Don’t Fear the MU Code

MU Code in WordPress is a super powerful tool. a few lines of code can replace an entire plugin.

As standard, MU Code is a bit difficult to reach and edit so I have created a handy plugin to allow you to edit and publish all of these snippets from inside your WP Admin Dashboard.

tcr-mu-plugin-editor-v1.0.4 Download

Snippets:

Here is a sneak peek of the handy code snippets to come which you can add to your own WP instance and tweak to suit your own needs:

Stop Spam Carts

<?php
// STOP SPAM CARTS !
    add_filter( 'woocommerce_add_to_cart_validation', 'prevent_get_request_add_cart_item', 10, 5 );
    function prevent_get_request_add_cart_item( $passed, $product_id, $quantity, $variation_id = '', $variations = '' ) {
      if ( isset( $_GET['add-to-cart'] ) ) {
        return false;
      }
      return $passed;
    }

Bot Trap Product

<?php
 404]);
}

/**
 * Block add-to-cart via classic flows (button, form POST, ?add-to-cart, AJAX).
 */
add_filter('woocommerce_add_to_cart_validation', function(
    $passed,
    $product_id,
    $quantity,
    $variation_id = 0,
    $variations = []
){
    if ( ! $product_id ) return $passed;

    $check_id = $variation_id ?: $product_id;
    $product  = function_exists('wc_get_product') ? wc_get_product($check_id) : null;

    if ( $product && $product->get_sku() === TCR_TRAP_SKU ) {
        tcr_send_404_and_die();
    }

    return $passed;
}, 0, 5);

/**
 * Extra guard: if someone hits ?add-to-cart=ID directly.
 */
add_action('init', function() {
    if ( empty($_REQUEST['add-to-cart']) ) return;

    $id      = absint($_REQUEST['add-to-cart']);
    $product = function_exists('wc_get_product') ? wc_get_product($id) : null;

    if ( $product && $product->get_sku() === TCR_TRAP_SKU ) {
        tcr_send_404_and_die();
    }
});

/**
 * Store API / headless guard: block /wp-json/wc/store/cart/add-item payloads.
 * We avoid theme templates and return the same 404 response body.
 */
add_action('rest_api_init', function () {
    $uri = $_SERVER['REQUEST_URI'] ?? '';
    if (strpos($uri, '/wp-json/wc/store/cart') === false) return;

    // Read once; REST calls send JSON bodies.
    $raw  = file_get_contents('php://input');
    $body = $raw ? json_decode($raw, true) : [];

    // Handle both single add and batch structures.
    $maybe_items = [];
    if (isset($body['id'])) {
        $maybe_items[] = $body;
    } elseif (!empty($body['items']) && is_array($body['items'])) {
        $maybe_items = $body['items'];
    }

    foreach ($maybe_items as $item) {
        $pid = isset($item['id']) ? absint($item['id']) : 0;
        if ( ! $pid ) continue;

        $product = function_exists('wc_get_product') ? wc_get_product($pid) : null;
        if ( $product && $product->get_sku() === TCR_TRAP_SKU ) {
            tcr_send_404_and_die();
        }
    }
});

Performance & Cleanup

Disable Emojis & Embeds – “Speed Up WP: Remove Emojis & Embeds”
Limit Revisions & Autosave – “Stop DB Bloat: Revisions/Autosave Tweak”
Dequeue Unused Block Styles – “Faster Frontend: Trim Block CSS”
Remove Query Strings from Assets – “Cache Better: Strip ?ver from CSS/JS”
Preload/Preconnect Hints – “Instant Speed: Preload Fonts & CDN”
Defer/Async JS (safe list) – “Defer Scripts for Faster Paints”
Heartbeat Rate Control – “Save CPU: Tame WP Heartbeat”
Disable XML-RPC – “Secure & Faster: Kill XML-RPC”
Tidy wp_head() Output – “Clean Head: Remove RSD/WLManifest/Shortlink”

Security & Hardening

Force Strong Passwords (non-admins) – “Stronger Passwords in 1 Minute”
Block User Enumeration – “Stop /?author= Scans”
Disallow File Editing – “Safer WP: Disable Theme/Plugin Editor”
Restrict REST Endpoints – “Lock Down REST: Public vs Private”
Auto-Logout Inactive Users – “Security: Auto-Logout Idle Users”
Limit Login Attempts (lightweight) – “Soft Rate Limit: Stop Brute Force”

Admin UX & Workflow

Custom Admin Menu Cleanup – “Declutter Admin: Hide Menu Items”
Custom Dashboard Widget – “Your Dashboard, Your Metrics”
Change Login Logo/URL/Title – “Brand Your Login Screen”
Auto-Assign Default Categories – “No ‘Uncategorized’ Ever Again”
Force Media Upload Limits (size/MIME) – “Control Uploads: Types & Sizes”
SVG Uploads (sanitized) – “Enable Safe SVG Uploads”

Content & SEO

Auto Nofollow External Links – “SEO Safety: Nofollow External Links”
Open External Links in New Tab – “UX Tweak: External Links Target=_blank”
Fallback ALT Text for Images – “Accessibility: Auto ALT Fallbacks”
Exclude Pages from Search – “Cleaner Search: Posts Only”
Canonical Tweaks on Archives – “Fix Duplicate Content Canonicals”
Auto-Set Featured Image (first image) – “No More Missing Thumbs”
Custom 404 Suggestions (popular posts) – “Smarter 404: Keep Users On-Site”
Disable RSS or Customize Feeds – “Control Feeds: Disable or Beautify”

Comments & Spam Control

Auto-Close Comments After X Days – “Kill Old Comment Spam”
Disable Comments on Media – “Stop Attachment Comment Spam”
Keyword/URL Count Filters – “Comment Filter: Fewer Spammy Links”
Nightly Spam Trash via Cron – “Auto-Clean Spam while You Sleep”

WooCommerce Practical Wins

Change “Add to Cart” Text – “Custom Add-to-Cart Text in 60s”
Min Order Amount + Notice – “Minimum Order with Friendly Message”
Hide Shipping Until Address – “Cleaner Checkout: Hide Shipping Early”
Auto-Complete Virtual Orders – “Instant Delivery: Virtual Orders Auto-Complete”
Block Spam Add-to-Cart via GET – (you planned this) “Stop Bot Carts (MU Code)”
Cart Item Limits/Blacklist – “Limit Quantities or Block SKUs”
Stock Threshold Alerts (custom) – “Smarter Low-Stock Email Triggers”

Scheduling / Automation

Custom Cron for DB Cleanup – “Weekly Tidy: Options/Transients”
Post-Publish Pings (e.g., webhook) – “Trigger Webhooks on Publish”
Auto-Expire Old Posts – “Set Content Expiry Dates”

Multisite / User Management

Force Site Language/Timezone – “Consistent Locale Settings”
Role/Capability Tweaks – “Create a Custom Editor+ Role”
Redirect After Login by Role – “Send Users Where They Belong”

The Code Rebel