Stop advertising a second, uglier address for every single page
Disable Shortlink removes the <link rel="shortlink"> tag and the matching HTTP header WordPress adds to every single post and page by default — a leftover from before URL shorteners existed, that some tools still pick up instead of the real permalink.
- Removes the shortlink tag from every page's head.
- Removes the matching Link header sent with every response.
- The ?p=ID address itself keeps working, unaffected.
- Only the advertisement of that address is removed.
<link rel="shortlink" href=".../?p=482" /><!-- shortlink tag removed -->Link: <.../?p=482>; rel=shortlink<!-- HTTP header removed -->What does Disable Shortlink do?
When the remove_shortlink module is active, TOWP_Remove_Shortlink removes two specific default WordPress callbacks: wp_shortlink_wp_head, which prints the <link rel="shortlink"> tag in the page head, and wp_shortlink_header, which sends the equivalent Link: HTTP header alongside the response. Both normally point to the ?p=ID form of a post's address, a compact link format WordPress introduced before third-party URL shorteners were common. Since the ?p=ID address itself keeps resolving exactly as before, only the two places WordPress actively advertises it get removed.
Every page ends up with two advertised addresses
Because WordPress still advertises this address by default, most sites carry it without anyone actually needing it.
The shortlink predates the tools that made it unnecessary
WordPress's shortlink feature was built for a time before URL shorteners were common, and on a modern site it mostly just sits there, unused by anyone who'd actually share a link.
Some tools pick it up instead of the real permalink
Because the shortlink gets actively advertised in both the page head and the HTTP response, a tool reading either one can end up using the ?p=ID address in place of a site's actual, cleaner permalink.
The advertisement removed, the address left working
The module removes both places WordPress actively promotes the shortlink, without touching the address itself.
A head tag, gone
The link rel="shortlink" element no longer appears in any page's HTML head.
An HTTP header, gone too
The matching Link header WordPress sends with every response stops going out alongside the shortlink tag.
Yet the address itself still works
Visiting the ?p=ID URL directly still resolves to the correct post; only WordPress's active advertisement of that address is removed.
A precise, minimal change
Every capability below is present in the supplied PHP class and its settings registration.
wp_shortlink_wp_head unhooked from wp_head
The exact callback WordPress uses to print the shortlink tag gets removed from the hook entirely.
wp_shortlink_header unhooked at its exact priority
The matching Link header callback gets removed from template_redirect at priority 11, the same priority WordPress core registers it at.
Not just the visible tag
The HTML tag is easy to notice by viewing page source; the HTTP header isn't, and this module removes both together.
Nothing about routing changes
The ?p=ID query format is a standard WordPress routing mechanism, entirely separate from the advertisement this module removes.
Two hook removals, nothing else
The entire module is exactly two remove_action calls, changing nothing else about how the site behaves.
A single toggle, nothing further
There's nothing to set up beyond enabling the module; the removal applies consistently across every post and page.
Where removing the shortlink helps most
The module supports any site that no longer has a real use for this legacy default output.
Keeping one consistent address per page
Reduce the chance that a syndication tool, embed generator, or crawler picks up the shortlink instead of the actual permalink.
General markup and header cleanup
Remove an output most modern sites have no use for, as part of keeping page markup and response headers tidy.
Sites auditing their own HTTP response headers
Trim an unnecessary header from every response as part of a broader review of what a site actually sends back.
A small cleanup, nothing broken
The module combines a genuine, if modest, tidy-up with zero effect on how the address itself works.
Two hooks removed, nothing added
The verified implementation only prevents two default outputs; it doesn't add any logic of its own.
Two hook removals, evaluated once
The entire change happens at initialization; there's no per-request logic beyond WordPress simply not calling the two removed callbacks.
Slightly less markup and one fewer header, every page
Every response sends marginally less data, since the shortlink tag and header are no longer generated at all.
No new processing added anywhere
The module doesn't add any logic of its own; it only prevents two things WordPress would otherwise do by default.
Honest about scope: cleanup, not a fix
The code closes no vulnerability; it removes two default outputs and nothing more.
A markup and header cleanup, not a vulnerability fix
This module addresses tidiness and link consistency; it isn't closing a security gap, and the module's own description makes no such claim.
One fewer place the internal post ID appears
The shortlink's ?p=ID format includes the post's internal database ID; removing its advertisement is a minor, incidental reduction in what's actively surfaced.
The underlying address remains fully reachable
Since the ?p=ID URL isn't disabled, this module doesn't restrict access to anything; it only stops actively pointing at it.
Configuration requires the same access as any other setting
Enabling the module happens through the standard TheOneWP settings screen, available only to an administrator.
Built directly around WordPress's own shortlink hooks
The supplied code integrates through APIs present in WordPress core; this page makes no compatibility claim beyond the verified implementation.
wp_head and wp_shortlink_wp_head
The native WordPress action and callback responsible for printing the shortlink tag in the page head.
template_redirect and wp_shortlink_header
The native WordPress action and callback responsible for sending the matching Link HTTP header, removed at its exact registered priority.
The ?p=ID query variable
The standard WordPress post-ID query routing that resolves the shortlink address, left completely untouched by this module.
TheOneWP versus common alternatives
Compare the verified implementation with a typical head-only cleanup snippet.
| Capability | TheOneWP Disable Shortlink | Other common solutions |
|---|---|---|
| Head tag removal | Removed via remove_action, cleanly | Often the only part addressed by a general cleanup snippet |
| HTTP header removal | Removed at its exact registered priority | Frequently missed entirely, since it's invisible in page source |
| Effect on the shortlink address itself | Left fully working, only its advertisement removed | Some broader "cleanup" snippets can accidentally affect routing too |
| Scope of the change | Exactly two hook removals, nothing more | Bundled cleanup plugins can carry unrelated side effects |
| Administration | A single toggle, nothing to configure | Usually a code snippet added manually to a theme |
Confirm the cleanup in four steps
Since there's nothing to configure beyond enabling it, verification is the real workflow here.
Enable Disable Shortlink
Activate the module from the TheOneWP Components settings tab; there's nothing further to configure.
View a page's source to confirm the tag is gone
Check a post or page's HTML head and confirm no shortlink link element appears.
Check the HTTP response headers
Inspect a page's response headers and confirm the Link header no longer includes a shortlink entry.
Confirm the address itself still resolves
Visit a post's ?p=ID address directly and confirm it still loads the correct content.
Treat this as housekeeping, not a security step
The value here is a tidier default output, nothing more and nothing less.
Treat this as routine cleanup, not a security step
This module tidies up markup and headers; it's worth enabling as general housekeeping rather than expecting it to close any risk.
Check third-party sharing or embed tools after enabling
If anything relied on reading the shortlink specifically, confirm it still behaves as expected once the advertisement is gone.
Pair it with other markup-cleanup modules for a tidier head
Removing the shortlink fits naturally alongside other modules that trim unnecessary default WordPress output.
No further maintenance needed once enabled
Since the module has no settings, there's nothing to revisit after the initial toggle.
Avoid expecting more than a modest cleanup
A couple of assumptions are worth correcting before enabling this module.
Expecting the ?p=ID address to stop working
The module removes the advertisement of the shortlink, not the address itself; visiting it directly still resolves normally.
Overestimating the security impact
This is a markup and header cleanup, not a vulnerability fix; the module's own description makes no security claim beyond removing an unnecessary output.
Checking only the page source and missing the HTTP header
Since the shortlink also travels as an HTTP Link header, invisible in page source, a thorough check needs to inspect response headers too.
Disable Shortlink FAQ
These answers come directly from the verified class and its settings registration.
What does Disable Shortlink do?
It removes the shortlink link tag from the page head and the matching Link HTTP header, both of which WordPress adds by default to every post and page.
Does this break the shortlink address itself?
No. The ?p=ID address keeps working exactly as before; only WordPress's active advertisement of it gets removed.
What was the shortlink feature originally for?
It was built for sharing a compact link before third-party URL shorteners became common; on a modern site it mostly duplicates the real permalink.
Does this remove both the visible tag and the HTTP header?
Yes. Both outputs of the same feature get removed together, including the header, which isn't visible just by viewing page source.
Is this a security feature?
No. It's a markup and header cleanup; it doesn't close a vulnerability or restrict access to anything.
Will any tool that reads the shortlink break?
A tool specifically looking for the shortlink tag or header won't find it anymore; the underlying page and its real permalink are unaffected.
Does this affect page load performance?
The effect is marginal: slightly less markup and one fewer HTTP header per page, with no other performance impact.
Is there anything to configure beyond enabling the module?
No. The module works automatically once enabled, with no additional settings.
Does this affect how search engines see the page?
The module only removes the shortlink tag and header; it doesn't touch canonical URLs, meta tags, or anything else search engines rely on.
Who can enable this module?
Only an administrator with access to the TheOneWP settings screen.
Stop advertising a second address for every page.Keep the shortlink URL working, just not promoted.
Use Disable Shortlink to remove the shortlink tag and its matching HTTP header from every post and page, with nothing else about the site affected.