Ultra Web Hosting Performance Toolkit

Three things every WordPress site needs, and one screen that shows you all of them working.

WordPress loads roughly 90 KB of scripts and styles on every single page that most sites never use. Emoji detection. A jQuery compatibility shim for code written a decade ago. An icon font for visitors who will never see the admin. This plugin removes them, and then tells you exactly how many kilobytes and how many requests it saved. Not an estimate: the size of the real file on your server.

Speed. Twenty-one optimizations, each a plain toggle. The Optimizations tab opens with a running total of what your current settings have stripped from every page load, broken down by category, next to how much is still on the table. You never have to wonder whether a switch did anything.

Security. Brute-force login protection with a per-IP lockout and a log of who tried. The lost-password form hardened against reset-request spam, with a honeypot, a signed form token, and a per-account rate limit. Comment spam stopped by a honeypot, a signed speed trap and a link limiter. XML-RPC closed. The registration page closed. The theme and plugin file editors removed, so a stolen password no longer means arbitrary PHP on your server. Each one steps aside politely when a dedicated security plugin is already handling it.

One button that clears everything. LiteSpeed, AccelerateWP, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, Elementor, Divi, Beaver Builder, Oxygen, GeneratePress, Brizy, OPcache, the object cache, your server’s reverse proxy and Cloudflare. One click, from the admin bar, wherever you are. It calls each plugin’s own flush routine rather than deleting its files behind its back, so it cooperates with your stack instead of fighting it. And if something fails, it says so and names it, rather than reporting a success that did not happen.

It tells you what you are actually running. The Environment tab draws the path a visitor’s request takes to reach your database, each hop lit or dimmed by what was detected, then grades your PHP version and handler, web server, reverse proxy, database, opcode and object caches, and the wp-config.php and .htaccess settings that matter. All read-only. The same checks appear in WordPress Site Health, where you already look.

No upsell, no account, no paid tier, and nothing phones home. The only external service the plugin ever contacts is Cloudflare, and only if you have deliberately set that up.

Every option is a plain toggle, and anything not marked below is generally safe to leave on.

Front-end optimizations

• Remove query strings from static CSS/JS URLs so proxies and CDNs cache them more aggressively. Off by default, since stripping ?ver= can serve stale CSS/JS after an update on sites that rely on it for cache-busting. Leave it off if you run WooCommerce, where a stale cart or checkout script can break purchases silently.
• Disable emoji scripts: browsers render emoji natively, so the detection script is dead weight.
• Remove legacy head tags (RSD, Windows Live Writer, shortlink).
• Hide the WordPress version generator tag from page source and feeds.
• Disable embeds: removes the oEmbed discovery links, REST route, and wp-embed.js.
• Remove jQuery Migrate: patches back methods jQuery 3 removed. Saves about 5 KB compressed and one request. Off by default, because if anything on the site still calls one of those methods this breaks it with only a console error to show for it. Leave jQuery Migrate loaded, open your browser console, and look for JQMIGRATE warnings first.
• Dashicons for logged-in users only: skips the icon font for logged-out visitors, and steps aside automatically when a theme or plugin has declared a dependency on it.
• Remove block editor CSS: drops the block library stylesheet and global styles from the front end. Off by default, and skipped automatically on block themes. Only suitable for classic themes that use no blocks.
• Heartbeat API control: set the interval independently for the front end, dashboard, and post editor, or remove the heartbeat from public pages entirely. Blank leaves the WordPress default in place.
• Disable pingbacks and self-pings: removes only the pingback.* XML-RPC methods and the X-Pingback header, closing a common DDoS amplification vector. Safe with Jetpack and the mobile app, which use the rest of XML-RPC.

Security and spam

• Login protection: five failed attempts triggers a 15-minute per-IP lockout, and each repeat lockout of the same address lasts longer than the last, up to a cap, so waiting one out and trying again stops working. A lockout log on the settings page records who was blocked. Automatically steps aside when Wordfence, Solid Security, Sucuri, All-In-One WP Security, WP Cerber, Limit Login Attempts, LoginPress, Jetpack Protect, or Imunify Security is active, so there are no double lockouts.
• Password reset protection: a honeypot and a signed form token turn away scripts that post straight to the lost-password form, and a rate limit caps how many reset emails a single address, or a single account, can trigger in an hour. The per-account cap is the one that matters: it holds even against an attacker rotating through addresses, since the flood is aimed at one inbox. A genuine “forgot my password” is untouched. Blocked requests are logged on the settings page, never emailed, so reset spam cannot in turn flood your inbox or spend your server’s sending reputation. A custom or WooCommerce reset form is rate limited but never required to carry the token it does not render. For an added challenge on top of all this, you can switch on one of three, all off by default: an invisible proof-of-work, where the visitor’s browser quietly solves a small puzzle before the form will submit; a plain arithmetic question; or Cloudflare Turnstile. The first two need no account and contact no external service; Turnstile is there for sites that prefer a managed challenge, and falls back to the invisible checks if Cloudflare is ever unreachable so it can never lock recovery out.
• No email reset for admins: optionally turn off the “Lost your password?” email link for administrator accounts, the ones attackers most want. Off by default, because it applies to you too: if an admin forgets their password the email link will not work for them either, so keep another way back in (your web host or developer can reset it for you).
• Disable XML-RPC: returns 403 on xmlrpc.php to block brute-force amplification.
• Comment spam protection: honeypot field, signed submit-speed trap, and link limiter. Comments with too many links are held for moderation rather than rejected, so a genuine comment is never lost.
• Auto-close old comments: closes comments on posts older than 90 days, the favourite target of spam bots. Existing comments are preserved. Recommended, but off by default because it overrides your Settings > Discussion choice, so turn it on deliberately.
• Block the registration page: closes wp-login.php?action=register and hides the Register link. Turning off “Anyone can register” stops accounts being created but still renders the form, and that URL is among the most probed on any WordPress site. Defers to the core setting: a site that allows registration is never blocked, however this is set.
• Disable the file editors: removes the theme and plugin editors from the admin. Those editors let anyone with administrator access write PHP that runs on your server, which is the first thing an attacker reaches for after stealing a login.

One-click cache purge

Adds a Clear All Caches button to the admin bar that flushes, in one click: the WordPress object cache and transients, PHP OPcache, LiteSpeed Cache / AccelerateWP, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, and Elementor / Divi / Beaver Builder / Oxygen / GeneratePress / Brizy generated CSS. Cloudflare purging and server-level cache purging are available as opt-in extras.

For each caching plugin the button calls that plugin’s own flush routine, so it works alongside your caching stack rather than fighting it. Anything not installed is skipped.

Database cleanup

Read the full description on the official page →