The Zinn® Footprint plugin

Zinn® Footprint reduces what a WordPress site tells the outside world about itself. It is part of the Footprint-Free hosting line and is available to signed-in customers from your dashboard rather than from a public download.

Everything it does is a removal. It adds nothing to your pages and changes nothing a visitor sees.

What it switches off, and why

• The generator tag and version in feeds — otherwise every page states which WordPress

version you run, which is the first thing an automated scan reads.

• The ?ver= query string on core assets — same information, in a second place. Your own

theme and plugin versions are left alone, because they are how browsers know to fetch a changed file.

• RSD, manifest, shortlink and discovery links — machine-readable pointers to your admin

and XML-RPC that almost no modern site uses.

• XML-RPC and pingbacks — a login surface with no rate limit, and the mechanism behind a

common reflected attack.

• Generic login errors — WordPress otherwise tells an attacker which of the username and

the password was wrong, which halves the work.

• The X-Powered-By header — the PHP version, on every response.

Each is an independent toggle and all of them default to on.

What to check after switching it on

XML-RPC is the only one that ever breaks something. If you use the WordPress mobile app, Jetpack's older features, or a desktop editor that posts remotely, they use XML-RPC and will stop working. Everything else on the list is inert on a modern site.

So: switch it on, then open the site, log out and back in, and post from anything you normally post from. If something has stopped, it is XML-RPC — turn that one toggle back off and leave the rest.

What it is not

It is not a security plugin and not a firewall. It removes information, which raises the cost of an automated scan; it does not block anything. Keep your updates current regardless.