About this plugin
FBS Secure Optimize (engineered by FBS Fusion ) is a modern, lightweight performance and security suite built around 6 Independent Zero-Overhead Modules.
Most sites don’t need bloated, all-or-nothing plugins that slow down wp-admin or clash with existing caching layers. With FBS Secure Optimize, every engine has its own 1-Click Master Toggle in the Module Control Center:
- Disabled Modules = Zero Runtime Overhead: Any module you toggle off is completely bypassed at boot—zero frontend hooks, zero database queries, and zero conflicts with WP Rocket, LiteSpeed Cache, FlyingPress, Autoptimize, Cloudflare, or WooCommerce.
- Auto-Hide Clean Interface: Turning a module off automatically hides its configuration panels and tabs so your dashboard stays focused and clutter-free.
6 Independent Modules Included Free
1. Asset & Core Web Vitals Optimizer (with 1-Click Universal Cache Purge)
Boost Lighthouse Performance, Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), and Total Blocking Time (TBT) without jQuery bloat or fragile script bundling:
com.
) paths and caching minified output.
* Zero-CLS Missing Image width & height Injection: Automatically detects local <img> tags missing explicit dimensions and injects cached width and height attributes to prevent layout shifts.
* LCP-Safe Native Lazy Loading: Adds native loading="lazy" and decoding="async" to offscreen images while stripping lazy-loading and applying fetchpriority="high" on your first above-the-fold hero image.
5s fallback—automatically bypassed on WooCommerce cart, checkout, and account pages.
* Top Admin Bar & Dashboard 1-Click “Purge Cache”: Instantly clears FBS inlined CSS & CLS dimension caches, WordPress Object Cache (Redis/Memcached), PHP OPcache, and triggers compatible cache flushes across LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Fastest Cache, WP Super Cache, Autoptimize, SiteGround, Breeze, and WP Engine.
* Iframe & Video Lazy Loading: Defers embedded maps and video players until visitors scroll near them.
* Safe Non-Critical JS Deferring: Adds defer to frontend scripts while automatically excluding jQuery core and sensitive checkout/account flows.
* Core Bloat Removal: Strip inline emoji scripts/styles, disable frontend Dashicons for logged-out visitors, dequeue unused oEmbed scripts, and clean <head> RSD, WLW, and shortlink tags.
php polling to 60 seconds to prevent CPU spikes and 502 timeouts on shared or VPS hosting.
2. Database & Autoload Cleaner
Keep MySQL lean for sub-200ms Server Time to First Byte (TTFB):
* 1-Click & Scheduled Cleanup: Safely remove post revisions, old auto-drafts ( > 7 days ), spam and trashed comments, expired transients, and orphaned postmeta rows.
* MySQL Table Optimization: Run OPTIMIZE TABLE across core tables manually or automatically via daily, weekly, or monthly WP-Cron schedules.
* Built-In Autoload Bloat Inspector: Instantly audit total autoloaded wp_options size (in KB) alongside your Top 5 Heaviest Autoloaded Options so hidden database bottlenecks never go unnoticed.
3. HTTP Security Headers
Achieve a hardened browser security posture without breaking stylesheets, fonts, or payment gateways:
* Toggleable X-Content-Type-Options: nosniff (MIME-sniffing defense)
* Toggleable X-Frame-Options: SAMEORIGIN (clickjacking protection)
* Toggleable Referrer-Policy: strict-origin-when-cross-origin
* Toggleable Permissions-Policy (restricts unauthorized camera, microphone, geolocation, and USB access)
* Optional Strict-Transport-Security (HSTS) for HTTPS sites
ver= )
4. Unified Login Brute-Force Shield
Stop automated credential-stuffing and brute-force bots before they exhaust PHP workers:
* Automatic IP Lockouts: Lock out attacking IPs after a configurable number of failed login attempts and lockout window.
* Trusted IP Allowlist: Whitelist your office or developer IPs so you are never locked out.
* Username Enumeration Masking: Replace verbose login failure hints with generic error messages so attackers cannot harvest valid usernames.
* Live Telemetry & 1-Click Reset: View recent failed login attempts (IP, username, UTC timestamp) and clear active lockouts in one click.
5. Core Hardening & 1-Click Uploads PHP Shield
Close the most common entry points used in automated site compromises:
phar shells uploaded into media folders.
multicall brute-force and pingback DDoS vectors.
author=1 archive scans and restricts unauthenticated REST API /wp/v2/users enumeration.
* Lock Theme & Plugin File Editors: Blocks arbitrary PHP code editing inside wp-admin via capability mapping ( map_meta_cap ).
* High-Risk Plugin Detector: Alerts you if risky file-manager or database-admin plugins are left active in production, with 1-click deactivation.
6. 6-Layer Malware, Core Checksum & Hidden-Admin Scanner
Built from real-world forensic incident response to uncover threats traditional scanners miss:
php drop-ins sitting in your site root ( ABSPATH ).
org cryptographic MD5 hashes.
* Layer 3 — Zero-Tolerance uploads/ Shell Scan: Detects disguised PHP webshells inside wp-content/uploads/.
* Layer 4 — mu-plugins Persistence Audit: Inspects Must-Use plugins where stealth malware often hides from the standard Plugins screen.
)), gzinflate, shell execution, and injected script payloads, complete with a Safe Read-Only Code Snippet Preview modal.
* Layer 6 — Stealth pre_user_query Hidden-Admin Detector: Compares high-level WP_User_Query results against raw database capabilities usermeta rows to expose rogue administrator accounts hidden by malicious hooks.
Unlock Active Defense with FBS Secure Optimize Pro
Need real-time attack blocking and 1-click threat eradication? FBS Secure Optimize Pro extends the free plugin with 5 additional independent modules:
* Early-Boot Web Application Firewall (WAF): Blocks SQL Injection (SQLi), Cross-Site Scripting (XSS), Directory Traversal, Null-Byte exploits, and bad-bot user-agents at priority 0 (includes safe Learning Mode ).
* 429 Anti-Bot Flood Rate Limiter: Sliding-window per-IP request throttling ( HTTP 429 Too Many Requests ) to prevent scraper floods from triggering 502 Bad Gateway crashes.
* Real-Time Admin Capability Guard: Locks an Approved Administrator Whitelist and automatically disarms unauthorized privilege escalation while destroying rogue sessions.
* 1-Click Malware & Rogue-User Eradication: Delete flagged backdoor files, malicious database rows, and stealth admin accounts directly from the 6-Layer Scanner.
* Custom CSP Header Builder & Scheduled Daily Scans: Test Content-Security-Policy directives in Report-Only mode before enforcing Grade A+ headers, plus automated daily scan email alerts.
External Services
0/ ) to fetch official MD5 file hashes for your installed core version and locale.
1&locale=en_US ), solely when a scan runs.
* Privacy: Zero personal data, visitor IPs, user accounts, or site content is ever transmitted. org Privacy Policy.