Don W. Voorhies

Right — eventhough I really haven’t been good at showing this News-page much love, due to behind-the-scenes turmoil and drama the past year or so, there’s recently been a busy stretch on the coding front here at Voorhies Towers, so here’s a roundup of what’s been updated, refactored or otherwise prodded into shape across the board.

OAP — v.2.0.2

The trusty old anthology got a couple of targeted fixes: a push-notification contrast issue has been sorted, compatibility for push/captcha scripts has been improved, and the query-string cleanup logic has been tightened up to only strip version-like parameters rather than going in with a sledgehammer.

More importantly, as of v.2.0.1, OAP has been intentionally scoped down so it can run cleanly alongside Critical Path CSS v2 without the two stepping on each other’s toes. A number of frontend optimization functions — critical CSS inlining, font handling, GTM deferral — have been migrated over there, where they logically belong. OAP now handles what the others don’t: header cleanup, embed disabling, Heartbeat API control, minify/combine, and similar housekeeping functions.

Download and further details: donvoorhies.github.io/oap

Critical Path CSS — v.2.x

This one started life as the “Above The Fold”-functionality I’d been baking into OAP for years (or rather: “trying to”), and has now been properly spun out into its own plugin — with a considerably more ambitious scope.

The main idea is straightforward enough: inline the CSS that’s needed for above-the-fold rendering, defer everything else, and get the browser painting as fast as possible. In practice, that involves a few moving parts:

• Google Fonts self-hosting — downloads the woff2 files to your own server and rewrites the CSS references locally, cutting out the fonts.gstatic.com DNS lookup chain entirely. (There were a couple of interesting bugs to iron out here — one involving corrupted upload URLs being constructed from filesystem paths rather than site_url(), and another where basename() was mangling CDN filenames. Both fixed, with proper error logging added.)
• Script deferral — defer or async individual scripts by handle or URL fragment
• GTM lazy-loading — defers Google Tag Manager until first user interaction, with a 5-second fallback to ensure it always fires
• LCP preload hints — adds fetchpriority="high" preload for the LCP image

Download and further details: donvoorhies.github.io/critical-path-css-v2

CCCP — Clean Cookie Consent Plugin — v.1.x

CCCP is the new privacy plugin, and it comes with something of a philosophical position baked in: there is no Marketing category. That’s not an oversight — it’s the point. Personal sites don’t need ad-tech surveillance infrastructure, and a cookie consent plugin shouldn’t pretend otherwise.

Three categories — Preferences, Functional, and Analytics — all blocked by default until the visitor explicitly opts in. Pre-configured to block Google Tag Manager, YouTube, and Vimeo until consent is given. Page reload on consent (rather than dynamic injection, which tends to be fiddly and fragile). Cookie policy page generator included.

If you’ve visited this site recently, you’ll have seen it in action in the bottom-left corner.

Download and further details: donvoorhies.github.io/cccp

Flak Jacket — WordPress Hardening

The newest addition to the suite. Flak Jacket is a security hardening plugin built on a single design principle: nothing is enabled automatically on activation. You get a dashboard showing what’s available and what’s active — you decide what to turn on.

This might sound like a strange choice for a security plugin, but silent auto-hardening is precisely how you end up locked out of your own admin panel. Better to show the options clearly and let the site owner make an informed decision.

What it covers:

• Login protection — limit login attempts with configurable lockout, rename /wp-login.php to a custom URL, TOTP-based two-factor authentication (pure PHP, no external library, inline SVG QR code)
• Security headers — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CSP — each individually toggleable
• File & directory protection — via .htaccess markers: protect wp-config.php, disable directory browsing, block access to readme.html, license.txt, and similar
• WordPress exposure — remove WP version, disable XML-RPC, disable login error hints

Flak Jacket also detects when OAP is active and marks overlapping items (WP version removal, XML-RPC) as “Handled by OAP” in the dashboard rather than duplicating them.

Download and further details: donvoorhies.github.io/flak-jacket

Vofa — v.1.x

Vofa hasn’t had any dramatic structural changes, but it’s been kept current and has had a number of smaller refinements applied. If you’re running an earlier version, the current one is worth picking up — the GitHub repository is the canonical source.

For those not familiar: Vofa is the lightweight WordPress theme I released a while back — minimal footprint, fast by default, responsive, and designed to be customisable via theme editor comments rather than a bloated options panel. Named after the Icelandic word for “ghost,” for reasons that should be self-evident once you’ve looked at the load times.

Download and further details: donvoorhies/github.io/vofa

_d (Underscored) — current

_d is the custom CSS layer and header.php tweaks I’ve built on top of Automattic’s _s (Underscores) starter theme — which is what this site runs on. It’s had some cosmetic and compatibility updates to keep it running cleanly alongside the current plugin suite.

It’s not a theme you install and forget about — it’s a starting point for people who want to roll their own design on a solid, minimal foundation. If that sounds like you, it’s available on GitHub along with the relevant instructions.

Download and further details: github.com/donvoorhies/_d-underscored

The suite, as it stands

The four plugins are now designed to run together without conflicts or duplicated functionality:

• OAP — general WordPress optimizations (cleanup, minify, Heartbeat control)
• Critical Path CSS — render performance (critical CSS, font self-hosting, GTM deferral)
• CCCP — privacy and cookie consent
• Flak Jacket — security hardening

All four are free, open source, and available on GitHub. No subscriptions, no SaaS dependencies, no phone-home.

Thanks for reading this…!