About this plugin
Header Junk Remover is a lightweight, no-settings plugin that cleans up the <head> section and headers of your WordPress site.
It removes outdated tags, redundant links, bloated scripts, and unnecessary headers that WordPress adds by default. The result: cleaner source code, faster page loads, less information leakage, and fewer HTTP requests.
What gets removed (and why it matters):
-
RSD Link
remove_action(‘wp_head’, ‘rsd_link’);
Used for Really Simple Discovery (old remote editing). Not needed anymore.
-
WordPress Generator
remove_action(‘wp_head’, ‘wp_generator’);
Hides your WP version. Avoids advertising it to bots/hackers.
-
Feed Links
remove_action(‘wp_head’, ‘feed_links’, 2);
remove_action(‘wp_head’, ‘feed_links_extra’, 3);
Removes auto-added RSS/Atom feed links. If you don’t use feeds, these are pointless.
-
Relational Links (index, start, parent, adjacent posts)
remove_action(‘wp_head’, ‘index_rel_link’);
remove_action(‘wp_head’, ‘start_post_rel_link’, 10, 0);
remove_action(‘wp_head’, ‘parent_post_rel_link’, 10, 0);
remove_action(‘wp_head’, ‘adjacent_posts_rel_link’, 10, 0);
remove_action(‘wp_head’, ‘adjacent_posts_rel_link_wp_head’, 10, 0);
Removes old “previous/next” link metadata almost no browsers or crawlers use.
-
Windows Live Writer Manifest
remove_action(‘wp_head’, ‘wlwmanifest_link’);
Dead tool support. Safe to remove.
-
Shortlink Tags/Headers
remove_action(‘wp_head’, ‘wp_shortlink_wp_head’, 10, 0);
remove_action(‘template_redirect’, ‘wp_shortlink_header’, 11);
Shortlink system is obsolete. Removing reduces clutter.
-
REST API Discovery Link
remove_action(‘wp_head’, ‘rest_output_link_wp_head’, 10);
REST API still works, but no longer broadcast in headers.
-
oEmbed Discovery + Scripts
remove_action(‘wp_head’, ‘wp_oembed_add_discovery_links’, 10);
remove_action(‘wp_head’, ‘wp_oembed_add_host_js’);
Prevents WordPress from advertising oEmbed endpoints and loading extra JS.
-
Resource Hints (dns-prefetch, preconnect)
remove_action(‘wp_head’, ‘wp_resource_hints’, 2);
Stops WP from auto-inserting DNS hints you may not control.
-
Emoji Scripts and Styles
remove_action(‘wp_head’, ‘print_emoji_detection_script’, 7);
remove_action(‘wp_print_styles’, ‘print_emoji_styles’);
Removes redundant emoji JS/CSS. Browsers already handle emojis natively.
-
Global Styles (Block Editor/Gutenberg)
remove_action(‘wp_head’, ‘wp_enqueue_global_styles’, 1);
Prevents WP from injecting default CSS that bloats your source.
Extra Hardening:
-
Disable XML-RPC
add_filter(‘xmlrpc_enabled’, ‘__return_false’);
Blocks XML-RPC protocol (commonly abused in brute force/DDoS attacks).
-
Remove X-Pingback Header
add_filter(‘wp_headers’, function($headers) { unset($headers[‘X-Pingback’]); return $headers; });
Stops WP from advertising its pingback URL.
-
Turn off PHP Exposure (optional)
@ini_set(‘expose_php’, ‘off’);
Prevents PHP version disclosure in server headers.
Why this matters:
- Less clutter in your <head>
- Fewer HTTP requests and faster load times
- Less information leakage for bots/hackers
- Cleaner source code when you “View Source”
- Safer defaults without touching your theme files
If you find this plugin useful, consider supporting my work:
👉 Buy Me a Coffee