=== GT Performance ===
Contributors: gauravtiwari
Tags: cache, performance, cloudflare, woocommerce, database
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.14
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Safe page caching, per-page unused CSS, Cloudflare Free cache rules and checkout-aware protection for WordPress, on any host.

== Description ==

A slow WordPress site usually needs three fixes at once: a page cache, lighter CSS and JavaScript, and an edge cache in front of it all. Most setups stitch these together from three plugins and a Cloudflare dashboard, and the gaps between them are where things break. A cart gets cached for everyone, a purge clears the origin but not the edge, or an optimizer strips the CSS a menu needed.

GT Performance puts those layers in one plugin that knows about all of them. It caches pages on your own server, removes the CSS each page doesn't use, manages one Cloudflare Cache Rule on the free plan and keeps carts, checkouts and accounts out of every cache. Everything runs on your WordPress server. There is no account, no external optimization service and no telemetry.

Caching is on by default and stays inactive until you install its drop-in. Riskier transformations stay off until you enable them, so you can switch one layer on, check the site and move to the next.

= Plugin Features =

**Page cache**

* Atomic origin page cache served by an early `advanced-cache.php` drop-in, before WordPress loads
* Fresh, stale and browser lifetimes with one-click presets (1 hour fresh and 24 hours stale by default)
* Stale-while-rebuild in the background and stale-if-error protection when the origin fails
* Separate mobile cache for themes that send different HTML to phones
* Automatic purge of the post and its related URLs on publish, update, trash, unpublish or slug change
* Sitemap-driven cache warming after a full purge, with a background preload queue
* Ignored marketing query parameters, plus custom bypass paths, cookies and query parameters
* Automatic cleanup of expired and orphaned entries, capped at a configurable entry budget
* Safe Mode: define `GTPERF_SAFE_MODE` and every transformation and cache read stops, without touching a setting

**Cloudflare on the free plan**

* One managed Cache Rule, compiled from the same bypass policy as the origin cache
* Rule preview before sync: the exact expression, drift, competing rules and remaining rule budget
* Exact-URL and full-zone purges, with retries for rate limits and temporary failures
* Scoped API token or legacy Global API Key, encrypted at rest or supplied in `wp-config.php`
* No APO, Workers, Argo or Enterprise plan needed

**Unused CSS, generated on your server**

* Removes the CSS each page doesn't use, per URL, in background jobs
* Three delivery modes: generated file, all inline, or critical CSS inline with the rest in a file
* Keeps hover, focus and other interaction states, plus a safelist with partial or regex matching
* Staged rollout to a percentage of URLs, and 0% restores the original stylesheets immediately
* Status report with sizes saved, build times, failures and per-URL or full regeneration
* Falls back to the original HTML and stylesheets whenever parsing or writing fails

**JavaScript**

* Minify local scripts, defer safe scripts and delay chosen third-party scripts until interaction
* Automatic protection for cart, checkout and payment scripts
* Analytics plugins are protected automatically: Independent Analytics, Burst Statistics, Koko Analytics, Matomo, WP Statistics, Site Kit by Google, MonsterInsights, ExactMetrics and PixelYourSite

**Images, embeds and fonts**

* Lazy-load non-critical images while the first images load eagerly
* Missing image dimensions added to reduce layout shift
* WebP or AVIF variants generated on upload and served where available
* Lightweight YouTube embeds that load the player only on click
* Google Fonts hosted locally, with a `font-display` control

**Database and WordPress bloat**

* Manual database scan with selectable cleanup, plus scheduled maintenance
* Heartbeat and autosave control
* Switches for emojis, embeds, XML-RPC, jQuery Migrate, Dashicons, self-pingbacks, the password strength meter, global styles, REST API links, Google Maps and more
* Separate controls for the main feed and secondary feeds, so /feed/ can stay live while the rest return 404

**Stores and memberships**

* FluentCart, Easy Digital Downloads and WooCommerce adapters built in
* Cart, checkout, account and receipt paths, session cookies and transactional query parameters are compiled into both origin and Cloudflare bypass rules
* Product pages purge when stock or price changes, not only when the post is saved

**Redis, CDN and hosting**

* Redis object-cache drop-in with host or Unix socket, ACL user, TLS, prefix and timeouts, falling back to request-local caching if Redis goes down
* Reads the `WP_REDIS_*` constants used by Redis Object Cache, so an existing setup doesn't need to be repeated
* Origin-pull CDN rewriting for the exact static file extensions you choose
* xCloud integration with host-cache purging and Cloudflare Enterprise add-on detection, so two plugins never fight over the same edge

**Diagnostics and tools**

* Explain This Page: the cache decision, the reasons behind it and the expected Cloudflare result
* Verified purge receipts that compare response fingerprints and cache headers after a purge
* Admin bar actions to purge, verify, warm or explain the current page
* WP-CLI commands: `doctor`, `cache`, `queue`, `cloudflare`, `xcloud` and `database`
* Perfmatters coordination and Akismet and Jetpack safeguards

= Works With Any Host =

GT Performance needs PHP 8.1, WordPress 6.6 and a writable `wp-content` directory. It works on Apache, NGINX, LiteSpeed and OpenLiteSpeed, because the cache is a WordPress drop-in and doesn't depend on a server module. Cloudflare, Redis, xCloud and a custom CDN are all optional.

Multisite activation is not supported. Its compiled configuration and cache directory would be shared across the network, and one site's settings would decide another site's cache.

= Privacy =

Cached pages, generated CSS and diagnostics stay on your server. GT Performance sends no telemetry and never contacts servers of its own. Third-party services are contacted only after you connect them, and each one is listed under External Services below.

= Open Source =

GT Performance is free GPL software with no license key and no paid tier. Development happens in the open on [GitHub](https://github.com/wpgaurav/gt-performance), where bug reports and pull requests are welcome.

== Installation ==

1. Install and activate GT Performance from Plugins > Add New.
2. Open GT Performance in the WordPress admin menu.
3. Install the page-cache drop-in from the Cache screen. Caching starts after this step.
4. Enable the optimization features you want, one at a time, and check your theme and key pages after each one.
5. Optional: connect Cloudflare with a scoped API token (Zone Read, Cache Rules Edit and Cache Purge), preview the rule plan, then select Connect/sync Cloudflare.
6. Optional: configure Redis, xCloud or an origin-pull CDN from the Integrations and CDN screens.

Riskier frontend transformations should be tried on a staging site before production.

== Frequently Asked Questions ==

= Is GT Performance free? =

Yes. Every feature is free, with no license key, no paid tier and no account.

= Does the Cloudflare integration need a paid plan? =

No. It uses Cache Rules and targeted purges, which are available on Cloudflare Free. APO, Workers and Enterprise are not required.

= Is my CSS sent to an external service? =

No. Stylesheet collection, selector matching, pruning and file creation all run on your WordPress server.

= Will it cache my cart or checkout? =

No. Active FluentCart, Easy Digital Downloads and WooCommerce adapters supply their dynamic paths, session cookies and query parameters to both the origin cache and the Cloudflare rule. Private responses also send no-store headers to browsers and CDNs.

= Can I use it with another cache plugin? =

Only one plugin should own the page cache. GT Performance checks drop-in ownership and reports active cache and optimization plugins. With Perfmatters, it coordinates which plugin owns each optimization so nothing runs twice.

= Something looks broken. How do I find out which option did it? =

Define `GTPERF_SAFE_MODE` as `true` in `wp-config.php`. Every HTML transformation stops and no page is served from or written to the cache, without changing any setting. Remove the constant and turn features back on one at a time.

= Can I use another CDN alongside Cloudflare? =

Yes. Add the CDN's HTTPS origin-pull URL on the CDN screen and choose the file extensions it should serve. Only same-site files with those extensions are rewritten. HTML, API responses, third-party URLs and other file types stay unchanged.

= Can Redis credentials go in wp-config.php? =

Yes. GT Performance reads the `WP_REDIS_HOST`, port, socket path, scheme, database, ACL password array, prefix, timeout, read-timeout and disable constants used by Redis Object Cache. `GTPERF_REDIS_*` constants take highest precedence. The Integrations screen provides a copy-ready example.

= Does it remove its data on uninstall? =

Only if you ask it to. Enable "Remove all data when the plugin is deleted" on the Optimization screen, and uninstalling removes the options, tables, drop-ins, cache directory and stored credentials.

== Screenshots ==

1. Dashboard with page cache, Cloudflare and unused CSS status, plus the current configuration.
2. Page cache settings with lifetime presets.
3. Unused CSS delivery modes, dynamic states and staged rollout.
4. JavaScript, image and embed optimization settings.
5. JavaScript, media and WordPress exceptions.

== Third-party libraries ==

GT Performance bundles three MIT-licensed PHP libraries in `vendor/`. All three are GPL-compatible and are used server-side only.

* [matthiasmullie/minify](https://github.com/matthiasmullie/minify) - JavaScript minification in memory. MIT.
* [sabberworm/php-css-parser](https://github.com/MyIntervals/PHP-CSS-Parser) - CSS parsing for the unused-CSS engine. MIT.
* [symfony/css-selector](https://github.com/symfony/css-selector) - CSS selector to XPath translation. MIT.

The full GPL-2.0 text this plugin is licensed under ships as `LICENSE` in the plugin directory.

== External Services ==

GT Performance works entirely on your server by default and sends no data anywhere. Each integration below contacts a third-party service only after you enable it and, where credentials are involved, only with credentials you supply. There is no telemetry, no account requirement, and the plugin never contacts servers of its own.

= Cloudflare API (api.cloudflare.com) =

Contacted only when you connect your own Cloudflare account to manage its cache rule and purge its cache. Requests carry the API token or Global API Key and account email you saved, your zone identifier or domain, the compiled cache-rule expression, and the exact URLs being purged. They are sent when you connect, synchronize, run diagnostics, or purge, and automatically when a content change requires an edge purge. Provider: Cloudflare, Inc. - [Terms of Service](https://www.cloudflare.com/terms/), [Privacy Policy](https://www.cloudflare.com/privacypolicy/).

= xCloud hosting API (app.xcloud.host) =

Contacted only when you connect a site hosted on xCloud using your own xCloud API token. Requests carry that token and your site's domain or xCloud identifier, and are sent when you connect or refresh the integration and when host-level caches are purged. Provider: xCloud by WPDeveloper - [Privacy Policy](https://xcloud.host/privacy-policy/).

= Google Fonts (fonts.googleapis.com, fonts.gstatic.com) =

Contacted only when you enable local Google Fonts hosting on a site whose theme or plugins already load Google Fonts. Your server downloads the stylesheet and font files once and serves them from your own domain afterward. The download is a server-side request that carries no visitor data, and the feature removes visitors' browser requests to Google entirely. Provider: Google LLC - [Privacy Policy](https://policies.google.com/privacy), [Google Fonts privacy notes](https://developers.google.com/fonts/faq/privacy).

= YouTube (i.ytimg.com, www.youtube-nocookie.com) =

Involved only on pages where you have already embedded a YouTube video and the lightweight embed option is enabled. The visitor's browser loads the video thumbnail from i.ytimg.com, and the player loads from the privacy-enhanced youtube-nocookie.com domain only after the visitor clicks play. Your server sends nothing to YouTube; without this option the standard YouTube embed would contact YouTube earlier and more broadly. Provider: Google LLC - [Terms of Service](https://www.youtube.com/t/terms), [Privacy Policy](https://policies.google.com/privacy).

GT Performance also sends requests to your own site's URLs for cache warming, CSS generation, and purge verification. Those requests never leave your domain.

= Hostnames that are matched, not contacted =

GT Performance stores a list of script hostname patterns such as `connect.facebook.net`, `googletagmanager.com`, `google-analytics.com`, `clarity.ms`, and `hotjar.com`. These are exclusion rules, not connections. They are compared against the script URLs your own site already loads so that those scripts are never minified, deferred, or delayed. GT Performance never contacts these hosts, sends them no data, and adds no script to your site that would.

== Upgrade Notice ==

= 1.0.14 =
Fixes individual Cloudflare purges. After updating, select Connect/sync Cloudflare once to update the managed rule. Unrelated Cloudflare rules are preserved.

= 1.0.4 =
Upgrading from 1.0.0 or earlier requires replacing the cache drop-in first. Run the standalone repair script linked in the 1.0.4 changelog entry before updating.

== Changelog ==

= 1.0.14 =
* Fixed individual Cloudflare purges by allowing internal PURGE requests in the managed cache rule while preserving checkout, session, and query exclusions.
* Wait for Cloudflare before verifying or reporting manual cache purges; show partial failures and retain the latest purge result even with debug logging disabled.
* Purge desktop, mobile, and tablet cache variants when separate device caching is enabled.
* Retry temporary Cloudflare transport, rate-limit, and server failures up to three times, preserving unprocessed batches and honoring Retry-After.
* A successful full purge supersedes queued URL purges and retries. Failed verification requests no longer appear successful, and receipt details display correctly.
* After upgrading, use Connect/sync Cloudflare once to update the existing managed rule. Unrelated Cloudflare rules are preserved.

= 1.0.13 =
* Protects configuration and drop-ins against incomplete writes and unsafe temporary files.
* Stores private diagnostics in the database and removes old log files.
* Keeps Redis markers in the plugin cache and prevents unsafe symlink traversal during uninstall.
* Reports failed runtime settings saves and retains previous settings instead of falsely reporting success.
* Replaced PHP-containing runtime configuration files with authenticated encrypted JSON and migrated both cache drop-ins.
* Removed legacy configuration files after successful migration.

= 1.0.12 =
* Protected temporary configuration files, restricted permissions before writing, and rejected incomplete writes.
* Escaped less-than characters in generated inline styles, preventing HTML closing-tag injection while preserving CSS string values.
* Returned completed page responses through an output-buffer callback, preserving scripts, forms, and SVG.
* Removed obsolete feature descriptions and interface remnants.

= 1.0.11 =
* Generated CSS and frontend loaders now use WordPress asset registration, enqueue, and printing functions.
* Opt-in JavaScript minification uses transient storage and signed delivery instead of JavaScript file writes. Defer, delay, saved settings, and exclusions remain supported.
* Restricted early cache reads to validated local files and hardened both drop-in configuration readers.

= 1.0.10 =
* Added unused CSS status counts, size savings, build timings, failure details, and per-URL, per-result, and full regeneration.
* Fixed CSS generator requests being blocked by page-cache and commerce rules, and fixed CSS reuse across pages with differing markup.

Older entries, from 1.0.0 to 1.0.8, are in the [full changelog on GitHub](https://github.com/wpgaurav/gt-performance/blob/main/CHANGELOG.md).
