WordPress Functions.php Snippet Generator

Pick from 22 vetted functions.php snippets — cleanup, security, admin, editor, performance and theme setup — and get prefixed, documented PHP.

Runs in your browser

Settings

Output for

Every function starts with this prefix.

Used for translatable strings.

Untick when appending to an existing functions.php.

Snippets (4 selected)

Presets:

Cleanup

  • Removes the emoji detection script, styles and DNS prefetch added to every page. Browsers display emojis natively.

  • Removes <meta name="generator"> from the head and feeds. Hides the version from casual scanners — it does not replace keeping WordPress updated.

  • Closes comments and pings, hides existing comments, removes comment support from all post types, the admin menu, dashboard box, admin bar item, widget, feed link and REST endpoints.

  • Stops WordPress from sending pingbacks to your own site when you link to one of your posts.

  • Redirects all feeds to the home page and removes feed links from the head. Only for sites without a blog.

Security

  • Disables XML-RPC methods (including pingbacks and system.multicall brute force), the X-Pingback header and the RSD link.

    Jetpack and the WordPress mobile apps need XML-RPC. To block xmlrpc.php before PHP even loads, use the .htaccess generator instead.
  • Stops /author/username/ pages (and ?author=1 user enumeration) and removes users from the core XML sitemap. Ideal for single-author or business sites.

  • Users who cannot edit posts (subscribers, customers) are sent to the front end. AJAX and admin-post.php form handlers keep working.

Admin

  • Hides the front-end toolbar for users below the chosen role.

  • Replaces the WordPress logo on wp-login.php with your own, linking to your home page instead of wordpress.org.

  • Adds a box to the Dashboard — handy for client instructions or support contact details.

  • Replaces “Thank you for creating with WordPress” at the bottom of admin screens.

Editor & media

  • Uses the Classic Editor for the listed post types via use_block_editor_for_post_type. Other post types keep the block editor.

  • Lets administrators upload SVG files to the Media Library.

  • Caps how many revisions are kept per post to keep the database lean. The WP_POST_REVISIONS constant in wp-config.php is the preferred method — use this filter when you cannot edit wp-config.php.

    0 disables revisions entirely (not recommended).

  • Changes the length (in words) of automatic excerpts and the text appended to them. Manual excerpts are not affected.

Performance

  • Drops the jquery-migrate dependency for visitors (the admin is untouched). Test your theme and plugins: old jQuery code may need it.

  • Saves a ~35 KB stylesheet for visitors. Dashicons still load if another enqueued style depends on them.

Theme setup

  • Declares core features for classic themes. Block themes enable most of these automatically.

  • Adds menu locations to Appearance → Menus (classic themes).

  • Adds image sizes with add_image_size() and makes them selectable in the editor. Existing images need their thumbnails regenerated.

  • Loads the stylesheet and script the right way, with filemtime() cache busting and a deferred script (WordPress 6.3+ loading strategy).

PHP · 104 lines

<?php
/**
 * Theme functions — paste into your child theme's functions.php.
 */

/* Cleanup --------------------------------------------------------------- */

/**
 * Disable the emoji script, styles and DNS prefetch.
 */
function acme_disable_emojis() {
	remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
	remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
	remove_action( 'wp_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	remove_action( 'admin_enqueue_scripts', 'wp_enqueue_emoji_styles' );
	remove_action( 'wp_print_styles', 'print_emoji_styles' ); // WordPress < 6.4.
	remove_action( 'admin_print_styles', 'print_emoji_styles' ); // WordPress < 6.4.
	remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
	remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );
	remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
	add_filter( 'tiny_mce_plugins', 'acme_disable_emojis_tinymce' );
	add_filter( 'wp_resource_hints', 'acme_disable_emojis_dns_prefetch', 10, 2 );
}
add_action( 'init', 'acme_disable_emojis' );

/**
 * Remove the emoji plugin from the classic editor.
 *
 * @param array $plugins TinyMCE plugins.
 * @return array
 */
function acme_disable_emojis_tinymce( $plugins ) {
	return is_array( $plugins ) ? array_diff( $plugins, array( 'wpemoji' ) ) : array();
}

/**
 * Remove the emoji CDN from the DNS prefetch hints.
 *
 * @param array  $urls          URLs to print for resource hints.
 * @param string $relation_type The relation type the URLs are printed for.
 * @return array
 */
function acme_disable_emojis_dns_prefetch( $urls, $relation_type ) {
	if ( 'dns-prefetch' !== $relation_type ) {
		return $urls;
	}
	foreach ( $urls as $key => $url ) {
		$href = is_array( $url ) && isset( $url['href'] ) ? $url['href'] : $url;
		if ( is_string( $href ) && false !== strpos( $href, 's.w.org/images/core/emoji' ) ) {
			unset( $urls[ $key ] );
		}
	}
	return $urls;
}

/**
 * Remove the WordPress version from the <head> and feeds.
 */
function acme_remove_version() {
	remove_action( 'wp_head', 'wp_generator' );
}
add_action( 'init', 'acme_remove_version' );
add_filter( 'the_generator', '__return_empty_string' );

/* Security -------------------------------------------------------------- */

// Disable XML-RPC and all of its methods.
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', '__return_empty_array' );

/**
 * Remove the X-Pingback HTTP header.
 *
 * @param array $headers HTTP headers.
 * @return array
 */
function acme_remove_x_pingback( $headers ) {
	unset( $headers['X-Pingback'] );
	return $headers;
}
add_filter( 'wp_headers', 'acme_remove_x_pingback' );

/**
 * Remove the Really Simple Discovery link from the <head>.
 */
function acme_remove_rsd_link() {
	remove_action( 'wp_head', 'rsd_link' );
}
add_action( 'init', 'acme_remove_rsd_link' );

/* Editor & media -------------------------------------------------------- */

/**
 * Keep at most 10 revisions per post.
 *
 * Preferred alternative — add this line to wp-config.php instead:
 * define( 'WP_POST_REVISIONS', 10 );
 *
 * @return int
 */
function acme_limit_revisions() {
	return 10;
}
add_filter( 'wp_revisions_to_keep', 'acme_limit_revisions' );

Test on a staging site first. A PHP syntax error in functions.php takes the site down — if that happens, WordPress recovery mode emails the admin a link, or remove the code over SFTP.

What belongs in functions.php?

Every WordPress theme can include a functions.php file that runs on every request, front end and admin. It is where themes declare features (add_theme_support()), register menus and image sizes and enqueue their CSS and JavaScript — and where site owners add small tweaks with actions and filters: removing the emoji script, disabling comments, changing the excerpt length or customising the login screen.

Copying snippets from random blog posts is risky: many are outdated (emoji styles moved to wp_enqueue_emoji_styles in WordPress 6.4), use unprefixed function names that collide with plugins, or skip escaping. This generator offers a curated library of 22 snippets that follow the WordPress Coding Standards: tabs, Yoda conditions, prefixed named functions with docblocks, escaped output and translatable strings using your text domain.

Choose Child theme functions.php for presentation-related code, or Site plugin for functionality that must survive a theme change — disabling comments, XML-RPC or author archives should not stop working when someone switches themes.

How to use the WordPress Functions.php Snippet Generator

  1. Set your function prefix (e.g. your theme or company slug) and text domain, and choose whether the code is for a child theme or a site plugin.
  2. Tick the snippets you need, or start from a preset such as Recommended cleanup or Brochure site. Options appear under each selected snippet.
  3. Review any warnings — some snippets (SVG uploads, disabling feeds or XML-RPC) have trade-offs explained right there.
  4. Copy the combined PHP or download it as functions.php / a plugin file, and test it on a staging site before deploying.

Example

Every snippet is a prefixed, documented function hooked into WordPress — for example, limiting revisions:

/**
 * Keep at most 10 revisions per post.
 *
 * Preferred alternative — add this line to wp-config.php instead:
 * define( 'WP_POST_REVISIONS', 10 );
 *
 * @return int
 */
function acme_limit_revisions() {
	return 10;
}
add_filter( 'wp_revisions_to_keep', 'acme_limit_revisions' );

functions.php or a site plugin?

Code in a theme’s functions.php only runs while that theme is active, and edits to a parent theme are lost on update — always use a child theme. A site-specific plugin is a single PHP file with a plugin header in wp-content/plugins/your-slug/; it keeps working regardless of the theme. A good rule: if the code changes how the site looks, put it in the theme; if it changes how the site works, put it in a plugin.

Notes on specific snippets

  • Disable XML-RPC removes all methods, but xmlrpc.php is still executed. Block it at the server with the .htaccess generator for better performance under attack.
  • Allow SVG uploads is limited to administrators and does not sanitise files. SVGs can carry JavaScript; use a sanitising plugin if anyone else uploads media.
  • Limit post revisions: the WP_POST_REVISIONS constant in wp-config.php is simpler and applies before any plugin loads; the filter is for hosts where you cannot edit wp-config.php.
  • Custom image sizes only apply to new uploads. Regenerate thumbnails (wp media regenerate) for existing images, and preview the resulting files with the Image Size Calculator.
  • Enqueue assets uses filemtime() so browsers fetch new CSS/JS as soon as the file changes, and the WordPress 6.3+ strategy => defer argument for non-blocking scripts.

Frequently Asked Questions

Why do all the functions have a prefix?

PHP functions share one global namespace. If a plugin defines disable_emojis() and so does your theme, the site crashes with a fatal “cannot redeclare” error. A unique prefix such as acme_ avoids collisions.

What if I break my site with functions.php?

A PHP error triggers WordPress recovery mode, which emails the admin a special login link so you can fix the code. You can also rename or edit the file over SFTP or your host’s file manager. Testing on staging first avoids the problem altogether.

Should I include the opening <?php tag?

Only if the file is new. An existing functions.php already starts with <?php; append the snippets below it without a second opening tag and without a closing ?>.

Do these snippets work with block themes?

Most do. Theme supports, menus and the excerpt filter are mainly for classic themes — block themes enable features through theme.json and use the Navigation and Post Excerpt blocks, which have their own settings.

Is disabling comments with code better than a plugin?

It is lighter: the snippet covers post type support, open/closed status, existing comments, the admin menu, dashboard box, admin bar, widget, comments feed and REST endpoints without adding a settings screen.