=== Celero Adaptive Speed ===
Contributors: ceotech
Donate link: https://paypal.me/ceotechit
Author: Francesco Palmieri
Author URI: https://www.ceotech.it/
Tags: performance, cache, page speed, core web vitals, optimization
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.7.23
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Finds what slows your site and fixes it one change at a time: tested out of visitors' sight, kept only if all works, undone if the site slows.

== Description ==

Celero Adaptive Speed is a performance plugin that decides from data. It observes your site, explains in plain language what slows it down, and tries one change at a time as a private preview. A change is applied only if pages, menus, forms and the cart keep working and nothing gets slower. Afterwards it keeps checking the numbers of your real visitors and undoes the change by itself if they get worse.

It works next to the cache and optimization plugin you already use. When LiteSpeed Cache, WP Rocket or a similar plugin is active, Adaptive Speed leaves their features to them and never changes their settings: it tells you what to change and where.

= What it does =

* **Diagnosis in plain language**: real-visitor Core Web Vitals (LCP, INP, CLS, time to first byte), which cache answers your pages (Adaptive Speed, LiteSpeed, Cloudflare), links with tracking parameters that skip the cache, slow pages, heavy images, scripts that block the page.
* **Controlled trials**: each recommendation shows evidence, impact, confidence, risk, compatibility, how it is verified and how it is undone. "Try" runs the change as a private preview (visitors see nothing), checks the key pages on the server and in your browser (JavaScript errors, missing files, mobile menu, forms, cart, missing content) and compares the speed with and without the change, alternating the measurements.
* **Real-visitor verification**: after a change is kept, the 75th percentile of LCP, INP and CLS is compared before and after. If it gets worse, the change is undone automatically.
* **Two modes**: Safe (recommends and tries only when you ask) and Adaptive (tries low-risk changes by itself, one at a time, with the same checks).
* **Optimizations**: page cache (optional early cache that serves pages before WordPress loads), Google Fonts served from your own domain, deferred and delayed JavaScript, used CSS, lazy loading, image dimensions, preconnect hints, WebP/AVIF copies, cleanup of emojis and embeds, plugin files only on the pages that use them, optional Redis object cache.
* **Safety**: settings snapshots, automatic rollback, emergency mode with a recovery link sent by email, and everything is removed when you uninstall.

= Built to go easy on your hosting =

* One trial at a time, never two together, and never on the public site: visitors always get the current settings until a change has passed every check.
* The cache preload works in small batches, pauses when the server slows down and stays off on local and development sites.
* Fonts and other files are downloaded in the background, never while a visitor waits for a page.
* Real-visitor measurements are sampled, limited per minute and per day, and deleted after 28 days.

= No paid services =

Everything works with the plugin alone. Google PageSpeed Insights tests are optional and need only a free API key; Cloudflare and a CDN are used only if you set them up.

= Good to know =

* Multisite networks are not supported yet: the plugin refuses network activation.
* Separate cache copies for phones are created automatically when a mobile-theme plugin is detected (filter `ctps_cache_mobile_variant`).
* The plugin never changes the settings of other plugins or of Cloudflare.

== Installation ==

1. Install the plugin from Plugins → Add New, or upload the `adaptive-speed` folder to `/wp-content/plugins/`.
2. Activate it. A short setup wizard starts in Safe mode.
3. Open **Adaptive Speed → Overview** to see the diagnosis and the recommendations, and use "Try" on the ones you want.

== Frequently Asked Questions ==

= Does it replace my cache plugin? =

No. If another cache or optimization plugin is active, Adaptive Speed leaves the overlapping features to it and focuses on diagnosis, trials and verification. On sites without another cache plugin it can handle the page cache itself.

= What does it change outside its own folder? =

Only when you turn the related feature on: rules in `.htaccess` (inside the plugin's own `# BEGIN` / `# END` block), the `wp-content/advanced-cache.php` drop-in and a `WP_CACHE` line in `wp-config.php` for the early cache, the `wp-content/object-cache.php` drop-in for Redis, cache files in `wp-content/cache/`. It never replaces a drop-in that belongs to another plugin. Deactivation and uninstall remove what it added.

= What do the real-visitor measurements collect? =

Anonymous numbers only: page path, device type (phone/computer), timing values, connection class, the names (never the values) of up to 3 URL parameters and the host names of scripts that blocked the page. No cookies are set and no IP address is stored with the measurements; a salted hash of the IP is kept for at most 2 minutes to limit abuse. Measurements are deleted after 28 days and can be turned off in the settings. A paragraph for your privacy policy is added to Settings → Privacy.

= What is the recovery link? =

At activation the plugin emails the site administrator a private link. If an optimization ever makes the admin area unreachable, opening the link and pressing the button turns off all optimizations (emergency mode).

= What happens to old image links after "Replace existing images with WebP"? =

A short block "# BEGIN Adaptive Speed WebP" at the top of .htaccess sends requests for the old .jpg/.png addresses to the WebP. It stays when the plugin is deactivated or deleted, because replaced images need it; remove it only if you restore the old files. On nginx add the rule shown in the Images section before starting.

= Does it work on nginx? =

Yes. The page cache is served by PHP or by the early cache drop-in; the plugin also shows optional nginx rules you can add to your server configuration.

== Screenshots ==

1. Overview: mode, cache status and the speed measured on your visitors' devices.
2. Recommendations with evidence, risk, how each change is verified and how it is undone, and the "Try it in a controlled way" button.
3. Applied changes: every change kept or discarded, with the measurements and an Undo button.
4. Measured speed: Core Web Vitals for phones and computers and for the most visited pages.
5. Optimizations: cache settings, one switch per feature with its expected impact.

== External services ==

The plugin connects to the following services only in the cases described.

* **Google PageSpeed Insights API** (`www.googleapis.com/pagespeedonline`): only when you ask for it: when you press "Test" or "Measure score" in the plugin, and once a day if you turn on "Daily PageSpeed test" (off by default). It sends the URL of the page to test, the strategy (mobile or desktop), the language of the site and, if you entered one, your API key. Nothing is sent when the plugin is activated. [Google APIs Terms of Service](https://developers.google.com/terms), [Google Privacy Policy](https://policies.google.com/privacy).
* **Google Fonts** (`fonts.googleapis.com`, `fonts.gstatic.com`): only when you turn on "Local Google Fonts" (off by default) and the theme loads Google Fonts, your server downloads the font CSS and files once, in the background, so that visitors load them from your site instead of Google. Only the font CSS address used by your theme is requested. [Google Fonts FAQ / privacy](https://developers.google.com/fonts/faq/privacy), [Google Privacy Policy](https://policies.google.com/privacy).
* **YouTube thumbnails** (`i.ytimg.com`): when the "YouTube facade" option is on, embedded YouTube videos are replaced by their thumbnail image until clicked; the visitor's browser loads the thumbnail from YouTube (sending its IP address to Google). [YouTube Terms of Service](https://www.youtube.com/t/terms), [Google Privacy Policy](https://policies.google.com/privacy).
* **Cloudflare API** (`api.cloudflare.com`): only if you enter a Cloudflare zone ID and API token. When the cache is cleared, the plugin asks Cloudflare to purge the same URLs (or everything). It sends the zone ID, the token and the URLs. [Cloudflare Website Terms](https://www.cloudflare.com/website-terms/), [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/).
* **Your CDN**: if you enter a CDN address, static files are served from that address.

The plugin also makes requests to your own site (cache preload, speed measurements, trials, health checks). It sends emails to the site administrator only when asked (recovery link on request, optional weekly report). "Measure real visitors" is off by default; when on, visitors' browsers send anonymous load times to your own site only. The plugin does not send any data to the plugin author.

== Changelog ==

= 3.7.23 =
* Used CSS is sanitized when received and again when printed inline (no HTML tag can appear in it, in any letter case).
* Inline scripts are printed with wp_print_inline_script_tag().

= 3.7.22 =
* "Local Google Fonts" is off by default (it downloads the fonts from Google only when you turn it on) and no profile turns it on by itself.
* Used CSS is enqueued through WordPress; the page keeps its stylesheets when it could not be enqueued.
* Input from requests and imported files is sanitized; admin dashboard output is escaped.

= 3.7.21 =
* New name: Celero Adaptive Speed (text domain celero-adaptive-speed).

= 3.7.20 =
* Privacy: the daily PageSpeed test and the real-visitor measurements are off by default and only start when you turn them on; the setup wizard sends nothing to Google unless you choose to measure the score.
* Activation no longer emails the recovery link: it is shown in Safety and recovery (and can be emailed from there). On multisite networks the plugin stays idle and shows a notice instead of stopping the activation.
* Front-end styles and scripts (critical CSS, YouTube facade, delayed-script and lazy-background loaders) are enqueued through WordPress.
* WordPress 6.9+: the page optimizer and the page cache use the template enhancement output buffer of WordPress; older versions close their own buffers on shutdown.
* Early page cache: settings saved as JSON (no generated PHP file).
* File locations resolved with WordPress functions; time limit only for the actions that need it; emergency pages use the standard WordPress screen.

= 3.7.19 =
* WebP replacement much faster on large databases: one search per upload folder for the whole group of images, instead of one per image; larger groups.

= 3.7.18 =
* WebP replacement: images whose published file is already WebP (made by WordPress at upload) are completed: the JPEG left next to it is removed, links to it lead to the WebP and the image type is corrected.

= 3.7.17 =
* WebP replacement: the checks the site makes on itself go straight to its own server, so a proxy in front of the site (Cloudflare bot protection) no longer stops them; when the redirect check fails, the message says what answered.

= 3.7.16 =
* WebP replacement for large libraries: images are handled in groups with one pass over each database table per group, the work goes on by itself on the server every minute (also with the page closed), only one step runs at a time, and a step stopped halfway (server time limit) is resumed safely.
* WebP replacement: a Cloudflare bot challenge on the site's own requests no longer stops the work.

= 3.7.15 =
* WebP: the site icon (favicon) is never turned into WebP, because Google Search does not accept WebP favicons. Images chosen in the Customizer are uploaded unchanged.

= 3.7.14 =
* WebP replacement: the "server busy" pause now takes the number of CPU cores into account, so it no longer waits forever on shared hosting.

= 3.7.13 =
* New: "Replace existing images with WebP". Each JPEG/PNG is converted (original and every size), every address in posts, settings and other plugins is updated, and the old files are deleted only after all the checks: WebP opens, same size, same look, no old address left, old .jpg links lead to the WebP. Images that fail a check are listed and left untouched.
* New: "Keep only the WebP of new uploads": JPEG and PNG are converted when uploaded and the original is deleted.
* WebP: LiteSpeed Cache counts as the WebP provider only while it is still producing WebP for recent uploads.

= 3.7.12 =
* WebP: LiteSpeed Cache counts as the WebP provider only when it has really received WebP images from QUIC.cloud, not just because its option is on.

= 3.7.11 =
* WebP: when another plugin already creates WebP images (LiteSpeed Cache image optimization, ShortPixel, Imagify, EWWW, WebP Express, Converter for Media, Optimole, Smush, Modern Image Formats), the WebP and AVIF options pause by themselves and the setup wizard no longer offers the library conversion.
* WebP: the plugin records the files it creates, and "Remove WebP" deletes only those, never copies used by another image plugin.

= 3.7.10 =
* Dates in the history of changes and diagnostics are shown in the site's time zone.

= 3.7.9 =
* Clearer plugin description.

= 3.7.8 =
* The plugin is now called Adaptive Speed (formerly WP Adaptive). Settings and history are kept.

= 3.7.7 =
* Overview: the "Turn on Adaptive mode" button appears only when there is something it would try, lists those changes and asks for confirmation.
* The "Real visitors" page is now called "Measured speed".

= 3.7.6 =
* The daily page scan no longer reports Google Fonts as loaded from Google once they are served from your domain.
* "Visitors wait": the recent value is shown only when it differs from the whole period.

= 3.7.5 =
* Page cache: separate copies for phones when the theme serves different HTML to them (automatic with known mobile-theme plugins), pages requested with tracking parameters are no longer stored, drafts and autosaves no longer clear the cache, content discarded by other plugins with ob_clean() is no longer kept.
* Optimizer: exclusions keep working on minified files, configuration data of scripts excluded from defer stays before them, the main image (fetchpriority="high") is never lazy-loaded, no duplicate preconnect hints, Google Fonts are downloaded in the background instead of during a visit.
* Adaptive mode now uses the same private preview as manual trials, and only one trial or experiment runs at a time; it no longer re-applies settings that are already on.
* Real-visitor verification: changes undone in the meantime are not "confirmed", overlapping changes are handled, unusual spikes of measurements do not trigger a rollback, measurements are signed with a daily token and limited per day.
* Security headers no longer block geolocation, camera and microphone, and are not sent on embeds; HSTS is opt-in.
* Removed the built-in updater (updates come from WordPress.org), unused endpoints and test files from the package; all texts translatable; options renamed with the `wpadapt_` prefix (existing data is moved automatically).
* Multisite networks: activation is refused instead of sharing one cache between sites.

= 3.7.4 =
* "Cloudflare does not keep the pages" no longer suggests a free cache rule on sites with a separate mobile version. The time-to-first-byte diagnosis also shows the value of the last days.

= 3.7.3 =
* The analysis of the key pages and the cache check are redone right after an update.

= 3.7.2 =
* The cache check names the cookies that stop the home page from being cached.

= 3.7.1 =
* Detects LiteSpeed Cache rules that make every page private ("/$" in Private Cached URIs) and responses that are not shared between visitors.

= 3.7.0 =
* New "Why visitors wait" diagnosis, LiteSpeed Cache settings advice, images and external scripts report, more reliable trials with alternating measurements.

= 3.6.0 =
* Trials as private previews with server and browser checks; new actions: fonts from your domain, plugin files only where needed, used CSS, delayed JavaScript.

= 3.5.0 =
* Single admin menu, recommendation cards with evidence and undo, real-visitor verification, early page cache.

= 3.4.0 =
* Safe mode on new installs and reliable rollback.

== Upgrade Notice ==

= 3.7.23 =
Security hardening for the used CSS.

= 3.7.22 =
Local Google Fonts is now opt-in; security and compatibility fixes.

= 3.7.21 =
The plugin is now called Celero Adaptive Speed.

= 3.7.20 =
Privacy and compatibility fixes: daily PageSpeed test and visitor measurements are now opt-in.

= 3.7.19 =
Faster WebP replacement on large sites.

= 3.7.18 =
WebP replacement also completes images already partly in WebP.

= 3.7.17 =
WebP replacement works on sites behind Cloudflare bot protection.

= 3.7.16 =
WebP replacement ready for large media libraries: works in groups and in the background.

= 3.7.15 =
The site icon stays PNG/JPEG so it keeps showing in Google Search.

= 3.7.14 =
WebP replacement no longer stays paused on busy shared servers.

= 3.7.13 =
Replace existing images with WebP and keep only the WebP of new uploads (both optional).

= 3.7.12 =
WebP keeps working when LiteSpeed image optimization is on but has not produced any image.

= 3.7.11 =
No more duplicate WebP work when another image plugin already does it.

= 3.7.10 =
Correct times in the history of changes.

= 3.7.9 =
Clearer plugin description only.

= 3.7.8 =
New name: Adaptive Speed. Nothing changes in how it works.

= 3.7.7 =
Clearer Adaptive mode button and menu name.

= 3.7.6 =
Corrects the Google Fonts check after fonts are served from your domain.

= 3.7.5 =
Fixes for sites with a mobile theme, tracking links and draft editing; safer automatic mode. Existing settings and history are kept.
