About this plugin
js server or CDN configuration. It delivers three core capabilities:
Speed Infrastructure
php before WordPress boots, achieving 22ms TTFB on any shared host (Apache, Nginx, LiteSpeed, IIS). Zero PHP execution on cache hits.
Ghost Protocol
Strips every WordPress fingerprint from HTML, headers, and JavaScript. wp, and X-Powered-By: PHP are all removed or rewritten. Wappalyzer reports Nginx, not WordPress.
Intelligent Automation
Content changes trigger selective snapshot regeneration, so only affected pages rebuild, with a 30-second debounce to coalesce bulk edits. Asset references are validated before serving.
Free Features
- Static HTML delivery with universal drop-in cache
- SPA client-side navigation between static pages
- Elementor & Gutenberg compatibility
- Delivery diagnostics (SSG status, serve-rule checker)
- Cache hit tracking and basic analytics
- Security hardening: REST user-enumeration block, author-enumeration block, XML-RPC disable, WordPress version removal, masked login errors
- Ghost Protocol WP masking: removes generator tags, REST discovery links and other WordPress signals from every response
- XML sitemap and the SEO & Metadata report
There is no page limit, no time limit, and no feature that stops working. Every
page on your site can be served statically on the free version, for as long as
you use it.
Pro Features
- Advanced Ghost Protocol: Stealth Proxy asset-path rewriting and JS namespace cloaking
- Smart automation: auto-rebuild on publish/update, debounced regeneration, conflict detection
- Scheduled regeneration cron
- Core Web Vitals tracking (LCP, INP, CLS) from real-user field data
- SEO intelligence and on-page scoring
- PDF infrastructure reports
- Edge CDN purge for Cloudflare and Bunny
- White-label admin branding
- Portal connectivity for auralogicslabs.com/portal
- Multisite fleet orchestration: network-wide SSG enable/disable and fleet dashboard
Privacy & WP.org Compliance
- Analytics are opt-in: disabled by default on new installs (see Settings → Neural Pulse)
- IP addresses are hashed before storage (SHA-256 with a per-site salt, non-reversible) and the raw address is never written to disk
- No data is sent to external servers without explicit user action
- No obfuscated code. Full GPL source.
- Cleanup on deletion: removes the plugin’s options, database tables, post and user meta, scheduled events, and the cache drop-in. The generated static files in /wp-content/uploads/nexora-static/ are kept, since they are your rendered content; delete them from Tools before removing the plugin if you want them gone.
External services
This plugin’s static-delivery features run entirely on your own server. To build the static cache it makes requests to your own website (loopback requests to your own pages) so it can capture their rendered HTML. Those are requests to your site, not to any third party.
Beyond that, this plugin contacts outside servers in the following cases, and only these:
1. Freemius: licensing and updates
Freemius provides the licence check, plugin update channel, and (if you choose to purchase) checkout.
The plugin starts in anonymous mode: no account is created, no opt-in prompt is shown, and no diagnostic data is sent. Every feature of the free version works in this state and you never have to connect anything.
Data is only shared if you choose to act:
- Activating a licence sends your site URL, WordPress and PHP version, plugin version and licence key, so the licence can be validated and updates delivered.
- Opting in to diagnostics from the Account screen additionally shares your email address and a list of active plugins and themes. This is entirely optional and can be revoked from the same screen.
Contact with Freemius happens when you activate a licence, when the plugin checks for an update to a licensed copy, and when you open the licensing screens.
Service provided by Freemius, Inc. com/privacy/
2. Broken-link checking: the sites you link to
When you run a link scan, the plugin sends an HTTP HEAD request to each external URL found in your own posts and pages, to see whether the link still resolves. Only the URL is requested; no data about you or your visitors is transmitted. The destinations are entirely determined by the links in your content, this plugin does not choose them, and the scan only runs when you start it.
3. Revalidation webhook (optional, off by default)
If, and only if, you enter a webhook URL in the plugin’s settings (for example to tell a headless front end that a page changed), the plugin sends a POST request to that URL when a post is updated. It contains the changed post’s ID and URL plus a signature generated from a secret you supply. Nothing is sent until you configure this URL, and the destination is entirely your choice; this plugin does not provide or control it.
This plugin does not phone home, send analytics, or transmit any data to Auralogics Labs servers.
Note: features that integrate with Google Search Console or with CDN providers (Cloudflare, BunnyCDN) are not part of this plugin. They are not included in this download and no code for them ships here.
Source code & development
Nexora Engine is fully open. js. Nothing is obfuscated or minified beyond a standard production build.
The complete, unminified source, including the build tooling and instructions, is maintained publicly at:
com/auralogicslabs/nexora-engine
To build the compiled assets from source:
- npm install: install the build dependencies.
- npm run build: compile frontend/ to assets/dist/nexora-engine.js with Vite.
The PHP is shipped as-is (no build step) and is directly readable in the includes/, app/, and admin/ directories.