Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vuln...
Free
3M+ installs 4.9★ (8,862)
The Off Switch
Disable unused WordPress features and remove bloat. 104 toggles for performance, security hardening, and WooCommerce — pure PHP, no .
The facts
- Rating
- 5★ from 6
- Active installs
- 100+
- Price
- Free
- Last updated
- 12 Aug 2026
- Added
- Mar 2010
- Requires WP
- 5.0
- Tested up to
- WP 7.0.4
- Requires PHP
- 7.4
- Downloads
- 8,507
Our analysis
AI-assistedThe Off Switch is a WordPress plugin designed to help you disable unnecessary scripts and features that come with a standard WordPress installation. It allows you to manage what is loaded on your site, potentially improving performance and security by removing bloat that is not needed for most sites.
With a user-friendly interface, you can toggle various switches to disable specific scripts and features, such as emoji support, XML-RPC, and the Heartbeat API. This plugin suits WordPress users who want to optimise their site's performance and reduce unwanted overhead.
Best for: WordPress users looking to optimise site performance by removing unnecessary scripts.
What it does well
- ✓Allows disabling of 104 individual scripts and features
- ✓User-friendly interface with live counters and sticky controls
- ✓Functionally verified against WordPress 7.0
- ✓Helps improve performance by removing bloat
- ✓Free to use from the WordPress.org directory
Where it falls short
- •Limited information on specific use cases or benefits
- •No details on support or updates beyond August 2026
Verdict
The Off Switch provides a straightforward way to manage and disable unwanted WordPress features, making it suitable for those focused on site optimisation.
From the developer
Abhishek Deshpande's own description of The Off Switch, lightly tidied.
WordPress prioritises backwards compatibility.
That’s a feature. It also means every install ships with things you didn’t ask for.
An emoji CDN script. An oEmbed script. A Windows Live Writer manifest (discontinued 2017).
Dashicons loaded for logged-out visitors. Heartbeat polling every 15 seconds.
A version tag that tells the world exactly which WordPress you’re running.
None of these are bugs. They’re just not needed on most sites.
Disable what you don’t need. Keep what you do.
The Off Switch lets you disable each one, individually.
One screen, every switch
A live counter shows how many switches are on. A sticky bar keeps Save, the filter, and state chips (All / On / Off / Changed / New) in reach while you scroll. Changed switches are highlighted until you save, and an “unsaved changes” pill shows exactly what you’ve flipped before you commit. Jump between sections with live per-section counts, or copy a WP-CLI command that replicates your whole configuration on another site.
Every switch card states what it removes, what it saves, and what to watch out for. All 104 switches were functionally verified against a live WordPress 7.0 install for this release.
Bloat Remover
- Emoji script – ~15 KB + 1 HTTP request. Browsers handle emoji natively.
- Embed script – ~4 KB + oEmbed discovery links in
<head>. - RSD link – Really Simple Discovery. Only needed for legacy XML-RPC clients.
- WLW manifest – Windows Live Writer has been discontinued since 2017. WordPress 6.3 removed this link from core — the switch matters on WordPress 6.2 and older.
- WP version tag – Stops advertising your WordPress version to the world.
- Shortlink – Removes
<link rel="shortlink">from<head>and HTTP headers. Search engines ignore it. - Asset query strings – Strips
?ver=from scripts, styles, and WP 6.5+ Script Modules so CDNs and proxies cache correctly. - XML-RPC – Closes a common brute-force attack vector.
- XML-RPC Kill Requests – Goes further than disabling: hard-kills any incoming xmlrpc.php request with a 403 before WordPress loads at all.
- Heartbeat API – Reduces admin polling from every 15 s to every 60 s.
- Dashicons (frontend) – ~35 KB (CSS + font) saved for every logged-out visitor.
- REST API Discovery Link – Removes
<link rel="https://api.w.org/">from<head>. Safe to remove on standard sites. - RSS Feed Links – Removes feed autodiscovery
<link>tags from<head>. Modern browsers no longer act on them. Leave enabled if you publish an RSS feed. - Speculation Rules (WP 6.8+) – Disables the WP 6.8+ Speculation Rules API that prefetches links before users click. Can inflate analytics, increase server bandwidth, and trigger consent flows on unfetched pages.
- Disable All Feeds – Redirects all RSS and Atom feed URLs to the homepage. For sites with no RSS subscribers.
- Comment Auto-Links – Stops WordPress from converting plain-text URLs in comments into clickable links.
- Editor Autosave – Deregisters the autosave script that POSTs editor content to the server every 60 seconds. For teams that prefer explicit saves.
- DNS Prefetch – Removes all
<link rel="dns-prefetch">hints from<head>. Redundant when Emojis and Embeds are already disabled. - Recent Comments Inline CSS – WordPress outputs a small inline
<style>block in<head>whenever the Recent Comments widget is active. Remove it if your theme already styles the widget.
Script & Style Control
- jQuery Migrate – ~30 KB. Modern themes don’t need it.
- Block Library CSS – ~7 KB loaded on every page, even with no Gutenberg blocks.
- Global Styles (theme.json CSS) – 10-50 KB inline CSS from block themes.
- SVG Duotone Filters – Hidden SVG blob injected on every page, even with no duotone images. WordPress 6.3 made duotone output on-demand — the switch matters on WordPress 6.2 and older.
- Script/Style type attributes –
type="text/javascript"andtype="text/css"are redundant in HTML5. - Defer non-critical JavaScript – Adds
deferso scripts don’t block HTML parsing. jQuery is never deferred. - Move scripts to footer – Relocates enqueued scripts from
<head>to just before</body>. jQuery is never moved. - Template Output Buffering (WP 7.0) – Since WordPress 7.0, classic themes get every frontend page buffered in memory in full and re-parsed before a single byte reaches the visitor, so late-printed block styles can be hoisted into
<head>. Turning the buffer off restores streamed output for faster TTFB and lower peak memory. Block themes are unaffected.
WordPress Behaviour Tweaks
- Self-pingbacks – WordPress pings your own posts when you link between them – a wasted HTTP request that creates an unwanted comment on the target post.
- Capital P filter – WordPress corrects “WordPress” to “WordPress” on every rendered string. Remove if you don’t need the autocorrect.
- Limit post revisions – WordPress stores unlimited revisions per post. Caps revisions at 3 to prevent silent database growth on active editorial sites.
- Attachment pages – WordPress creates a full template page for every uploaded file. These waste crawl budget on most sites. Sends a 301 redirect to the parent post instead.
- Comments – Closes all comments and pingbacks site-wide, hides existing comments on the frontend, and removes comment-related UI from wp-admin (Comments menu, admin bar node, dashboard widget). Enable only if your site does not use comments.
- Search – Redirects all WordPress search queries (
/?s=) to the homepage with a 301, preventing bots from triggering repeated database queries. Also removes search forms rendered viaget_search_form(). Hardcoded forms in theme templates are not affected. - oEmbed Provider – WordPress registers a REST endpoint at
/wp-json/oembed/1.0/embedso other sites can embed your content via the oEmbed protocol. Remove it if you don’t want your content embeddable externally. Does not affect your ability to embed others’ content. - Post via Email – Removes the Post via Email configuration from Writing Settings and disables the feature. Almost no modern site uses email-to-post.
- Update Services (Ping-o-Matic) – Removes Update Services from Writing Settings and stops outbound pings to weblog ping services on every published post.
- Native XML Sitemap (WP 5.5+) – Disables WordPress’s built-in XML sitemap generator. Most sites use external SEO plugins (Yoast, Rank Math) for sitemaps instead. Removes unnecessary redirects and reduces crawl overhead (default OFF).
- oEmbed Auto-Embed – Disables WordPress from regex-scanning post content for [embed] shortcodes and oEmbed patterns on every frontend page load. For sites that do not embed external content, removing this filter saves processing overhead (default OFF).
Database & Query
- Expired Transients – Schedules a daily cleanup of expired transient rows in wp_options. Useful on low-traffic sites where WP-Cron can go days without firing.
- Abandoned Auto-Drafts – WordPress creates an auto-draft every time the post editor opens. Abandoned sessions leave these rows permanently. Runs a daily sweep to delete auto-drafts older than 30 days.
- Skip Row Count on Singles – On every single post or page, MySQL runs SQL_CALC_FOUND_ROWS to count total matching rows – a full index scan only needed for paginated archives. Removes that sub-query on all singular views.
- Adjacent Post Links – Older WordPress queries the previous and next post on every single post page to output
<link rel="prev/next">in<head>— two extra DB queries per page load. Google dropped support for these hints in 2019, and modern WordPress no longer outputs them; the switch matters on older installs. - Reduce Trash Retention – WordPress keeps trashed items for 30 days before permanent deletion. A daily sweep permanently deletes posts and comments trashed more than 7 days ago, keeping wp_posts leaner on active editorial sites without affecting normal recovery workflows.
Tagged as
platform
WooCommerce
quality
Security
Alternatives
Other plugins for securing a site.
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team....
Free
5M+ installs 4.7★ (4,983)
The best anti-spam protection to block spam comments and spam in a contact form. The most trusted antispam sol...
Free
5M+ installs 4.7★ (1,186)
Loginizer
93Loginizer is a WordPress security plugin which helps you fight against bruteforce attacks.
Free
1M+ installs 4.8★ (1,030)
Safe SVG
93Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
Free
1M+ installs 4.9★ (79)
Protect your website investment with All-In-One Security (AIOS) – a comprehensive and easy to use security plu...
Free
1M+ installs 4.7★ (1,715)