PHPackages jazzman/wp-performance - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. jazzman/wp-performance ActiveWordpress-muplugin[Security](/categories/security) jazzman/wp-performance ====================== wp-performance 3.5.1(6mo ago)71.5k[5 PRs](https://github.com/Jazz-Man/wp-performance/pulls)1MITPHPPHP ^8.2CI passing Since Mar 18Pushed 3mo ago1 watchersCompare [ Source](https://github.com/Jazz-Man/wp-performance)[ Packagist](https://packagist.org/packages/jazzman/wp-performance)[ RSS](/packages/jazzman-wp-performance/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (10)Dependencies (14)Versions (86)Used By (1) WP Performance ============== [](#wp-performance) > Comprehensive WordPress performance optimization and security hardening plugin [![PHP Version](https://camo.githubusercontent.com/68f08f50b4e992f78f1f52f8343e8bd003f5d3e5cdb32f5695cf690b04386a96/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e322b2d3737374242343f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://www.php.net/)[![WordPress](https://camo.githubusercontent.com/9008aa39b5c1c83ad12da6996812bb56d793dcdabceba5dcab5296fc38e01816/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f576f726450726573732d362e302b2d3231373539423f6c6f676f3d776f72647072657373266c6f676f436f6c6f723d7768697465)](https://wordpress.org/)[![Codacy Badge](https://camo.githubusercontent.com/c5a7fb6724ffd84f8ff78c1d7abe47aa5b1737fff44335ad8095887af4c739bb/68747470733a2f2f6170692e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f3262646332356665313037663434313561393938303937373661323061323230)](https://app.codacy.com/app/vsokolyk/wp-performance)[![License](https://camo.githubusercontent.com/784362b26e4b3546254f1893e778ba64616e362bd6ac791991d2c9e880a3a64e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e2e737667)](LICENSE)[![Composer](https://camo.githubusercontent.com/61792526ba9812584a6c4d82846fae960b2371a2e30265d1d132717726e30fbd/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f436f6d706f7365722d5061636b6167652d3838353633303f6c6f676f3d636f6d706f736572266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/jazzman/wp-performance) The Problem ----------- [](#the-problem) WordPress out-of-the-box includes numerous features that most sites don't need: - Excessive HTTP requests for scripts and styles - Hundreds of unnecessary database queries - Bloated wp\_head output with meta tags, feeds, and generator tags - Constant update checks for core, plugins, and themes - Inefficient media handling and image size generation - Missing input sanitization and security hardening **Result:** Slower page loads, higher server costs, security vulnerabilities, poor user experience. The Solution ------------ [](#the-solution) WP Performance is a comprehensive must-use plugin that: - ✅ **Eliminates bloat** - Removes 50+ unnecessary WordPress features - ✅ **Optimizes queries** - Reduces database calls by 30-50% - ✅ **Enhances security** - Adds input sanitization and hardening - ✅ **Zero configuration** - Works out-of-the-box - ✅ **Production-tested** - Battle-tested on high-traffic sites - ✅ **Modern codebase** - PHP 8.2+, PSR-4, comprehensive quality tooling Key Features ------------ [](#key-features) ### 🚀 Performance Optimization [](#-performance-optimization) **Script & Style Management (Enqueue Module)** - Remove WordPress version from scripts and styles - Disable emoji scripts and styles - Remove DNS prefetch for s.w.org - Clean up script/style tags - Optimize jQuery loading **Database Query Optimization (WPQuery Module)** - Optimize `WP_Query` with smart caching - Reduce term count queries - Optimize post meta queries - Improve last modified time queries **Media Optimization (Media Module)** - Disable unnecessary image sizes - Lazy load images - Optimize image generation - Remove image size suffix - Prevent WebP conversion for specific formats **Update Management (Update Module)** - Disable WordPress core update checks - Disable plugin update checks - Disable theme update checks - Remove update nag screens - Reduce HTTP requests to WordPress.org **General Cleanup (CleanUp Module)** - Remove RSD link, WLW manifest, shortlink - Disable REST API discovery - Remove WordPress generator tag - Clean up wp\_head bloat - Disable XML-RPC when not needed ### 🔐 Security Hardening [](#-security-hardening) **Input Sanitization (Sanitize Module)** - Sanitize `$_GET`, `$_POST`, `$_REQUEST` superglobals - Prevent XSS attacks - Clean user input automatically - Validate URLs and paths **General Security** - Remove version information exposure - Disable file editing in admin - Harden WordPress configuration ### ⚡ SQL Query Optimization [](#-sql-query-optimization) **Term Count Optimization** - Optimized term counting for better performance - Reduced database calls for taxonomy queries - Smart caching for term counts **Post GUID Optimization** - Optimize post GUID queries - Improve permalink performance **Post Meta Optimization** - Efficient meta query handling - Reduce meta table lookups Installation ------------ [](#installation) ``` composer require jazzman/wp-performance ``` Dependencies ------------ [](#dependencies) This package is part of the **jazzman WordPress ecosystem** and depends on: - [`jazzman/autoload-interface`](https://github.com/Jazz-Man/autoload-interface) - Autoloading interface - [`jazzman/wp-app-config`](https://github.com/Jazz-Man/wp-app-config) - Configuration management - [`jazzman/wp-db-pdo`](https://github.com/Jazz-Man/wp-db-pdo) - PDO database layer All dependencies are installed automatically via Composer. Configuration ------------- [](#configuration) The plugin works out-of-the-box with sensible defaults for most sites. No configuration needed. Architecture ------------ [](#architecture) ### Module-Based Design [](#module-based-design) ``` src/ ├── Optimization/ # Performance optimization modules │ ├── CleanUp.php # Remove WordPress bloat │ ├── Enqueue.php # Optimize scripts and styles │ ├── LastPostModified.php # Caching optimization │ ├── Media.php # Image and media optimization │ ├── PostGuid.php # GUID optimization │ ├── PostMeta.php # Meta query optimization │ ├── TermCount.php # Term count optimization │ ├── Update.php # Update check management │ └── WPQuery.php # Query optimization ├── Security/ # Security hardening modules │ └── Sanitize.php # Input sanitization └── Utils/ # Utility classes ``` ### Quality Tools [](#quality-tools) - ✅ **PHPStan** (max level with baseline) - ✅ **Psalm** (strict mode with baseline) - ✅ **PHPMD** (mess detection with baseline) - ✅ **PHP CS Fixer** (PSR-12 compliance) - ✅ **Rector** (automated refactoring) - ✅ **Roave Security Advisories** (dependency scanning) ### CI/CD [](#cicd) GitHub Actions workflows for: - Code quality checks on PR - Static analysis - Code style validation - Security scanning Requirements ------------ [](#requirements) - **PHP**: 8.2+ (strictly enforced) - **WordPress**: 6.0+ - **Composer**: For installation and autoloading Why This Plugin Exists ---------------------- [](#why-this-plugin-exists) After years of WordPress development across hundreds of sites, I identified common performance bottlenecks: - Default WordPress includes 50+ features most sites never use - Each feature adds HTTP requests, database queries, and processing time - Manual optimization is tedious and error-prone - Most performance plugins focus on caching, not eliminating unnecessary features **WP Performance takes a different approach:** Instead of caching bloat, eliminate it at the source. Related Packages ---------------- [](#related-packages) Part of the **jazzman WordPress ecosystem**: - [`jazzman/wp-object-cache`](https://github.com/Jazz-Man/wp-object-cache) - PSR-16 object caching - [`jazzman/wp-nav-menu-cache`](https://github.com/Jazz-Man/wp-nav-menu-cache) - Navigation menu caching - [`jazzman/wp-password-argon`](https://github.com/Jazz-Man/wp-password-argon) - Argon2i password hashing - [`jazzman/wp-lscache`](https://github.com/Jazz-Man/wp-lscache) - LiteSpeed cache integration - [`jazzman/wp-geoip`](https://github.com/Jazz-Man/wp-geoip) - GeoIP functionality Contributing ------------ [](#contributing) Found a bug? Have a feature request? Contributions welcome! 1. Fork the repository 2. Create feature branch (`git checkout -b feature/amazing`) 3. Run quality checks (`composer phpstan && composer psalm && composer cs-check`) 4. Commit changes (`git commit -m 'Add amazing feature'`) 5. Push to branch (`git push origin feature/amazing`) 6. Open Pull Request --- Support ------- [](#support) ⭐ **If WP Performance improved your site, please star the repo!** 💬 **Questions?** Open an issue on GitHub --- **Built with ❤️ for the WordPress community** ### Health Score 54 — FairBetter than 97% of packages Maintenance76 Regular maintenance activity Popularity21 Limited adoption so far Community14 Small or concentrated contributor base Maturity88 Battle-tested with a long release history Bus Factor1 Top contributor holds 99.3% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~32 days Recently: every ~188 days Total 77 Last Release 183d ago Major Versions 0.9.2.2 → 1.02019-05-29 1.9.9 → 2.0.02021-01-08 2.2.7 → 3.0.02022-03-09 PHP version history (5 changes)0.2PHP >=7.0 0.8.1PHP >=7.1 3.0.0PHP >=7.4 3.3.0PHP ^7.4|^8.1 3.4.3PHP ^8.2 ### Community Maintainers ![](https://www.gravatar.com/avatar/bde0917196a65a6134bf7aa9d1b3969ae4ef3b92907662fdf68070d033de6843?d=identicon)[Jazz-Man](/maintainers/Jazz-Man) --- Top Contributors [![Jazz-Man](https://avatars.githubusercontent.com/u/6892898?v=4)](https://github.com/Jazz-Man "Jazz-Man (760 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (2 commits)")[![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4)](https://github.com/dependabot-preview[bot] "dependabot-preview[bot] (2 commits)")[![codacy-badger](https://avatars.githubusercontent.com/u/23704769?v=4)](https://github.com/codacy-badger "codacy-badger (1 commits)") --- Tags composer-packagedatabase-optimizationoptimizationperformancephpquery-optimizationsecurityspeed-optimizationwordpresswordpress-mupluginwordpress-performancewordpress-pluginwordpress-security ### Code Quality Static AnalysisRector ### Embed Badge ![Health badge](/badges/jazzman-wp-performance/health.svg) ``` [![Health](https://phpackages.com/badges/jazzman-wp-performance/health.svg)](https://phpackages.com/packages/jazzman-wp-performance) ``` ### Alternatives [johnbillion/user-switching Instant switching between user accounts in WordPress and WooCommerce. 19768.3k2](/packages/johnbillion-user-switching)[wp-privacy/wp-api-privacy Strips potentially identifying information from outbound requests to the WordPress.org API 1632.0k](/packages/wp-privacy-wp-api-privacy) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)