WordPress snippets that just work.
70 ready-made snippets in 10 packs, the same ones that ship inside Snipfire: security, speed, the admin area, WooCommerce, and a pack for Greek e-shops. Each one tested on the latest WordPress before it went in, and installable in one click.
Packs
- Harden WordPress Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors. 7 snippets
- Clean up the head Remove the links, scripts and styles WordPress adds to every page that most sites never use. 7 snippets
- Performance Small changes that save the server and the browser some work. 7 snippets
- Turn off what you don’t use Each of these replaces a small plugin: no comments, classic editor, no feeds, no search and more. 9 snippets
- Admin and login Your branding on the login page, a tidier admin, and handy extras such as duplicating posts. 8 snippets
- Content and media Shortcodes, links, images and small design touches for the public site. 10 snippets
- WooCommerce essentials The small WooCommerce changes shop owners ask for most. 11 snippets
- Greek e-shop For shops in Greece: receipt or invoice with a checked VAT number (ΑΦΜ), Greek phone and postcode checks, a cash on delivery fee, and greeklish addresses. 6 snippets
- Privacy and GDPR Keep less personal data and send less of it to other companies. 4 snippets
- Analytics and pixels The usual tracking codes, ready to paste your ID into. Administrators’ visits aren’t counted. 6 snippets
Every snippet
- Turn off XML-RPC Blocks remote publishing, pingbacks and password guessing through xmlrpc.php. The block editor, the REST API and the WordPress apps don’t need it.
- Stop visitors from listing user names Closes the usual ways to find your user names: ?author=1 links, the public users list in the REST API and the users sitemap. Logged-in editors still see authors as usual.
- One message for every failed login The login form says “Wrong username or password” instead of telling a stranger whether a user name exists.
- Turn off the theme and plugin file editors Removes the code editors under Appearance and Plugins, so a stolen admin login can’t be used to write PHP into your theme or plugin files.
- Hide the WordPress version Removes the version number from the page head and feeds, and from the addresses of WordPress’s own scripts and styles.
- Add security headers Sends headers that stop other sites from framing your pages, stop browsers from guessing file types, keep full page addresses private when visitors follow links, and turn off camera, microphone and location access.
- Turn off application passwords Removes application passwords (logins for apps and scripts through the REST API) if you don’t use them.
- Remove the emoji script and styles Stops WordPress from loading its emoji script and styles on every page. Every current browser shows emoji on its own.
- Remove the RSD and Windows Live Writer links Removes two links from the page head that only old desktop blogging apps used.
- Remove the shortlink Removes the ?p=123 shortlink from the page head and the HTTP headers.
- Remove the REST API and oEmbed links Removes the REST API and oEmbed discovery links from the page head and the HTTP headers. The REST API itself keeps working.
- Remove the extra feed links Keeps the main posts and comments feeds in the page head, and removes the links to category, tag, author, search and per-post comment feeds.
- Stop loading jQuery Migrate jQuery Migrate helps very old jQuery code run. Most sites don’t need it on the public pages; the admin keeps it.
- Keep 10 revisions per post Keeps the last 10 revisions of each post and page instead of every one, so the database doesn’t fill up with old versions.
- Slow down the Heartbeat API While the admin is open, WordPress checks in with the server every 15 to 60 seconds. Once a minute is enough for post locks and login checks, and saves server work.
- Empty the trash after 7 days Deletes posts, pages and comments for good after 7 days in the trash, instead of 30.
- No pingbacks to your own posts When you link to one of your own posts, WordPress sends it a pingback, which shows up as a comment. This stops that.
- Load Dashicons for logged-in users only The Dashicons icon font is loaded on the public site for the admin bar. Visitors who aren’t logged in don’t need it.
- Turn off comments everywhere Closes comments and pingbacks on every post and page, hides existing comments, and removes Comments from the admin menu, the admin bar and the dashboard. WooCommerce product reviews keep working.
- Use the classic editor Posts and pages open in the classic editor instead of the block editor, as with the Classic Editor plugin.
- Use the classic widgets screen Appearance > Widgets and the Customizer go back to the classic widgets, as with the Classic Widgets plugin.
- Turn off RSS feeds Every feed address (/feed/, comment feeds, category feeds) sends visitors to the home page, and the feed links leave the page head.
- Turn off site search Search results show the “not found” page, and search forms and Search blocks print nothing.
- Send attachment pages to the file Each uploaded image has its own thin page (…/image-name/). This sends visitors straight to the file instead, as new WordPress sites do.
- No email after successful automatic updates WordPress stops emailing you every time a plugin, theme or WordPress itself updates on its own. You still get an email when an update fails.
- Stop the admin email check Every six months WordPress asks administrators to confirm the site’s admin email after they log in. This turns that screen off.
- Admin bar for editors only Hides the admin bar on the public site for subscribers and customers. Users who can write posts still see it.
- Login logo links to your site The logo on the login page links to your home page, with your site’s name, instead of WordPress.org.
- Your logo on the login page Shows the logo set in your theme (Site Logo or Customizer > Site Identity) on the login page instead of the WordPress logo.
- Your site name in the admin footer Replaces “Thank you for creating with WordPress” at the bottom of admin screens with your site’s name, and hides the version number from users who can’t update WordPress.
- Hide update notices from non-admins Editors and other users stop seeing “WordPress X is available! Please notify the site administrator.”
- A cleaner dashboard Removes the Welcome panel, WordPress Events and News, and Quick Draft from the dashboard.
- Show IDs in the admin lists Adds an ID column to the lists of posts, pages, media and users.
- Send subscribers to the home page after login Users who can’t write posts (subscribers, customers) land on the home page after logging in, instead of an almost empty dashboard.
- Duplicate posts and pages Adds “Duplicate” under each post and page in the admin lists. The copy is a draft with the same content, categories, tags, custom fields and featured image.
- Current year shortcode Type [year] anywhere, for example “© [year] My Shop” in the footer, and it always shows the current year.
- Reading time shortcode Type [reading_time] in a post or template to show “4 min read”. [reading_time wpm="180"] changes the reading speed.
- Open outside links in a new tab Links in your posts and pages that go to other sites open in a new tab. Menus and footers aren’t changed.
- Back-to-top button A round button at the bottom right that appears after scrolling down and takes visitors back to the top of the page.
- Smooth scrolling Links to a part of the same page (#contact) glide there instead of jumping. Visitors who asked their device for less motion still jump.
- Print-friendly pages When someone prints a page, menus, sidebars, comments and the footer are left out, and link addresses are printed next to the links.
- Let administrators upload SVG images Administrators can upload SVG files to the media library. Other users can’t, because an SVG file can contain scripts.
- Keep large photos sharper WordPress shrinks uploaded images wider or taller than 2560 pixels. This raises the limit to 3000 pixels, which suits full-width photos on large screens.
- Featured images in the RSS feed Adds each post’s featured image to the top of its feed entry, so feed readers and email newsletters built from your feed show it.
- Hide the reCAPTCHA badge Hides Google’s reCAPTCHA badge from the bottom corner of every page.
- Hide other shipping when shipping is free When an order qualifies for free shipping, the customer sees only free shipping (and local pickup, if you offer it) instead of paid options too.
- Minimum order amount Customers can’t check out until the cart reaches the amount you set. The cart says how much is missing.
- Show the discount on sale badges Sale badges show the discount, for example “-20%”, instead of “Sale!”. For variable products it’s the biggest discount.
- Change the “Add to cart” text Uses your own words on the add-to-cart buttons of product pages and of simple products in shop lists.
- Go straight to checkout Add to cart takes customers straight to the checkout instead of the cart. Suits shops that mostly sell one product at a time.
- Remove checkout fields you don’t need Removes company name and the second address line from the checkout. Edit the list to remove other fields.
- Remove the order notes field Removes “Order notes” from the checkout.
- Complete paid orders of virtual products Paid orders that contain only virtual products (services, memberships, tickets) go straight to Completed instead of waiting in Processing.
- Four related products in one row Shows four related products in a row of four under each product.
- Remove the Reviews tab Removes the Reviews tab from product pages, for shops that don’t take reviews.
- No WooCommerce marketplace suggestions Removes the extension suggestions WooCommerce shows in its admin screens.
- Receipt or invoice at checkout (Απόδειξη / Τιμολόγιο) Customers choose a receipt or an invoice. For an invoice they fill in company name, VAT number (ΑΦΜ, checked), tax office (ΔΟΥ) and business activity. The details are saved with the order and shown in the admin, the order emails and the order page.
- Check Greek phone numbers at checkout For customers in Greece, the checkout accepts only valid Greek phone numbers: 10 digits starting with 2 (landline) or 69 (mobile), with or without +30.
- Check Greek postcodes at checkout For addresses in Greece, the checkout accepts only valid 5-digit postcodes (10000 to 85999, with or without a space).
- Cash on delivery fee (αντικαταβολή) Adds a fee to the order when the customer pays cash on delivery. The checkout totals update as soon as they pick it.
- Greeklish addresses for Greek titles New posts, pages, products, categories and tags with Greek titles get addresses in Latin letters: “Καλοκαιρινά φορέματα” becomes kalokairina-foremata. Existing addresses don’t change.
- Greeklish file names for uploads Uploaded files with Greek names get names in Latin letters (φωτογραφία.jpg becomes fotografia.jpg), so their addresses work everywhere.
- Don’t store commenters’ IP addresses New comments are saved without the commenter’s IP address and browser details, so you keep less personal data.
- Don’t load avatars from Gravatar Turns avatars off, so visitors’ browsers don’t contact Gravatar (which would see their IP address and a code made from commenters’ emails).
- Google Consent Mode defaults (all denied) Tells Google tags that visitors haven’t agreed to cookies yet, until your cookie banner says they have. Load it before Google Analytics or Tag Manager.
- Google Analytics 4 Adds the Google Analytics 4 tag to every page. Visits by administrators aren’t counted.
- Google Tag Manager (head) The first part of the Google Tag Manager container code, for the page head. Install “Google Tag Manager (body)” too.
- Google Tag Manager (body) The second part of the Google Tag Manager container code, right after the opening body tag.
- Meta (Facebook) Pixel Adds the Meta Pixel base code and counts a page view on every page. Visits by administrators aren’t counted.
- Microsoft Clarity Adds Microsoft Clarity (heatmaps and session recordings). Visits by administrators aren’t recorded.
No snippet matches that yet. Tell us what you need and we'll consider adding it. Suggest a snippet
Library from Snipfire 0.15.0. Written from scratch for Snipfire, free to use on any site. Which plugins can a snippet replace?
Move your snippets over this afternoon.
Importing changes nothing until you switch over, and your old shortcodes keep working.