fix(seo): stop core guessing a destination for a 404

[parisek]

Ported from a downstream project where it had been a hand-rolled add_filter() in functions.php. It is a reasonable default for this stack rather than a project quirk.

What core does

redirect_guess_404_permalink() matches the requested slug as a prefix and redirects to whatever comes back first:

// wp-includes/canonical.php:979
$where = $wpdb->prepare( 'post_name LIKE %s', $wpdb->esc_like( get_query_var( 'name' ) ) . '%' );

Two problems, and only the first is a matter of taste.

A wrong 301 is worse than a 404. A reader following a dead link is told the page moved and then shown something unrelated. A 404 is a fact; a guess is an answer, and it is confidently wrong.

The query cannot use the index. Leading value, trailing wildcard. It runs on every 404 that carries a name in the URL — a scan any visitor can ask for as often as they like, with no authentication and no rate limit.

Genuine canonical redirects are untouched

Checked rather than assumed. The guess is the last thing redirect_canonical() tries:

// wp-includes/canonical.php:214
if ( ! $redirect_url ) {
    $redirect_url = redirect_guess_404_permalink();

Trailing-slash, ?p=ID-to-slug and category-base have each had their turn before it. Those correct a request that names the right post, and they keep working.

On by default, which reverses core

Disabling the guess loses nothing correct — it only stops the guessing. The site it costs is one that renames slugs without leaving redirects behind and relies on the guess to catch the fallout:

// Base.php
protected bool $disable_404_permalink_guess = false;

Naming

Written as $guess_404_permalink = false first. Every flag in this group reads "true means the kit does the thing" — $disable_xmlrpc, $disable_emojis, $disable_feeds, $disable_self_pingbacks, $disable_file_editing.

The inverted name also broke the family's own test_no_hooks_registered_when_all_flags_disabled, because "all flags off" would have registered a filter. That failure was the signal the polarity was wrong rather than merely unusual — worth recording, because the test caught a naming problem, not a bug.

Tests

Two, both verified load-bearing by removal: flipping the default fails the default test, removing the wiring fails the registration test, and neither touches the other. Added to the existing RegisterSecurityHardeningHooksTest harness rather than a new file, and the property is registered in its bareInstanceWithAllFlagsOff() list.

1878 tests, PHPStan clean.