_filter(‚wp_headers‘, function($headers) { unset($headers[‚X-Pingback‘]); return $headers; }); Stops WP from advertising its pingback URL.
-
Turn off PHP Exposure (optional) @ini_set(‚expose_php‘, ‚off‘); Prevents PHP version disclosure in server headers.
Why this matters:
- Less clutter in your
<head> - Fewer HTTP requests and faster load times
- Less information leakage for bots/hackers
- Cleaner source code when you “View Source”
- Safer defaults without touching your theme files
If you find this plugin useful, consider supporting my work: 👉 Buy Me a Coffee