Dashicons loaded in frontend by Generatepress theme

Hi there,

I don’t think AI is telling you the right things 🙂

Line 16 of header.php is<?php wp_head(); ?>, and line 17 of page.php isget_header(); ?>; these are standard functions for WP themes.

Neither of the codes will cause the visitor to load Thickbox.

Thickbox is only loaded on the front end if a theme or plugin explicitly registers and queues it using wp_enqueue_script( 'thickbox' ) and wp_enqueue_style( 'thickbox' ). But this kind of code does not exist in GP’s files.

Can you provide your site link?

I don’t see any Dashicon font being loaded on the front end, as you can see in the screenshot, all the fonts loaded are listed here:
https://app.screencast.com/RI3Zbs4w0W9IB

Hi there,

You’re right that Dashicons is being delivered to visitors. I checked both your live and staging shop pages while logged out, and both include Dashicons CSS, Thickbox CSS, and Thickbox JavaScript.

The font screenshot missed this because Dashicons embeds its font directly inside the CSS file. It therefore doesn’t need to appear as a separate font download in the Network panel.

However, Google AI’s conclusion about the GeneratePress files is incorrect. Those lines contain the standard WordPress functions wp_head() and get_header(). Their appearance in a diagnostic trace doesn’t mean Thickbox was hardcoded into the theme or that malicious code was injected. Seeing parent-theme templates while using a child theme is also normal.

WordPress automatically includes Dashicons when Thickbox’s stylesheet is requested. We therefore need to identify what is requesting Thickbox.

BeRocket’s Advanced AJAX Product Filters plugin would be a useful first test, although I haven’t confirmed it as the cause. On staging, could you temporarily deactivate it, clear the page cache, and check whether Dashicons and Thickbox still appear when viewing the shop while logged out?

There’s no reason to edit those GeneratePress template files based on the information provided.

I assume the plugin is required for your site, so keeping it deactivated isn’t really an option.

The remaining question is whether its frontend features actually need Thickbox. Loading it doesn’t necessarily mean there’s a bug, but it could be unnecessary overhead.

If you rely on the product filters, I’d keep the plugin enabled and contact BeRocket support with your findings. Ask them:

– Which frontend feature requires Thickbox?

– If it’s only needed in the admin area, can they prevent it from loading for visitors?

I wouldn’t remove Dashicons on its own, since Thickbox uses it for its close icon. If BeRocket confirms Thickbox isn’t needed on the frontend, they can provide a suitable fix or snippet to stop loading both Thickbox assets. Dashicons may then disappear automatically, provided nothing else requires it.

No problem! 🙂