10 Plugins You Can Replace With a Few Lines of Code

Some plugins are real products — WooCommerce, a proper backup tool, a form system wired to your CRM. Keep those. But a huge share of what’s installed on typical WordPress sites is a 5–15 line snippet wearing a settings page, an admin banner and an upsell.

Every one you replace removes requests, database weight, update anxiety and attack surface (remember: 96% of WordPress vulnerabilities live in plugins). Here are ten with the exact code. Put snippets in a small site plugin or your child theme’s functions.php.

1. Duplicate Post

add_filter('post_row_actions', function ($actions, $post) {
    if (current_user_can('edit_posts')) {
        $url = wp_nonce_url(admin_url('admin.php?action=wpr_dup&post=' . $post->ID), 'wpr_dup');
        $actions['duplicate'] = '<a href="' . esc_url($url) . '">Duplicate</a>';
    }
    return $actions;
}, 10, 2);

add_action('admin_action_wpr_dup', function () {
    check_admin_referer('wpr_dup');
    $post = get_post((int) ($_GET['post'] ?? 0));
    if (!$post || !current_user_can('edit_posts')) wp_die('Not allowed');
    $new_id = wp_insert_post([
        'post_title'   => $post->post_title . ' (Copy)',
        'post_content' => $post->post_content,
        'post_type'    => $post->post_type,
        'post_status'  => 'draft',
    ]);
    wp_safe_redirect(admin_url('post.php?action=edit&post=' . $new_id));
    exit;
});

2. Google Analytics inserter

add_action('wp_head', function () { ?>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}
gtag('js',new Date());gtag('config','G-XXXXXXX');</script>
<?php }, 20);

An entire category of “insert header code” plugins is this one hook.

3. Hide the WordPress version

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

4. Disable XML-RPC (if you don’t use remote publishing)

add_filter('xmlrpc_enabled', '__return_false');

Both #3 and #4 are standard hardening — more in the security checklist.

5. SVG uploads (admins only, from trusted sources)

add_filter('upload_mimes', function ($m) {
    if (current_user_can('manage_options')) $m['svg'] = 'image/svg+xml';
    return $m;
});

6. Limit post revisions (instead of a “database optimizer”)

define('WP_POST_REVISIONS', 5); // wp-config.php

7. Disable comments site-wide

add_action('init', function () {
    foreach (get_post_types() as $pt) {
        remove_post_type_support($pt, 'comments');
        remove_post_type_support($pt, 'trackbacks');
    }
});
add_filter('comments_open', '__return_false');
add_filter('pings_open', '__return_false');

8. Related posts (same category, no tracking plugin)

$related = new WP_Query([
    'category__in'   => wp_get_post_categories(get_the_ID()),
    'post__not_in'   => [get_the_ID()],
    'posts_per_page' => 3,
    'no_found_rows'  => true,
]);

Loop it in your single template — done. (This exact pattern powers the “Keep reading” block on this blog.)

9. “Coming soon” / maintenance mode

add_action('template_redirect', function () {
    if (!is_user_logged_in()) {
        wp_die('<h1>Back soon</h1><p>We are doing scheduled maintenance.</p>', 'Maintenance', ['response' => 503]);
    }
});

10. Remove emoji scripts and other head bloat

remove_action('wp_head', 'print_emoji_detection_script', 7);
remove_action('wp_print_styles', 'print_emoji_styles');
remove_action('wp_head', 'wp_shortlink_wp_head');
remove_action('wp_head', 'rsd_link');
remove_action('wp_head', 'wlwmanifest_link');

The rules that make this safe

1. One snippet, one job, clearly commented. Keep them in a single “site functionality” plugin so a theme switch doesn’t lose them.
2. Replace one at a time. Add snippet → test → deactivate plugin → test for a week → delete.
3. Know where the line is. Payments, backups, complex forms, multilingual — those are products. Don’t hand-roll them.

Ten snippets ≈ ten fewer plugins ≈ dozens of fewer requests and queries, and a visibly smaller attack surface. Run the free analyzer before and after — the plugin count and CSS/JS file count are the scoreboard. And if the audit shows the builder is your real weight, that’s a different conversation.