JPKCom Harden & Trim

Trim

Constants

AUTOSAVE_INTERVAL : mixed = $settings['autosave_interval']
DISALLOW_FILE_EDIT : mixed = true
JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES : mixed = 65536: Largest import accepted, in bytes (64 KB).

Functions

jpkcom_harden_trim_page_slug() : string: Slug of the settings page.
jpkcom_harden_trim_field_label() : string: Short label of a setting.
jpkcom_harden_trim_field_description() : string: Description of a setting, with a warning wherever switching it on can break something.
jpkcom_harden_trim_standalone_hint() : string: Note for a field whose standalone JPKCom plugin is active.
jpkcom_harden_trim_choice_label() : string: Display name of one choice of an enum or int setting.
jpkcom_harden_trim_notice_messages() : array<string, string>: The messages the settings page shows after a redirect, by code.
jpkcom_harden_trim_notice_transient() : string: Name of the current user's notice transient.
jpkcom_harden_trim_notice_list_cap() : int: How many entries a notice list keeps.
jpkcom_harden_trim_redirect_with_notice() : never: Redirect back to the settings page with a message code, then stop.
jpkcom_harden_trim_changed_keys() : array<int, string>: Keys whose value differs between two settings arrays.
jpkcom_harden_trim_handle_save() : void: Store a settings form submission (admin_post_jpkcom_harden_trim_save).
jpkcom_harden_trim_handle_preset() : void: Apply a preset (admin_post_jpkcom_harden_trim_preset).
jpkcom_harden_trim_admin_menu() : void: Add Settings → Harden & Trim and hook its assets to that screen only.
jpkcom_harden_trim_enqueue_styles() : void: Enqueue the settings page stylesheet.
jpkcom_harden_trim_enqueue_scripts() : void: Enqueue the settings page script (preset confirmation).
jpkcom_harden_trim_plugin_action_links() : array<string|int, string>: Put a "Settings" link first in the plugin's row on the Plugins screen.
jpkcom_harden_trim_format_value() : string: A constant's value as shown next to a locked field.
jpkcom_harden_trim_display_value() : string: A setting's value as the settings page names it.
jpkcom_harden_trim_core_control_value() : array{value: mixed, other: string|null}: What a field locked by a core constant shows: the core value, read the way core reads it.
jpkcom_harden_trim_role_options() : array<string, string>: Roles offered as checkboxes: every role whose slug the store accepts.
jpkcom_harden_trim_render_notices() : void: Kill-switch, invalid-constant and redirect notices.
jpkcom_harden_trim_render_field() : void: One form-table row for one setting.
jpkcom_harden_trim_render_role_scope() : void: Which features honour the role exemption and which are global.
jpkcom_harden_trim_render_presets() : void: The presets section: what each preset sets, and one button per preset.
jpkcom_harden_trim_render_page() : void: Render Settings → Harden & Trim.
jpkcom_harden_trim_register_head_features() : void: Remove the head output of the active head features.
jpkcom_harden_trim_register_performance_features() : void: Register the hooks of the active performance features.
jpkcom_harden_trim_remove_emoji() : void: Remove the emoji detection script and styles for the current request.
jpkcom_harden_trim_filter_tinymce_plugins() : mixed: Drop the TinyMCE `wpemoji` plugin (classic editor and Classic block).
jpkcom_harden_trim_normalized_host() : string: Lowercase ASCII host of a URL without a leading `www.`.
jpkcom_harden_trim_url_path() : string: Lowercase path of a URL without trailing slashes ('' for the root).
jpkcom_harden_trim_sibling_site_paths() : array<int, string>: Paths of the other sites of a multisite installation on a host.
jpkcom_harden_trim_path_of_sibling() : bool: Whether a path below this site's base belongs to another site of the network.
jpkcom_harden_trim_is_self_link() : bool: Whether a URL points to this site (home or WordPress address).
jpkcom_harden_trim_filter_self_pings() : void: Remove links to this site from the pingback list (`pre_ping`, by reference).
jpkcom_harden_trim_rewrite_asset_src() : string: Hash or remove the `ver` query argument of an asset URL.
jpkcom_harden_trim_filter_asset_src() : mixed: `script_loader_src` / `style_loader_src` / `script_module_loader_src` callback.
jpkcom_harden_trim_strip_wp_embed_iframe() : string: Turn WordPress post-embed markup into its plain blockquote fallback.
jpkcom_harden_trim_filter_embed_html() : mixed: `embed_oembed_html` callback: strip WordPress embed iframes (cached and fresh).
jpkcom_harden_trim_embed_404() : void: Answer `/embed/` requests with the theme's 404.
jpkcom_harden_trim_oembed_proxy_no_discover() : mixed: Switch off oEmbed discovery for the editor's oEmbed proxy route.
jpkcom_harden_trim_dequeue_comment_reply() : void: Dequeue `comment-reply`; replies fall back to the `?replytocom=` reload.
jpkcom_harden_trim_dequeue_dashicons() : void: Dequeue `dashicons` for logged-out visitors.
jpkcom_harden_trim_dequeue_block_library_css() : void: Dequeue the block library CSS and the core per-block styles (classic themes only).
jpkcom_harden_trim_dequeue_global_styles() : void: Dequeue the global styles and the core block-supports / duotone CSS (classic themes only).
jpkcom_harden_trim_heartbeat_settings() : array<string, mixed>: Heartbeat settings for `optimized`: 120 s interval and minimal interval.
jpkcom_harden_trim_filter_heartbeat_settings() : mixed: `heartbeat_settings` callback.
jpkcom_harden_trim_heartbeat_disabled_handles() : array<int, string>: Script handles that print nothing while heartbeat is disabled.
jpkcom_harden_trim_filter_heartbeat_src() : mixed: `script_loader_src` callback for `heartbeat = disabled`.
jpkcom_harden_trim_filter_auth_check_load() : mixed: `wp_auth_check_load` callback for `heartbeat = disabled`.
jpkcom_harden_trim_revision_exempt_post_types() : array<int, string>: Post types whose revision count this plugin never changes.
jpkcom_harden_trim_revisions_to_keep() : int: Number of revisions to keep for a post.
jpkcom_harden_trim_filter_revisions_to_keep() : mixed: `wp_revisions_to_keep` callback.
jpkcom_harden_trim_register_privacy_features() : void: Register the hooks of the active privacy features.
jpkcom_harden_trim_is_author_enum_request() : bool: Whether a request is an author enumeration probe.
jpkcom_harden_trim_requested_url() : string: The requested URL exactly as core's redirect_canonical() builds it.
jpkcom_harden_trim_author_is_only_query_arg() : bool: Whether `author` is the only argument of the requested URL's query.
jpkcom_harden_trim_activitypub_answers_author() : bool: Whether the ActivityPub plugin itself answers this `?author=N` request.
jpkcom_harden_trim_author_enum_exempt() : bool: Whether an author enumeration probe is let through.
jpkcom_harden_trim_author_enum_guard_template() : mixed: `template_include` callback (PHP_INT_MAX): the exempted probe must get ActivityPub's own document.
jpkcom_harden_trim_block_author_enum() : void: `template_redirect` callback: answer author enumeration probes with a 404.
jpkcom_harden_trim_is_users_route() : bool: Whether a REST route is the users collection or anything below it.
jpkcom_harden_trim_filter_rest_users() : mixed: `rest_pre_dispatch` callback: 401 for unauthenticated users requests.
jpkcom_harden_trim_anonymize_oembed() : array<string, mixed>: Replace the author in oEmbed data by the site.
jpkcom_harden_trim_filter_oembed_response_data() : mixed: `oembed_response_data` callback.
jpkcom_harden_trim_filter_sitemap_provider() : mixed: `wp_sitemaps_add_provider` callback: drop the users provider.
jpkcom_harden_trim_is_browse_happy_url() : bool: Whether a URL is the Browse Happy API (http or https).
jpkcom_harden_trim_filter_browse_happy() : mixed: `pre_http_request` callback: short-circuit the Browse Happy request.
jpkcom_harden_trim_remove_events_widget() : void: `wp_dashboard_setup` callback: remove "WordPress Events and News".
jpkcom_harden_trim_local_avatar_data() : array<string, mixed>: Point avatar data at the plugin's local SVG.
jpkcom_harden_trim_filter_avatar_data() : mixed: `pre_get_avatar_data` callback: local avatar instead of Gravatar.
jpkcom_harden_trim_anonymize_ip() : string: Anonymise an IP address: IPv4 to /24, IPv6 to /48.
jpkcom_harden_trim_filter_comment_ip() : mixed: `pre_comment_user_ip` callback.
jpkcom_harden_trim_filter_comment_flood() : mixed: `wp_is_comment_flood` callback: flood check against the anonymised IP.
jpkcom_harden_trim_filter_comment_agent() : mixed: `pre_comment_user_agent` callback: store no user agent.
jpkcom_harden_trim_privacy_embed_src() : string: Rewrite one iframe src for privacy.
jpkcom_harden_trim_privacy_embed_html() : string: Rewrite the src of every YouTube and Vimeo iframe in a piece of HTML.
jpkcom_harden_trim_filter_embed_privacy() : mixed: `embed_oembed_html` callback.
jpkcom_harden_trim_filter_cover_embed() : mixed: `render_block_core/cover` callback for embedded background videos.
jpkcom_harden_trim_filter_oembed_proxy_response() : mixed: `rest_post_dispatch` callback: rewrite the oEmbed proxy's preview HTML.
jpkcom_harden_trim_filter_editor_settings() : mixed: `block_editor_settings_all` callback: hide the Openverse media category.
jpkcom_harden_trim_unregister_google_fonts() : void: `init` callback: unregister core's Google Fonts collection.
jpkcom_harden_trim_register_security_features() : void: Register the hooks of the active security features.
jpkcom_harden_trim_neutral_login_errors() : WP_Error: Replace the user-enumerating login errors by one neutral message.
jpkcom_harden_trim_filter_login_errors() : mixed: `wp_login_errors` callback, limited to the login form.
jpkcom_harden_trim_security_headers() : array<string, string>: Security response headers to send for the active settings.
jpkcom_harden_trim_send_security_headers() : void: `send_headers` callback: send the security headers on the front end.
jpkcom_harden_trim_remove_fingerprint_headers() : void: `send_headers` callback: drop `X-Powered-By` on the front end.
jpkcom_harden_trim_filter_app_passwords_for_user() : bool: `wp_is_application_passwords_available_for_user` callback for the `roles` mode.
jpkcom_harden_trim_register_sitewide_features() : void: Register the hooks of the active site-wide features.
jpkcom_harden_trim_is_xmlrpc_request() : bool: Whether the current request is being served by xmlrpc.php.
jpkcom_harden_trim_xmlrpc_fault_xml() : string: Build the XML-RPC fault sent in place of a served request.
jpkcom_harden_trim_xmlrpc_refuse() : void: `init` priority 0: reject XML-RPC requests with a 403 and an XML-RPC fault.
jpkcom_harden_trim_xmlrpc_server_class() : never: `wp_xmlrpc_server_class` callback, last resort: block the server class.
jpkcom_harden_trim_comments_close_rest_status() : mixed: Report comments and pings as closed in a REST post response.
jpkcom_harden_trim_comments_is_note_request() : bool: Whether a REST request on the comment routes is a block-editor Notes request.
jpkcom_harden_trim_comments_is_note_query() : bool: Whether a comment query asks for notes and nothing else.
jpkcom_harden_trim_comments_attach_rest_status() : void: `rest_api_init` callback: apply the REST status rewrite to every post type.
jpkcom_harden_trim_comments_remove_support() : void: `wp_loaded` callback: remove comment and trackback support from every post type.
jpkcom_harden_trim_comments_redirect_screen() : void: `admin_init` callback: redirect the comments screen to the dashboard.
jpkcom_harden_trim_comments_zero_counts() : object: `wp_count_comments` callback: report zero comments everywhere.
jpkcom_harden_trim_comments_short_circuit_query() : mixed: `comments_pre_query` callback: short-circuit every comment query except note-only ones.
jpkcom_harden_trim_comments_block_feed() : void: `template_redirect` priority 0: refuse the comment feeds.
jpkcom_harden_trim_comments_remove_menu() : void: `admin_menu` callback: remove the Comments entry from the admin menu.
jpkcom_harden_trim_comments_remove_admin_bar_node() : void: `admin_bar_menu` priority 999: remove the Comments node from the admin bar.
jpkcom_harden_trim_comments_rest_gate() : mixed: `rest_pre_dispatch` callback: close the REST comment routes to everything except block-editor Notes.
jpkcom_harden_trim_register_features() : void: Register the hooks of every feature group.
jpkcom_harden_trim_is_front_end() : bool: Whether the request renders the public site.
jpkcom_harden_trim_force_404() : void: Turn the main query into a plain 404 that the theme's 404 template renders.
jpkcom_harden_trim_import_max_size() : string: The import limit as the settings page names it ("64 KB").
jpkcom_harden_trim_export_payload() : array{plugin: string, schema: int, version: string, settings: array}: The export document.
jpkcom_harden_trim_export_headers() : array<string, string>: HTTP headers of the export download (besides nocache_headers()).
jpkcom_harden_trim_handle_export() : void: Send the export download (admin_post_jpkcom_harden_trim_export).
jpkcom_harden_trim_import_error_message() : string: The message for an import error code.
jpkcom_harden_trim_parse_import() : array{settings: array, applied: list, rejected: list}|WP_Error: Validate an import and merge it over the stored settings (writes nothing).
jpkcom_harden_trim_import_source() : string|WP_Error: The raw import from the request: an uploaded file, else pasted JSON.
jpkcom_harden_trim_handle_import() : void: Import settings (admin_post_jpkcom_harden_trim_import).
jpkcom_harden_trim_render_import_export() : void: The import / export section of the settings page.
jpkcom_harden_trim_schema_entry() : array<string, mixed>: Build one schema entry with every field present.
jpkcom_harden_trim_schema() : array<string, array<string, mixed>>: Every setting, in settings-page order (performance, head, privacy, security, roles).
jpkcom_harden_trim_defaults() : array<string, mixed>: Default value of every setting.
jpkcom_harden_trim_presets() : array{harmless: array, recommended: array, strict: array}: The three presets as overrides of the defaults.
jpkcom_harden_trim_preset_managed_keys() : array<int, string>: Keys a preset assigns a value to; every other key is never touched.
jpkcom_harden_trim_option_name() : string: Name of the option holding all settings.
jpkcom_harden_trim_sanitize_value() : array{valid: bool, value: mixed, dropped: list}: Validate one value against its schema entry.
jpkcom_harden_trim_sanitize_settings() : array{settings: array, rejected: list}: Coerce any input into a complete, valid settings array.
jpkcom_harden_trim_get_stored() : array<string, mixed>: The stored settings, sanitised and merged over the defaults.
jpkcom_harden_trim_constant_state() : array{name: string, defined: bool, valid: bool, value: mixed}: State of the plugin constant for one key (`JPKCOM_HARDEN_TRIM_<KEY>`).
jpkcom_harden_trim_core_lock() : array{name: string, value: mixed}|null: The core constant that locks a key, if it was defined before the plugin loaded.
jpkcom_harden_trim_locked_keys() : array<string, string>: Every key whose value the settings page cannot change.
jpkcom_harden_trim_kill_switch_state() : array{defined: bool, valid: bool, active: bool}: State of the kill switch `JPKCOM_HARDEN_TRIM_DISABLE_ALL`.
jpkcom_harden_trim_kill_switch() : bool: Whether the kill switch is on (no feature hooks at all).
jpkcom_harden_trim_invalid_constants() : array<int, string>: Names of plugin constants that are defined but hold an invalid value.
jpkcom_harden_trim_settings_cache() : array<string, mixed>|null: Holder of the effective-settings cache, one entry per site.
jpkcom_harden_trim_settings_reset_cache() : void: Forget the cached effective settings.
jpkcom_harden_trim_settings() : array<string, mixed>: The effective settings: valid plugin constant, else stored value, else default.
jpkcom_harden_trim_save_settings() : array{settings: array, rejected: list}: Sanitise and store a complete settings array.
jpkcom_harden_trim_apply_preset() : array{settings: array, changed: list}: Apply a preset to a settings array (does not store it).
jpkcom_harden_trim_user_roles() : array<int, string>: The roles a user holds for the role-based settings.
jpkcom_harden_trim_is_exempt() : bool: Whether a user is exempt from the role-scoped features.
jpkcom_harden_trim_is_active_value() : bool: Whether a value means "the feature does something".
jpkcom_harden_trim_feature_applies() : bool: Whether a feature acts for the current request.
jpkcom_harden_trim_activate() : void: Store the defaults on activation; never overwrites an existing option.

AUTOSAVE_INTERVAL


    public
        mixed
    AUTOSAVE_INTERVAL
    = $settings['autosave_interval']

DISALLOW_FILE_EDIT


    public
        mixed
    DISALLOW_FILE_EDIT
    = true

JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES

Largest import accepted, in bytes (64 KB).


    public
        mixed
    JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES
    = 65536

An export of every setting is about 1.5 KB.

jpkcom_harden_trim_page_slug()

Slug of the settings page.


    
                    jpkcom_harden_trim_page_slug() : string

Return values

string —

Menu slug.

jpkcom_harden_trim_field_label()

Short label of a setting.


    
                    jpkcom_harden_trim_field_label(string $key) : string

Parameters

$key : string: Setting key.

Return values

string —

Translated label, '' for an unknown key.

jpkcom_harden_trim_field_description()

Description of a setting, with a warning wherever switching it on can break something.


    
                    jpkcom_harden_trim_field_description(string $key) : string

Parameters

$key : string: Setting key.

Return values

string —

Translated description, '' for an unknown key.

jpkcom_harden_trim_standalone_hint()

Note for a field whose standalone JPKCom plugin is active.


    
                    jpkcom_harden_trim_standalone_hint(string $key) : string

JPKCom Disable XML-RPC and JPKCom Disable Comments define their version constant at load; while one of them is active, the matching switch here is redundant (both together are harmless). Information only: no notice, no link, nothing is changed.

Parameters

$key : string: Setting key.

Return values

string —

Translated hint, '' when not applicable.

jpkcom_harden_trim_choice_label()

Display name of one choice of an enum or int setting.


    
                    jpkcom_harden_trim_choice_label(string $key, string|int|bool|null $value) : string

Parameters

$key : string: Setting key.
$value : string|int|bool|null: Choice; null is the "WordPress default" option.

Return values

string —

Translated name.

jpkcom_harden_trim_notice_messages()

The messages the settings page shows after a redirect, by code.


    
                    jpkcom_harden_trim_notice_messages() : array<string, string>

Only the code travels in the URL; a code that is not listed here shows nothing, so a crafted link cannot put words in front of an administrator.

Return values

array<string, string> —

Code => translated message.

jpkcom_harden_trim_notice_transient()

Name of the current user's notice transient.


    
                    jpkcom_harden_trim_notice_transient() : string

Holds the key lists of the last save, preset or import for 60 seconds, so they never travel through the URL and no other user can read them.

Return values

string —

Transient name.

jpkcom_harden_trim_notice_list_cap()

How many entries a notice list keeps.


    
                    jpkcom_harden_trim_notice_list_cap() : int

Return values

int —

Maximum entries per list.

jpkcom_harden_trim_redirect_with_notice()

Redirect back to the settings page with a message code, then stop.


    
                    jpkcom_harden_trim_redirect_with_notice(string $code[, array<string, array<int, string>> $lists = array() ]) : never

Key lists (changed, rejected, locked) go to the user-scoped transient; the URL only carries the code and the number of changed keys. Each list keeps at most jpkcom_harden_trim_notice_list_cap() entries; how many were cut is kept under more, so a hostile import with thousands of unknown keys cannot bloat the transient or the notice.

Parameters

$code : string: A key of jpkcom_harden_trim_notice_messages().
$lists : array<string, array<int, string>> = array(): Key lists for the notice.

Return values

never

jpkcom_harden_trim_changed_keys()

Keys whose value differs between two settings arrays.


    
                    jpkcom_harden_trim_changed_keys(array<string, mixed> $before, array<string, mixed> $after) : array<int, string>

Parameters

$before : array<string, mixed>: Settings before.
$after : array<string, mixed>: Settings after.

Return values

array<int, string> —

Keys in the order of $after.

jpkcom_harden_trim_handle_save()

Store a settings form submission (admin_post_jpkcom_harden_trim_save).


    
                    jpkcom_harden_trim_handle_save() : void

Fields that were disabled because the active theme is a block theme are not submitted; they keep their stored value instead of falling back to the default. Locked keys keep theirs inside the store.

jpkcom_harden_trim_handle_preset()

Apply a preset (admin_post_jpkcom_harden_trim_preset).


    
                    jpkcom_harden_trim_handle_preset() : void

Only an exact preset name is accepted; anything else, or a preset that would change nothing, writes nothing.

jpkcom_harden_trim_admin_menu()

Add Settings → Harden & Trim and hook its assets to that screen only.


    
                    jpkcom_harden_trim_admin_menu() : void

jpkcom_harden_trim_enqueue_styles()

Enqueue the settings page stylesheet.


    
                    jpkcom_harden_trim_enqueue_styles() : void

jpkcom_harden_trim_enqueue_scripts()

Enqueue the settings page script (preset confirmation).


    
                    jpkcom_harden_trim_enqueue_scripts() : void

jpkcom_harden_trim_plugin_action_links()

Put a "Settings" link first in the plugin's row on the Plugins screen.


    
                    jpkcom_harden_trim_plugin_action_links(array<string|int, string> $links) : array<string|int, string>

Parameters

$links : array<string|int, string>: Action links.

Return values

array<string|int, string> —

Links with the settings link first.

jpkcom_harden_trim_format_value()

A constant's value as shown next to a locked field.


    
                    jpkcom_harden_trim_format_value(mixed $value) : string

Parameters

$value : mixed: Value.

Return values

string —

Plain text, not escaped.

jpkcom_harden_trim_display_value()

A setting's value as the settings page names it.


    
                    jpkcom_harden_trim_display_value(string $key, mixed $value) : string

Parameters

$key : string: Setting key.
$value : mixed: Value.

Return values

string —

Plain text, not escaped.

jpkcom_harden_trim_core_control_value()

What a field locked by a core constant shows: the core value, read the way core reads it.


    
                    jpkcom_harden_trim_core_control_value(string $key, mixed $value) : array{value: mixed, other: string|null}

The control of a core-locked field must show what is in effect, which is the core constant (core honours it and the feature code then does nothing), never the stored value or an ignored plugin constant. Core reads (7.1.3):

DISALLOW_FILE_EDIT: truthy disables the editors (capabilities.php:609).
WP_AI_SUPPORT: falsy disables AI (ai-client.php:23); the field is "Disable core AI features", so it is checked for a falsy value.
WP_POST_REVISIONS: true is unlimited, anything else is cast to int (revision.php:813-818); a negative number is unlimited as well, which is what "WordPress default" means for this field. 0 and the listed limits select their option.
AUTOSAVE_INTERVAL: seconds handed to the editor (script-loader.php:1962); 60 is core's own default (default-constants.php:381). A value no option names is returned as other, the text of an extra option the disabled select shows selected.

Parameters

$key : string: Setting key with a core constant.
$value : mixed: The core constant's value.

Return values

array{value: mixed, other: string|null} —

Control value; other is set when no option fits.

jpkcom_harden_trim_role_options()

Roles offered as checkboxes: every role whose slug the store accepts.


    
                    jpkcom_harden_trim_role_options() : array<string, string>

Return values

array<string, string> —

Slug => translated name.

jpkcom_harden_trim_render_notices()

Kill-switch, invalid-constant and redirect notices.


    
                    jpkcom_harden_trim_render_notices() : void

jpkcom_harden_trim_render_field()

One form-table row for one setting.


    
                    jpkcom_harden_trim_render_field(string $key, array<string, mixed> $settings, array<string, string> $locked[, array<string, mixed> $effective = array() ]) : void

Parameters

$key : string: Setting key. A field locked by a core constant shows the core value instead (see jpkcom_harden_trim_core_control_value()).
$settings : array<string, mixed>: Values the inputs show: stored for unlocked keys, effective for locked ones.
$locked : array<string, string>: Key => locking constant name.
$effective : array<string, mixed> = array(): Effective settings (filter applied); empty to skip the comparison.

jpkcom_harden_trim_render_role_scope()

Which features honour the role exemption and which are global.


    
                    jpkcom_harden_trim_render_role_scope() : void

jpkcom_harden_trim_render_presets()

The presets section: what each preset sets, and one button per preset.


    
                    jpkcom_harden_trim_render_presets() : void

jpkcom_harden_trim_render_page()

Render Settings → Harden & Trim.


    
                    jpkcom_harden_trim_render_page() : void

jpkcom_harden_trim_register_head_features()

Remove the head output of the active head features.


    
                    jpkcom_harden_trim_register_head_features(array<string, mixed> $settings) : void

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_register_performance_features()


    
                    jpkcom_harden_trim_register_performance_features(array<string, mixed> $settings) : void

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_remove_emoji()

Remove the emoji detection script and styles for the current request.


    
                    jpkcom_harden_trim_remove_emoji() : void

The deprecated print_emoji_styles() fallback is removed together with wp_enqueue_emoji_styles(): the latter normally unhooks the former, and left alone it would raise a deprecation notice. Idempotent.

jpkcom_harden_trim_filter_tinymce_plugins()

Drop the TinyMCE `wpemoji` plugin (classic editor and Classic block).


    
                    jpkcom_harden_trim_filter_tinymce_plugins(mixed $plugins) : mixed

Parameters

$plugins : mixed: TinyMCE plugin names.

Return values

mixed —

The list without wpemoji; anything else unchanged.

jpkcom_harden_trim_normalized_host()

Lowercase ASCII host of a URL without a leading `www.`.


    
                    jpkcom_harden_trim_normalized_host(string $url) : string

An internationalised host is converted to its punycode form when the intl extension is available, so bücher.example and xn--bcher-kva.example compare equal.

Parameters

$url : string: Absolute or protocol-relative URL.

Return values

string —

Host, or '' when the URL has none.

jpkcom_harden_trim_url_path()

Lowercase path of a URL without trailing slashes ('' for the root).


    
                    jpkcom_harden_trim_url_path(string $url) : string

Parameters

$url : string: URL.

Return values

string —

Path such as /site2, or ''.

jpkcom_harden_trim_sibling_site_paths()

Paths of the other sites of a multisite installation on a host.


    
                    jpkcom_harden_trim_sibling_site_paths(string $host) : array<int, string>

On the main site of a subdirectory network home_url() has no path, so host and path prefix alone would count every sibling site as "self". Every site with the same domain (with or without www.) except the current one is listed, in any network and any status: a path that belongs to another site is never the current site's. Cached per request, current site and host; empty on a single site.

Parameters

$host : string: Normalised host (see jpkcom_harden_trim_normalized_host()).

Return values

array<int, string> —

Lowercase paths without trailing slash, such as /site2.

jpkcom_harden_trim_path_of_sibling()

Whether a path below this site's base belongs to another site of the network.


    
                    jpkcom_harden_trim_path_of_sibling(string $host, string $path, string $base) : bool

Parameters

$host : string: Normalised host of the link.
$path : string: Lowercase link path without trailing slash.
$base : string: Lowercase path of this site's matching URL ('' for the host root).

Return values

bool —

True when a sibling site's path, deeper than $base, contains $path.

jpkcom_harden_trim_is_self_link()

Whether a URL points to this site (home or WordPress address).


    
                    jpkcom_harden_trim_is_self_link(string $url) : bool

Host and path prefix: the host is compared without scheme, www. and letter case, and the link's path must start with the path of home_url() or site_url() at a segment boundary. On a subdirectory multisite (or a second WordPress under a path) a link to a sibling site on the same host is therefore not a self ping. On the main site of such a network (home without a path) a link into the path of another site of the network is not a self ping either (see jpkcom_harden_trim_sibling_site_paths()); a single site is unaffected.

Parameters

$url : string: URL to check.

Return values

bool —

True for a link to this site.

jpkcom_harden_trim_filter_self_pings()

Remove links to this site from the pingback list (`pre_ping`, by reference).


    
                    jpkcom_harden_trim_filter_self_pings(array<int, mixed> &$links) : void

Parameters

$links : array<int, mixed>: Links about to be pinged.

jpkcom_harden_trim_rewrite_asset_src()

Hash or remove the `ver` query argument of an asset URL.


    
                    jpkcom_harden_trim_rewrite_asset_src(string $src, string $mode) : string

Only an argument named exactly ver is touched; every other argument and the fragment are kept byte for byte.

Parameters

$src : string: Asset URL.
$mode : string: hash, remove; anything else returns $src.

Return values

string —

Rewritten URL.

jpkcom_harden_trim_filter_asset_src()

`script_loader_src` / `style_loader_src` / `script_module_loader_src` callback.


    
                    jpkcom_harden_trim_filter_asset_src(mixed $src) : mixed

Front end only; non-string values (core may pass false) are returned as is.

Parameters

$src : mixed: Asset URL.

Return values

mixed —

Rewritten URL, or the value unchanged.

jpkcom_harden_trim_strip_wp_embed_iframe()

Turn WordPress post-embed markup into its plain blockquote fallback.


    
                    jpkcom_harden_trim_strip_wp_embed_iframe(string $html) : string

Removes every <iframe> carrying the wp-embedded-content class (also self-closing ones), so the hidden iframe no longer loads the remote page, and drops an inline style that hides the blockquote. Other iframes (YouTube and the like) are untouched.

Parameters

$html : string: Embed HTML.

Return values

string —

HTML without WordPress embed iframes.

jpkcom_harden_trim_filter_embed_html()

`embed_oembed_html` callback: strip WordPress embed iframes (cached and fresh).


    
                    jpkcom_harden_trim_filter_embed_html(mixed $html) : mixed

Parameters

$html : mixed: Embed HTML.

Return values

mixed —

Stripped HTML, or the value unchanged.

jpkcom_harden_trim_embed_404()

Answer `/embed/` requests with the theme's 404.


    
                    jpkcom_harden_trim_embed_404() : void

Runs at template_redirect priority 1. jpkcom_harden_trim_force_404() also clears is_embed and the post, so the template loader picks the 404 template instead of the embed card (theme-compat/embed.php renders while have_posts()). redirect_canonical() is told not to turn the 404 into a guessed redirect to the post.

jpkcom_harden_trim_oembed_proxy_no_discover()

Switch off oEmbed discovery for the editor's oEmbed proxy route.


    
                    jpkcom_harden_trim_oembed_proxy_no_discover(mixed $result[, mixed $server = null ][, mixed $request = null ]) : mixed

Keeps the editor preview consistent with the front end, where embed_oembed_discover is false. Whitelisted providers still work.

Parameters

$result : mixed: Dispatch short-circuit value, passed through.
$server : mixed = null: REST server.
$request : mixed = null: REST request.

Return values

mixed —

$result unchanged.

jpkcom_harden_trim_dequeue_comment_reply()

Dequeue `comment-reply`; replies fall back to the `?replytocom=` reload.


    
                    jpkcom_harden_trim_dequeue_comment_reply() : void

jpkcom_harden_trim_dequeue_dashicons()

Dequeue `dashicons` for logged-out visitors.


    
                    jpkcom_harden_trim_dequeue_dashicons() : void

Never deregistered: styles that depend on dashicons still pull it in.

jpkcom_harden_trim_dequeue_block_library_css()

Dequeue the block library CSS and the core per-block styles (classic themes only).


    
                    jpkcom_harden_trim_dequeue_block_library_css() : void

Core per-block style handles are wp-block-<name>. The block-theme check happens here, at print time, so a theme switch needs no re-registration.

jpkcom_harden_trim_dequeue_global_styles()

Dequeue the global styles and the core block-supports / duotone CSS (classic themes only).


    
                    jpkcom_harden_trim_dequeue_global_styles() : void

Covers the head output and the classic-theme on-demand path, where global styles are enqueued at wp_footer@1 and a placeholder in the head.

jpkcom_harden_trim_heartbeat_settings()

Heartbeat settings for `optimized`: 120 s interval and minimal interval.


    
                    jpkcom_harden_trim_heartbeat_settings(array<string, mixed> $settings) : array<string, mixed>

minimalInterval is the only value the block editor's forced interval( 10 ) respects; 120 s is the maximum core documents as safe for post locks. Higher values set by someone else are kept (heartbeat.js ignores a minimal interval above 600 s, so that is the cap).

Parameters

$settings : array<string, mixed>: Heartbeat settings.

Return values

array<string, mixed> —

Adjusted settings, unchanged unless optimized and not exempt.

jpkcom_harden_trim_filter_heartbeat_settings()

`heartbeat_settings` callback.


    
                    jpkcom_harden_trim_filter_heartbeat_settings(mixed $settings) : mixed

Parameters

$settings : mixed: Heartbeat settings.

Return values

mixed —

Adjusted settings, or the value unchanged when it is no array.

jpkcom_harden_trim_heartbeat_disabled_handles()

Script handles that print nothing while heartbeat is disabled.


    
                    jpkcom_harden_trim_heartbeat_disabled_handles() : array<int, string>

Mechanism (read from 7.1.3 script-loader.php, class-wp-dependencies.php, class-wp-scripts.php, edit-form-blocks.php and js/dist/editor.js):

Deregistering heartbeat is not an option: autosave and wp-auth-check depend on it, and WP_Dependencies::all_deps() then raises _doing_it_wrong for the missing dependency (since 6.9.1).
Instead the handles stay registered and resolvable, and script_loader_src returns '' for them. WP_Scripts::do_item() then returns before building the tag, so neither the file nor its inline before/after scripts are printed. That drops edit-form-blocks.php's inline wp.heartbeat.interval( 10 ), which would throw without heartbeat.js. Only the localized heartbeatSettings variable remains.
autosave goes too: its triggerSave() calls wp.heartbeat.connectNow() unguarded (Ctrl+S, slug blur in the classic editor). Every caller of wp.autosave in core checks wp.autosave first, and every core caller of wp.heartbeat outside autosave.js checks wp.heartbeat first.
The block editor (js/dist/editor.js) only uses heartbeat.send / heartbeat.tick hook actions and its own REST autosave, so it runs without heartbeat; wp-auth-check is also switched off via wp_auth_check_load, which removes its CSS and markup as well.

Return values

array<int, string> —

Script handles.

jpkcom_harden_trim_filter_heartbeat_src()

`script_loader_src` callback for `heartbeat = disabled`.


    
                    jpkcom_harden_trim_filter_heartbeat_src(mixed $src[, mixed $handle = '' ]) : mixed

Parameters

$src : mixed: Script URL.
$handle : mixed = '': Script handle.

Return values

mixed —

'' for the heartbeat handles, otherwise $src unchanged.

jpkcom_harden_trim_filter_auth_check_load()

`wp_auth_check_load` callback for `heartbeat = disabled`.


    
                    jpkcom_harden_trim_filter_auth_check_load(mixed $show) : mixed

Parameters

$show : mixed: Whether to load the authentication check.

Return values

mixed —

False while heartbeat is disabled for this user, otherwise $show.

jpkcom_harden_trim_revision_exempt_post_types()

Post types whose revision count this plugin never changes.


    
                    jpkcom_harden_trim_revision_exempt_post_types() : array<int, string>

The Site Editor types, so Site Editor history survives.

Return values

array<int, string> —

Post type slugs.

jpkcom_harden_trim_revisions_to_keep()

Number of revisions to keep for a post.


    
                    jpkcom_harden_trim_revisions_to_keep(int $num, WP_Post $post) : int

Exempt post types and post types without revision support keep the value core computed.

Parameters

$num : int: Value computed so far.
$post : WP_Post: Post.

Return values

int —

The setting, or $num.

jpkcom_harden_trim_filter_revisions_to_keep()

`wp_revisions_to_keep` callback.


    
                    jpkcom_harden_trim_filter_revisions_to_keep(mixed $num[, mixed $post = null ]) : mixed

Parameters

$num : mixed: Value computed so far.
$post : mixed = null: Post.

Return values

mixed —

The setting, or $num unchanged.

jpkcom_harden_trim_register_privacy_features()


    
                    jpkcom_harden_trim_register_privacy_features(array<string, mixed> $settings) : void

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_is_author_enum_request()

Whether a request is an author enumeration probe.


    
                    jpkcom_harden_trim_is_author_enum_request(array<string, mixed> $query, bool $logged_in, string $permalink_structure, bool $is_admin) : bool

Plain permalinks are left alone (there ?author=N is the real author link), as are logged-in users and the admin. Whether a probe is exempt (ActivityPub) is decided separately, see jpkcom_harden_trim_author_enum_exempt().

Parameters

$query : array<string, mixed>: Parsed request query vars.
$logged_in : bool: Whether a user is logged in.
$permalink_structure : string: The permalink structure option.
$is_admin : bool: Whether this is an admin request.

Return values

bool —

True for an anonymous ?author=N request with pretty permalinks.

jpkcom_harden_trim_requested_url()

The requested URL exactly as core's redirect_canonical() builds it.


    
                    jpkcom_harden_trim_requested_url() : string

7.1.3 canonical.php:69-73: scheme from is_ssl(), then the raw Host header and the raw REQUEST_URI, concatenated unchecked; no Host header, no URL. This is the $requested_url ActivityPub's Router::redirect_canonical() parses, so a Host header such as example.com# moves the whole REQUEST_URI into the fragment there. A non-string server value (no web SAPI sends one) gives '' as well.

Return values

string —

The URL, or '' when core builds none.

jpkcom_harden_trim_author_is_only_query_arg()

Whether `author` is the only argument of the requested URL's query.


    
                    jpkcom_harden_trim_author_is_only_query_arg(string $requested_url) : bool

Mirrors ActivityPub's own check in Router::redirect_canonical() (ActivityPub 9.3.1, class-router.php:300-330), input included: it takes the query of core's $requested_url (see jpkcom_harden_trim_requested_url(), not REQUEST_URI alone) with wp_parse_url(), parses it with wp_parse_args(), ignores activitypub and stamp, and suppresses core's redirect to /author// only when exactly one argument, author, remains. No query (also one hidden in a fragment by the Host header) or any further argument (also one WordPress ignores) lets that redirect through.

Parameters

$requested_url : string: The requested URL as core builds it.

Return values

bool —

True for ?author=N, optionally with activitypub/stamp.

jpkcom_harden_trim_activitypub_answers_author()

Whether the ActivityPub plugin itself answers this `?author=N` request.


    
                    jpkcom_harden_trim_activitypub_answers_author(array<string, mixed> $query, string $requested_url) : bool

ActivityPub (wordpress.org slug activitypub, read against 9.3.1) answers ?author=N with the actor document only when all of these hold, each decided by its own public API, never by a header test of ours:

\Activitypub\is_activitypub_request() (functions-request.php:70): ?activitypub, or an Accept header whose highest-quality type is activity+json or ld+json with the ActivityStreams profile (q-aware, q=0 refuses), plus its filter. Otherwise it does not suppress core's canonical redirect (class-router.php:301).
\Activitypub\should_negotiate_content() (functions-request.php:79): otherwise it renders the theme template (class-router.php:92).
author is the only argument in the query of the requested URL as core builds it from the Host header and REQUEST_URI (see jpkcom_harden_trim_author_is_only_query_arg()); otherwise core's redirect goes through.
\Activitypub\user_can_activitypub( N ) (functions-user.php:90): a user who is no actor gets no transformer (transformer/class-factory.php:109) and the theme renders the author archive.
The request reaches template_include, where ActivityPub renders its document (class-router.php:24). Core's template loader answers robots, favicon, feeds and trackbacks before that filter (template-loader.php:40-62), and sitemaps exit on template_redirect; a feed path such as /feed/?author=N keeps the raw query at author alone, yet core serves the author's feed (display name, by default the login). Any of their query vars (feed, tb, robots, favicon, sitemap, sitemap-stylesheet), from path, query or POST body, refuses.

The functions are looked up at call time. If any of them is missing (ActivityPub not loaded, or a version with a different API), the answer is false: an unknown ActivityPub is not trusted to answer.

Parameters

$query : array<string, mixed>: Parsed request query vars.
$requested_url : string: The requested URL as core builds it (jpkcom_harden_trim_requested_url()).

Return values

bool —

True when ActivityPub answers the request with its own document.

jpkcom_harden_trim_author_enum_exempt()

Whether an author enumeration probe is let through.


    
                    jpkcom_harden_trim_author_enum_exempt(array<string, mixed> $query, string $accept[, string $request_uri = '' ][, string $requested_url = '' ]) : bool

By default only when the ActivityPub plugin itself answers this very request with the actor document (see jpkcom_harden_trim_activitypub_answers_author()): then ?author=N is the actor ID other servers resolve, and ActivityPub publishes the actor's name by design. Every other probe, whatever its Accept header, gets the 404, because core would redirect it to /author//.

Parameters

$query : array<string, mixed>: Parsed request query vars.
$accept : string: The Accept request header (passed to the filter).
$request_uri : string = '': The raw REQUEST_URI (passed to the filter).
$requested_url : string = '': The requested URL as core builds it (jpkcom_harden_trim_requested_url()); '' never exempts.

Return values

bool —

True when the probe must not get the 404.

jpkcom_harden_trim_author_enum_guard_template()

`template_include` callback (PHP_INT_MAX): the exempted probe must get ActivityPub's own document.


    
                    jpkcom_harden_trim_author_enum_guard_template(mixed $template) : mixed

Added only for a request that was exempted because ActivityPub answers it. ActivityPub still falls back to the theme template on some paths it decides only while rendering: under Authorized Fetch an unsigned request gets status 401 and the theme template (9.3.1 class-router.php:211-215), which for ?author=N is the author archive with the user's name and nicename. ActivityPub's own templates live in its plugin directory (ACTIVITYPUB_PLUGIN_DIR); any other template turns the response into the 404 the probe would have got.

Parameters

$template : mixed: Template path chosen so far.

Return values

mixed —

The template, or the theme's 404 template.

jpkcom_harden_trim_block_author_enum()

`template_redirect` callback: answer author enumeration probes with a 404.


    
                    jpkcom_harden_trim_block_author_enum() : void

Reads the parsed request ($wp->query_vars), not $wp_query: WP_Query fills its own author from author_name on pretty author archives, which must keep working. The query is emptied (see jpkcom_harden_trim_force_404()), so the theme's 404 template renders and neither a feed nor a fallback index lists the author's posts; redirect_canonical() sees is_404() and has nothing to guess from.

jpkcom_harden_trim_is_users_route()

Whether a REST route is the users collection or anything below it.


    
                    jpkcom_harden_trim_is_users_route(string $route) : bool

Case-insensitive like core's route matching; a trailing slash is tolerated.

The anchor must keep core's semantics: WP_REST_Server::match_request_to_handler() (7.1.3 class-wp-rest-server.php:1172) matches with '@^' . $route . '$@i', no D modifier, so its $ also matches before a trailing "\n", and rest_api_loaded() only strips slashes (untrailingslashit()). Core therefore serves ?rest_route=/wp/v2/users%0A as the user list. Do not "tighten" this to \z: that would let exactly that request through.

Parameters

$route : string: REST route, e.g. /wp/v2/users/1.

Return values

bool —

True for /wp/v2/users and /wp/v2/users/….

jpkcom_harden_trim_filter_rest_users()

`rest_pre_dispatch` callback: 401 for unauthenticated users requests.


    
                    jpkcom_harden_trim_filter_rest_users(mixed $result[, mixed $server = null ][, mixed $request = null ]) : mixed

Decided at dispatch time, after cookie+nonce and application-password authentication. An error set earlier (rate limit, another plugin) is kept; any other short-circuit result is replaced.

Parameters

$result : mixed: Short-circuit result so far (null to continue).
$server : mixed = null: REST server (unused).
$request : mixed = null: The request.

Return values

mixed —

The result, or a WP_Error with status 401.

jpkcom_harden_trim_anonymize_oembed()

Replace the author in oEmbed data by the site.


    
                    jpkcom_harden_trim_anonymize_oembed(array<string, mixed> $data) : array<string, mixed>

Parameters

$data : array<string, mixed>: oEmbed response data.

Return values

array<string, mixed> —

The data; only existing author keys are changed.

jpkcom_harden_trim_filter_oembed_response_data()

`oembed_response_data` callback.


    
                    jpkcom_harden_trim_filter_oembed_response_data(mixed $data) : mixed

Parameters

$data : mixed: oEmbed response data.

Return values

mixed —

The anonymised data, or the input when it is no array.

jpkcom_harden_trim_filter_sitemap_provider()

`wp_sitemaps_add_provider` callback: drop the users provider.


    
                    jpkcom_harden_trim_filter_sitemap_provider(mixed $provider[, mixed $name = '' ]) : mixed

Parameters

$provider : mixed: Sitemap provider.
$name : mixed = '': Provider name.

Return values

mixed —

False for users (core then skips it), else the provider.

jpkcom_harden_trim_is_browse_happy_url()

Whether a URL is the Browse Happy API (http or https).


    
                    jpkcom_harden_trim_is_browse_happy_url(string $url) : bool

Parameters

$url : string: Request URL.

Return values

bool —

True for api.wordpress.org/core/browse-happy/….

jpkcom_harden_trim_filter_browse_happy()

`pre_http_request` callback: short-circuit the Browse Happy request.


    
                    jpkcom_harden_trim_filter_browse_happy(mixed $pre[, mixed $args = array() ][, mixed $url = '' ]) : mixed

The error message is never shown (core only checks is_wp_error()), so it is not translated; translating here could load the text domain early.

Parameters

$pre : mixed: Short-circuit value so far (false to continue).
$args : mixed = array(): Request arguments (unused).
$url : mixed = '': Request URL.

Return values

mixed —

A WP_Error for the Browse Happy request, else $pre.

jpkcom_harden_trim_remove_events_widget()

`wp_dashboard_setup` callback: remove "WordPress Events and News".


    
                    jpkcom_harden_trim_remove_events_widget() : void

Without the widget its scripts never request events or news.

jpkcom_harden_trim_local_avatar_data()

Point avatar data at the plugin's local SVG.


    
                    jpkcom_harden_trim_local_avatar_data(array<string, mixed> $args) : array<string, mixed>

Parameters

$args : array<string, mixed>: Avatar data arguments.

Return values

array<string, mixed> —

The arguments with url and found_avatar set.

jpkcom_harden_trim_filter_avatar_data()

`pre_get_avatar_data` callback: local avatar instead of Gravatar.


    
                    jpkcom_harden_trim_filter_avatar_data(mixed $args) : mixed

Setting url makes get_avatar_data() return before it hashes the e-mail address. A URL another plugin already set is kept.

Parameters

$args : mixed: Avatar data arguments.

Return values

mixed —

The arguments.

jpkcom_harden_trim_anonymize_ip()

Anonymise an IP address: IPv4 to /24, IPv6 to /48.


    
                    jpkcom_harden_trim_anonymize_ip(string $ip) : string

An IPv4-mapped IPv6 address (::ffff:a.b.c.d, as dual-stack listeners report IPv4 clients) is anonymised as the IPv4 address it carries; keeping its first 48 bits would store :: for every such client. Core's sanitiser keeps commas and spaces (comment.php:2424), so a proxy list anonymises its first valid address.

Parameters

$ip : string: IP address, or a comma-separated list of them.

Return values

string —

The anonymised address, or '' when no valid IP is found.

jpkcom_harden_trim_filter_comment_ip()

`pre_comment_user_ip` callback.


    
                    jpkcom_harden_trim_filter_comment_ip(mixed $ip) : mixed

Re-checks the setting of the current site: after switch_to_blog() a comment stored on another site of the network follows that site's choice, not the one the request booted with.

Parameters

$ip : mixed: Commenter IP.

Return values

mixed —

The anonymised IP ('' for anything that is no IP), or $ip unchanged when the current site does not anonymise.

jpkcom_harden_trim_filter_comment_flood()

`wp_is_comment_flood` callback: flood check against the anonymised IP.


    
                    jpkcom_harden_trim_filter_comment_flood(mixed $is_flood[, mixed $ip = '' ][, mixed $email = '' ][, mixed $date = '' ][, mixed $avoid_die = false ]) : mixed

wp_check_comment_flood() (7.1.3 comment.php:909) looks for a recent comment with comment_author_IP = <live IP> or the same e-mail address. While comment_ip is on, stored rows hold the shortened address, so for guests only the e-mail clause would still match and a guest changing the e-mail address on every comment was never throttled. This runs the same core check once more with the shortened form, so the IP clause works again, per /24 (IPv4) or /48 (IPv6) network.

Skipped when core already found a flood, for logged-in users (core checks the user ID), when the IP is already in its stored form, and when the site removed core's flood check.

Parameters

$is_flood : mixed: Flood verdict so far.
$ip : mixed = '': Live commenter IP.
$email : mixed = '': Commenter e-mail address.
$date : mixed = '': GMT date of the new comment.
$avoid_die : mixed = false: Whether to return instead of calling wp_die().

Return values

mixed —

The verdict.

jpkcom_harden_trim_filter_comment_agent()

`pre_comment_user_agent` callback: store no user agent.


    
                    jpkcom_harden_trim_filter_comment_agent(mixed $agent) : mixed

Parameters

$agent : mixed: Commenter user agent.

Return values

mixed —

'' while the current site anonymises comments, else $agent.

jpkcom_harden_trim_privacy_embed_src()

Rewrite one iframe src for privacy.


    
                    jpkcom_harden_trim_privacy_embed_src(string $src) : string

YouTube (www. or bare host) moves to youtube-nocookie.com; a Vimeo player URL gets dnt=1, and an existing dnt parameter with any other value (dnt=0 keeps tracking on) is set to 1. The separator follows the src's own escaping (&, & or &) and the parameter goes before a fragment.

Parameters

$src : string: Raw attribute value.

Return values

string —

The rewritten value.

jpkcom_harden_trim_privacy_embed_html()

Rewrite the src of every YouTube and Vimeo iframe in a piece of HTML.


    
                    jpkcom_harden_trim_privacy_embed_html(string $html) : string

Only src attributes of <iframe> tags are touched; links and text stay as they are. Idempotent.

Parameters

$html : string: Embed or block HTML.

Return values

string —

The rewritten HTML.

jpkcom_harden_trim_filter_embed_privacy()

`embed_oembed_html` callback.


    
                    jpkcom_harden_trim_filter_embed_privacy(mixed $html) : mixed

Parameters

$html : mixed: Embed HTML.

Return values

mixed —

The rewritten HTML, or the input when it is no string.

jpkcom_harden_trim_filter_cover_embed()

`render_block_core/cover` callback for embedded background videos.


    
                    jpkcom_harden_trim_filter_cover_embed(mixed $content[, mixed $block = array() ]) : mixed

Parameters

$content : mixed: Rendered block HTML.
$block : mixed = array(): Parsed block.

Return values

mixed —

The rewritten HTML for embed-video covers, else the input.

jpkcom_harden_trim_filter_oembed_proxy_response()

`rest_post_dispatch` callback: rewrite the oEmbed proxy's preview HTML.


    
                    jpkcom_harden_trim_filter_oembed_proxy_response(mixed $result[, mixed $server = null ][, mixed $request = null ]) : mixed

Covers fresh and cached proxy responses; the cached copy itself is not changed.

Parameters

$result : mixed: REST response.
$server : mixed = null: REST server (unused).
$request : mixed = null: The request.

Return values

mixed —

The response.

jpkcom_harden_trim_filter_editor_settings()

`block_editor_settings_all` callback: hide the Openverse media category.


    
                    jpkcom_harden_trim_filter_editor_settings(mixed $settings) : mixed

Parameters

$settings : mixed: Block editor settings.

Return values

mixed —

The settings.

jpkcom_harden_trim_unregister_google_fonts()

`init` callback: unregister core's Google Fonts collection.


    
                    jpkcom_harden_trim_unregister_google_fonts() : void

Checked first, because unregistering a collection that is not registered (removed by another plugin) raises _doing_it_wrong. The check goes through the public get_font_collections(): WP_Font_Library::is_collection_registered() is private (7.1.3, class-wp-font-library.php:96) and calling it is a fatal Error.

jpkcom_harden_trim_register_security_features()


    
                    jpkcom_harden_trim_register_security_features(array<string, mixed> $settings) : void

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_neutral_login_errors()

Replace the user-enumerating login errors by one neutral message.


    
                    jpkcom_harden_trim_neutral_login_errors(WP_Error $errors) : WP_Error

Only invalid_username, invalid_email and incorrect_password are replaced; codes from other plugins (two-factor, captcha, lockout) stay.

Parameters

$errors : WP_Error: Login errors.

Return values

WP_Error —

The same object with the mapped codes replaced.

jpkcom_harden_trim_filter_login_errors()

`wp_login_errors` callback, limited to the login form.


    
                    jpkcom_harden_trim_filter_login_errors(mixed $errors[, mixed $redirect_to = '' ]) : mixed

wp-login.php applies the filter in two places: the checkemail case and the login case (case 'login': default:, so every unknown action is a login request too). The lost-password flow does not use it, and checkemail never carries credential errors, so only that action is skipped; gating on login alone would let action=foo bypass the neutral message.

Parameters

$errors : mixed: Login errors.
$redirect_to : mixed = '': Redirect destination (unused).

Return values

mixed —

The errors, rewritten unless the action is checkemail.

jpkcom_harden_trim_security_headers()

Security response headers to send for the active settings.


    
                    jpkcom_harden_trim_security_headers(array<string, mixed> $settings, array<int, string> $already_sent, bool $is_ssl, bool $is_embed) : array<string, string>

A header whose name is already in $already_sent (set in PHP by core or another plugin) is never returned, so the plugin cannot override it. headers_list() only knows headers set in PHP: one added by the web server (nginx add_header, Apache mod_headers) or a CDN is invisible here and would be sent twice.

Parameters

$settings : array<string, mixed>: Effective settings.
$already_sent : array<int, string>: Raw headers_list() lines.
$is_ssl : bool: Whether the request is HTTPS.
$is_embed : bool: Whether the response is an embed.

Return values

array<string, string> —

Header name => value.

jpkcom_harden_trim_send_security_headers()

`send_headers` callback: send the security headers on the front end.


    
                    jpkcom_harden_trim_send_security_headers() : void

jpkcom_harden_trim_remove_fingerprint_headers()

`send_headers` callback: drop `X-Powered-By` on the front end.


    
                    jpkcom_harden_trim_remove_fingerprint_headers() : void

jpkcom_harden_trim_filter_app_passwords_for_user()

`wp_is_application_passwords_available_for_user` callback for the `roles` mode.


    
                    jpkcom_harden_trim_filter_app_passwords_for_user(mixed $available[, mixed $user = null ]) : bool

Registered from the booting site's settings, decided with the current site's: after switch_to_blog() a site whose mode is unchanged keeps core's answer and a disabled site denies.

Parameters

$available : mixed: Availability so far.
$user : mixed = null: The user checked.

Return values

bool —

True only when already available and the user holds an allowed role.

jpkcom_harden_trim_register_sitewide_features()


    
                    jpkcom_harden_trim_register_sitewide_features(array<string, mixed> $settings) : void

Nothing is registered for a switch that is off. Registered at plugin load (plugins_loaded priority 5), so the XML-RPC guard is in place before init.

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_is_xmlrpc_request()

Whether the current request is being served by xmlrpc.php.


    
                    jpkcom_harden_trim_is_xmlrpc_request() : bool

XMLRPC_REQUEST is defined at the top of xmlrpc.php (7.1.3 xmlrpc.php:13), before wp-load.php runs, so it is set for every request that reaches the endpoint and cannot be spoofed by the request. The standalone plugin derived it from $_SERVER['SCRIPT_FILENAME'] up to 1.0.8, which depends on how a SAPI fills that variable.

Return values

bool —

True when serving an XML-RPC request.

jpkcom_harden_trim_xmlrpc_fault_xml()

Build the XML-RPC fault sent in place of a served request.


    
                    jpkcom_harden_trim_xmlrpc_fault_xml() : string

A fault response keeps the refusal machine-readable for XML-RPC clients, which cannot parse an HTML error page. The fault string is the English literal, not a translation: the guard runs at init priority 0, before this plugin loads its text domain at init priority 1, and the body is read by machines. It is escaped like the standalone plugin's string.

Return values

string —

A complete XML-RPC methodResponse fault document (faultCode 403).

jpkcom_harden_trim_xmlrpc_refuse()

`init` priority 0: reject XML-RPC requests with a 403 and an XML-RPC fault.


    
                    jpkcom_harden_trim_xmlrpc_refuse() : void

The response is written here instead of being left to wp_die(). With XMLRPC_REQUEST defined, wp_die() dispatches to _xmlrpc_wp_die_handler(), which only emits anything when the global $wp_xmlrpc_server already exists (7.1.3 functions.php:4254), and xmlrpc.php creates that object after init (xmlrpc.php:82). That handler also never calls status_header(). Measured by the standalone plugin against 7.0.2: up to its 1.0.8 the endpoint answered HTTP 200 with an empty body.

Priority 0 puts it ahead of the text domain (1) and the updater (5), so a refused request does no further work.

jpkcom_harden_trim_xmlrpc_server_class()

`wp_xmlrpc_server_class` callback, last resort: block the server class.


    
                    jpkcom_harden_trim_xmlrpc_server_class(string $class) : never

Unreachable while the init guard is in place (xmlrpc.php:81 runs after init), and kept so that removing or short-circuiting the guard cannot silently re-enable the endpoint. status_header() is called explicitly because the XML-RPC die handler never sets one. These strings are translated: the text domain is loaded by then.

Parameters

$class : string: The XML-RPC server class name.

Return values

never

jpkcom_harden_trim_comments_close_rest_status()

Report comments and pings as closed in a REST post response.


    
                    jpkcom_harden_trim_comments_close_rest_status(mixed $response) : mixed

Removing post type support is not enough for post, page and attachment: WP_REST_Posts_Controller::get_item_schema() carries a hardcoded $fixed_schemas list for those three in which comments is always present (7.1.3 class-wp-rest-posts-controller.php:2552, :2586-2588); the post_type_supports() check applies only to other post types. The response therefore kept reporting the stored value, typically open.

The fields are rewritten rather than removed, so the block editor keeps the response shape it expects. A REST write can still store open, but it is inert: comments_open is filtered false and this reports closed.

Parameters

$response : mixed: Prepared response, a WP_REST_Response in practice.

Return values

mixed —

The response with both status fields set to closed.

jpkcom_harden_trim_comments_is_note_request()

Whether a REST request on the comment routes is a block-editor Notes request.


    
                    jpkcom_harden_trim_comments_is_note_request(WP_REST_Request $request) : bool

Notes (core since 6.9) are comments of type note, created and read through /wp/v2/comments. A request counts as a note request when

it targets the collection route and its type parameter is exactly note - the same strict comparison core's controller makes ('note' === $request['type']), for GET and POST alike;
it targets the item route /wp/v2/comments/<id> and that comment exists and is of type note (any method; core refuses to change a comment's type on update, 7.1.3 class-wp-rest-comments-controller.php:925).

The route is read from get_route() and matched the way core matches it (class-wp-rest-server.php:1172): case-insensitively, against the same [\d]+ item pattern, and with $ accepting a trailing newline as core's @^…$@i does. A trailing slash is tolerated as well. The ID is taken from the route because the URL parameters are not populated yet on rest_pre_dispatch: dispatch() applies the filter (:1079) before it matches the route (:1096), and a batch sub-request is passed with its URL parameters cleared (:1860-1866).

The controller itself does not use the ID in the route: it reads $request['id'] (class-wp-rest-comments-controller.php:435, :480, :873, :918, :1042, :1066), and get_param() prefers the JSON body, the form body and the query string to the URL parameters (class-wp-rest-request.php:362-384, :408-418). /wp/v2/comments/<note>?id=<n> would therefore load comment <n>. An item request with an id parameter is a note request only when that parameter is numeric and equal to the ID in the route. Read here, before routing, get_param( 'id' ) returns exactly the value core will prefer later, since the URL parameters are still empty.

Core's own permission checks still decide who may read or write notes.

Parameters

$request : WP_REST_Request: The request about to be dispatched.

Return values

bool —

True for a note request, false for anything else.

jpkcom_harden_trim_comments_is_note_query()

Whether a comment query asks for notes and nothing else.


    
                    jpkcom_harden_trim_comments_is_note_query(WP_Comment_Query $query) : bool

Mirrors how WP_Comment_Query::get_comment_ids() reads the requested types (7.1.3 class-wp-comment-query.php:776-789): type and type__in are merged, and an empty string means "all types". The query counts as a note query only when, after dropping those empty entries, exactly note remains. all, comment, an empty type, a mix such as [ 'note', 'comment' ] or a spelling core would not treat as a note (NOTE, note,comment) do not qualify.

Parameters

$query : WP_Comment_Query: The query about to run.

Return values

bool —

True when only notes are requested.

jpkcom_harden_trim_comments_attach_rest_status()

`rest_api_init` callback: apply the REST status rewrite to every post type.


    
                    jpkcom_harden_trim_comments_attach_rest_status() : void

Registered on rest_api_init because the filter name is per post type and every post type is registered by then.

jpkcom_harden_trim_comments_remove_support()

`wp_loaded` callback: remove comment and trackback support from every post type.


    
                    jpkcom_harden_trim_comments_remove_support() : void

Bound to wp_loaded, not admin_init: every post type is registered once init has completed (7.1.3 wp-settings.php:779 init, :801 wp_loaded), while admin_init and rest_api_init fire later. On admin_init (the standalone plugin up to 1.0.8) the removal never reached REST requests, so /wp/v2/posts kept reporting comment_status: open.

The two supports are checked independently: a post type may declare trackbacks without comments, and a nested check left those untouched.

jpkcom_harden_trim_comments_redirect_screen()

`admin_init` callback: redirect the comments screen to the dashboard.


    
                    jpkcom_harden_trim_comments_redirect_screen() : void

jpkcom_harden_trim_comments_zero_counts()

`wp_count_comments` callback: report zero comments everywhere.


    
                    jpkcom_harden_trim_comments_zero_counts(mixed $counts, mixed $post_id) : object

The dashboard's "At a Glance" widget builds its comment line from wp_count_comments() (filter at 7.1.3 comment.php:1529); with a non-zero count it linked to edit-comments.php, which is redirected away. A non-empty object also keeps core from running its own count query.

Parameters

$counts : mixed: Counts assembled so far, an empty array by default.
$post_id : mixed: Post ID the counts were requested for.

Return values

object —

Zeroed count object in the shape core expects.

jpkcom_harden_trim_comments_short_circuit_query()

`comments_pre_query` callback: short-circuit every comment query except note-only ones.


    
                    jpkcom_harden_trim_comments_short_circuit_query(mixed $comment_data, WP_Comment_Query $query) : mixed

comments_array only covers the template path. The dashboard Activity widget queries comments straight through WP_Comment_Query (filter at 7.1.3 class-wp-comment-query.php:441), which is why the full moderation list still appeared there. dashboard_recent_comments has not been a widget since WordPress 3.8, so removing that meta box does nothing.

Queries for block-editor Notes and nothing else pass through untouched (see jpkcom_harden_trim_comments_is_note_query()), so the Notes panel can list notes and core gets the real note count. Notes are not public: core leaves them out of every query that does not ask for them (:782-789), and out of comment_count (comment.php:3138).

Parameters

$comment_data : mixed: Short-circuit value, null by default.
$query : WP_Comment_Query: The query instance.

Return values

mixed —

0 for counting queries, an empty array otherwise; the incoming value for a note-only query.

jpkcom_harden_trim_comments_block_feed()

`template_redirect` priority 0: refuse the comment feeds.


    
                    jpkcom_harden_trim_comments_block_feed() : void

Comment feeds are assembled by WP_Query directly through $wpdb (only the comment_feed_* filters apply), so they bypass comments_array and comments_pre_query: approved comments stayed readable at /comments/feed/ and <post>/feed/. /feed/ is unaffected, because is_comment_feed() is false there.

Deliberately a wp_die( ..., 404 ) and not jpkcom_harden_trim_force_404(), as in the standalone plugin: while is_comment_feed() is true core routes it to _xml_wp_die_handler (7.1.3 functions.php:3866-3878), so the answer is a 404 XML error document, not the theme's 404 template.

jpkcom_harden_trim_comments_remove_menu()

`admin_menu` callback: remove the Comments entry from the admin menu.


    
                    jpkcom_harden_trim_comments_remove_menu() : void

jpkcom_harden_trim_comments_remove_admin_bar_node()

`admin_bar_menu` priority 999: remove the Comments node from the admin bar.


    
                    jpkcom_harden_trim_comments_remove_admin_bar_node(WP_Admin_Bar $wp_admin_bar) : void

Parameters

$wp_admin_bar : WP_Admin_Bar: The admin bar instance.

jpkcom_harden_trim_comments_rest_gate()

`rest_pre_dispatch` callback: close the REST comment routes to everything except block-editor Notes.


    
                    jpkcom_harden_trim_comments_rest_gate(mixed $result, mixed $server, mixed $request) : mixed

Up to Disable Comments 1.0.10 the /wp/v2/comments routes were removed on rest_endpoints. That also broke Notes, which core reads and writes through exactly those routes. The routes now stay registered, and this gate answers every request on them that is not a note request (see jpkcom_harden_trim_comments_is_note_request()) the way a missing route is answered: rest_no_route, core's own message (default text domain, so the translation is core's too) and status 404.

A request is on the comment routes when its route is /wp/v2/comments or lies below /wp/v2/comments/, compared case-insensitively as core does; ?rest_route= requests arrive with the same route. /wp/v2/commentsfoo and other namespaces are not touched.

PHP_INT_MAX, and a non-note request is answered even when an earlier filter already produced a result - that includes core's OPTIONS handler at priority 10 (7.1.3 rest-api.php:837), which would otherwise describe the route. For a note request the incoming value is returned unchanged.

The error is returned as a response, not as a WP_Error: in a batch request core passes a rest_pre_dispatch result straight on to rest_post_dispatch (class-wp-rest-server.php:1894), where rest_send_allow_header() calls get_matched_route() on it, which a WP_Error does not have. In a single request dispatch() returns the response as is - the same bytes as core's own missing-route answer.

Side effect: the route index at /wp-json/ lists the comment routes again; that is inherent to keeping them for Notes.

Parameters

$result : mixed: Response from an earlier filter, null by default.
$server : mixed: Server instance.
$request : mixed: The request about to be dispatched.

Return values

mixed —

The incoming value, or the 404 response.

jpkcom_harden_trim_register_features()


    
                    jpkcom_harden_trim_register_features(array<string, mixed> $settings) : void

Registrars only add hooks for features whose value is active; role decisions happen later, inside the callbacks, where the user is known.

Parameters

$settings : array<string, mixed>: Effective settings.

jpkcom_harden_trim_is_front_end()

Whether the request renders the public site.


    
                    jpkcom_harden_trim_is_front_end() : bool

Excludes the admin and REST requests: the block-editor settings REST route builds the editor canvas assets through _wp_get_iframed_editor_assets(), which fires wp_print_styles and wp_print_footer_scripts with is_admin() false.

Return values

bool —

True on the front end.

jpkcom_harden_trim_force_404()

Turn the main query into a plain 404 that the theme's 404 template renders.


    
                    jpkcom_harden_trim_force_404(WP_Query $query) : void

WP_Query::set_404() (7.1.3 class-wp-query.php:1843) resets the conditional flags but keeps is_feed, keeps is_embed (unknown to init_query_flags(), :502) and never touches the queried posts or the queried object. template-loader.php runs do_feed() while is_feed() is true and checks is_embed before is_404, and a theme without a 404 template falls back to its index, whose loop would still list the posts. So feed, embed, posts and queried object are cleared as well, together with the globals WP::register_globals() derived from them.

On a feed request WP::send_headers() (7.1.3 class-wp.php:471-476) has already set the feed Content-Type (application/rss+xml and the like) before template_redirect, so the HTML 404 page would go out under it. The Content-Type is then set back to what core sends for HTML pages (html_type; charset blog_charset, class-wp.php:468), unless the headers are already sent.

Parameters

$query : WP_Query: The main query, at template_redirect.

jpkcom_harden_trim_import_max_size()

The import limit as the settings page names it ("64 KB").


    
                    jpkcom_harden_trim_import_max_size() : string

Follows JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES, which wp-config.php may set.

Return values

string —

Formatted size.

jpkcom_harden_trim_export_payload()

The export document.


    
                    jpkcom_harden_trim_export_payload() : array{plugin: string, schema: int, version: string, settings: array}

Stored values only: no constant, no filter, no site URL, no user data.

Return values

array{plugin: string, schema: int, version: string, settings: array}

jpkcom_harden_trim_export_headers()

HTTP headers of the export download (besides nocache_headers()).


    
                    jpkcom_harden_trim_export_headers() : array<string, string>

The date in the filename is UTC, as in the other family plugins.

Return values

array<string, string> —

Header name => value.

jpkcom_harden_trim_handle_export()

Send the export download (admin_post_jpkcom_harden_trim_export).


    
                    jpkcom_harden_trim_handle_export() : void

jpkcom_harden_trim_import_error_message()

The message for an import error code.


    
                    jpkcom_harden_trim_import_error_message(string $code) : string

Only codes listed here produce text, so a code that reaches the notice from anywhere else shows nothing.

Parameters

$code : string: Error code.

Return values

string —

Translated message, '' for an unknown code.

jpkcom_harden_trim_parse_import()

Validate an import and merge it over the stored settings (writes nothing).


    
                    jpkcom_harden_trim_parse_import(string $raw) : array{settings: array, applied: list, rejected: list}|WP_Error

Every key in the file goes through the settings sanitiser on its own: a valid value is applied, an unknown key or an invalid value is rejected and the stored value stays, role slugs that do not exist on this site are dropped and reported as <key>:<slug>. Keys missing from the file keep their stored value.

Parameters

$raw : string: File or pasted content.

Return values

array{settings: array, applied: list, rejected: list}|WP_Error —

Complete settings to store, or an error with code too_large, invalid_json, wrong_plugin, unsupported_schema or no_settings.

jpkcom_harden_trim_import_source()

The raw import from the request: an uploaded file, else pasted JSON.


    
                    jpkcom_harden_trim_import_source() : string|WP_Error

A file wins over pasted text. The upload is only read when PHP itself received it (is_uploaded_file()); the client's file name and MIME type are never trusted.

Return values

string|WP_Error —

Raw content, or an error with code no_input, upload_failed or too_large.

jpkcom_harden_trim_handle_import()

Import settings (admin_post_jpkcom_harden_trim_import).


    
                    jpkcom_harden_trim_handle_import() : void

A failed import writes nothing and names the reason. A successful one stores every applied value, locked keys included; the notice counts the applied and rejected entries, lists the keys that changed, the rejected ones and the locked ones whose constant still wins.

jpkcom_harden_trim_render_import_export()

The import / export section of the settings page.


    
                    jpkcom_harden_trim_render_import_export() : void

jpkcom_harden_trim_schema_entry()

Build one schema entry with every field present.


    
                    jpkcom_harden_trim_schema_entry(string $type, mixed $default, string $group[, array<string, mixed> $extra = array() ]) : array<string, mixed>

Parameters

$type : string: One of bool, enum, int, roles.
$default : mixed: Default value on activation.
$group : string: Section: performance, head, privacy, security, roles.
$extra : array<string, mixed> = array(): Overrides for choices, nullable, role_scoped, core_constant, block_theme_unavailable, flags.

Return values

array<string, mixed> —

The complete entry.

jpkcom_harden_trim_schema()

Every setting, in settings-page order (performance, head, privacy, security, roles).


    
                    jpkcom_harden_trim_schema() : array<string, array<string, mixed>>

Flags drive the badges on the settings page: appearance (changes how the site looks), editors (changes the editing workflow), global (the role exemption does not apply), irreversible (effects that a later switch-off does not undo).

Return values

array<string, array<string, mixed>> —

Key => entry.

jpkcom_harden_trim_defaults()

Default value of every setting.


    
                    jpkcom_harden_trim_defaults() : array<string, mixed>

Return values

array<string, mixed> —

Key => default.

jpkcom_harden_trim_presets()

The three presets as overrides of the defaults.


    
                    jpkcom_harden_trim_presets() : array{harmless: array, recommended: array, strict: array}

A key a preset does not list gets its default when the preset is applied (see jpkcom_harden_trim_preset_managed_keys()).

Return values

array{harmless: array, recommended: array, strict: array}

jpkcom_harden_trim_preset_managed_keys()

Keys a preset assigns a value to; every other key is never touched.


    
                    jpkcom_harden_trim_preset_managed_keys() : array<int, string>

The excluded keys either have a break path no preset may switch on, or hold a decision only the site owner can make (role lists, application passwords, HSTS, feed discovery, comments). xmlrpc is managed: it is on in every preset, so no preset can reopen XML-RPC.

Return values

array<int, string> —

Keys in schema order.

jpkcom_harden_trim_option_name()

Name of the option holding all settings.


    
                    jpkcom_harden_trim_option_name() : string

Stored structure: ['schema' => 1, 'updated' => string, 'settings' => array].

Return values

string —

Option name.

jpkcom_harden_trim_sanitize_value()

Validate one value against its schema entry.


    
                    jpkcom_harden_trim_sanitize_value(string $key, mixed $value) : array{valid: bool, value: mixed, dropped: list}

Role lists are valid as soon as the type is right (array or comma string); entries that are no existing role slug are dropped and listed in dropped. Never throws.

Parameters

$key : string: Setting key.
$value : mixed: Raw value (form, import, constant, database).

Return values

array{valid: bool, value: mixed, dropped: list} —

value is null when invalid.

jpkcom_harden_trim_sanitize_settings()

Coerce any input into a complete, valid settings array.


    
                    jpkcom_harden_trim_sanitize_settings(mixed $input) : array{settings: array, rejected: list}

Missing keys get their default, invalid values fall back to the default, unknown keys are dropped. Rejected keys and dropped role slugs (<key>:<slug>) are reported. Never throws.

Parameters

$input : mixed: Value from the database, an import, a form or a filter.

Return values

array{settings: array, rejected: list}

jpkcom_harden_trim_get_stored()

The stored settings, sanitised and merged over the defaults.


    
                    jpkcom_harden_trim_get_stored() : array<string, mixed>

Return values

array<string, mixed> —

Key => stored value.

jpkcom_harden_trim_constant_state()

State of the plugin constant for one key (`JPKCOM_HARDEN_TRIM_<KEY>`).


    
                    jpkcom_harden_trim_constant_state(string $key) : array{name: string, defined: bool, valid: bool, value: mixed}

Parameters

$key : string: Setting key.

Return values

array{name: string, defined: bool, valid: bool, value: mixed} —

value is null unless valid.

jpkcom_harden_trim_core_lock()

The core constant that locks a key, if it was defined before the plugin loaded.


    
                    jpkcom_harden_trim_core_lock(string $key) : array{name: string, value: mixed}|null

Reads the snapshot taken by the main file, so a constant this plugin defines itself never counts as a lock.

Parameters

$key : string: Setting key.

Return values

array{name: string, value: mixed}|null —

Null when not locked.

jpkcom_harden_trim_locked_keys()

Every key whose value the settings page cannot change.


    
                    jpkcom_harden_trim_locked_keys() : array<string, string>

A core constant defined before the plugin loaded names the lock: core honours it and the feature code then does nothing, so it is what is in effect even when a plugin constant for the same key exists. Otherwise a valid plugin constant names the lock.

Return values

array<string, string> —

Key => constant name.

jpkcom_harden_trim_kill_switch_state()

State of the kill switch `JPKCOM_HARDEN_TRIM_DISABLE_ALL`.


    
                    jpkcom_harden_trim_kill_switch_state() : array{defined: bool, valid: bool, active: bool}

Parsed like every boolean setting constant, with filter_var( FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE ): the strings 'false', 'off', 'no' and '0' do not switch everything off. A value that is no boolean is ignored and named in the invalid-constants notice.

Return values

array{defined: bool, valid: bool, active: bool}

jpkcom_harden_trim_kill_switch()

Whether the kill switch is on (no feature hooks at all).


    
                    jpkcom_harden_trim_kill_switch() : bool

Return values

bool —

True when JPKCOM_HARDEN_TRIM_DISABLE_ALL holds a true boolean value.

jpkcom_harden_trim_invalid_constants()

Names of plugin constants that are defined but hold an invalid value.


    
                    jpkcom_harden_trim_invalid_constants() : array<int, string>

Such constants are ignored; the settings page names them in a notice. Covers the setting constants and the kill switch.

Return values

array<int, string> —

Constant names.

jpkcom_harden_trim_settings_cache()

Holder of the effective-settings cache, one entry per site.


    
                    jpkcom_harden_trim_settings_cache([string $op = 'get' ][, array<string, mixed>|null $value = null ]) : array<string, mixed>|null

Settings are per site (there is no network settings screen). Keyed by get_current_blog_id(), so after switch_to_blog() every reader gets the switched site's settings instead of the booting site's. reset forgets every site.

Parameters

$op : string = 'get': get, set or reset.
$value : array<string, mixed>|null = null: Value for set.

Return values

array<string, mixed>|null —

The current site's cached settings, null when empty.

jpkcom_harden_trim_settings_reset_cache()

Forget the cached effective settings.


    
                    jpkcom_harden_trim_settings_reset_cache() : void

jpkcom_harden_trim_settings()

The effective settings: valid plugin constant, else stored value, else default.


    
                    jpkcom_harden_trim_settings() : array<string, mixed>

The whole array then passes the jpkcom_harden_trim_settings filter and the sanitiser again. Core locks do not change the value here; the feature code skips acting when a core lock exists, because the core constant already wins inside core.

Return values

array<string, mixed> —

Key => effective value.

jpkcom_harden_trim_save_settings()

Sanitise and store a complete settings array.


    
                    jpkcom_harden_trim_save_settings(array<string, mixed> $input[, bool $keep_locked = true ]) : array{settings: array, rejected: list}

Keys missing from $input are stored with their default (a form sends every field; an unchecked role list sends nothing). Locked keys keep their stored value, whatever the input says, unless $keep_locked is false: an import stores what the file says for them too, and the constant still wins at runtime.

Parameters

$input : array<string, mixed>: Raw settings.
$keep_locked : bool = true: Whether locked keys keep their stored value.

Return values

array{settings: array, rejected: list} —

What was stored, and what was rejected.

jpkcom_harden_trim_apply_preset()

Apply a preset to a settings array (does not store it).


    
                    jpkcom_harden_trim_apply_preset(string $preset, array<string, mixed> $current) : array{settings: array, changed: list}

Every unlocked preset-managed key gets the preset's value or, if the preset does not list it, its default. All other keys stay as they are.

Parameters

$preset : string: harmless, recommended or strict.
$current : array<string, mixed>: Settings to start from.

Return values

array{settings: array, changed: list} —

New settings and the keys whose value changed.

jpkcom_harden_trim_user_roles()

The roles a user holds for the role-based settings.


    
                    jpkcom_harden_trim_user_roles(WP_User $user) : array<int, string>

On multisite WP_User::roles only lists the current site's roles, so a super admin without a role on a site has none there. Policy: a super admin counts as administrator on every site of the network, both for the exempt roles and for the application-password roles. On a single site is_super_admin() is not consulted.

Parameters

$user : WP_User: User.

Return values

array<int, string> —

Role slugs.

jpkcom_harden_trim_is_exempt()

Whether a user is exempt from the role-scoped features.


    
                    jpkcom_harden_trim_is_exempt([WP_User|null $user = null ]) : bool

With no exempt roles and no filter callback, the current user is never looked up, so the default settings cannot trigger an early user lookup. Never cached: the answer depends on the user and is decided per call.

Parameters

$user : WP_User|null = null: User to check; null means the current user.

Return values

bool —

True when the user holds an exempt role.

jpkcom_harden_trim_is_active_value()

Whether a value means "the feature does something".


    
                    jpkcom_harden_trim_is_active_value(string $key, mixed $value) : bool

Parameters

$key : string: Setting key.
$value : mixed: Value to judge.

Return values

bool —

True when the value switches the feature on.

jpkcom_harden_trim_feature_applies()

Whether a feature acts for the current request.


    
                    jpkcom_harden_trim_feature_applies(string $key) : bool

Active value, and for role-scoped keys a user who is not exempt. Feature modules call this inside their callbacks, where the user is known.

Parameters

$key : string: Setting key.

Return values

bool —

True when the feature should act.

jpkcom_harden_trim_activate()

Store the defaults on activation; never overwrites an existing option.


    
                    jpkcom_harden_trim_activate() : void

Trim

Table of Contents

Constants

Functions

Constants

AUTOSAVE_INTERVAL

DISALLOW_FILE_EDIT

JPKCOM_HARDEN_TRIM_IMPORT_MAX_BYTES

Tags

Functions

jpkcom_harden_trim_page_slug()

Tags

Return values

jpkcom_harden_trim_field_label()

Parameters

Tags

Return values

jpkcom_harden_trim_field_description()

Parameters

Tags

Return values

jpkcom_harden_trim_standalone_hint()

Parameters

Tags

Return values

jpkcom_harden_trim_choice_label()

Parameters

Tags

Return values

jpkcom_harden_trim_notice_messages()

Tags

Return values

jpkcom_harden_trim_notice_transient()

Tags

Return values

jpkcom_harden_trim_notice_list_cap()

Tags

Return values

jpkcom_harden_trim_redirect_with_notice()

Parameters

Tags

Return values

jpkcom_harden_trim_changed_keys()

Parameters

Tags

Return values

jpkcom_harden_trim_handle_save()

Tags

jpkcom_harden_trim_handle_preset()

Tags

jpkcom_harden_trim_admin_menu()

Tags

jpkcom_harden_trim_enqueue_styles()

Tags

jpkcom_harden_trim_enqueue_scripts()

Tags

jpkcom_harden_trim_plugin_action_links()

Parameters

Tags

Return values

jpkcom_harden_trim_format_value()

Parameters

Tags

Return values

jpkcom_harden_trim_display_value()

Parameters

Tags

Return values

jpkcom_harden_trim_core_control_value()

Parameters

Tags

Return values

jpkcom_harden_trim_role_options()

Tags

Return values

jpkcom_harden_trim_render_notices()

Tags

jpkcom_harden_trim_render_field()

Parameters

Tags