[westonruter]

The pr ("hint probability") attribute allowed by wp_resource_hints() since r38826 was only ever part of the W3C Resource Hints working drafts. No browser implemented it, and it was removed from that spec in w3c/resource-hints#76. The HTML Living Standard, which now defines resource hints, has no such attribute on <link>, so printing it only produces invalid markup.

This PR:

• Stops printing pr and removes it from the wp_resource_hints filter documentation.
• Moves the inline allowlist into an $allowed_attributes map from each attribute name to whether it may be printed without a value. Only crossorigin can be valueless.
• Allows fetchpriority, hreflang, media, referrerpolicy, and title, the remaining <link> attributes the spec permits with dns-prefetch, preconnect, prefetch, and prerender. Of these, fetchpriority most closely fills the role pr was meant to. The other <link> attributes stay disallowed because the spec restricts them to other link types: blocking, color, disabled, imagesizes, imagesrcset, integrity, and sizes.
• Applies the same $allowed_attributes map approach to wp_preload_resources(), which shared the same hand-built markup and the same valueless attribute handling.
• Builds the <link> tags in both functions with WP_HTML_Tag_Processor instead of concatenating strings, so set_attribute() escapes the values (running href through esc_url()) and prints true as a bare attribute. The preload href is still limited to the http and https protocols.

Behavior changes for valueless attributes, in both wp_resource_hints() and wp_preload_resources():

• 'crossorigin' => true prints a bare crossorigin instead of crossorigin='1', and false omits it instead of printing crossorigin=''.
• A list item, as in array( 'crossorigin', 'href' => … ), is printed only when it names an allowed attribute that may be valueless. Previously any string list item was printed as a bare attribute, which let arbitrary attribute names bypass the allowlist.
• true or false supplied for an attribute that requires a value is skipped instead of being printed as '1' or ''.

Markup changes from using the HTML API:

• Attribute values are now in double quotes, and the tags no longer end in />. For example, <link rel='dns-prefetch' href='//wordpress.org' /> is now printed as <link rel="dns-prefetch" href="//wordpress.org">. The tests now compare markup with assertEqualHTML(), so they are not tied to either serialization.
• Every & in a value is encoded, whereas esc_attr() left existing character references alone. A value that was already HTML-escaped by the caller, such as Tom & Jerry, is now double-encoded.

Trac ticket: https://core.trac.wordpress.org/ticket/66435

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5 (medium effort)
Used for: Researching the status of the pr attribute and the <link> attributes in the HTML spec, implementing the changes and tests, and drafting the Trac ticket and this description, under the direction of the author, who reviewed the result.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[westonruter]

_{🤖 Comment by Claude Opus 5.5 (medium effort)}

A Veloria search of the plugin and theme directories found no code using pr for resource hints, so dropping it appears to affect no one. Four extensions pass 'crossorigin' => true, which now prints a valid bare crossorigin instead of crossorigin='1', with fetch behavior unchanged.

Details

pr attribute: no usage found

• No plugin or theme passes 'pr' => with a probability value. Case-insensitive matches for 'pr' => turned up only unrelated arrays: Freemius country lists ('PR' => 'Puerto Rico'), public suffix lists, CSS padding options (pt/pr/pb/pl), payment line items, and query args.
• 'pr' => with a variable value (15 matches across 13 plugins) is likewise unrelated to resource hints.
• No plugin or theme prints pr= on a hand-written <link rel="dns-prefetch|preconnect|prefetch|prerender"> either.

'crossorigin' => true: output improves

About 850 wp_resource_hints filter callbacks exist (459 across 387 plugins, 787 across 571 themes). Most add a fonts.gstatic.com preconnect using the list-item form from the bundled themes, array( 'href' => …, 'crossorigin' ). That form is unchanged.

These pass 'crossorigin' => true:

• Go (60,000 installs): includes/core.php:524
• Simple CAPTCHA with Cloudflare Turnstile (200,000 installs): inc/integrations/other/resource-hints.php:27
• Tiger Elements Forms: src/Form/Widget/Asset_Manager.php:373
• Ayyash: inc/customizer/class-ayyash-customize.php:189

Since '1' is an invalid value for a CORS settings attribute, browsers already treat it as anonymous.

Most other 'crossorigin' => true matches (233 across 146 plugins) are wp_kses() allowed-HTML arrays, which are unaffected.

List items other than crossorigin: none found

No hint arrays were found that pass a list item other than crossorigin, such as 'anonymous' or 'use-credentials' without a key. Those will now be dropped. The searches here are line-based, so a list item inside a multi-line array that does not sit on its own line could have been missed.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[westonruter]

cc @dmsnell @sirreal for how the HTML Tag Processor is now used to construct the LINK tags in wp_preload_resources() and wp_resource_hints().