Get Plugin xSpeed Hub
Features

By what you run

WooCommerce storesAgencies & freelancersBlogs & publishersElementor & page buildersMembership & LMSAI & agents

By your business

Home & trade services 3 Food & hospitality 4 Health & wellness 5 Professional services 5 Retail & ecommerce 5 Creative & events 4 Publishing & media 4 Learning & community 4 Tech & agencies 3 All use cases & industries
xSpeed Hub Pricing Docs Blog Scan
Free vs Pro Compare Coverage Support Community
Appearance
Get Plugin

How to strip WordPress bloat

Optimization 7 min

Turn off WordPress features your site doesn't use — dashicons, oEmbed, feeds, XML-RPC, jQuery Migrate — and know exactly what each one costs you if you're wrong.

WordPress ships features every site pays for and most sites don’t use — an icon font for the admin bar, embed handlers for pasted URLs, a legacy XML-RPC endpoint. Bloat Control turns them off individually. Every setting here is off by default, because each one removes something, and whether that something matters depends entirely on your site.

Where to find it

  1. In your WordPress admin, click xSpeed Cache in the left menu.
  2. In the xSpeed Cache sidebar, open the Optimization group.
  3. Click the Bloat Control card.

Shortcut: open wp-admin/admin.php?page=xspeed#/performance/bloat directly.

✅ This panel is part of xSpeed Cache (Free).

The bloat control settings

  1. Disable Dashicons on Frontend — drop the admin icon font.
  2. Disable oEmbed Discovery — stop auto-embedding pasted URLs.
  3. Disable RSS Feeds — 404 your feed endpoints.
  4. Disable XML-RPC — close the legacy remote endpoint.
  5. Strip jQuery Migrate — remove the compatibility shim.
  6. Restrict REST API to Logged-In Users — block anonymous API access.

Settings at a glance

SettingDefaultSavesRisk if wrong
Disable Dashicons on FrontendOff~45 KB per visitorLow
Disable oEmbed DiscoveryOffA request per pageLow — pasted URLs stop auto-embedding
Disable RSS FeedsOffFeed-fetcher trafficModerate — breaks subscribers
Disable XML-RPCOffBrute-force noiseModerate — breaks remote clients
Strip jQuery MigrateOff~10 KBLow on modern themes
Restrict REST APIOffAnonymous API trafficHigh — see below

How it works

Each toggle removes one WordPress behaviour from the front end. There’s no analysis and no automatic detection — you’re telling xSpeed that your site doesn’t need something, and it takes you at your word.

That’s why everything is off by default. Unlike caching, which is safe to enable blindly, these settings are only correct if the assumption behind them holds for your site.

💡 Work through these one at a time, and know what each one does before you flip it. The savings are real but modest — tens of kilobytes. Breaking your feed or your checkout to save 45 KB is a bad trade.

The low-risk ones

Disable Dashicons on Frontend drops the dashicons stylesheet from non-admin pages — about 45 KB per visitor, the biggest saving here. Dashicons is WordPress’s admin icon font; most themes don’t use it on the front end. Some do, for social icons or menu arrows, so check a page after enabling.

Strip jQuery Migrate on Frontend removes the compatibility shim that patches old jQuery APIs — about 10 KB, and safe on modern themes and plugins. Older code that relies on removed jQuery methods will break, which shows up as JavaScript console errors.

Disable oEmbed Discovery + wp-embed.min.js strips the auto-embed handlers and the embed script. The consequence is specific: pasting a YouTube URL into a post stops auto-rendering the player — you’d embed via a block instead. If your authors rely on paste-to-embed, leave this off.

The ones with real consequences

Disable RSS Feeds returns a 404 on /feed/ and similar endpoints. Useful for sites that don’t publish feeds and want to cut feed-fetcher traffic.

Be sure first, though. Feeds are consumed by more than people: podcast clients, news aggregators, some social platforms, and third-party services that syndicate your content. If any of that matters, consider caching your feeds instead of disabling them — you get the traffic reduction without breaking anyone.

Disable XML-RPC closes the legacy xmlrpc.php endpoint. This is a genuine security win — XML-RPC is a favourite brute-force target and generates constant background noise in your logs.

Safe to disable unless you use a remote WordPress client: Jetpack, the WordPress mobile app, or anything posting to your site remotely all use it. If you publish from your phone, this will stop that working.

Restrict REST API — read before enabling

This one deserves more caution than the rest, and the panel’s own description is unusually emphatic.

It blocks /wp-json/ for anonymous requests. That sounds like a straightforward hardening measure, and on a genuinely closed site it is. But the REST API is used far more widely than people expect:

  • WooCommerce checkout
  • Contact-form submissions
  • Block-editor previews
  • Many themes and plugins for ordinary front-end behaviour

All of those make anonymous REST requests during normal use — which is exactly what this blocks.

⚠️ The panel’s own advice is “keep this off unless you know your site does not depend on it.” That’s the right framing. The failure mode is nasty: your site looks fine, and a form or a checkout silently stops working for logged-out visitors — the people you least want to break things for, and the ones least likely to tell you.

If you enable it, test checkout and every form while logged out.