OptimizeSho

OptimizeSho brings performance tuning, security hardening and maintenance tools together in a clean, developer-friendly dashboard. Every optimisation and protection feature is opt-in, uses WordPress APIs where they exist, and fails safe: when something cannot run safely, it simply steps aside.

After installation only the lightweight statistics are switched on (server performance sampling, Core Web Vitals from a share of visitors and the outgoing request log), so the dashboard has real numbers to show from day one. Nothing on your site changes until you enable a feature yourself, and each statistic can be turned off under Monitoring or Outgoing requests.

Performance

• Page cache – static HTML served by an advanced-cache.php drop-in before WordPress loads: gzip copies, “304 Not Modified” (ETag revalidation), separate mobile cache, smart purging when content changes, background preloading, lifespan, URL/cookie exclusions, ignored tracking parameters and a “Clear cache” item in the admin bar. Logged-in users, carts, checkouts and searches are never cached.

• Browser caching rules for Apache/LiteSpeed (.htaccess, between markers) and a ready-to-copy nginx snippet.

• Delay JavaScript until the first interaction (or a timeout) – including inline scripts, in their original order, with DOMContentLoaded/load handlers still firing. Great for chat widgets, analytics and ads.

• LCP and CLS helpers – fetchpriority=”high” for the LCP image, missing width/height for local images, a YouTube facade (lightweight preview until click) and lazy rendering of long sections with content-visibility.

• Asset manager – scan any page to see every script and stylesheet with its plugin/theme and size, then unload it everywhere, on the front page, by URL or by post type. WooCommerce cart fragments and shop assets can be limited to shop pages.

• Local Google Fonts – downloads the fonts your theme uses and serves them from your domain (no third-party connection for visitors), with font-display: swap.

• Speculative loading control (WordPress 6.8+) – prefetch or prerender with your chosen eagerness; carts, checkouts and account pages are excluded.

• Media – WebP or AVIF for generated image sizes (when the server supports it), compression quality and the big-image threshold. CDN URL rewriting for wp-content and wp-includes files.

• Bloat removal – disable comments site-wide, RSS feeds, the front-end password strength meter and set the autosave interval.

• Native script loading strategies – defer or async enqueued scripts through the WordPress 6.3+ strategy API, which keeps execution order correct automatically. Exclusion list included.

• Smart lazy loading – adds loading="lazy" and decoding="async" with the WordPress HTML API, while keeping the first images (your LCP element) eager for better Core Web Vitals.

• Resource hints & preload – preconnect/dns-prefetch for third-party origins of enqueued assets, plus your own preload URLs (LCP image, web fonts) with automatic as /type detection.

• Safe minification – whitespace-aware HTML minifier that never merges words, string-aware inline CSS minifier and a conservative inline JS minifier that keeps // comments and semicolon-free code working.

• Brotli compression – only when the response is not already compressed, no page cache or other output handler is active, and the browser accepts it.

• Google Fonts removal, emoji/oEmbed/RSD/shortlink cleanup, Dashicons and block library CSS removal, jQuery Migrate removal, Heartbeat control, revision limits and local avatars instead of Gravatar.

• Persistent object cache – a complete Redis / Memcached drop-in (TLS, unix sockets, Redis ACL, per-site prefixes, non-blocking prefix flush). Connection test before activation; falls back to a per-request cache if the server becomes unreachable.

Security

• wp2shell protection – virtual patch for CVE-2026-63030 and CVE-2026-60137: blocks anonymous REST batch requests in every URL form, non-numeric author__not_in / author_exclude values and the public exploit tools.

• Application firewall – context-aware signatures for XSS, SQL injection, code/command injection, path traversal, template injection, XXE and PHP object injection, designed for very low false positives. Passwords are never inspected and trusted editors are never scanned.

• Trusted client IP detection – REMOTE_ADDR by default; Cloudflare, X-Forwarded-For, X-Real-IP or a custom header only from trusted proxies, so attackers cannot spoof their IP.

• Rate limiting with HTTP 429 + Retry-After and automatic DNS verification of Googlebot, Bingbot and other search engines (no SEO impact).

• Login protection – limits failed logins on wp-login.php, XML-RPC and application passwords; optional generic error messages.

• Upload scanning – executable and double extensions, server config files, PHP code inside files and scripts inside SVG images.

• Hardening – XML-RPC blocking, user enumeration protection (archives, REST, sitemaps, oEmbed), file editor lock, version hiding, security headers (CSP frame-ancestors, Permissions-Policy, COOP, optional HSTS) and REST API restrictions with a public-namespace allowlist.

• Health check – flags known vulnerabilities in your WordPress, PHP (PHP2Shell) and nginx/Apache versions, PHP end-of-life, debug output and missing HTTPS, plus a read-only indicator-of-compromise scan.

Maintenance & monitoring

• Dashboard charts – generation time, peak memory and SQL queries per hour or day, blocked requests per day by attack type, settings coverage, resource usage (memory, disk, CPU load, autoloaded options) – each chart has a table view and keyboard support.

• Core Web Vitals from real visitors – LCP, INP, CLS, FCP and TTFB at the 75th percentile, measured by a 3 KB script on a sample of page views (10% by default, can be turned off under Monitoring) and stored on your site only.

• Scheduled database cleanup (daily, weekly or monthly) and charts of the largest tables and autoloaded options.

• WP-CLI – wp optimizesho cache|db|settings|firewall|fonts|metrics|health.

• Database cleanup in time-limited batches: revisions, old auto-drafts, trash, spam, expired or all transients, orphaned meta and term relationships, oEmbed cache and OPTIMIZE TABLE only for tables with reclaimable space – limited to this site’s table prefix.

• Outgoing request monitor – see which remote APIs slow down your site and block them by host, wildcard or URL prefix. Query strings are never logged.

• Import / export (compatible with 1.x exports), reset and a copyable system report.

Developer friendly

optimizesho_safe=1 to see it without OptimizeSho’s front-end optimisations. Add data-no-delay to a script tag to keep it out of “Delay JavaScript”, and data-no-facade to a YouTube iframe to keep the original player.

Filters include optimizesho_settings, optimizesho_cache_page, optimizesho_purge_post_urls, optimizesho_site_wide_post_types, optimizesho_delay_js_exclusions, the optimizesho_cache_purged action, optimizesho_client_ip, optimizesho_firewall_should_block, optimizesho_firewall_signatures, optimizesho_firewall_whitelist_paths, optimizesho_rest_public_namespaces, optimizesho_security_headers, optimizesho_script_strategy_exclusions, optimizesho_skip_output_buffer, optimizesho_brotli_quality and optimizesho_security_advisories.

Privacy

OptimizeSho does not send data to the plugin author or any analytics service and does not track users. All measurements stay in your WordPress database.

• The firewall and login protection store blocked IP addresses, the request URI and User-Agent of blocked requests in your WordPress database (last 300 events, removed on uninstall). Mention this in your privacy policy if required in your jurisdiction.

• The outgoing request log (on by default, can be turned off) stores endpoint URLs without query strings, call counts, durations and status codes – no request or response bodies.

• Search engine verification performs reverse and forward DNS lookups of the requesting IP through your server’s DNS resolver.

• “Replace Gravatar” stops requests to gravatar.com.

• Server performance sampling (on by default, 10% of front-end page views) stores only aggregated hourly and daily numbers (time, memory, query count, cache hits) – no URLs, IP addresses or user data.

• Core Web Vitals collection (on by default for 10% of page views, can be turned off under Monitoring): a 3 KB script sends timing values and a device class (mobile/desktop) to your site’s own REST API ( /wp-json/optimizesho/v1/vitals ). Nothing is sent to third parties. No cookies are set; no URL, IP address or identifier is stored. A hash of the IP address is kept for 10 minutes to rate-limit the endpoint. Logged-in editors are not measured.

• The page cache stores public HTML pages on disk; pages for logged-in users, carts and checkouts are never stored.

External services

OptimizeSho connects to third-party services only for features you enable:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) – when “Host Google Fonts locally” is enabled, your server downloads the Google Fonts stylesheets and font files that your theme already loads, once, in a background task. Only the stylesheet URL and a browser User-Agent are sent; no visitor data. Afterwards visitors load the fonts from your own domain. Google Fonts privacy FAQ: https://developers.google.com/fonts/faq/privacy · Google Privacy Policy: https://policies.google.com/privacy · Google Terms of Service: https://policies.google.com/terms

• YouTube (i.ytimg.com, youtube.com) – when the YouTube facade is enabled, visitors’ browsers load the video thumbnail from i.ytimg.com instead of the full player; the player (which you embedded) loads from youtube.com only after the visitor clicks. YouTube Terms of Service: https://www.youtube.com/t/terms · Google Privacy Policy: https://policies.google.com/privacy

The asset scanner and the cache preloader only request pages of your own site.

Third-party resources

• Vazirmatn font by Saber Rastikerdar (https://github.com/rastikerdar/vazirmatn), SIL Open Font License 1.1 – used on the settings screen only (assets/fonts/vazirmatn, license included).

• Cloudflare IP ranges (public list, https://www.cloudflare.com/ips/) are bundled for verifying CF-Connecting-IP.