Bundled WordPress Plugins

Scope

ReactWP builds six normal WordPress plugins from src/plugins/. They are independent packages in the generated installation: their behavior applies only while the corresponding generated plugin is active.

Plugin	Source version	Responsibility
reactwp-frontend	1.0.0	remove public WordPress output that conflicts with the controlled React shell
reactwp-backend	1.0.0	reshape the classic administration experience
reactwp-images	1.0.0	disable WordPress image derivatives and preserve editor quality
reactwp-accept-svg	1.2.0	capability-gated, sanitized SVG uploads
reactwp-acf-local-json	1.1.0	store ACF JSON with the active theme
reactwp-seo	1.0.1	ACF SEO fields, robots policy, and direct/client-navigation head output

Their JavaScript, SCSS, and media entry files are empty starter entries today. The implemented behavior below is PHP behavior; the build still creates the normal plugin bundle targets so a project can add assets deliberately.

reactwp-frontend

The plugin applies these public-side choices:

• hides the WordPress admin bar
• disables WordPress's automatic sizes="auto" image addition
• returns null from the speculation-rules configuration
• dequeues global-styles, wp-block-library, and classic-theme-styles
• removes global-style enqueue callbacks from the head/footer
• removes RSD, generator, index relation, Windows Live Writer, start/adjacent post relation, REST discovery, oEmbed discovery, feed, resource-hint, shortlink, and emoji output
• removes the shortlink HTTP header callback

These choices reduce duplicate or framework-owned output; they also mean a project that intentionally uses block-library CSS, feeds, oEmbed discovery, resource hints, speculation rules, or WordPress auto-size behavior must change or disable this plugin. It does not unregister WordPress REST routes, feeds, oEmbed endpoints, or blocks themselves; it removes the listed frontend discovery/enqueue output.

reactwp-backend

Editor and Dashboard

The plugin disables the block editor for every post type through use_block_editor_for_post_type. It additionally removes classic editor support from the built-in post and page types.

At dashboard setup priority 99 it removes the welcome panel and these dashboard boxes when present: incoming links, plugins, secondary news, recent comments, At a Glance, activity, Site Health, WordPress events/news, Quick Draft, and recent drafts.

Side Menu and Customizer

The normal side menu hides Tools, Media, Appearance, Plugins, Comments, Users, and ACF field groups. Under Settings it hides Privacy, Media, Writing, and Discussion. The Customizer removes the themes and navigation panels plus Site Identity, Homepage Settings, Additional CSS, and Colors sections.

This is interface cleanup, not an authorization boundary. The plugin does not remove the underlying WordPress capabilities, routes, screens, post types, or APIs. A user who still has permission can reach several hidden screens through the ReactWP admin bar or a direct admin URL.

Admin Bar

The plugin removes the WordPress logo, default site-name, comments, and new-content nodes. It removes Updates unless the user has all three update capabilities for core, plugins, and themes.

It can then add:

• the site name linking to / in a new tab
• Menus when the user can edit theme options and at least one ReactWP theme location exists
• Images & files when the user can upload files
• Users plus Profile when the user can list users, or only Profile otherwise
• a ReactWP group when the user can edit theme options
• Site settings and Theme settings when ACF options-page APIs exist
• Themes and its Editor child according to switch_themes / edit_themes
• Plugins, Cache, plugin Editor, ACF, Import, and Export according to the corresponding capabilities and feature availability

The Cache node is added after Plugins and requires manage_options, but it is nested inside the branch that also requires activate_plugins. Production DISALLOW_FILE_EDIT still controls whether WordPress permits a linked theme/plugin editor screen; the admin-bar link does not override WordPress configuration.

Finally, the plugin hides the top-level Site settings and Theme settings menu nodes and theme action buttons with administration CSS. Their intended entry points are the ReactWP admin-bar group.

reactwp-images

The plugin returns an empty array from intermediate_image_sizes_advanced, so WordPress does not generate registered intermediate sizes for new image processing operations. It also returns quality 100 from both jpeg_quality and wp_editor_set_quality.

It does not resize originals, create responsive derivatives, transcode formats, optimize previously uploaded files, or control the separate ReactWP theme-build optimization performed by Sharp/SVGO. Projects that use WordPress thumbnails or srcset derivatives should change or deactivate this policy before relying on those files.

reactwp-acf-local-json

The runtime directory is:

<active stylesheet theme>/datas/acf/

In this repository, author the equivalent deployable source at:

src/themes/<theme>/template/datas/acf/

On admin_init and before an ACF JSON save, the plugin creates the directory when possible and adds missing index.php, .htaccess, and web.config deny files. It returns that directory as ACF's one save path. For loading, it removes ACF's first default path and appends the theme directory only when it exists.

The directory therefore needs write permission when WordPress is expected to save JSON from the admin. On read-only production deployments, commit JSON from a development environment and ship it with the theme instead. Nginx must apply the equivalent HTTP deny rule because .htaccess and web.config are server-specific.

reactwp-accept-svg

SVG MIME registration defaults to users with manage_options; rwp_svg_upload_capability can return another capability. The maximum file size defaults to 2 MiB through rwp_svg_max_bytes, with a hard minimum of 1 KiB after filtering.

Every normal upload, sideload, and SVG filetype/extension verification goes through the same path sanitizer. It:

1. requires a readable regular non-symlink file
2. rejects the byte limit, DOCTYPE, and entity declarations
3. parses XML with network access disabled
4. requires an SVG document element in the empty or standard SVG namespace
5. sanitizes with bundled enshrined/svg-sanitize 0.22.0
6. removes remote references and minifies the result
7. validates the sanitized XML again
8. writes a temporary sibling with an exclusive lock, preserves file permissions when possible, and atomically renames it over the upload

The ReactWP sanitizer extension keeps only empty or same-document #fragment href/xlink:href values. JavaScript URLs, remote images, event attributes, scripts, external entities, malformed XML, and a missing sanitizer fail closed.

The plugin sanitizes SVG markup; it does not turn an SVG into a raster image, inspect the visual meaning of safe vector paths, or make arbitrary inline SVG strings in project React components trustworthy.

reactwp-seo

The SEO plugin registers its content and global ACF groups only in request contexts that need them, contributes the rwp_wp_head tag set, updates WordPress robots directives, and localizes global defaults as window.RWP_SEO when the main theme handle is enqueued.

Its exact fields, output tags, fallback order, robots rules, browser head allowlist, and PHP resolver methods are documented in Head and SEO.

Build and Activation Boundary

configs/webpack.plugins.config.js is the authoritative list of generated normal plugins. The production/development build copies each plugin's template/ directory and builds its optional JavaScript, SCSS, and media entry. Building a plugin does not activate it in WordPress; activation remains WordPress state in the generated installation.

The shared ReactWP mu-plugin is not one of these six normal plugins. It is loaded separately from wp-content/mu-plugins and owns the route, payload, rendering, cache, settings, and REST contracts described in PHP Runtime.