=== Performance Optimisation ===
Contributors: nilesh912
Tags: cache, performance, speed, pagespeed, minify
Requires at least: 6.2
Requires PHP: 8.2
Tested up to: 7.1
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Speed up WordPress with page caching, JS/CSS minify, lazy load, WebP/AVIF images, Redis object cache, and database cleanup. Simple and powerful.

== Description ==

**Performance Optimisation** is a free, all-in-one speed plugin that makes your WordPress site faster — without the complexity. Fully compatible with popular themes and page builders (Elementor, Divi, Astra, GeneratePress, Kadence, WooCommerce, Yoast SEO, Rank Math). Page caching, file minification, image optimization, lazy loading, database cleanup, and Redis object cache — all from one clean dashboard.

= Why choose Performance Optimisation? =

Most performance plugins either do too little or overwhelm you with dozens of confusing settings. This plugin gives you **everything you need to speed up WordPress** in one place, with safe defaults and clear explanations for every option.

 - **Simple to use:** Clean, modern dashboard. Enable what you need, leave the rest off. No guesswork.
 - **Powerful features:** Page cache, JS/CSS/HTML minify, WebP/AVIF image conversion, lazy loading, Redis object cache, database cleanup — the full stack.
 - **Safe by default:** Aggressive options like defer JS, delay JS, and WooCommerce asset removal are off by default with clear warnings when you turn them on.
 - **Works everywhere:** Shared hosting, VPS, dedicated servers, Apache, Nginx — it adapts to your environment.

= What does this plugin do? =

**🚀 Page Caching**
Generate static HTML files for your pages so they load instantly. Includes Gzip compression, CDN support, and smart cache clearing when you update content.

**📦 File Optimization**
Minify and combine JavaScript, CSS, and HTML. Defer or delay render-blocking scripts. Remove WordPress bloat like emojis, embeds, dashicons, and XML-RPC.

**🖼️ Image Optimization**
Convert images to next-gen WebP and AVIF formats automatically. Lazy load images, iframes, and videos with lightweight SVG placeholders. Preload critical images for faster LCP.

**⚡ Preloading & Prefetching**
Warm up your cache automatically. Preconnect to third-party origins, prefetch DNS, and preload critical fonts and CSS for faster page rendering.

**🗄️ Database Cleanup**
Remove post revisions, auto-drafts, spam comments, expired transients, and orphaned metadata. Schedule automated cleanups daily, weekly, or monthly.

**🔴 Redis Object Cache**
Built-in Redis object cache with support for standalone, Sentinel, and Cluster topologies. TLS/SSL encryption included. No separate plugin needed.

**📊 Performance Monitor**
Built-in performance scanner that measures real load times, TTFB, DNS resolution, and Core Web Vitals — right from your WordPress dashboard.

**📡 Real-User Monitoring (RUM)**
Collects anonymised field Web Vitals (LCP, INP, CLS) from real visitors and charts trends in the dashboard, so you can see what each optimisation actually changed.

**🤖 AI Adaptive Suggestions**
Heuristic auto-tune that reads RUM trends and audit results to suggest safe next steps — read-only recommendations, never silent changes.

**🔀 LiteSpeed Coexistence**
Auto-detects LiteSpeed/OLS servers and LSCache: pick Auto, WPPO, LiteSpeed, or Standalone mode, with purge sync and header-protocol support so the two caches never fight.

**🧩 Edge Cache & CDN Purge**
Purge fan-out for Cloudflare, Bunny, and Varnish edge caches plus per-mapping CDN URL rewriting with attribute controls.

**🕷️ Cache Crawler**
Background crawler (WP-Cron/Action Scheduler) that warms the static cache across a variant matrix with concurrency and load limits.

**⏪ bfcache Support**
Serves revalidatable cache headers for logged-in users so the browser back/forward cache keeps working instead of forcing full reloads.

**📄 llms.txt**
Auto-generated `/llms.txt` and `/llms-full.txt` virtual files (refreshed daily) so AI crawlers and assistants can understand your site.

**🔌 ESI & Abilities API**
LiteSpeed ESI bridge for dynamic fragments (LSWS Enterprise; AJAX fallback on OLS) and a WordPress Abilities/MCP surface (abilities like `performance-optimisation/cache-management`) for programmatic access.

**🛠️ Developer Friendly**
System Info dashboard, Google PageSpeed Insights integration, per-page asset manager, and import/export settings.

= Who is this plugin for? =

 - **Site owners** who want a faster website without hiring a developer.
 - **Freelancers and agencies** who need a reliable speed plugin they can deploy across client sites.
 - **Developers** who want granular control over caching, minification, and delivery without vendor lock-in.

This plugin bundles 7 Composer packages: `voku/html-min` (HTML minification), `matthiasmullie/minify` with its `matthiasmullie/path-converter` and `symfony/css-selector` dependencies (CSS/JS minification), `tedivm/jshrink` (JS minification), `voku/simple_html_dom` (HTML parsing), and `woocommerce/action-scheduler` (background job processing).

== Installation ==

1. Install the plugin from the **WordPress Plugin Directory** (search for "Performance Optimisation") or upload it manually to `/wp-content/plugins/performance-optimisation`.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Go to the **Performance Optimisation** menu in your WordPress admin panel.
4. Start with the **Dashboard** to see your current performance status, then enable features one at a time.

After activation, you can manage the following from the settings tabs:

- **Dashboard** — See your cache size, optimized file counts, image status, and recent activity at a glance.
- **File Optimization** — Minify JS/CSS/HTML, combine CSS, defer/delay JS, and remove WordPress bloat.
- **Preload** — Cache warm-up, preconnect, DNS prefetch, and font/CSS preloading.
- **Image Optimization** — Lazy load images with SVG placeholders, convert to WebP/AVIF, and preload feature images.
- **Database** — Clean up revisions, auto-drafts, transients, spam, and orphaned data — manually or on a schedule.
- **Object Cache** — One-click Redis integration with standalone, sentinel, and cluster support.
- **Tools** — Import/export settings for quick deployment across multiple sites.

== Changelog ==

= 2.0.0 (2026-09-11) =
* New: LiteSpeed/OpenLiteSpeed coexistence with Auto/WPPO/LiteSpeed/Standalone modes, native X-LiteSpeed header protocol, purge sync, ESI punch-holing, per-page/per-post-type TTL overrides and a background cache crawler.
* New: Edge cache support with purge fan-out for Cloudflare, Bunny and Varnish, plus per-mapping CDN URL rewriting.
* New: Real-User Monitoring (RUM) collects anonymised field Web Vitals (LCP, INP, CLS) with trend charts in the dashboard.
* New: AI Adaptive read-only suggestions and RUM anomaly detection, with optional WordPress AI client integration.
* New: Optimization Detective bridge for real-visit LCP data.
* New: bfcache support for logged-in users.
* New: Auto-generated /llms.txt and /llms-full.txt files, refreshed daily.
* New: WordPress Abilities API (WP 6.9+) surface for programmatic/AI access, plus a `wp wppo verify` WP-CLI self-verification command.
* New: Autoloaded-options audit with dry-run/apply/revert remediation, and a read-only expired-transients export.
* New: Safe-by-default Used CSS with coupled purge and builder-drift requeue, plus a user safelist with automatic checksum regeneration.
* New: Critical CSS size cap, per-template variants and file-first delivery.
* New: Delay-JS presets (INP-first, builder, commerce, interaction), a per-page kill switch and a WooCommerce safe-mode toggle.
* New: LCP guardrails that never lazy-load above-the-fold content and preload the hero image with fetchpriority.
* New: AVIF-first picture output with smart quality, skip-small threshold and HDR gain-map handling.
* New: Configurable static-page Cache Life (TTL), with per-role/per-URL variants.
* New: Redis object-cache circuit breaker with auto-disable, recovery probe and admin notice.
* New: Builder-update purge watcher for Elementor, Divi, Bricks and WPBakery.
* New: Redesigned dashboard and all settings tabs with WCAG AA contrast, equal-height metrics and full mobile/RTL support.
* Improvement: Native lazy loading (`loading="lazy"`) is now the default; the legacy JavaScript IntersectionObserver lazy loader is opt-in.
* Improvement: Adopted WordPress 6.9+ core APIs — template enhancement buffer, salted cache deletes, script-loader fetchpriority/in_footer, inline-style budget and the WordPress Abilities API.
* Improvement: Speculative loading is more conservative by default (prefetch + conservative eagerness) and narrowed to core's Speculation Rules API with commerce and nonce exclusions.
* Improvement: Canonical settings defaults single-sourced across the admin, REST API and WP-CLI.
* Performance: Centralised URL caching, memoised settings, removed N+1 permalink lookups and reduced minifier regex overhead.
* Performance: Lazy-render below-fold DOM with content-visibility and defer non-critical fetchpriority hints.
* Security: Hardened cache-path/static-file handling against path traversal and arbitrary file write, fixed host-header cache-poisoning and stored-XSS vectors, added nonce verification to ESI/AJAX handlers and redacted sensitive data from System Info.
* Security: Atomic, verified writes for wp-config, advanced-cache.php and .htaccess with rollback.
* Fixed: Redis drop-in boot fatal on some WordPress 7.0 setups.
* Fixed: wp-login/admin fatals caused by a typed property and a filter signature.
* Fixed: frontend 500 from Minify\JS cache-file path visibility.
* Fixed: media-print deadlock when defer/delay scripts are swapped.
* Fixed: inline CSS minification no longer strips the critical-CSS id; localhost now gets a synchronous CCSS fallback.
* Fixed: assorted mobile/RTL/a11y and unsaved-changes issues across the admin UI.
* Removed: `file_optimisation.removeQueryStrings` ("Remove Query Strings From Static Resources") — `?ver=` is the cache-busting mechanism and is now always preserved; a stored legacy value is ignored (fail-open) and dropped on the next save.
* Removed: orphaned `performance-optimisation/v1/crawler` and `crawler_status` REST routes.
* Removed: `performance-optimisation/v1/get_page_assets` REST route and handler; use the Abilities API `performance-optimisation/get-page-assets` or `Asset_Manager::get_page_assets()`.
* Removed: the public `Cache::clear_ccss()` method; use `Critical_CSS::clear_all()` instead.
* Changed: the legacy `core_tweaks` settings tab is no longer accepted by `update_settings`/`import_settings` (core-tweak options live under File Optimization); pre-2.0 exports containing `core_tweaks` will be rejected.
* Changed: minimum runtime remains WordPress 6.2 / PHP 8.2, now enforced with clean self-deactivation.



= 1.9.0 (2026-08-11) =
* Performance: Centralized `content_url()` static caching across asset minification loops via `Util::cached_content_url()`. Keys static cache per site per request (`get_current_blog_id()`) for multisite safety under `switch_to_blog()` and gates caching with `has_filter('content_url')`.
* New: Added WordPress 7.1+ client-side media processing toggle (`filter_client_side_supported_mime_types`). Admin setting enables selecting in-browser Web Worker supported MIME types, intersected with core's reported capabilities to prevent unsupported formats from shadowing core defaults.
* Image Optimization: Integrated WordPress 7.1+ size-aware `wp_get_image_encode_quality()` and WP 6.7–7.0 `wp_image_quality()` for WebP/AVIF image conversion.
* Image Optimization: Preserved fixed quality (40) for LQIP (`generate_lqip()`) image placeholders to keep inline base64 data URIs small and prevent payload inflation on WP 6.7–7.0.
* Preload & Hints: Migrated preconnect and DNS-prefetch emission to core's `wp_resource_hints` filter API. Added automatic scheme-less bare-hostname (`example.com`) normalization to protocol-relative (`//example.com`) form so origins survive core's host guard, while retaining `crossorigin="anonymous"` attributes for preconnect hints.
* Inline CSS: Inlines combined/minified CSS stylesheets via WordPress core's `wp_maybe_inline_styles()` when within the `styles_inline_size_limit` budget. Added `wppo_inline_combined_css` filter for CDN opt-out.
* Block Assets: WordPress 6.9+ compatibility for block asset loading — classic themes now load separate core block styles on demand by default.
* Multisite & Object Cache: Added transient key isolation on multisite networks using `{blog_id}_` prefix via `Util::transient_key()`. Updated Redis Object Cache drop-in with WP 6.9+ key salt support.
* UI & Safety: Added `Array.isArray()` defensive guards for stored options in React admin SPA components and single-sourced `DEFAULT_CLIENT_SIDE_MIME_TYPES` constants.

= 1.8.1 (2026-08-01) =
* New: Inline the combined/minified CSS via WordPress core's `wp_maybe_inline_styles()` when the file is within the `styles_inline_size_limit` budget, eliminating a render-blocking stylesheet round-trip on first load. Use the `wppo_inline_combined_css` filter (return falsy) to disable inlining, e.g. when serving the combined file from a CDN.
* New: WordPress 6.9+ compatibility for block asset loading — classic themes now load separate core block styles on demand by default (matching WordPress core). The "Load Block Assets On Demand" toggle acts as an opt-out on 6.9+: disable it to force the combined `wp-block-library` stylesheet.
* Improvement: Existing installs are migrated once to the WordPress 6.9+ on-demand default without overwriting explicit user settings.

= 1.8.0 (2026-07-28) =
* New: WordPress 6.9+ object cache key salt support for cache key space invalidation.
* New: Lazy loading and HTML Tag Processor support for `iframe` elements.
* Performance: Pre-cached delayJS script exclusion parsing in HTML minification worker loops.
* Performance: Cached `home_url()` path per blog ID in URL utility resolution.
* Accessibility: Added `aria-describedby` accessibility associations and modal focus trap management.
* Safety: Integrated React ErrorBoundary wrapper for SPA runtime exception handling.
* Fix: Corrected key-indexed return array structure in Redis Object Cache fallback methods.

= 1.7.0 (2026-07-26) =
* Improvement: Cached minification status checks to reduce disk I/O overhead.
* Improvement: Optimized minification detection using streaming file readers.
* Accessibility: Made Tooltip component fully keyboard accessible and theme-adaptive.
* Accessibility: Added ARIA labels and accessible descriptions across Performance Audit and Database Cleanup settings.
* UI: Integrated LoadingSubmitButton for granular database cleanup actions.
* Fix: Throttled WP_CACHE environment verification checks on failure.
* Fix: Aligned PageSpeed result strategy labels with scan output and prevented stale suggestion responses on consecutive scans.
* Localization: Migrated client-side translations to @wordpress/i18n.

= 1.6.0 (2026-04-26) =
* New: Google PageSpeed Insights integration — audit Mobile/Desktop performance from your dashboard.
* New: Suggestion Engine — actionable performance tips based on real-time site telemetry.
* New: Nginx Support — dynamic configuration snippets for Gzip and Browser Caching.
* New: WP_CACHE Self-Healing — automatically repairs wp-config.php constant issues.
* Improvement: Modernized telemetry with Zstd support and detailed network timing breakdown.
* Security: Implemented SSRF protection for PageSpeed scans and automated API key redaction.
* Fix: Standardized Object Cache return contracts for multi-key operations.
* Improvement: Updated minimum PHP requirement to 8.2 for enhanced library compatibility.

= 1.5.1 (2026-04-23) =
* Performance: Optimized wppo_img_info database option to reduce memory overhead.
* Fix: Implemented atomic write protection for image metadata.
* Fix: Consolidated build patterns and performance guidelines.

= 1.5.0 (2026-04-20) =
* New: Performance Monitor — High-precision local telemetry engine using raw cURL for granular network diagnostics (DNS, Connect, SSL, TTFB).
* New: System Info Dashboard — Real-time environment diagnostic tool providing detailed PHP, Database, WordPress, and Server metrics.
* New: Developer Mode — Advanced UI toggle for granular performance metrics and environment data.
* Improvement: Enhanced SSRF protection for local telemetry scans.
* Improvement: Modernized UI with dynamic WordPress admin color scheme adaptation using `color-mix()`.

= 1.4.0 (2026-04-18) =
* New: Enterprise Redis Object Cache support including Sentinel, Cluster, and TLS/SSL encryption modes.
* New: Atomic, batched processing for database cleanup and cron tasks to ensure stability on large-scale sites.
* New: Upgraded Design System v2.1 with modular components (FeatureCard, FeatureHeader, SwitchField) and optimized Sass architecture.
* New: Real-time status reporting on the dashboard for background optimization visibility.
* Improvement: Hardened security architecture with AJAX-based nonce resilience and DoS protection for image conversion.
* Improvement: Standardized REST API permission callbacks and input sanitization for enterprise compliance.
* Fix: Resolved structural regressions in REST cleanup controllers and improved reliability of revision management.

= 1.3.0 (2026-04-15) =
* New: Core Tweaks section to remove WordPress bloat (Emojis, Embeds, Dashicons) and control Heartbeat limits.
* New: Active WP-Cron scheduling for Database cleanups (Daily, Weekly, Monthly) with precise age/revision limits.
* New: Injected `fetchpriority` support to preload links for faster asset transmission.
* New: Implemented an active MutationObserver to track and lazy-load dynamically generated DOM content.
* New: Extended server-level cache expiration and Deflate/Gzip compression rules within `.htaccess`.
* New: Added logic to exclude specific self-hosted videos from lazy-loading routines.
* Improvement: Automatically inject `font-display: swap` into CSS payloads to eliminate render-blocking text.
* Improvement: Substantially refined UI aesthetics by migrating to native WP CSS variables and expanding component descriptions.
* Improvement: Added logic toggles to conditionally skip heavy HTML, CSS, and JS minification overhead.
* Fix: Mitigated false-positive SQL placeholder warnings (`WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare`) in database garbage collection routines.

= 1.2.3 (2026-04-14) =
* Fix: Resolved fatal error where `Advanced_Cache_Handler` was not found during activation or admin notice checks.
* Performance: Refactored `Advanced_Cache_Handler` to use lazy loading ("require when needed") to reduce memory footprint.
* Fix: Shortened plugin short description to meet WordPress.org's 150-character limit.

= 1.2.1 (2026-04-14) =
* Fix: Implemented handle whitelisting in Metabox to prevent unauthorized script/style handle persistence.
* Fix: Support parent directory locations for `wp-config.php` (core-mirroring behavior).
* Fix: Properly handle transient deletion and `WP_CACHE` constant guards during activation.
* Fix: Alignment and escaping in admin notices for WPCS compliance.
* Fix: Add `WP_CACHE` to wp-config.php when the constant was previously undefined (correct activation logic).
* Safety: `advanced-cache.php` includes a plugin marker; do not overwrite or delete another plugin’s drop-in.
* UX: Admin notices for foreign drop-in, wp-config issues, competing full-page cache plugins, and a short post-activation welcome notice.
* UI: Stronger warning when enabling WooCommerce asset removal.
* Docs: Expanded readme description, FAQ, and screenshot placeholders.
* Meta: Plugin header `Requires at least` now matches readme.txt (6.2).

= 1.2.0 (2026-04-13) =
* New: Automatic Gzip compression and browser caching for faster page loads.
* New: CDN support — serve static assets from your own CDN domain.
* New: Smarter cache clearing — related pages update automatically when you edit content.
* New: Safety prompts before deleting data, removing images, or importing settings.
* New: Helpful warnings when enabling advanced options like Defer JS or Server Rules.
* New: Plugin UI matches your chosen WordPress admin color scheme.
* Improvement: Faster loading — removed external font dependency.
* Improvement: Better form inputs, loading indicators, and keyboard navigation.
* Improvement: Faster database operations for image processing.
* Security: Fixed several file path security issues.
 * Compatibility: Tested up to WordPress 6.9.
 * Compatibility: Tested up to WordPress 7.0.

= 1.1.4 (2026-04-08) =
* Security: Fixed path traversal vulnerability in the Image Optimisation REST endpoint.
* Security: Added directory traversal protection in URL-to-path resolution.
* Performance: Optimized image queue database writes by caching in memory and flushing once on shutdown.
* Fix: Updated CheckboxOption component to use unique IDs for proper accessibility (label/input association, aria-describedby).

= 1.1.3 (2026-04-07) =
* Fix: Anchored build paths in .distignore to prevent accidental exclusion of vendor files.

= 1.1.2 (2026-04-07) =
* Fix: Cache the Img_Converter instance to reduce PHP overhead during image conversion.
* Fix: Validate and sanitize imported REST API settings before saving.
* Fix: Improve sidebar accessibility and keyboard navigation in the admin UI.
* Update: Use `@wordpress/element` for React rendering compatibility in WordPress.

= 1.1.1 (2026-04-06) =
* Improvement: Optimized JS Defer and Delay loading by caching exclusion lists.
* Improvement: Enhanced backend performance by reducing redundant string parsing.
* Security: Implemented protection against potential directory traversal vulnerabilities.
* Fix: Standardized REST API key sanitization to prevent settings synchronization issues.
* Localization: Added translated ARIA labels for sidebar accessibility.

= 1.1.0 (2026-04-05) =
* Improvement: Visually enhanced the 'File Optimization' settings for easier configuration.
* Improvement: Hardened overall plugin security and input validation.
* Fix: Automatically clear cache when changing permalink settings or switching themes.
* Fix: Prevented unnecessary CSS files from generating on 404 error pages.
* Update: Improved image lazy loading reliability for smoother page rendering.


= 1.0.0 (2024-12-18) =

Initial release with full functionality:
Dashboard overview.
Cache management.
JavaScript, CSS, and HTML optimization.
Advanced image optimisation and lazy loading.
Preloading settings for cache, fonts, and images.
Import/export settings tools.

== Frequently Asked Questions ==

= How do I speed up my WordPress site with this plugin? =
Install and activate the plugin, then visit the **Dashboard**. Start by enabling **Page Caching** for the biggest speed boost. Then enable **JS/CSS Minification** and **Lazy Loading** for images. Each feature can be turned on independently — enable one at a time and test your site.

= Will this work with WooCommerce? =
Yes. The plugin is fully compatible with WooCommerce. WooCommerce-specific asset removal is **optional** and off by default. If you enable it, the plugin shows a clear warning reminding you to test cart, checkout, and product pages.

= Can I use this alongside another cache plugin? =
You should only run **one** full-page caching solution at a time. If another plugin (WP Super Cache, LiteSpeed Cache, WP Rocket, etc.) already manages caching, this plugin will detect it and won't overwrite the existing setup. You can still use the minification, image optimization, and database cleanup features alongside most other plugins.

= Does this plugin improve Core Web Vitals and PageSpeed scores? =
Yes. The features below — static HTML caching, lazy loading, WebP/AVIF image conversion, font preloading, and script deferral — directly target the metrics measured by Core Web Vitals and PageSpeed Insights. In one internal example benchmark on a standard WordPress install (Astra theme, 5 images) we observed improvements in PageSpeed scores, Time to First Byte, LCP, and total page size, but **results vary** significantly with hosting, theme, plugin mix, and content, so your own before/after measurements are the only reliable guide.

= Does this work on shared hosting? =
Yes. The plugin works on any standard WordPress hosting — shared hosting, VPS, dedicated servers, and managed WordPress hosts. Redis Object Cache requires Redis to be installed on your server, but all other features work everywhere.

= Is this compatible with page builders like Elementor or Divi? =
Yes. The plugin works with all major page builders including Elementor, Divi, Beaver Builder, and WPBakery. If you experience any layout issues after enabling minification, you can exclude specific files using the built-in exclusion rules.

= Is this plugin compatible with popular themes, WooCommerce, and SEO plugins? =
Yes. It is fully tested and compatible with major themes (Astra, GeneratePress, Kadence, OceanWP, Blocksy, Twenty Twenty-Four), e-commerce (WooCommerce), and SEO plugins (Yoast SEO, Rank Math, All in One SEO, SEOPress). WooCommerce cart, checkout, and account pages are automatically excluded from full-page caching. If minification or deferral affects specific scripts or style handles, you can add them to the exclusion rules in the File Optimization tab.

= How do I convert images to WebP or AVIF? =
Go to the **Image Optimization** tab, enable image conversion, and choose your format (WebP, AVIF, or both). Click **Optimize Now** to start converting your existing images. New uploads are converted automatically in the background.

= Can I exclude specific files from minification? =
Yes. In the **File Optimization** tab, you can list specific JavaScript or CSS files to exclude from minification, defer, or delay. This is useful for scripts that break when minified.

= Does the plugin support lazy loading? =
Yes. The plugin lazy loads images, iframes, and videos using an IntersectionObserver. You can use lightweight SVG placeholders for a better loading experience. A MutationObserver also catches dynamically injected content.

= How do I clean up my WordPress database? =
Go to the **Database** tab. You can manually clean post revisions, auto-drafts, spam comments, expired transients, trashed posts, and orphaned metadata. You can also schedule automatic cleanups to run daily, weekly, or monthly.

= Can I import/export plugin settings? =
Yes. Use the **Tools** tab to export your current configuration as a JSON file and import it on another site. This is useful for agencies deploying the same setup across multiple client sites.

= Is this plugin free? =
Yes. Performance Optimisation is 100% free and open source. There is no premium version, no upsells, and no feature restrictions.

== External Services ==

This plugin relies on the following external services. The PageSpeed and Google Fonts requests are only made after an explicit administrator action as described below. Edge-cache purges (Cloudflare, Bunny and Varnish) are the one exception: the plugin calls them automatically after it clears its own page cache — including on post publish/update — but only when the administrator has already configured the integration and stored the relevant credentials. Each entry lists the exact data sent and how to opt out.

= Google PageSpeed Insights API (https://www.googleapis.com/pagespeedonline/v5/runPagespeed) =
* **Purpose:** Provides Lighthouse performance scores, Core Web Vitals, and diagnostic audits for the URL you choose to scan. Used by the Dashboard → Performance Audit → PageSpeed panel.
* **When:** Only when an administrator who has set a PageSpeed API key (Performance Audit → PageSpeed API Key) clicks “Scan” (or when the daily auto-rescan cron runs if that option is enabled). No request is made on page load, and no request is made without a stored API key.
* **Where:** The request is made server-side via `wp_remote_get` to `https://www.googleapis.com/pagespeedonline/v5/runPagespeed` with query params `url` (the scanned URL), `strategy` (`mobile` or `desktop`), `category` (PERFORMANCE, ACCESSIBILITY, BEST_PRACTICES, SEO), and `key` (your API key).
* **What data is sent:** The public URL to audit and the chosen strategy. The API key is sent as authentication. No site visitor data, cookies, or admin credentials are sent. Results are cached as a transient (`wppo_pagespeed_*`) for 24 hours and optionally stored as trend history in the `wppo_web_vitals_trends` option.
* **Terms/Privacy:** https://developers.google.com/speed/docs/insights/v5/get-started and https://policies.google.com/privacy. You must obtain your own API key from https://console.cloud.google.com/; the plugin never ships a default key.
* **EOL/Opt-out:** Remove the API key or disable the PageSpeed panel to stop all requests. No further calls are made.

= Google Fonts CDN (https://fonts.googleapis.com and https://fonts.gstatic.com) =
* **Purpose:** When the File Optimization option “Host Google Fonts Locally” is enabled, the plugin detects Google Fonts CSS requested via `fonts.googleapis.com` and downloads the CSS and associated font files (`fonts.gstatic.com`, woff2) to serve locally (`wp-content/cache/wppo/fonts/`). This eliminates external DNS lookups on the frontend, improves GDPR compliance, and enables `font-display: swap`.
* **When:** Only when “Host Google Fonts Locally” is enabled **and** a page or enqueued stylesheet contains a `fonts.googleapis.com` URL (via `style_loader_tag` or an `@import`/`link` in the HTML buffer). Each unique Google Fonts CSS URL is fetched once and then served from the local cache. When the option is disabled, the plugin makes no requests to Google Fonts; the browser loads fonts directly from Google as authored.
* **Where:** Server-side via `wp_remote_get` to `https://fonts.googleapis.com/...` (CSS, using a Chrome 120 UA to request woff2) and `https://fonts.gstatic.com/...` (font file, woff2). Timeouts are 20s (CSS) and 30s (font file).
* **What data is sent:** Only the Google Fonts stylesheet URL as authored in the theme/plugin (e.g. `https://fonts.googleapis.com/css2?family=Inter:wght@400`). No visitor IP beyond the server’s outbound request, no cookies, and no site content is sent.
* **Terms/Privacy:** https://developers.google.com/fonts/faq and https://policies.google.com/privacy.
* **EOL/Opt-out:** Disable “Host Google Fonts Locally” to stop all server-side fetches; existing cached files remain in `wp-content/cache/wppo/fonts/` until cleared via “Clear All Cache” or the plugin is uninstalled.

= Cloudflare cache purge (https://api.cloudflare.com/client/v4/zones/{zoneId}/purge_cache) =
* **Purpose:** Purge the configured Cloudflare zone cache whenever the plugin clears its own page cache, so visitors do not receive stale HTML after content or settings change.
* **When:** Automatically after `wppo_after_cache_clear` fires — this includes post publish/update (`save_post`), theme/plugin changes, settings saves and manual "Clear All Cache". No request is made unless an administrator has stored a Cloudflare API token (constant `WPPO_CLOUDFLARE_API_TOKEN`) and a Zone ID in the Edge Cache settings.
* **Where:** Server-side `wp_remote_request` POST to `https://api.cloudflare.com/client/v4/zones/{zoneId}/purge_cache`. A full purge sends `{"purge_everything":true}`; a single-page clear sends `{"files":["<page URL>"]}`.
* **What data is sent:** The Cloudflare Zone ID (in the URL), the API token (as an `Authorization: Bearer` header) and either the purge-everything flag or the URL(s) being purged. No visitor data, cookies, or site content are sent.
* **Terms/Privacy:** https://www.cloudflare.com/terms/ and https://www.cloudflare.com/privacypolicy/.
* **Opt-out:** Remove the `WPPO_CLOUDFLARE_API_TOKEN` constant, clear the Zone ID, or set the CDN purge service to "None" in the Edge Cache settings. No further purge calls are made.

= Bunny pull-zone cache purge (https://api.bunny.net/pullzone/{pullZoneId}/purgeCache) =
* **Purpose:** Purge the configured Bunny pull zone whenever the plugin clears its own page cache, so edge visitors do not receive stale HTML.
* **When:** Automatically after `wppo_after_cache_clear` (post publish/update, settings saves, manual cache clear), but only when an administrator has stored a Bunny API key (constant `WPPO_BUNNY_API_KEY`) and a Pull Zone ID in the Edge Cache settings. Bunny only supports all-or-nothing purges, so single-page clears skip it.
* **Where:** Server-side `wp_remote_request` POST to `https://api.bunny.net/pullzone/{pullZoneId}/purgeCache`.
* **What data is sent:** The Pull Zone ID (in the URL) and the API key (as an `AccessKey` header). No request body, visitor data or site content are sent.
* **Terms/Privacy:** https://bunny.net/terms/ and https://bunny.net/privacy/.
* **Opt-out:** Remove the `WPPO_BUNNY_API_KEY` constant and/or clear the Pull Zone ID. No further purge calls are made.

= Varnish cache purge (administrator-provided endpoints) =
* **Purpose:** Send HTTP `PURGE` requests to the Varnish endpoints you configure, so your own edge/Varnish layer is invalidated together with the plugin cache.
* **When:** Automatically after `wppo_after_cache_clear` (post publish/update, settings saves, manual cache clear), but only when you have entered one or more Varnish purge URLs in the CDN settings.
* **Where:** Server-side `wp_remote_request` `PURGE` calls to the exact URLs you entered (capped at 20 per purge, filterable). No vendor service is contacted.
* **What data is sent:** Only the HTTP `PURGE` request to your configured endpoint; no site content or visitor data.
* **Opt-out:** Remove the configured Varnish purge URLs. No further purge calls are made.

= First-party Real-User Monitoring (RUM) data =

When Real-User Monitoring is enabled (Dashboard → Web Vitals), the plugin records **anonymised field metrics only** — the page path and that page's Largest Contentful Paint (LCP), Interaction to Next Paint (INP) and Cumulative Layout Shift (CLS) samples. No cookies, names, email addresses, user IDs, form values, or IP addresses are stored with the samples. A visitor IP is read into memory solely to rate-limit the public beacon (120 requests/hour) and is never persisted. Metrics are aggregated and stored only in your own site's database (`wppo_web_vitals_rum` option plus per-path trend data), retained on a rolling 14-day window (up to 200 paths/day, 600 paths total), and are never sent to the plugin author or any third party. Disabling RUM stops collection; uninstalling the plugin removes the stored data. See `includes/class-rum.php`.

== Upgrade Notice ==

= 2.0.0 (2026-09-11) =
Major release. Native lazy loading is now the default and several safety presets ship enabled; the legacy `core_tweaks` settings tab and `Cache::clear_ccss()` are removed, and the `get_page_assets` REST route is removed. Back up your settings before upgrading.

= 1.9.0 (2026-08-11) =
Major feature and compatibility release introducing WP 7.1+ client-side media processing control, size-aware image encoding quality, content_url() static caching, core resource hints API migration, and inline CSS budget support.

= 1.8.0 (2026-07-28) =
Feature and performance release introducing WordPress 6.9+ object cache salt support, iframe lazy loading, delayJS parsing optimizations, and accessibility enhancements.

= 1.7.0 (2026-07-26) =
Performance, accessibility, and stability release adding cached minification checks, keyboard-accessible tooltips, ARIA accessibility labels, request cancellation safety, and 100% React component test coverage.

= 1.6.0 (2026-04-26) =
Major feature release bringing official Google PageSpeed Insights integration to the WordPress dashboard. Introduces Nginx configuration support, automatic wp-config.php self-healing, and enhanced telemetry with modern compression support (Zstd). Now requires PHP 8.2 for high-performance library compatibility.

= 1.5.1 (2026-04-23) =
Performance and stability release optimizing the `wppo_img_info` database option for reduced memory overhead and implementing atomic write protection for image metadata.

= 1.5.0 (2026-04-20) =
Introduces the Performance Monitor (high-precision local telemetry engine), System Info Dashboard for real-time environment diagnostics, and a new Developer Mode for granular network timings.

= 1.4.0 (2026-04-18) =
Major stability and feature release introducing Enterprise Redis Support, batched processing architecture for long-running tasks, and a refined Design System v2.1. Includes critical security hardening and AJAX-based session resilience.

= 1.3.0 (2026-04-15) =
Feature release introducing automated database optimization scheduling, comprehensive "Core Tweaks", MutationObserver-based lazy loading, and numerous systemic UI/UX improvements utilizing native WordPress CSS schemas.

= 1.2.3 (2026-04-14) =
Stability and performance release: Fixed a fatal error during activation/admin notices, implemented lazy loading for cache handlers to reduce overhead, and aligned documentation with official directory limits.

= 1.2.1 (2026-04-14) =
Stability and security release with wp-config path resolution fixes, asset handle whitelisting, and improved activation logic for WP_CACHE management.

= 1.2.0 (2026-04-13) =
Major feature release completing the "Cache Core" milestone: .htaccess automation, CDN URL rewriting, and smart cache purging. Includes a full Design System v2.0 with WordPress admin color scheme sync, confirmation dialogs, and polished form controls. Significant security and performance improvements throughout.

= 1.1.4 (2026-04-08) =
Security release with path traversal fixes, image queue performance improvements, and accessibility fixes.

= 1.1.3 (2026-04-07) =
Maintenance release to fix vendor file exclusion in build packages.

= 1.1.2 (2026-04-07) =
Compatibility release ensuring React rendering compatibility with @wordpress/element and sanitized REST API imports.

= 1.1.1 (2026-04-06) =
Minor release with JS performance optimizations and security hardening.

= 1.1.0 (2026-04-05) =
Feature release introducing Database Cleanup tools, Asset Manager monitoring, and a major UI overhaul of File Optimization settings.

= 1.0.0 (2024-12-18) =
Initial release with core performance features.
