WordPress performance, security and SEO: Core Web Vitals, caching, Wordfence and migrations

add_action( 'wp_head', function () {
    if ( ! is_singular() ) {
        return;
    }
    $image_id = get_post_thumbnail_id();
    if ( ! $image_id ) {
        return;
    }
    $src = wp_get_attachment_image_src( $image_id, 'full' );
    if ( ! $src ) {
        return;
    }
    printf(
        '<link rel="preload" as="image" href="%s" fetchpriority="high">' . "\n",
        esc_url( $src[0] )
    );
}, 1 );

// And make sure the LCP image is NOT lazy-loaded.
add_filter( 'wp_get_attachment_image_attributes', function ( $attr, $attachment, $size ) {
    if ( 'full' === $size && is_singular() && get_post_thumbnail_id() === $attachment->ID ) {
        $attr['loading']       = 'eager';
        $attr['fetchpriority'] = 'high';
    }
    return $attr;
}, 10, 3 );

The second filter is the one people forget: the preload only helps if the image itself isn't deferred.

// wp-config.php
define( 'WP_REDIS_HOST', '127.0.0.1' );
define( 'WP_REDIS_PORT', 6379 );
define( 'WP_REDIS_PREFIX', 'mysite:' );
define( 'WP_REDIS_DATABASE', 0 );
define( 'WP_REDIS_MAXTTL', 86400 );

// Keep admin-only data out of Redis so it can't leak or bloat it.
add_action( 'init', function () {
    wp_cache_add_non_persistent_groups( [ 'my_admin', 'my_import_log' ] );
} );

// Flush on deploy — stale page CSS + stale object cache is the classic "ghost bug".
// In your deploy script: wp cache flush && wp transient delete --all

WP_REDIS_PREFIX is per environment; without it a staging flush wipes production's cache.

add_filter( 'authenticate', function ( $user, $username ) {
    if ( empty( $username ) ) {
        return $user;
    }
    $ip  = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
    $key = 'login_fail_' . md5( $ip . '|' . strtolower( $username ) );
    $n   = (int) get_transient( $key );

    if ( $n >= 5 ) {
        return new WP_Error( 'too_many_attempts', __( 'Too many attempts. Try again in 15 minutes.', 'my-textdomain' ) );
    }
    return $user;
}, 30, 2 );

add_action( 'wp_login_failed', function ( $username ) {
    $ip  = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
    $key = 'login_fail_' . md5( $ip . '|' . strtolower( $username ) );
    set_transient( $key, (int) get_transient( $key ) + 1, 15 * MINUTE_IN_SECONDS );
} );

After 5 failed attempts for the same IP and username the login is refused for 15 minutes, with no plugin to deactivate.

// Yoast: change the Article schema type.
add_filter( 'wpseo_schema_article', function ( $data ) {
    if ( is_singular( 'case_study' ) ) {
        $data['@type'] = 'CaseStudy';
    }
    return $data;
} );

// Rank Math: equivalent hook.
add_filter( 'rank_math/schema', function ( $data ) {
    if ( is_singular( 'case_study' ) && isset( $data['@type'] ) ) {
        $data['@type'] = 'CaseStudy';
    }
    return $data;
} );

The hook names are plugin-specific, so a snippet copied from Yoast to Rank Math silently does nothing.

add_filter( 'xmlrpc_enabled', '__return_false' );

add_filter( 'wp_headers', function ( $headers ) {
    $headers['X-Content-Type-Options']  = 'nosniff';
    $headers['X-Frame-Options']         = 'SAMEORIGIN';
    $headers['Referrer-Policy']         = 'strict-origin-when-cross-origin';
    $headers['Permissions-Policy']      = 'camera=(), microphone=(), geolocation=()';
    return $headers;
} );
// HSTS belongs at the server/proxy layer, not in PHP.

Disabling XML-RPC in code survives plugin deactivation, and you should still block it at the server too.