內容簡介
RefiTune - Site refiner toolkit 是一款模組化的 WordPress 外掛，旨在優化網站性能與安全性。透過啟用或禁用各個模組，使用者可以輕鬆清理前端程式碼、強化登錄與上傳安全、調整 Heartbeat 和更新設定，提升網站效能。
【主要功能】
• 清理標頭輸出，減少頁面負擔
• 控制 RSS/Atom 餵送鏈接標籤
• 移除 WordPress 表情符號腳本與樣式
• 限制每篇文章的修訂版本數
• 自動將上傳的 JPEG/PNG 轉換為 WebP
• 調整或禁用 Heartbeat API
外掛標籤
開發者團隊
② 後台搜尋「RefiTune – Site refiner toolkit」→ 直接安裝（推薦）
原文外掛簡介
Hungarian: Magyar nyelvű bővítmény leírás
RefiTune – Site refiner toolkit is a modular Swiss Army knife for WordPress. Clean up unnecessary front-end code, harden login and uploads, tune Heartbeat and updates, or brand wp-login – each module is opt-in.
Enable or disable features individually. A clean dashboard shows what is active. In-plugin Help pages document behaviour, trade-offs, and requirements.
What’s Inside? (37 Modules)
Performance:
* Header Cleanup – Strip unnecessary wp_head output for leaner pages.
* Feed Management – Control RSS/Atom feed link tags in the document head.
* Disable Emoji – Remove WordPress emoji scripts and styles.
* Disable jQuery Migrate – Drop legacy jquery-migrate when your stack does not need it.
* Disable oEmbed – Stop automatic embeds from pasted YouTube, Vimeo, Twitter/X, and similar URLs.
* Remove Asset Version Query Strings – Strip ?ver= from front-end CSS/JS (can break cache busting; prefer CDN purge or hashed filenames). Locked when WP_CACHE is true in wp-config.php.
* Post Revisions Limit – Cap stored revisions per post. Locked when WP_POST_REVISIONS is defined in wp-config.php.
* Auto-save Interval – Change how often the editor auto-saves. Locked when AUTOSAVE_INTERVAL is defined in wp-config.php.
* Trash Auto-Delete – Set trash retention; expired items are removed in batches so large queues stay memory-safe. Locked when EMPTY_TRASH_DAYS is defined in wp-config.php.
* Convert Uploads to WebP – Convert JPEG/PNG to WebP on upload, optional max size resize, then remove the original (GD or Imagick with WebP; uses unique filenames and refuses unsafe overwrites).
* Heartbeat API Control – Tune or disable Heartbeat in admin, front end, and the post editor.
* Resource Preload – Add early link rel="preload" hints for internal site assets by location (everywhere, front page, blog, or post ID), with as, type, crossorigin, and fetchpriority. Optional one-click import of active WordPress Font Library fonts (AJAX on demand).
Security:
* Hide Generator Tags – Remove WordPress (and WooCommerce, when active) version meta tags.
* Disable XML-RPC – Respond to XML-RPC with 404 and remove RSD discovery.
* Disable Trackback/Pingback – Close pings and strip pingback methods/headers.
* Disable File Editor – Set DISALLOW_FILE_EDIT so theme/plugin editors stay off. Locked in the UI when the constant is already defined in wp-config.php.
* Automatic Updates Control – Tri-state plugin, theme, translation, and core updates; reschedule update checks. Respects AUTOMATIC_UPDATER_DISABLED (full lock) and WP_AUTO_UPDATE_CORE (core-only; plugins/themes/translations and update checks stay configurable).
* Login Error Messages – Generic login errors to reduce username enumeration.
* Restrict Admin Access – Choose which roles may open wp-admin UI. Users with manage_options always keep access. Front-end admin-ajax.php is intentionally not blocked.
* REST API Restrictions – Limit selected core REST routes to users with manage_options.
* Login Limit – Rate-limit failed logins by IP and IP+username pair (REMOTE_ADDR only). Optional IP whitelist (one address per line). Covers wp-login.php and other wp_signon() paths (including WooCommerce).
* Verified Upload – Block disguised uploads: double extensions, MIME/magic mismatches, and script markers.
Visual:
* Hide Admin Bar – Hide the admin bar for selected roles.
* Block Visibility (Mobile) – Per-block always / mobile-only / desktop-only via wp_is_mobile(); omits HTML server-side; sends Vary: User-Agent (full-page caches must honour it). Also available in the core Hide block modal.
* Block Visibility (Roles) – Per-block visibility for guests, logged-in users, or selected roles; omits HTML server-side. Shares the Visibility panel and Hide block modal with the mobile module.
* Login Page Customization – Brand wp-login.php with logo and colours.
Email:
* Email Notifications – Disable or redirect selected WordPress system emails.
* Email sending – SMTP with encrypted password storage, or disable all site emails. In production, disabling TLS/certificate verification is blocked.
Miscellaneous:
* Disable Comments – Site-wide comments off (optional WooCommerce review keep).
* External Links in New Window – Open external links in a new tab with safe rel attributes.
* Enable Page Excerpt – Excerpt support for pages.
* Clean Upload Filenames – Sanitize upload filenames (accents, spaces, special characters).
* SVG Upload – Role-gated SVG uploads with allowlist-based sanitization (XXE-safe parse).
* AVIF Upload – Role-gated AVIF uploads (full core AVIF support needs WordPress 6.5+).
* Role Redirects – Per-role login and logout redirect URLs.
* Maintenance Mode – 503 maintenance page for guests; chosen roles keep access. Admin, AJAX, and cron stay available so staff can work.
* Dynamic Year Shortcodes – [refi-year] and [refi-year from="2006"].
More plugins: rotistudio.com
Author site: rottenbacher.hu
GitHub: github.com/rotisoft/refitune
Translations
English (default – source strings in code and refitune.pot)
Hungarian (Magyar) – refitune-hu_HU.po (compile to .mo for WordPress to load)
Contribute translations under /wp-content/plugins/refitune/languages/. Text Domain: refitune.
