# TipWP — WordPress Developer Portal

> Production-tested WordPress code snippets, interactive developer tools, high-scale performance guides, and verified software architectures.

## Core Developer Tools

- [wp-config.php Generator](https://tipwp.com/tools/wp-config-generator): Generate secure, performance-tuned wp-config.php files with custom memory limits, debugging flags, and database prefixes.
- [Security Salts Generator](https://tipwp.com/tools/salts-generator): Generate fresh cryptographic WordPress secret keys and salts using PHP 8.2 CSPRNG to protect session cookies.
- [.htaccess Speed & Security Optimizer](https://tipwp.com/tools/htaccess-generator): Generate hardened Apache & LiteSpeed .htaccess rules with Gzip compression, browser caching, XML-RPC protection, and SSL redirects.
- [Custom Post Type & Taxonomy Builder](https://tipwp.com/tools/cpt-generator): Generate clean, standard-compliant PHP code for custom post types and taxonomies with REST API and Gutenberg support.
- [WordPress robots.txt Generator](https://tipwp.com/tools/robots-generator): Generate an SEO-optimized robots.txt file with sitemap links and proper permissions for AI search bots (ChatGPT, Claude, Perplexity).
- [Real Server Cron Job Generator](https://tipwp.com/tools/cron-generator): Disable sluggish wp-cron and generate server-level crontab rules (wget/curl/cli) for maximum reliability and site speed.
- [Database Prefix Rename SQL Builder](https://tipwp.com/tools/db-prefix-generator): Generate safe MySQL queries to rename table prefixes and update internal role capabilities in options and usermeta.
- [HTTP Security Headers & CSP Builder](https://tipwp.com/tools/security-headers-generator): Generate HSTS, X-Content-Type-Options, X-Frame-Options, and CSP rules for .htaccess, Nginx, or functions.php.
- [Emergency Password Hash & Reset Builder](https://tipwp.com/tools/password-hash-generator): Generate emergency MySQL SQL update commands or WP-CLI commands to reset locked WordPress admin credentials.
- [WP_Query & Transient Caching Helper](https://tipwp.com/tools/transient-cache-generator): Generate transient caching wrappers for expensive WP_Query instances and external API calls with automatic purge hooks.

## Key Content Directories & Products

- [TipWP PRO Suite](https://tipwp.com/pro): Commercial Developer FSE Theme, 10+ Block Patterns & 100+ Tested Snippet Vault bundle.
- [Code Snippets Library](https://tipwp.com/snippets): Copy-paste PHP functions, WooCommerce hooks, database SQL queries, and security snippets.
- [Developer Tools Hub](https://tipwp.com/tools): 10 client-side generator tools for wp-config, salts, htaccess, CPTs, crons, DB prefix, and security headers.
- [Deep Technical Guides](https://tipwp.com/guides): Architecture teardowns, Core Web Vitals optimization, and high-concurrency WooCommerce engineering.
- [Curated Stacks](https://tipwp.com/stacks): Verified, bloat-free WordPress production stacks (LiteSpeed/Nginx + Redis + FSE).

## Code Categories

- [WooCommerce Snippets](https://tipwp.com/snippet-category/woocommerce/)
- [Security Snippets](https://tipwp.com/snippet-category/security/)
- [Performance Snippets](https://tipwp.com/snippet-category/performance/)
- [Admin UI Snippets](https://tipwp.com/snippet-category/admin-ui/)
- [Database & SQL Snippets](https://tipwp.com/snippet-category/database/)

## Full AI Context

- Full documentation and snippet text: [https://tipwp.com/llms-full.txt](https://tipwp.com/llms-full.txt)


# Full Tested Code Snippets Reference

### Sanitize Uploaded SVG Files to Prevent Stored XSS Attacks
- URL: https://tipwp.com/snippets/sanitize-uploaded-svg-files-security/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Enables SVG file uploads while stripping malicious embedded JavaScript tags, onclick handlers, and foreign entities before saving to disk.

```php
// 1. Allow SVG Mime Type
add_filter( 'upload_mimes', function( $mimes ) {
    $mimes['svg'] = 'image/svg+xml';
    $mimes['svgz'] = 'image/svg+xml';
    return $mimes;
} );

// 2. Sanitize SVG XML Content on Upload
add_filter( 'wp_handle_upload_prefilter', function( $file ) {
    if ( 'image/svg+xml' === $file['type'] || 'image/svg' === $file['type'] ) {
        $svg_content = file_get_contents( $file['tmp_name'] );
        // Remove dangerous script, iframe, and object tags
        $clean_svg = preg_replace( '/<(script|iframe|object|embed)[^>]*?>.*?<\/(script|iframe|object|embed)>/si', '', $svg_content );
        $clean_svg = preg_replace( '/on\w+="[^"]*"/i', '', $clean_svg );
        $clean_svg = preg_replace( '/javascript:/i', '', $clean_svg );
        file_put_contents( $file['tmp_name'], $clean_svg );
    }
    return $file;
} );
```

---

### Remove WordPress Version Query Strings from Static Scripts and Styles
- URL: https://tipwp.com/snippets/remove-ver-query-strings-static-assets/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Strips &#8216;?ver=6.6.1&#8217; query parameters from enqueued CSS and JS files to enable static CDN proxy caching and hide WP version details.

```php
function tipwp_remove_script_version( $src ) {
    if ( strpos( $src, 'ver=' ) ) {
        $src = remove_query_arg( 'ver', $src );
    }
    return $src;
}
add_filter( 'style_loader_src', 'tipwp_remove_script_version', 9999 );
add_filter( 'script_loader_src', 'tipwp_remove_script_version', 9999 );
```

---

### Force SSL on All WordPress Login and Admin Sessions
- URL: https://tipwp.com/snippets/force-ssl-admin-and-login-snippet/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Enforces HTTPS encryption on all login forms and wp-admin administrative sessions to prevent session cookie interception on public networks.

```php
if ( ! defined( 'FORCE_SSL_ADMIN' ) ) {
    define( 'FORCE_SSL_ADMIN', true );
}
add_action( 'login_init', function() {
    if ( ! is_ssl() && ! empty( $_SERVER['HTTP_HOST'] ) ) {
        wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
        exit;
    }
} );
```

---

### Delete Expired and Orphaned Transients from wp_options via SQL
- URL: https://tipwp.com/snippets/delete-expired-transients-sql-query/
- Target: `phpMyAdmin / SQL` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `sql`
- Description: Clean thousands of abandoned and expired transient records from wp_options to instantly reduce database memory footprint and table fragmentation.

```sql
-- 1. Delete expired transient timeouts
DELETE FROM wp_options 
WHERE option_name LIKE '_transient_timeout_%' 
AND option_value < UNIX_TIMESTAMP();

-- 2. Delete corresponding transient data rows that have timed out
DELETE o1 FROM wp_options o1 
JOIN wp_options o2 ON o2.option_name = CONCAT('_transient_timeout_', SUBSTRING(o1.option_name, 12)) 
WHERE o1.option_name LIKE '_transient_%' 
AND o1.option_name NOT LIKE '_transient_timeout_%' 
AND o2.option_value < UNIX_TIMESTAMP();
```

---

### Add Featured Image Thumbnail Column to WP Admin Post List
- URL: https://tipwp.com/snippets/add-featured-image-thumbnail-column-admin/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Adds a clean preview thumbnail column to the admin post list (wp-admin/edit.php) so editors can visually verify featured images.

```php
// 1. Add Thumbnail Column Header
add_filter( 'manage_posts_columns', function( $columns ) {
    $new_cols = [];
    foreach ( $columns as $key => $title ) {
        if ( 'title' === $key ) {
            $new_cols['tipwp_thumb'] = __( 'Image', 'tipwp' );
        }
        $new_cols[$key] = $title;
    }
    return $new_cols;
} );

// 2. Render Thumbnail in Column
add_action( 'manage_posts_custom_column', function( $column, $post_id ) {
    if ( 'tipwp_thumb' === $column ) {
        if ( has_post_thumbnail( $post_id ) ) {
            echo get_the_post_thumbnail( $post_id, [ 48, 48 ], [ 'style' => 'border-radius: 4px; object-fit: cover;' ] );
        } else {
            echo '<span style="color:#a1a1aa;font-size:11px;">No Image</span>';
        }
    }
}, 10, 2 );
```

---

### Customize Admin Footer Branding and Support Links
- URL: https://tipwp.com/snippets/customize-admin-footer-branding/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Replace the default &#8216;Thank you for creating with WordPress&#8217; footer text with custom agency branding, contact links, or copyright notices.

```php
add_filter( 'admin_footer_text', function() {
    return '<span>Maintained with excellence by <a href="' . esc_url( home_url() ) . '" target="_blank">' . esc_html( get_bloginfo( 'name' ) ) . '</a>. For support, contact <a href="mailto:support@tipwp.com">support@tipwp.com</a>.</span>';
} );
```

---

### Replace WordPress Login Logo and Link with Custom Site Logo
- URL: https://tipwp.com/snippets/replace-wordpress-login-logo-and-url/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: White-label the wp-login.php screen with your own custom logo and redirect the logo click to your homepage instead of WordPress.org.

```php
// 1. Change Login Logo URL to Homepage
add_filter( 'login_headerurl', function() {
    return home_url();
} );

// 2. Change Login Logo Tooltip Title
add_filter( 'login_headertext', function() {
    return get_bloginfo( 'name' );
} );

// 3. Inject Custom Logo CSS
add_action( 'login_enqueue_scripts', function() {
    $custom_logo_id = get_theme_mod( 'custom_logo' );
    $logo_url = $custom_logo_id ? wp_get_attachment_image_url( $custom_logo_id, 'medium' ) : '';
    if ( ! $logo_url ) return;
    ?>
    <style type="text/css">
        #login h1 a, .login h1 a {
            background-image: url('<?php echo esc_url( $logo_url ); ?>');
            background-size: contain;
            background-position: center;
            background-repeat: no-repeat;
            width: 100%;
            height: 80px;
            margin-bottom: 20px;
        }
    </style>
    <?php
} );
```

---

### Disable WordPress REST API for Unauthenticated Guest Users
- URL: https://tipwp.com/snippets/disable-rest-api-for-unauthenticated-users/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Restricts public /wp-json/ user and data endpoints to authenticated users and logged-in administrators only.

```php
add_filter( 'rest_authentication_errors', function( $result ) {
    if ( ! empty( $result ) ) {
        return $result;
    }
    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            'rest_not_logged_in',
            __( 'REST API access is restricted to authenticated users only.', 'tipwp' ),
            [ 'status' => 401 ]
        );
    }
    return $result;
} );
```

---

### Block Author URL Enumeration Scans (?author=1)
- URL: https://tipwp.com/snippets/block-author-enumeration-scans/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Prevents automated bots from discovering valid WordPress administrator usernames by requesting /?author=1 query parameters.

```php
add_action( 'template_redirect', function() {
    if ( is_author() && isset( $_GET['author'] ) ) {
        wp_safe_redirect( home_url(), 301 );
        exit;
    }
} );
```

---

### Hide Generic WordPress Login Error Hints to Prevent Username Probing
- URL: https://tipwp.com/snippets/hide-wordpress-login-error-hints/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Replaces informative login error messages (&#8216;Invalid username&#8217; vs &#8216;Incorrect password&#8217;) with a generic notice to prevent credential enumeration.

```php
add_filter( 'login_errors', function( $error ) {
    return '<strong>Error:</strong> Invalid login credentials. Please verify your details and try again.';
} );
```

---

### Limit Maximum Post Revisions to 5 via Filter
- URL: https://tipwp.com/snippets/limit-post-revisions-to-5/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Prevents database bloat in wp_posts by capping the maximum number of revisions stored per post to 5 without modifying wp-config.php.

```php
add_filter( 'wp_revisions_to_keep', function( $num, $post ) {
    return 5; // Keep only the latest 5 revisions
}, 10, 2 );
```

---

### Throttle WordPress Heartbeat API Frequency to 60 Seconds
- URL: https://tipwp.com/snippets/throttle-wordpress-heartbeat-api/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Reduces high CPU usage from admin-ajax.php by slowing down the background Heartbeat API frequency from 15s to 60s in the post editor.

```php
add_filter( 'heartbeat_settings', function( $settings ) {
    $settings['interval'] = 60; // Set interval in seconds (default is 15)
    return $settings;
} );
```

---

### Disable Dashicons CSS for Unauthenticated Guest Visitors
- URL: https://tipwp.com/snippets/disable-dashicons-for-guests/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Prevents loading the heavy 30KB Dashicons font and stylesheet for normal site visitors who are not logged into the WordPress admin.

```php
add_action( 'wp_enqueue_scripts', function() {
    if ( ! is_user_logged_in() ) {
        wp_deregister_style( 'dashicons' );
    }
}, 100 );
```

---

### Hide All Other Shipping Methods When Free Shipping Is Available in WooCommerce
- URL: https://tipwp.com/snippets/hide-other-shipping-methods-when-free-shipping/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Streamline checkout by hiding expensive flat-rate and local pickup options whenever the customer qualifies for Free Shipping.

```php
add_filter( 'woocommerce_package_rates', 'tipwp_hide_shipping_when_free_available', 100, 2 );
function tipwp_hide_shipping_when_free_available( $rates, $package ) {
    $free_shipping = [];
    foreach ( $rates as $rate_id => $rate ) {
        if ( 'free_shipping' === $rate->get_method_id() ) {
            $free_shipping[ $rate_id ] = $rate;
            break;
        }
    }
    return ! empty( $free_shipping ) ? $free_shipping : $rates;
}
```

---

### Disable WooCommerce Cart Fragments AJAX Script on Non-Shop Pages
- URL: https://tipwp.com/snippets/disable-woocommerce-cart-fragments-non-shop/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: WooCommerce loads wc-cart-fragments.js on every page to update mini-carts via AJAX. This snippet disables it on blog and content pages to save 300ms TTFB.

```php
add_action( 'wp_enqueue_scripts', 'tipwp_disable_cart_fragments_selectively', 99 );
function tipwp_disable_cart_fragments_selectively() {
    if ( function_exists( 'is_woocommerce' ) ) {
        if ( ! is_woocommerce() && ! is_cart() && ! is_checkout() ) {
            wp_dequeue_script( 'wc-cart-fragments' );
        }
    }
}
```

---

### Auto-Complete Virtual and Downloadable WooCommerce Orders on Successful Payment
- URL: https://tipwp.com/snippets/autocomplete-virtual-woocommerce-orders/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Automatically marks orders containing only virtual or downloadable products as Completed immediately after successful payment.

```php
add_action( 'woocommerce_thankyou', 'tipwp_autocomplete_virtual_orders', 10, 1 );
function tipwp_autocomplete_virtual_orders( $order_id ) {
    if ( ! $order_id ) return;
    
    $order = wc_get_order( $order_id );
    if ( ! $order || $order->get_status() !== 'processing' ) return;
    
    $is_virtual_only = true;
    foreach ( $order->get_items() as $item ) {
        $product = $item->get_product();
        if ( $product && ! $product->is_virtual() && ! $product->is_downloadable() ) {
            $is_virtual_only = false;
            break;
        }
    }
    
    if ( $is_virtual_only ) {
        $order->update_status( 'completed', __( 'Auto-completed virtual order by TipWP snippet.', 'woocommerce' ) );
    }
}
```

---

### Find and Replace URL in Entire WordPress Database via Raw SQL
- URL: https://tipwp.com/snippets/find-and-replace-url-in-entire-wordpress-database-via-raw-sql/
- Target: `phpMyAdmin / SQL Console` | Tested: `MySQL 8.0+ / MariaDB 10.5+` | Lang: `sql`
- Description: When migrating a WordPress site or switching domain names, execute these SQL queries in phpMyAdmin to replace old URLs across post content, excerpts, post meta, options, and comments in one pass.

```sql
-- Find and replace old URLs in posts, meta, options, and comments
UPDATE wp_options SET option_value = replace(option_value, 'https://olddomain.com', 'https://newdomain.com') WHERE option_name = 'home' OR option_name = 'siteurl';
UPDATE wp_posts SET post_content = replace(post_content, 'https://olddomain.com', 'https://newdomain.com');
UPDATE wp_posts SET post_excerpt = replace(post_excerpt, 'https://olddomain.com', 'https://newdomain.com');
UPDATE wp_posts SET guid = replace(guid, 'https://olddomain.com', 'https://newdomain.com');
UPDATE wp_postmeta SET meta_value = replace(meta_value, 'https://olddomain.com', 'https://newdomain.com');
UPDATE wp_comments SET comment_content = replace(comment_content, 'https://olddomain.com', 'https://newdomain.com');
UPDATE wp_comments SET comment_author_url = replace(comment_author_url, 'https://olddomain.com', 'https://newdomain.com');
```

---

### Disable Dashboard Welcome Panel and Default Widgets for All Users
- URL: https://tipwp.com/snippets/disable-dashboard-welcome-panel-and-default-widgets-for-all-users/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Declutter the WordPress admin dashboard for clients and content managers by removing unnecessary default boxes such as WordPress Events and News, Quick Draft, and the Welcome panel.

```php
// Remove default dashboard clutter and widgets
add_action( 'wp_dashboard_setup', function() {
    remove_action( 'welcome_panel', 'wp_welcome_panel' ); // Welcome Panel
    remove_meta_box( 'dashboard_primary', 'dashboard', 'side' ); // WP Events & News
    remove_meta_box( 'dashboard_quick_press', 'dashboard', 'side' ); // Quick Draft
    remove_meta_box( 'dashboard_activity', 'dashboard', 'normal' ); // Activity
} );
```

---

### Disable XML-RPC Pingbacks and Trackbacks While Keeping Jetpack Active
- URL: https://tipwp.com/snippets/disable-xml-rpc-pingbacks-and-trackbacks-while-keeping-jetpack-active/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: XML-RPC pingbacks are frequently exploited in large-scale DDoS amplification and brute-force attacks. This snippet disables dangerous pingback methods without breaking Jetpack or the official WordPress mobile app.

```php
// Disable XML-RPC pingback methods (Prevents DDoS amplification attacks)
add_filter( 'xmlrpc_methods', function( $methods ) {
    unset( $methods['pingback.ping'] );
    unset( $methods['pingback.extensions.getPingbacks'] );
    return $methods;
} );

// Remove X-Pingback HTTP header from server responses
add_filter( 'wp_headers', function( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );
```

---

### Disable Emoji Scripts and Styles Completely in WordPress
- URL: https://tipwp.com/snippets/disable-emoji-scripts-and-styles-completely-in-wordpress/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: WordPress loads unnecessary JavaScript and CSS styles on every page load to support legacy browser emojis. This snippet completely removes wp-emoji scripts, styles, and DNS prefetch requests to reduce HTTP requests.

```php
add_action( 'init', function() {
    // Remove emoji actions from header and feeds
    remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
    remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
    remove_action( 'wp_print_styles', 'print_emoji_styles' );
    remove_action( 'admin_print_styles', 'print_emoji_styles' );
    remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
    remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );
    remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );

    // Remove TinyMCE emoji plugin and DNS prefetch
    add_filter( 'tiny_mce_plugins', function( $plugins ) {
        return is_array( $plugins ) ? array_diff( $plugins, [ 'wpemoji' ] ) : [];
    } );
    add_filter( 'wp_resource_hints', function( $urls, $relation_type ) {
        if ( 'dns-prefetch' === $relation_type ) {
            $urls = array_filter( $urls, function( $url ) {
                return false === strpos( $url, 'https://s.w.org/images/core/emoji/' );
            } );
        }
        return $urls;
    }, 10, 2 );
} );
```

---

### Add Custom Minimum Order Amount Requirement in WooCommerce
- URL: https://tipwp.com/snippets/add-custom-minimum-order-amount-requirement-in-woocommerce/
- Target: `functions.php` | Tested: `WooCommerce 8.0+ / WP 6.6+` | Lang: `php`
- Description: Enforce a storewide minimum checkout threshold in WooCommerce. If a customer attempts to checkout with a cart value below the threshold, an error notice is triggered preventing checkout.

```php
add_action( 'woocommerce_checkout_process', 'tipwp_require_minimum_order_amount' );
add_action( 'woocommerce_before_cart', 'tipwp_require_minimum_order_amount' );
function tipwp_require_minimum_order_amount() {
    $minimum = 50; // Set minimum order threshold in store currency
    $cart_total = WC()->cart->total;

    if ( $cart_total < $minimum ) {
        $notice = sprintf( 'A minimum order total of %s is required to place your order. Your current total is %s.', wc_price( $minimum ), wc_price( $cart_total ) );
        if ( is_cart() ) {
            wc_print_notice( $notice, 'error' );
        } else {
            wc_add_notice( $notice, 'error' );
        }
    }
}
```

---

### Delete Orphaned Post Meta Records via Direct SQL
- URL: https://tipwp.com/snippets/delete-orphaned-post-meta-records-via-direct-sql/
- Target: `phpMyAdmin / WP-CLI db query` | Tested: `MySQL 8.0+ / MariaDB 10.4+` | Lang: `sql`
- Description: When posts or custom post types are deleted without proper cleanup hooks, their metadata remains in wp_postmeta. This query cleans orphaned post meta.

```sql
DELETE pm FROM wp_postmeta pm 
LEFT JOIN wp_posts wp ON wp.ID = pm.post_id 
WHERE wp.ID IS NULL;
```

---

### Clean Up Expired Transients from WordPress Database with One Query
- URL: https://tipwp.com/snippets/clean-up-expired-transients-from-wordpress-database-with-one-query/
- Target: `phpMyAdmin / WP-CLI db query` | Tested: `MySQL 8.0+ / MariaDB 10.4+` | Lang: `sql`
- Description: Expired transients often accumulate into tens of thousands of unused rows in wp_options, inflating database backup size and slowing autoloaded options. This SQL query safely purges expired transients.

```sql
DELETE a, b FROM wp_options a 
LEFT JOIN wp_options b ON b.option_name = CONCAT( '_transient_timeout_', SUBSTRING( a.option_name, 12 ) ) 
WHERE a.option_name LIKE '_transient_%' 
AND a.option_name NOT LIKE '_transient_timeout_%' 
AND b.option_value < UNIX_TIMESTAMP();
```

---

### Add Featured Image Thumbnail Column to Admin Posts List
- URL: https://tipwp.com/snippets/add-featured-image-thumbnail-column-to-admin-posts-list/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Save time when managing large blogs by previewing featured image thumbnails directly in the WordPress posts list table.

```php
add_filter( 'manage_posts_columns', function( $cols ) {
    $cols['featured_thumb'] = __( 'Thumbnail', 'textdomain' );
    return $cols;
} );

add_action( 'manage_posts_custom_column', function( $col, $post_id ) {
    if ( 'featured_thumb' === $col ) {
        echo get_the_post_thumbnail( $post_id, [50, 50] ) ?: '—';
    }
}, 10, 2 );
```

---

### Customize WordPress Admin Footer Text and Remove Version Info
- URL: https://tipwp.com/snippets/customize-wordpress-admin-footer-text-and-remove-version-info/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: White-label the WordPress administration area for client sites with custom branding and support links in the dashboard footer.

```php
add_filter( 'admin_footer_text', function() {
    return '<span>Developed & Managed with <a href="' . home_url() . '" target="_blank">TipWP</a></span>';
} );
add_filter( 'update_footer', '__return_empty_string', 11 );
```

---

### Dequeue Gutenberg Block Library CSS on Pages Without Blocks
- URL: https://tipwp.com/snippets/dequeue-gutenberg-block-library-css-on-pages-without-blocks/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Eliminate render-blocking CSS on classic pages, landing pages, or lightweight custom templates by dequeuing default Gutenberg block stylesheets.

```php
add_action( 'wp_enqueue_scripts', function() {
    if ( ! has_blocks() ) {
        wp_dequeue_style( 'wp-block-library' );
        wp_dequeue_style( 'wp-block-library-theme' );
        wp_dequeue_style( 'wc-blocks-style' ); // WooCommerce block CSS
    }
}, 100 );
```

---

### Disable WordPress Heartbeat API Except on Post Edit Screen
- URL: https://tipwp.com/snippets/disable-wordpress-heartbeat-api-except-on-post-edit-screen/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: The WordPress Heartbeat API sends frequent AJAX requests (/wp-admin/admin-ajax.php) every 15-60 seconds, which can overload CPU on shared and VPS hosting. This snippet disables heartbeat globally except while drafting posts.

```php
add_action( 'init', function() {
    global $pagenow;
    if ( 'post.php' !== $pagenow && 'post-new.php' !== $pagenow ) {
        wp_deregister_script( 'heartbeat' );
    }
}, 1 );
```

---

### Completely Remove WordPress Version String from Header and Feeds
- URL: https://tipwp.com/snippets/completely-remove-wordpress-version-string-from-header-and-feeds/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Prevent automated vulnerability scanners from identifying your exact WordPress core version across HTML meta tags, scripts, and RSS feeds.

```php
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );
add_filter( 'style_loader_src', fn( $src ) => remove_query_arg( 'ver', $src ) );
add_filter( 'script_loader_src', fn( $src ) => remove_query_arg( 'ver', $src ) );
```

---

### Disable Author Enumeration Scans (?author=1) in WordPress
- URL: https://tipwp.com/snippets/disable-author-enumeration-scans-author1-in-wordpress/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Attackers and botnets use URL parameters like /?author=1 to reveal administrative usernames. This snippet intercepts query parameters and safely redirects or returns a 404 header.

```php
add_action( 'template_redirect', function() {
    if ( is_author() || ( isset( $_GET['author'] ) && is_numeric( $_GET['author'] ) ) ) {
        wp_safe_redirect( home_url(), 301 );
        exit;
    }
} );
```

---

### Hide Other Shipping Methods When Free Shipping is Available in WooCommerce
- URL: https://tipwp.com/snippets/hide-other-shipping-methods-when-free-shipping-is-available-in-woocommerce/
- Target: `functions.php` | Tested: `WooCommerce 8.0+ / WP 6.6+` | Lang: `php`
- Description: By default, WooCommerce continues to display Flat Rate and Local Pickup alongside Free Shipping. This filter hides paid shipping rates once a customer qualifies for Free Shipping.

```php
add_filter( 'woocommerce_package_rates', function( $rates, $package ) {
    $free_shipping = [];
    foreach ( $rates as $rate_id => $rate ) {
        if ( 'free_shipping' === $rate->method_id ) {
            $free_shipping[ $rate_id ] = $rate;
            break;
        }
    }
    return ! empty( $free_shipping ) ? $free_shipping : $rates;
}, 10, 2 );
```

---

### Automatically Empty Cart Before Adding New Product in WooCommerce
- URL: https://tipwp.com/snippets/automatically-empty-cart-before-adding-new-product-in-woocommerce/
- Target: `functions.php` | Tested: `WooCommerce 8.0+ / WP 6.6+` | Lang: `php`
- Description: When selling digital products, booking services, or individual course memberships, you often want only one item in the WooCommerce cart at any time. This hook clears the existing cart before adding a new product.

```php
add_filter( 'woocommerce_add_to_cart_validation', function( $passed, $product_id, $quantity ) {
    if ( ! WC()->cart->is_empty() ) {
        WC()->cart->empty_cart();
    }
    return $passed;
}, 10, 3 );
```

---

### How to Properly Increase Maximum Upload File Size in WordPress
- URL: https://tipwp.com/snippets/increase-maximum-upload-file-size-via-functions-php/
- Target: `.htaccess / .user.ini` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `apache`
- Description: Important Technical Note: In PHP, upload_max_filesize and post_max_size are PHP_INI_PERDIR directives. Calling @ini_set() inside functions.php or wp-config.php is ineffective on modern FastCGI/PHP-FPM servers because the HTTP payload is evaluated before theme execution starts.To reliably increase your WordPress upload file size, place these directives in your .htaccess (Apache/LiteSpeed) or .user.ini (Nginx/PHP-FPM), and adjust WP_MEMORY_LIMIT in wp-config.php.

```apache
# Add to .htaccess (Apache / LiteSpeed)
php_value upload_max_filesize 64M
php_value post_max_size 64M
php_value max_execution_time 300
php_value max_input_time 300

# Or add to .user.ini (Nginx / PHP-FPM / cPanel MultiPHP)
# upload_max_filesize = 64M
# post_max_size = 64M
# max_execution_time = 300
```

---

### Replace WordPress Login Logo and Custom URL
- URL: https://tipwp.com/snippets/replace-wordpress-login-logo-and-custom-url/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: Brand your WordPress client websites by replacing the default WordPress logo on wp-login.php and redirecting the logo URL to your homepage.

```php
add_action( "login_enqueue_scripts", function() {
    echo "<style type="text/css">#login h1 a { background-image: url(" . get_stylesheet_directory_uri() . "/assets/images/logo.svg) !important; background-size: contain !important; width: 100% !important; }</style>";
} );
add_filter( "login_headerurl", fn() => home_url() );
```

---

### Allow SVG Uploads Safely in WordPress Media Library
- URL: https://tipwp.com/snippets/allow-svg-uploads-safely-in-wordpress-media-library/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: By default, WordPress blocks SVG uploads due to potential XML vulnerability risks. This lightweight function safely whitelists SVG MIME types for administrators.

```php
add_filter( "upload_mimes", function( $mimes ) {
    if ( current_user_can( "manage_options" ) ) {
        $mimes["svg"]  = "image/svg+xml";
        $mimes["svgz"] = "image/svg+xml";
    }
    return $mimes;
} );
```

---

### How to Safely Disable XML-RPC in WordPress
- URL: https://tipwp.com/snippets/how-to-safely-disable-xml-rpc-in-wordpress/
- Target: `functions.php` | Tested: `WP 6.6+ / PHP 8.2+` | Lang: `php`
- Description: XML-RPC in WordPress is frequently targeted by brute-force attacks and DDoS amplification vulnerabilities. If you are not using the WordPress mobile app or Jetpack, disabling XML-RPC significantly improves site security and reduces server load.

```php
add_filter( "xmlrpc_enabled", "__return_false" );
```

---