Title: Prunekit Author: nimboo Published: October 23, 2026 Last modified: October 23, 2026 --- Search plugins ![](https://ps.w.org/prunekit/assets/banner-772x250.png?rev=3761418) ![](https://ps.w.org/prunekit/assets/icon.svg?rev=3761418) # Prunekit By [nimboo](https://profiles.wordpress.org/nimboo/) [Download](https://downloads.wordpress.org/plugin/prunekit.1.0.2.zip) * [Details](https://wordpress.org/plugins/prunekit/#description) * [Reviews](https://wordpress.org/plugins/prunekit/#reviews) * [Installation](https://wordpress.org/plugins/prunekit/#installation) * [Development](https://wordpress.org/plugins/prunekit/#developers) [Support](https://wordpress.org/support/plugin/prunekit/) ## Description WordPress ships with features many sites never use. Each one adds requests, database rows or attack surface. Prunekit lets you switch them off with simple toggles, without touching code. **Nothing changes when you activate Prunekit.** You choose what to turn off, or click “Apply recommended” to switch on only the options that are safe on every site. Every option shows a badge: _Safe_, _Check after enabling_ or _May break plugins_. #### Performance * Slow down the Heartbeat API or switch it off outside the post editor * Limit post revisions * Change the autosave interval #### Security * Disable XML-RPC and pingbacks * Hide the WordPress version * Hide the user list in the REST API (stops username enumeration via the REST API) * Restrict the REST API to logged-in users #### Clean-up * Remove emoji scripts and styles * Stop other sites from embedding your posts * Disable RSS feeds * Remove RSD and shortlink tags * Load Dashicons for logged-in users only #### Comments * Disable comments everywhere, including comment feeds and the REST comments endpoint( existing comments are kept, just hidden) Prunekit uses only WordPress’ own hooks. No external services, no tracking, no ads, no upsell nags. #### Prunekit Pro [Prunekit Pro](https://checkout.freemius.com/plugin/41768/plan/72542/) is an optional add-on with AI crawler rules, database cleanup, export/import of settings and REST route rules. Prunekit itself is complete and free; you don’t need Pro. ## Screenshots [⌊The settings page. Every option shows a risk badge, and nothing is switched on until you choose.⌉⌊The settings page. Every option shows a risk badge, and nothing is switched on until you choose.⌉[ The settings page. Every option shows a risk badge, and nothing is switched on until you choose. [⌊After clicking "Apply recommended": only the options that are safe on every site are switched on.⌉⌊After clicking "Apply recommended": only the options that are safe on every site are switched on.⌉[ After clicking “Apply recommended”: only the options that are safe on every site are switched on. [⌊The settings page on a phone.⌉⌊The settings page on a phone.⌉[ The settings page on a phone. ## Installation 1. Install Prunekit from Plugins Add New, or upload the zip. 2. Activate it. 3. Go to Settings Prunekit and turn on what you want — or click “Apply recommended”. ## FAQ ### Will activating Prunekit change my site? No. Every option is off until you turn it on. ### Which options are in “Apply recommended”? Limit revisions to 5, disable XML-RPC, hide the WordPress version, hide the REST user list, remove emoji scripts and remove RSD/shortlink tags. These are safe on virtually every site. ### Something broke after I turned an option on. What do I do? Turn the option off again, or click “Reset all”. Options marked _Check after enabling_ or _May break plugins_ depend on what your theme and other plugins use. ### Does disabling comments delete my comments? No. They are hidden and new comments are blocked. Turn the option off to show them again. ### Does limiting revisions delete old revisions? Not right away. Nothing is deleted when you turn the option on. The next time you update a post, WordPress removes that post’s oldest revisions above the limit. “ Keep none” stops new revisions and leaves existing ones in place. ### Can I still embed YouTube videos if I disable embeds? Yes. The option stops other sites from discovering and embedding your posts via oEmbed. It also removes the script used when you embed other WordPress sites in your posts. YouTube and similar services still work. ### What else changes when I turn off Heartbeat? The “your session expired” login prompt is also turned off on the affected screens. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Prunekit” is open source software. The following people have contributed to this plugin. Contributors * [ nimboo ](https://profiles.wordpress.org/nimboo/) [Translate “Prunekit” into your language.](https://translate.wordpress.org/projects/wp-plugins/prunekit) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/prunekit/), check out the [SVN repository](https://plugins.svn.wordpress.org/prunekit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/prunekit/) by [RSS](https://plugins.trac.wordpress.org/log/prunekit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * The settings page has a short note about the optional Prunekit Pro add-on. It is hidden when Pro is active. #### 1.0.1 * Disable comments: the single-comment admin screen (comment.php) now redirects to the dashboard, and the dashboard’s At a Glance and Activity widgets no longer show comment counts or recent comments. * Load Dashicons for logged-in users only: Dashicons enqueued late on the page ( for example by blocks) are now removed for visitors too. * Disable RSS feeds: only hooks the feed actions WordPress actually fires. No change in behaviour. * Post revisions: the description now says the setting overrides WP_POST_REVISIONS in wp-config.php. * The confirmation flag after “Apply recommended” or “Reset all” is removed from the address bar, so reloading does not show the notice again. * For developers: new filters prunekit_features, prunekit_labels and prunekit_groups( for add-ons) and prunekit_rest_public_routes (REST routes visitors may still use while the REST API is limited to logged-in users). #### 1.0.0 * First release. ## Meta * Version **1.0.2** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [disable comments](https://wordpress.org/plugins/tags/disable-comments/)[heartbeat](https://wordpress.org/plugins/tags/heartbeat/) [performance](https://wordpress.org/plugins/tags/performance/)[security](https://wordpress.org/plugins/tags/security/) [xml-rpc](https://wordpress.org/plugins/tags/xml-rpc/) * [Advanced View](https://wordpress.org/plugins/prunekit/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/prunekit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/prunekit/reviews/) ## Contributors * [ nimboo ](https://profiles.wordpress.org/nimboo/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/prunekit/)