Reversible switches
28Applied live through WordPress hooks. The plugin stores which switches are on and reapplies the behaviour on every request.
Turn one off and its behaviour disappears completely - nothing is left behind. Deactivating the plugin has the same effect, so uninstalling cleanly undoes every switch.
One-off actions
13
These change data or settings directly: deleting revisions, purging
transients, updating an option, removing readme.html.
Some cannot be undone. Each one states exactly what it will do, and anything that deletes data or changes visitor-facing behaviour is marked Review before applying and asks you to confirm.
Fixes that delete comments or write alt text work in batches so they cannot exhaust the request on a large site. The result message tells you when more remain - run the fix again to continue.
SEO
7| Fix | What it does | Kind |
|---|---|---|
| Allow search engines to index the site | Unticks Settings → Reading → “Discourage search engines from indexing this site”. | Action |
| Switch to SEO friendly permalinks | Sets the permalink structure to /%postname%/ and flushes rewrite rules. Old plain-permalink URLs keep working through WordPress' canonical redirect. |
Action Review |
| Advertise the XML sitemap in robots.txt | Appends a Sitemap: directive to the virtual robots.txt so crawlers discover your sitemap immediately. |
Switch |
| Output a canonical URL on every page | Adds <link rel="canonical"> when the theme and other plugins do not. Automatically stands down if a dedicated SEO plugin is active. |
Switch |
| Add Open Graph and Twitter Card tags | Generates og:title, og:description, og:image, og:url and Twitter Card tags from the current post so shared links render a rich preview. | Switch |
| Keep search results and 404s out of the index | Sends a noindex, follow robots tag on internal search result pages and 404 pages, which carry no crawlable value. |
Switch |
| Redirect attachment pages to the parent post | Attachment pages are near-empty duplicates. This 301-redirects them to the post they belong to, or to the file itself when orphaned. | Switch |
Performance
9| Fix | What it does | Kind |
|---|---|---|
| Remove the emoji script | Drops wp-emoji-release.min.js and its inline detection script. Modern browsers render emoji natively. |
Switch |
| Cap stored post revisions at 5 | Keeps the five most recent revisions per post from now on, so the posts table stops growing unchecked. Existing revisions are untouched. | Switch |
| Delete old revisions (keep the latest 5) | Permanently removes revision rows beyond the five most recent for each post. Published content is never touched. | Action Review |
| Purge expired transients | Deletes transient rows whose expiry has already passed. These are caches; WordPress regenerates them on demand. | Action |
| Empty spam comments and trashed content | Permanently deletes comments marked as spam or trash, and posts sitting in the trash. | Action Review |
| Throttle the Heartbeat API | Disables Heartbeat on the front end and slows it to one request per 60 seconds in the admin, cutting background admin-ajax load. | Switch |
| Disable pingbacks and self-pings | Removes the XML-RPC pingback methods, drops the X-Pingback header and stops your posts pinging themselves. |
Switch |
| Stop loading Dashicons for logged-out visitors | Dashicons is an admin icon font. It stays loaded for logged-in users (the toolbar needs it) and is dropped for everyone else. | Switch Review |
| Optimise database tables | Runs OPTIMIZE TABLE on tables carrying free-space overhead, reclaiming disk space and tightening indexes. |
Action Review |
Core Web Vitals
4| Fix | What it does | Kind |
|---|---|---|
| Prioritise the Largest Contentful Paint image | Marks the first in-content image with fetchpriority="high" and removes its lazy-loading attribute so the hero image starts downloading immediately. |
Switch |
| Add missing width and height to content images | Reserves layout space for images that ship without dimensions, which is the most common cause of Cumulative Layout Shift. | Switch |
Force font-display: swap on Google Fonts |
Appends &display=swap to Google Fonts requests so text paints in a fallback font instead of staying invisible. |
Switch |
| Preconnect to the Google Fonts hosts | Opens the TLS connection to fonts.googleapis.com and fonts.gstatic.com early, shaving a round trip off font delivery. Only emitted when Google Fonts are actually enqueued. | Switch |
Accessibility
4| Fix | What it does | Kind |
|---|---|---|
| Fill in missing image alt text | For every media library image with no alt text, derives a readable description from the image title or filename. Review and refine afterwards - generated text is a starting point, not a substitute for a real description. | Action Review |
| Add a “Skip to content” link | Injects a keyboard-only skip link at the top of the page so screen reader and keyboard users can jump past the navigation. | Switch |
| Re-enable pinch zoom | Strips user-scalable=no and maximum-scale from the viewport meta tag. Blocking zoom is a WCAG 1.4.4 failure. |
Switch |
| Add titles to untitled iframes | Gives embedded iframes in post content a descriptive title attribute so assistive technology can announce them. |
Switch |
Security
6| Fix | What it does | Kind |
|---|---|---|
| Send hardening response headers | Adds X-Content-Type-Options, X-Frame-Options: SAMEORIGIN, Referrer-Policy and a conservative Permissions-Policy to front-end responses. | Switch |
| Disable XML-RPC | Turns off the legacy XML-RPC endpoint, a persistent target for brute-force amplification. Disable this fix if you use the WordPress mobile app or Jetpack. | Switch Review |
| Hide the WordPress version | Removes the generator meta tag, the RSD/WLW discovery links and the version query string appended to asset URLs. | Switch |
| Disable the theme and plugin file editors | Defines DISALLOW_FILE_EDIT so a compromised admin account cannot execute PHP through the dashboard editor. |
Switch |
| Block username enumeration | Stops ?author=1 scans and hides the REST users endpoint from logged-out visitors, so bots cannot harvest login names. |
Switch Review |
| Remove readme.html and license.txt | Deletes the publicly readable core files that disclose your exact WordPress version. WordPress restores them on the next core update; re-run this fix afterwards. | Action |
Mobile usability
1| Fix | What it does | Kind |
|---|---|---|
| Add a responsive viewport meta tag | Outputs width=device-width, initial-scale=1 so mobile browsers stop rendering the page at desktop width. Only enable this when the audit reports the tag as missing - the plugin cannot tell whether your theme adds one later, and two viewport tags is worse than one. |
Switch |
User experience
3| Fix | What it does | Kind |
|---|---|---|
| Create and assign a Privacy Policy page | Creates WordPress' draft privacy policy page and sets it as the site privacy page. Publish it once you have reviewed the wording. | Action |
| Turn off comments on media attachments | Attachment pages attract spam and are never a place visitors intend to comment. | Switch |
| Require approval for comments with links | Holds any comment containing two or more links for moderation and closes comments on posts older than 90 days. | Action Review |
WooCommerce
6| Fix | What it does | Kind |
|---|---|---|
| Load cart fragments only where they are needed | The cart-fragments AJAX call fires on every page load and is one of the heaviest costs in a default WooCommerce install. This restricts it to cart, checkout and product pages. Skip if your header shows a live cart count site-wide. | Switch Review |
| Drop WooCommerce CSS/JS on non-shop pages | Removes the WooCommerce stylesheets and scripts from pages that contain no store content. Skip if you use Woo shortcodes or blocks inside ordinary pages. | Switch Review |
| Hide WooCommerce marketplace suggestions | Stops WooCommerce fetching and rendering extension adverts in the admin, removing a recurring external request. | Switch |
| Force secure checkout | Enables WooCommerce's “Force secure checkout” option so cart, checkout and account pages are served over HTTPS only. | Action |
| Disable the legacy WooCommerce REST API | Switches off the deprecated /wc-api/ endpoints. Only keep them if an old integration still depends on them. |
Action Review |
| Dismiss the demo store notice | Removes the site-wide “This is a demo store” banner that WooCommerce shows while the store notice is enabled. | Action |
Fixes worth pausing over
- Disable XML-RPC - breaks the WordPress mobile app, Jetpack and any remote publishing tool that relies on it.
- Switch to SEO friendly permalinks - only safe on a site that has not yet been indexed with its current structure. On an established site, changing permalinks without redirects loses your rankings.
- Load cart fragments only where needed - if your header shows a live cart count on every page, that count will stop updating without a page load.
- Drop WooCommerce CSS/JS on non-shop pages - check first that no ordinary page uses a Woo shortcode or block. Test a few pages after enabling it.
- Fill in missing image alt text - generated from filenames and titles, so it is a placeholder, not a description. Review the wording in the Media Library afterwards; bad alt text is worse for a screen reader user than none.
- Delete old revisions / Empty spam and trash - permanent. Nothing goes to the trash; it is gone.
After applying a fix
Load your homepage, a post and - on a store - a product, the cart and the checkout, in a logged-out browser window. Then re-run the audit; the cached copy of your markup is discarded automatically whenever a fix is applied, so the next run measures the real result.
Undoing everything
Turn every switch off on the One-Click Fixes screen, or simply deactivate the plugin - switches stop applying immediately. One-off actions cannot be undone from the plugin; restore from your backup if you need to reverse one.