=== XO Magic Box Light ===
Contributors:      xodesignworks
Tags:              performance, cleanup, optimization, core web vitals, security
Requires at least: 6.2
Tested up to:      7.1
Requires PHP:      7.4
Stable tag:        1.0.0
License:           GPLv2 or later
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

Speed up, clean up and harden WordPress from one admin. 67 modules instead of a dozen plugins. No telemetry, no external calls, no account.

== Description ==

**A dozen single-purpose plugins do what this one does — and most of them phone home. This one never does.**

XO Magic Box Light is the maintenance layer nearly every WordPress site ends up needing: front-end performance, head cleanup, essential SEO, security hardening and the small tweaks you always apply anyway. Seven groups of switches in one fast admin screen, instead of a shelf of separate plugins each loading its own framework.

Every feature is a self-contained module, and a module that is switched off **loads no code at all** — the things you leave off cost you nothing at runtime.

There is no account, no subscription, no telemetry and **not a single outbound request**. Nothing in this plugin contacts any external server, ever.

= It works alongside your cache plugin, not instead of it =

A page cache makes WordPress send a page faster. This plugin makes the page itself lighter before anything caches it — fewer scripts, fewer third-party connections, less markup. The two jobs are different, so nothing here duplicates or fights your caching setup, and the dashboard **detects other active cache and optimization plugins** so you can see up front where features might overlap.

= Faster pages =

* Remove jQuery Migrate, asset query strings, front-end Dashicons and unused block-library CSS.
* Minify HTML, safely: `pre`, `textarea`, `script`, `style` and `code` blocks are never touched.
* Defer JavaScript, with an exclusion list.
* Delay JavaScript until the first interaction, matched by keyword — ideal for analytics, chat widgets and trackers.
* Preconnect hints for third-party origins, handed to WordPress's own resource-hints pipeline, plus a preload list for your own critical assets.
* Speculative loading (prefetch/prerender) for near-instant navigation, configured through core's own ruleset on WordPress 6.8+.
* Disable or relax Google Fonts, and force `font-display: swap`.
* Throttle the Heartbeat API, and send `Last-Modified` headers.

= Better Core Web Vitals =

* Preload the featured image as the LCP candidate, with a proper responsive `srcset`.
* Adjustable above-the-fold lazy-load threshold, so the first images are not lazy-loaded.
* Stop generating registered image sizes you never use, on future uploads.
* Control big-image scaling and the maximum upload dimension.

= Cleanup =

* Remove the generator meta tag, RSD/WLW links, shortlink, REST and oEmbed head links, and the recent-comments inline style.
* Disable emojis, embeds and the feeds you do not use.
* Limit or disable post revisions; keep trashed items instead of auto-purging them.
* Scheduled database cleanup, plus an on-demand cleanup that shows you **how many rows each type would remove before it removes anything**.

= Essential SEO =

* robots.txt editor.
* Noindex for paginated archives and post subpages.
* Noindex on staging and non-production environments, detected automatically.
* Attachment-page redirects and forced HTTPS, including a mixed-content fix.
* `rel="noopener noreferrer"` on external new-tab links, with optional `nofollow`.
* Disable the built-in search where a site does not need it.

= Security hardening =

* Limit login attempts, and unify login error messages so they stop confirming valid usernames.
* Block user enumeration.
* Disable XML-RPC, application passwords and the built-in file editor.
* Security headers, `X-Powered-By` removal and `X-Pingback` removal.
* Comment spam honeypot — no captcha, no JavaScript, no external service, cache-safe.
* Password-protect the whole front end behind one shared password, for staging and private previews.

= Tweaks you would otherwise install plugins for =

* Disable comments, the comment website field and self-pingbacks.
* Classic widgets, no remote block patterns, no block directory or Openverse.
* Local placeholder instead of Gravatar, so no visitor data reaches an avatar service.
* Clean up the admin bar and dashboard, remove rarely used widgets, show post and page IDs.
* Duplicate any post or page in one click.
* Auto-publish posts stuck on "Missed schedule".
* Choose whether WordPress emails you about every auto-update, only failures, or never.

= Change things without holding your breath =

* Take a settings snapshot before risky changes, and restore it in one click.
* Curated one-click presets.
* Import and export the whole configuration.
* Conflict detection for other optimization and cache plugins.

= What this plugin does not do =

Being explicit saves everyone time:

* It is **not a page cache**. Use it together with your caching plugin.
* It does **not** minify or combine CSS and JavaScript, and does not generate critical CSS. HTML is the only thing minified here.
* It is **not** a full SEO suite. It handles indexing hygiene, not editorial SEO analysis.
* It is **not** a firewall or malware scanner. It hardens configuration; it does not police traffic.
* No backups, no SMTP delivery, no cookie banner, no image CDN.

= Privacy =

No telemetry, no analytics, no advertising, no remote account features, no licence checks, and no outbound HTTP requests of any kind. Everything happens on your own server. Settings live in a single autoloaded option; feature data lives in its own non-autoloaded rows so it never bloats the settings load.

= Good fit for =

* Site owners replacing several small maintenance plugins with one.
* Agencies standardising client sites, with presets and export/import.
* Shops and content sites working on Core Web Vitals.
* Shared hosting, where every avoided request matters.
* Cleaning up an inherited WordPress install.

== Installation ==

1. Install through **Plugins → Add New**, or upload the `xo-magic-box-light` folder to `/wp-content/plugins/`.
2. Activate **XO Magic Box Light** on the **Plugins** screen.
3. Open **XO Magic Box Light** in the admin sidebar.
4. Optionally apply the **Recommended** preset on the Dashboard tab for a safe baseline in one click.
5. Take a snapshot before making broad changes, and check the conflict notice if you run a cache or optimization plugin.

No account, API key or configuration file is required.

== Frequently Asked Questions ==

= Does it replace my cache plugin? =

No, and it is not meant to. A cache plugin serves pages faster; this plugin makes the page lighter in the first place. Run both. The Dashboard flags other active cache and optimization plugins so you can spot overlapping features before enabling them.

= Does the plugin collect any data or phone home? =

No. There is zero telemetry, no licence or update server of its own, and no feature that contacts any external service. The plugin makes no outbound HTTP requests at all.

= Will enabling a lot of modules slow my site down? =

No. A disabled module never loads its code — `boot()` only runs for what you switch on, so there is no dormant overhead. Settings are read from a single autoloaded option.

= What if I change a lot of settings and something breaks? =

Use the Dashboard's safe mode: snapshot before you start, restore in one click if anything misbehaves. Presets are snapshotted automatically before they are applied.

= Does it work with WooCommerce, page builders and caching plugins? =

Yes. It does not assume a theme or builder, and the conflict detector warns about common cache and optimizer plugins.

= Does the database cleanup delete anything without asking? =

No. Each cleanup type shows its row count first, and nothing is removed until you click that type. Auto-drafts follow the same 7-day age rule WordPress core uses, so a post you are still writing is never touched.

= What happens to my data if I uninstall? =

Every option the plugin created, its snapshot and its login-lockout transients are removed on uninstall, on every site of a multisite network.

= Does it work on multisite? =

It runs per site: every site in a network keeps its own settings, whether you activate it per site or network-wide. There is no network-admin settings screen, so each site is configured from its own admin. The conflict detector also takes network-activated plugins into account, and uninstalling removes the plugin's data from every site in the network.

= Is there a fuller version? =

Yes. XO Magic Box (the full edition) adds local WebP/AVIF conversion, schema.org structured data and Open Graph, IndexNow, a redirect manager, 404 monitor, activity and mail logs, conditional per-page asset unloading with a live asset scanner, self-hosted Core Web Vitals monitoring, lazy-loaded video embeds, login-URL renaming, WooCommerce optimisation, WP-CLI commands, and Dashboard tools such as a database optimizer, serialization-safe search & replace and a broken-link checker. Those features are marked with a "Pro" badge in this plugin's admin so you can see what they are. It is a separate, larger package — none of its code ships here.

= How is the admin translated? =

The plugin is fully internationalised and translations come from translate.wordpress.org, so WordPress downloads and applies the pack for your site language automatically. Contributions in any language are welcome there.

== Changelog ==

= 1.0.0 =
* Initial public release: 67 modules across Performance, Media, Cleanup, SEO, Security, Tweaks and Tools.
* Modular core — one class per feature, a disabled module loads no code, all settings in a single autoloaded option.
* Performance: asset cleanup, safe HTML minification, defer and interaction-based delay for JavaScript, resource hints, speculative loading, font controls, Heartbeat throttling, `Last-Modified` headers, scheduled and on-demand database cleanup.
* Core Web Vitals: LCP featured-image preload with responsive `srcset`, lazy-load threshold, image-size management, upload-dimension limits.
* Cleanup: head and meta cleanup, emoji/embeds/feeds toggles, revision limits, trash retention.
* SEO: robots.txt editor, pagination and non-production noindex, attachment redirects, forced HTTPS, mixed-content fix, external-link attributes.
* Security: login-attempt limits, generic login errors, user-enumeration blocking, XML-RPC and application-password controls, file-editor lockdown, security headers, comment honeypot, front-end password gate.
* Tweaks: comments, classic widgets, remote patterns and block directory, local avatar placeholder, admin-bar and dashboard cleanup, post IDs, one-click duplicate, missed-schedule recovery, auto-update email control.
* Dashboard: conflict detector, curated presets, one-click snapshot and restore, settings import/export.
* Zero telemetry and zero outbound HTTP requests.
* Fully internationalised, ready for community translations on translate.wordpress.org.

== Upgrade Notice ==

= 1.0.0 =
Initial public release.
