Restrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
"Do Not Sell or Share My Personal Information" Link
Adds a [do_not_sell_link] shortcode for the opt-out link US state privacy laws such as the CCPA require; clicking it records the visitor's opt-out in a cookie and tells marketing scripts held back by consent snippets not to run.
Allow SVG Uploads for Administrators
Lets administrators upload SVG files to the Media Library. Files containing scripts, event handlers or javascript: links are rejected.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Click-to-Play YouTube Embeds
Shows a lightweight thumbnail instead of the full YouTube player until the visitor clicks play, saving around a megabyte of scripts per video.
Collapsible Transcript Shortcode for Audio and Video
Adds a [transcript] shortcode that wraps the text version of a podcast or video in an accessible show/hide section, so every recording can have a transcript without cluttering the page.
Defer Selected Scripts
Adds the defer attribute to the front-end scripts you list by handle, so they no longer block page rendering.
Delay Third-Party Scripts Until the Visitor Interacts
Holds back the scripts you list (chat widgets, heatmaps, social widgets) until the visitor first scrolls, taps, clicks or presses a key, or after a timeout, so they no longer slow down the initial page load.
Disable the Emoji Script and Styles
Removes the emoji detection script, inline styles and DNS prefetch that WordPress adds to every page. Browsers still display emoji natively.
Expose the Page Language to JavaScript
Adds a small window.wpideLang object with the current locale, language code and text direction, so your scripts can format dates, numbers or messages correctly without guessing.
Fast 404 for Missing Images, Scripts and Styles
Answers requests for missing images, CSS, JavaScript and font files with a tiny 404 instead of loading a full theme page, saving server time.
Find Insecure http:// Links in Content (WP-CLI)
Adds a "wp find-http-links" command that lists posts containing http:// images, scripts or links, marking which point to your own domain, to clean up mixed content after moving to HTTPS.
Hold Tracking Scripts Until the Visitor Consents
Turns the scripts you list by handle into inactive placeholders and only runs them after the visitor gives consent, through the WP Consent API when a consent plugin provides it or the simple wpide_consent cookie otherwise.
JSON Feed for Your Posts
Publishes your latest posts as a JSON Feed at /feed/json/, a modern alternative to RSS supported by many feed readers and easy to use from apps and scripts.
Keep Critical Scripts Out of WP Rocket's Delay JavaScript
Excludes scripts you list, such as a consent banner, chat widget or analytics loader, from WP Rocket's "Delay JavaScript execution" so they run right away.
Latin Slugs for Cyrillic, Greek and Other Scripts
Turns post and term titles written in Cyrillic, Greek, Georgian or other non-Latin scripts into readable Latin URL slugs (for example "Привет мир" becomes privet-mir) instead of long percent-encoded addresses.
List Enqueued Scripts and Styles in the Page Source
Prints an HTML comment at the bottom of each page, visible to administrators, listing every script and stylesheet handle loaded and its source, to find what to optimize.
Load Contact Form 7 Assets Only Where a Form Is Used
Keeps Contact Form 7 scripts and styles off every page except those that contain a form, removing two requests from most pages.
Load Social Media Post Embeds Only on Click
Holds back embedded posts from X (Twitter), Instagram, Facebook, TikTok and Threads behind a short notice, so their scripts and trackers only load when the visitor asks for them.
Load WooCommerce Assets Only on Shop Pages
Stops WooCommerce stylesheets and scripts from loading on pages that are not part of the store, such as blog posts and the about page.
Load a Script or Stylesheet Only on Selected Pages
Enqueues a JavaScript or CSS file only on the pages you list, instead of on every page, to keep the rest of the site fast.
Move Selected Scripts to the Footer
Moves the scripts you list from the page head to the footer, so they stop blocking the page from rendering.
Never Send the Referrer From Checkout and Account Pages
Sends a strict no-referrer policy on the WooCommerce checkout, order received and account pages, so order keys and other private URL details are never passed to third-party scripts or sites linked from there.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.