{"id":19107766,"url":"https://github.com/alleyinteractive/wp-alleyvate","last_synced_at":"2025-08-21T17:32:07.703Z","repository":{"id":145027816,"uuid":"607244306","full_name":"alleyinteractive/wp-alleyvate","owner":"alleyinteractive","description":"Defaults for WordPress sites by Alley.","archived":false,"fork":false,"pushed_at":"2024-10-23T18:58:10.000Z","size":408,"stargazers_count":18,"open_issues_count":26,"forks_count":2,"subscribers_count":23,"default_branch":"main","last_synced_at":"2024-10-25T14:38:26.004Z","etag":null,"topics":["wordpress","wordpress-plugin"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alleyinteractive.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-27T15:56:41.000Z","updated_at":"2024-10-17T15:53:00.000Z","dependencies_parsed_at":null,"dependency_job_id":"7d9cefbe-79df-4e89-a120-c8a8572a614d","html_url":"https://github.com/alleyinteractive/wp-alleyvate","commit_stats":null,"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alleyinteractive%2Fwp-alleyvate","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alleyinteractive%2Fwp-alleyvate/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alleyinteractive%2Fwp-alleyvate/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alleyinteractive%2Fwp-alleyvate/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alleyinteractive","download_url":"https://codeload.github.com/alleyinteractive/wp-alleyvate/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230523761,"owners_count":18239445,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["wordpress","wordpress-plugin"],"created_at":"2024-11-09T04:13:53.474Z","updated_at":"2025-08-21T17:32:07.694Z","avatar_url":"https://github.com/alleyinteractive.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Alleyvate\n\nAlleyvate contains baseline customizations and functionality for WordPress sites that are essential to delivering a project meeting Alley's standard of quality.\n\n## Installation\n\nInstall the latest version with:\n\n```bash\ncomposer require alleyinteractive/wp-alleyvate\n```\n\n## Basic usage\n\nAlleyvate is a collection of distinct features, each of which is enabled by default. Each feature has a handle, and sites can opt out of individual features with the `alleyvate_load_feature` or `alleyvate_load_{$handle}` filters. Features load on the `after_setup_theme` hook, so your filters must be in place before then.\n\n### Disabling Features\n\nThe intention of this plugin is that all features should be on by default, unless there is a good reason to turn them off. For example most sites will want to have the `disable_comments` feature turned on, unless a site is actually using WordPress comments, in which case it should be turned off.\n\nTo disable a feature, use the `alleyvate_load_{$feature_name}` filter and return `false`. For example, to tell Alleyvate to _not_ disable comments:\n\n```php\nadd_filter( 'alleyvate_load_disable_comments', '__return_false' );\n```\n\n## Features\n\nEach feature's handle is listed below, along with a description of what it does.\n\n### `cache_slow_queries`\n\nThis feature caches/optimizes slow queries to the database to improve\nperformance. It is enabled by default and currently includes the following slow\nqueries with the relevant filters to disable them:\n\n- `alleyvate_cache_months_dropdown`: The dropdown for selecting a month in the post list table.\n\n### `clean_admin_bar`\n\nThis feature removes selected nodes from the admin bar.\n\n### `disable_apple_news_non_prod_push`\n\nThis feature disables pushing to Apple News when not on a production environment. This is determined by setting the `WP_ENVIRONMENT_TYPE` environment variable, or the `WP_ENVIRONMENT_TYPE` constant.\n\n### `disable_attachment_routing`\n\nThis feature disables WordPress attachment pages entirely from the front end of the site.\n\n### `disable_block_editor_rest_api_preload_paths`\n\nThis feature enhances the stability and performance of the block edit screen by disabling the preloading of Synced\nPatterns (Reusable Blocks). Typically, preloading triggers `the_content` filter for each block, along with\nadditional processing. This can lead to unexpected behavior and performance degradation, especially on sites with\nhundreds of synced patterns. Notably, an error in a single block can propagate issues across all block edit screens.\nDisabling preloading makes the system more resilient—less susceptible to cascading failures—thus improving overall\nadmin stability. For technical details on how WP core implements preloading, refer to\n`wp-admin/edit-form-blocks.php.`\n\n### `disable_comments`\n\nThis feature disables WordPress comments entirely, including the ability to post, view, edit, list, count, modify settings for, or access URLs that are related to comments completely. The blocks are also removed from the Gutenberg block editor.\n\n### `disable_custom_fields_meta_box`\n\nThis feature removes the custom fields meta box from the post editor.\n\n### `disable_dashboard_widgets`\n\nThis feature removes clutter from the dashboard.\n\n### `disable_deep_pagination`\n\nThis feature restricts pagination queries to, at most, 100 pages by default. This value is filterable using the `alleyvate_deep_pagination_max_pages` filter, or by passing the  `__dangerously_set_max_pages` argument to `WP_Query`.\n\n```php\n// An example.\n$query = new WP_Query(\n  [\n    'paged' =\u003e 102,\n    '__dangerously_set_max_pages' =\u003e 150,\n  ]\n);\n```\n\n### `disable_file_edit`\n\nThis feature prevents the editing of themes and plugins directly from the admin.\n\nSuch editing can introduce unexpected and undocumented code changes.\n\n### `disable_pantheon_constant_overrides`\n\nThis feature prevents Pantheon environments from forcing CLI and Cron runs to use the `WP_HOME` or `WP_SITEURL` constants,\nwhich have been shown to force those environments to use an insecure protocol at times.\n\n### `disable_password_change_notification`\n\nThis feature disables sending password change notification emails to site admins.\n\n### `disable_site_health_directories`\n\nThis feature disables the site health check for information about the WordPress directories and their sizes.\n\n### `disable_sticky_posts`\n\nThis feature disables WordPress sticky posts entirely, including the ability to set and query sticky posts.\n\n\n### `disable_trackbacks`\n\nThis feature disables WordPress from sending or receiving trackbacks or pingbacks.\n\n### `disable_xmlrpc`\n\nThis feature disables XML-RPC (and removes all methods) for all requests made to XML-RPC that come from IPs that are not known Jetpack IPs.\n\n### `force_two_factor_authentication`\n\nThis feature forces users with `edit_posts` permissions to use two factor authentication (2fa) for their accounts.\n\n### `login_nonce`\n\nThis feature adds a nonce to the login form to prevent CSRF attacks.\n\n### `noindex_password_protected_posts`\n\nThis feature adds noindex to the robots meta tag content for password-protected posts.\n\n### `prevent_framing`\n\nThis feature prevents the site from being framed by other sites by outputting a\n`X-Frame-Options: SAMEORIGIN` header. The header can be disabled by filtering\n`alleyvate_prevent_framing_disable` to return true. The value of the header can\nbe filtered using the `alleyvate_prevent_framing_x_frame_options` filter.\n\nThe feature can also output a `Content-Security-Policy` header instead of\n`X-Frame-Options` by filtering `alleyvate_prevent_framing_csp` to return true.\nBy default, it will output `Content-Security-Policy: frame-ancestors 'self'`.\nThe value of the header can be filtered using\n`alleyvate_prevent_framing_csp_frame_ancestors` to filter the allowed\nframe-ancestors. The entire header can be filtered using\n`alleyvate_prevent_framing_csp_header`.\n\n### `redirect_guess_shortcircuit`\n\nThis feature stops WordPress from attempting to guess a redirect URL for a 404 request.\n\nThe underlying behavior of `redirect_guess_404_permalink()` often confuses clients, and its database queries are non-performant on larger sites.\n\n### `remove_shortlink`\n\nThis feature removes the shortlink from the head of the site. By default,\nWordPress adds a shortlink to the head of the site, which is not used by most\nsites.\n\n### `user_enumeration_restrictions`\n\nThis feature requires users to be logged in before accessing data about registered users that would otherwise be publicly accessible. Its handle is `user_enumeration_restrictions`.\n\nWordPress core [\"doesn't consider usernames or user IDs to be private or secure information\"][1] and therefore allows users to be listed through some of its APIs.\n\nOur clients tend to not want information about the registered users on their sites to be discoverable; such lists can even disclose Alley's relationship with a client.\n\n### `twitter_embeds`\n\nThis feature adds full support for `x.com` URLs for oEmbeds. Out of the box, only `twitter.com` URLs are fully supported in WordPress (the block editor, it should be noted, [replaces x.com with twitter.com](https://github.com/WordPress/gutenberg/blob/a2b6d39d01d023b6c7c48ad6df5002b78a06794d/packages/block-library/src/embed/edit.js#L161-L166)).\n\nThis feature also adds fallback handling for Twitter's oEmbed API endpoint, which can unpredictably and inexplicably return 404 responses (see [the X Developers Forum for numerous threads on the topic](https://devcommunity.x.com/tag/oembed)). If a 404 is encountered, the response is passed through the `alleyvate_twitter_embeds_404_backstop` filter, along with data about the request and the number of attempts to that endpoint during this pageload.\n\nBy default, Alleyvate hooks into this filter to provide one additional attempt at getting a successful response from a proxy server, if the ENV variable `TWITTER_OEMBED_BACKSTOP_ENDPOINT` is set. WPVIP offers a fallback proxy server which seems to reliably return a valid response.\n\nIf one doesn't have a proxy service, one suggestion would be to hook into this filter to enqueue a cron task that makes many (e.g. up to 100) rapid-fire requests to twitter until a successful response comes back. In experimenting with the Twitter oEmbed endpoint, we've found that it both works and fails in spurts, and if we make 100 requests in a loop, we eventually get a 200 response.\n\n## About\n\n### License\n\n[GPL-2.0-or-later](https://github.com/alleyinteractive/wp-alleyvate/blob/main/LICENSE)\n\n### Maintainers\n\n[Alley Interactive](https://github.com/alleyinteractive)\n\n[1]: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falleyinteractive%2Fwp-alleyvate","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falleyinteractive%2Fwp-alleyvate","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falleyinteractive%2Fwp-alleyvate/lists"}