About this plugin
A dozen single-purpose plugins do what this one does — and most of them phone home. This one never does.
XO Magic Box Light is the maintenance layer nearly every WordPress site ends up needing: front-end performance, head cleanup, essential SEO, security hardening and the small tweaks you always apply anyway. Seven groups of switches in one fast admin screen, instead of a shelf of separate plugins each loading its own framework.
Every feature is a self-contained module, and a module that is switched off loads no code at all — the things you leave off cost you nothing at runtime.
There is no account, no subscription, no telemetry and not a single outbound request. Nothing in this plugin contacts any external server, ever.
It works alongside your cache plugin, not instead of it
A page cache makes WordPress send a page faster. This plugin makes the page itself lighter before anything caches it — fewer scripts, fewer third-party connections, less markup. The two jobs are different, so nothing here duplicates or fights your caching setup, and the dashboard detects other active cache and optimization plugins so you can see up front where features might overlap.
Faster pages
- Remove jQuery Migrate, asset query strings, front-end Dashicons and unused block-library CSS.
- Minify HTML, safely: pre, textarea, script, style and code blocks are never touched.
- Defer JavaScript, with an exclusion list.
- Delay JavaScript until the first interaction, matched by keyword — ideal for analytics, chat widgets and trackers.
- Preconnect hints for third-party origins, handed to WordPress’s own resource-hints pipeline, plus a preload list for your own critical assets.
- Speculative loading (prefetch/prerender) for near-instant navigation, configured through core’s own ruleset on WordPress 6.8+.
- Disable or relax Google Fonts, and force font-display: swap.
- Throttle the Heartbeat API, and send Last-Modified headers.
Better Core Web Vitals
- Preload the featured image as the LCP candidate, with a proper responsive srcset.
- Adjustable above-the-fold lazy-load threshold, so the first images are not lazy-loaded.
- Stop generating registered image sizes you never use, on future uploads.
- Control big-image scaling and the maximum upload dimension.
Cleanup
- Remove the generator meta tag, RSD/WLW links, shortlink, REST and oEmbed head links, and the recent-comments inline style.
- Disable emojis, embeds and the feeds you do not use.
- Limit or disable post revisions; keep trashed items instead of auto-purging them.
- Scheduled database cleanup, plus an on-demand cleanup that shows you how many rows each type would remove before it removes anything.
Essential SEO
- robots.txt editor.
- Noindex for paginated archives and post subpages.
- Noindex on staging and non-production environments, detected automatically.
- Attachment-page redirects and forced HTTPS, including a mixed-content fix.
- rel="noopener noreferrer" on external new-tab links, with optional nofollow.
- Disable the built-in search where a site does not need it.
Security hardening
- Limit login attempts, and unify login error messages so they stop confirming valid usernames.
- Block user enumeration.
- Disable XML-RPC, application passwords and the built-in file editor.
- Security headers, X-Powered-By removal and X-Pingback removal.
- Comment spam honeypot — no captcha, no JavaScript, no external service, cache-safe.
- Password-protect the whole front end behind one shared password, for staging and private previews.
Tweaks you would otherwise install plugins for
- Disable comments, the comment website field and self-pingbacks.
- Classic widgets, no remote block patterns, no block directory or Openverse.
- Local placeholder instead of Gravatar, so no visitor data reaches an avatar service.
- Clean up the admin bar and dashboard, remove rarely used widgets, show post and page IDs.
- Duplicate any post or page in one click.
- Auto-publish posts stuck on “Missed schedule”.
- Choose whether WordPress emails you about every auto-update, only failures, or never.
Change things without holding your breath
- Take a settings snapshot before risky changes, and restore it in one click.
- Curated one-click presets.
- Import and export the whole configuration.
- Conflict detection for other optimization and cache plugins.
What this plugin does not do
Being explicit saves everyone time:
- It is not a page cache. Use it together with your caching plugin.
- It does not minify or combine CSS and JavaScript, and does not generate critical CSS. HTML is the only thing minified here.
- It is not a full SEO suite. It handles indexing hygiene, not editorial SEO analysis.
- It is not a firewall or malware scanner. It hardens configuration; it does not police traffic.
- No backups, no SMTP delivery, no cookie banner, no image CDN.
Privacy
No telemetry, no analytics, no advertising, no remote account features, no licence checks, and no outbound HTTP requests of any kind. Everything happens on your own server. Settings live in a single autoloaded option; feature data lives in its own non-autoloaded rows so it never bloats the settings load.
Good fit for
- Site owners replacing several small maintenance plugins with one.
- Agencies standardising client sites, with presets and export/import.
- Shops and content sites working on Core Web Vitals.
- Shared hosting, where every avoided request matters.
- Cleaning up an inherited WordPress install.