Add Security & performance settings group + hardening module

New Settings > Security & performance group (Hardening + Performance) with
toggles wired by admin/src/Security/Security.php — each gated on its own
setting, adding/removing core hooks so anything left off behaves exactly like
stock WordPress:

- Disable XML-RPC (xmlrpc_enabled false + drop X-Pingback header)
- Disable comments site-wide (close everywhere, strip post-type support,
  remove the Comments menu/dashboard-widget/toolbar node)
- Clean up <head> (generator, RSD, WLW manifest, shortlink)
- Disable emoji scripts/styles + the s.w.org dns-prefetch
- Disable oEmbeds (discovery links, host js, embed REST route, wp-embed) —
  discovery links are removed at whatever priority core hooks them (loops,
  since they can be registered at more than one)
- Heartbeat API: default / slow (60s) / disabled

New setting keys need no schema change (Settings::merge_on_save +
additionalProperties). Every toggle verified at the hook level on PHP 8.5.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

app/src/pages/settings/settingsConfig.js

@@ -317,6 +317,77 @@ export const settingsGroups = [
       },
     ],
   },
+  {
+    id: 'security',
+    title: 'Security & performance',
+    icon: 'dashicons-shield',
+    categories: [
+      {
+        id: 'security-hardening',
+        title: 'Hardening',
+        subtitle: 'Reduce your site’s attack surface and trim unnecessary output',
+        icon: 'dashicons-shield-alt',
+        fields: [
+          {
+            key: 'disable_xmlrpc',
+            type: 'toggle',
+            label: 'Disable XML-RPC',
+            description:
+              'Turn off the XML-RPC endpoint, a common brute-force and pingback-DDoS vector. Leave on only if you rely on the WordPress mobile app or remote publishing.',
+          },
+          {
+            key: 'disable_comments',
+            type: 'toggle',
+            label: 'Disable comments',
+            description:
+              'Turn comments off site-wide — closes them on every post type, hides existing ones, and removes the Comments admin screen and dashboard widget.',
+          },
+          {
+            key: 'remove_head_junk',
+            type: 'toggle',
+            label: 'Clean up <head>',
+            description:
+              'Remove the WordPress generator/version tag, RSD link, WLW manifest, and shortlink meta from your site’s <head>.',
+          },
+        ],
+      },
+      {
+        id: 'performance-tweaks',
+        title: 'Performance',
+        subtitle: 'Trim requests and scripts WordPress loads by default',
+        icon: 'dashicons-performance',
+        fields: [
+          {
+            key: 'disable_emojis',
+            type: 'toggle',
+            label: 'Disable emoji scripts',
+            description:
+              'Stop WordPress loading its emoji-detection script and styles on every front-end and admin page.',
+          },
+          {
+            key: 'disable_oembed',
+            type: 'toggle',
+            label: 'Disable oEmbeds',
+            description:
+              'Remove oEmbed discovery links and the wp-embed script (stops auto-embedding of pasted URLs and the embed REST route).',
+          },
+          {
+            key: 'heartbeat_mode',
+            type: 'select',
+            label: 'Heartbeat API',
+            description:
+              'The Heartbeat API polls the server on a timer (autosave, post-lock notices). Slow it down or disable it to cut admin-ajax load.',
+            default: 'default',
+            options: [
+              { value: 'default', label: 'Default (15–60s)' },
+              { value: 'slow', label: 'Slow (60s)' },
+              { value: 'disabled', label: 'Disabled' },
+            ],
+          },
+        ],
+      },
+    ],
+  },
   {
     id: 'add-ons',
     title: 'Add-ons',