xSpeed Cache
Get Plugin
Features Pricing Reviews FAQ
Documentation Blog Support Community Free vs Pro Compare
Get Plugin

Disabling Bloat

4 min read

WordPress loads several features by default that many sites never use. The Disable Bloat panel lets you turn those off to save bytes, requests, and attack surface.

What this does

Each setting in this panel is a single toggle. When you turn one on, xSpeed Cache stops WordPress from loading a default feature. Every toggle is off by default, because most sites have at least one plugin that quietly depends on these features. It is safer to let you choose than to risk breaking your theme.

Why use it

  • Smaller pages, since unused styles and scripts are removed.
  • Fewer requests per page.
  • A smaller attack surface for features you do not use.

How to set it up

  1. Go to the xSpeed Cache dashboard in your WordPress admin.
  2. Open the Disable Bloat panel.
  3. Turn on only the toggles for features you are sure you do not need.
  4. Test your site afterward, especially the front end and any forms.

Settings explained

SettingWhat it doesDefault
Disable Dashicons on FrontendDrops the dashicons stylesheet from non-admin pagesOff
Disable oEmbed Discovery + wp-embed.min.jsStrips auto-embed handlers and the embed scriptOff
Disable RSS FeedsReturns a 404 on feed endpointsOff
Disable XML-RPCDisables the xmlrpc.php endpointOff
Strip jQuery Migrate on FrontendRemoves the jquery-migrate shim from non-admin pagesOff
Restrict REST API to Logged-In UsersBlocks /wp-json/ for anonymous requestsOff

Disable Dashicons on Frontend. Drops the dashicons stylesheet from non-admin pages. Most themes do not need it, and it saves about 45 KB per visitor. xSpeed Cache keeps dashicons loaded when the admin bar is showing or the user is logged in, so it only strips the file on truly anonymous pages.

Disable oEmbed Discovery + wp-embed.min.js. Strips the auto-embed handlers and the embed script. Posts that paste a YouTube URL will no longer auto-render the player. Embed media through a block instead. Saves a request per page.

Disable RSS Feeds. Returns a 404 on /feed/ and similar endpoints. Useful for sites that do not publish feeds and want to cut feed-fetcher traffic.

Disable XML-RPC. Disables the legacy xmlrpc.php endpoint and removes the X-Pingback header. This cuts pingback brute-force noise. It is safe to disable unless you use a remote WordPress client such as Jetpack or the WordPress mobile app.

Strip jQuery Migrate on Frontend. Removes the jquery-migrate compatibility shim from non-admin pages. Saves about 10 KB. It is safe on modern themes and plugins. It only affects the front end, not the admin.

Restrict REST API to Logged-In Users. Blocks /wp-json/ for anonymous requests. WooCommerce checkout, contact-form submissions, and many block-editor previews need anonymous REST access. Keep this off unless you know your site does not depend on it.

Warning: Restricting the REST API can break stores, forms, and the block editor. Test checkout, forms, and editing after enabling it.

Best practices

  • Turn on one toggle at a time and check your site after each.
  • Keep Disable XML-RPC off if you use Jetpack or the WordPress mobile app.
  • Keep Restrict REST API to Logged-In Users off unless you are certain no anonymous feature depends on it.
  • Disable oEmbed Discovery + wp-embed.min.js is safe if you embed media using blocks rather than pasting bare URLs.

Troubleshooting

  • Icons look broken on the front end. Your theme may use dashicons. Turn Disable Dashicons on Frontend back off.
  • A pasted URL no longer turns into an embed. That is expected with Disable oEmbed Discovery + wp-embed.min.js on. Use a block to embed instead.
  • A form or checkout stopped working. Restrict REST API to Logged-In Users may be blocking anonymous REST requests. Turn it off.
  • A remote app cannot connect. Disable XML-RPC may be blocking it. Turn it off if you rely on Jetpack or the mobile app.
  • Something on the front end broke after enabling jQuery Migrate stripping. An older theme or plugin may still depend on jquery-migrate. Turn Strip jQuery Migrate on Frontend back off.

FAQ

Are these on by default? No. Every toggle is off by default so nothing changes until you choose it.

Does disabling dashicons affect the admin? No. It only affects non-admin pages, and it is skipped when the admin bar is showing or a user is logged in.

Does disabling XML-RPC stop pingbacks? Yes. It disables the endpoint, removes the X-Pingback header, and turns off pings.

  • Font Optimization
  • Lazy Loading Images, Iframes, and Videos
  • Controlling the WordPress Heartbeat