=== RD Performance Toolkit ===
Contributors: odealing
Donate link: https://odealing.com/
Tags: performance, cache, webp, core web vitals, elementor
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 3.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Real Core Web Vitals optimization and security hardening: WebP + LCP priority, render-blocking cleanup, self-hosted fonts, a real PageSpeed monitor, plus a Security Score, SSL checker, and hardening checklist.

== Description ==

RD Performance Toolkit implements the optimizations that are actually within a WordPress plugin's control to improve Core Web Vitals — and is upfront about the ones that aren't (your hosting's server response time and the images/video you choose to upload matter too; see the plugin's own Diagnostics panel).

**Images (LCP)**

* Converts uploads to WebP automatically (GD or Imagick), served only to browsers that support it
* Prioritizes the first non-logo image rendered on *any* page — singular, archive, or homepage — with `fetchpriority="high"`, no lazy-loading, and a `<link rel=preload>` hint
* Reduces JPEG quality to a visually-identical 82

**Scripts & Styles**

* Removes WordPress's emoji script/style and the oEmbed script
* Dequeues Dashicons on the frontend for logged-out visitors
* String-aware CSS minification (never touches content inside quotes)
* Optional deferred JavaScript and non-blocking CSS loading (off by default — these can affect scripts that assume synchronous load order, so they're opt-in with clear warnings)

**Fonts**

* Self-hosts Google Fonts (downloads once, serves from your own domain after) — removes a third-party connection from the critical rendering path

**Elementor**

* Detects Elementor and reports on its own asset-loading/icon-SVG experiments, with a direct link to enable them in Elementor's own settings
* One-click fix for Elementor's font-display setting
* Optional: strips Elementor's global Font Awesome/animations/swiper.js assets from pages that were never built with Elementor

**Server Rules**

* One click applies gzip/deflate compression and long-lived browser caching headers via `.htaccess` on Apache/LiteSpeed hosts (with a copy-paste Nginx-equivalent snippet if your host isn't Apache)

**Compatible with WP Rocket, LiteSpeed Cache & other caching plugins**

If a dedicated caching plugin is detected active, this plugin's own optional page cache automatically stays off to avoid two caches conflicting. Every other feature (image, script, font, Elementor optimizations) works fine alongside them.

**Core Web Vitals Monitor**

Runs a real Lighthouse check via Google's PageSpeed Insights API and shows the actual metrics for your site: First Contentful Paint, Largest Contentful Paint, Total Blocking Time, Cumulative Layout Shift, and Speed Index, plus the overall Performance score — color-coded against Google's published thresholds, with history tracked over time. Works without an API key at a shared rate limit; add your own free key for higher limits.

**Cleanup & Privacy**

* Remove jQuery Migrate, query strings from static resources, and unused `<head>` tags (RSD link, WLW manifest, shortlink, REST discovery link, generator tag)
* Optional: disable XML-RPC, disable comments entirely, remove slow dashboard widgets
* Lazy load iframes

**Pro: Delay JavaScript Execution**

Holds non-essential scripts until the visitor interacts with the page (or an 8-second fallback) — usually the single biggest lever for Total Blocking Time / INP.

**Pro: Script Manager**

A live panel in the frontend admin toolbar listing every script/style loaded on the current page type, with checkboxes to disable specific ones per context.

**Pro: CDN URL Rewriting**

Rewrites static asset URLs to your CDN domain (assumes your CDN already mirrors the site).

**Pro: Custom Resource Hints**

Add preconnect/prefetch/preload hints for third-party domains or assets not already covered automatically.

**Pro: Core Web Vitals Email Alerts**

Get emailed when your scheduled Performance score check drops into Google's "Poor" range.

**Pro: Cache Preloader**

Automatically re-warms the free Page Cache after it clears, so the first real visitor never hits an uncached page.

**Pro: Click-to-Load Embeds**

Replaces heavy YouTube embeds with a lightweight thumbnail + play button; the real embed only loads on click.

**Pro: Self-Hosted Analytics**

Serves Google Analytics' gtag.js from your own domain instead of a third-party connection.

**Pro: Database Optimizer**

One click runs OPTIMIZE TABLE across every table this site owns.

**License management**

A dedicated License tab shows current status and links to your secure Freemius account page for activation, deactivation, and billing.

= A note on honesty =

No plugin can guarantee a specific score. Core Web Vitals also depend on your hosting server's response time and the images/content you choose to publish. This plugin implements every optimization that genuinely is within a plugin's control, and is upfront in its own interface about what still depends on you.

= External services =

This plugin connects to the following third-party services, only when the corresponding feature is used:

* **Google PageSpeed Insights API** (`googleapis.com`) — when you run a Core Web Vitals check (Monitor tab), your site's URL is sent to Google's PageSpeed Insights API to retrieve Lighthouse performance data. See [Google's Privacy Policy](https://policies.google.com/privacy) and [PageSpeed Insights Terms](https://developers.google.com/speed/docs/insights/v5/about).
* **Google Fonts** (`fonts.googleapis.com`, `fonts.gstatic.com`) — only when "Self-host Google Fonts" is enabled, to download font files once; after that, fonts are served from your own domain and no further requests are made.

Neither is contacted unless you enable the corresponding feature.

== Installation ==

1. Upload the plugin files, or install through the Plugins screen directly.
2. Activate the plugin.
3. Go to **Performance** in the admin menu.
4. Safe defaults are already on. Enable the ⚠️-marked features one at a time, re-testing your site after each.

== Frequently Asked Questions ==

= Will this guarantee a 100 PageSpeed score? =

No plugin can. Your hosting server's response time and the images/content you publish matter as much as anything a plugin can do. This plugin implements every optimization genuinely within its control and is upfront about the rest — see the Diagnostics panel.

= Does this work with WP Rocket or LiteSpeed Cache? =

Yes. If a dedicated caching plugin is detected, this plugin's own page cache feature automatically disables itself to avoid conflicts, while every other optimization (images, scripts, fonts, Elementor) continues to work normally alongside it.

= Does this work with Elementor? =

Yes — there's a dedicated Elementor tab that reports on Elementor's own optimization settings and can optionally remove Elementor's global assets from pages that don't use it.

= Do I need a Google API key for the Monitor? =

No. It works without one at a shared, rate-limited free tier. An optional free key from Google Cloud Console raises that limit if you check frequently.

= Will deferring JavaScript break my site? =

It can, on some sites — that's why it's off by default with a clear warning. Enable it and test every interactive part of your site (menus, forms) afterward; a filter (`rdpt_defer_exclude_handles`) lets you exclude specific scripts if needed.

== Screenshots ==

1. Optimizations tab — every toggle, tiered by risk
2. Core Web Vitals Monitor — real Lighthouse data with history
3. Elementor status panel
4. Server compression & caching rules, one click

== Changelog ==

= 3.4.0 =
* Added: Security tab — hide WordPress version, block user enumeration, disable dashboard file editing, hide detailed login errors, block directory browsing, block readme.txt/changelog access, disable PHP execution in uploads (all via real .htaccess rules where applicable)
* Added: transparent Security Score (evenly-weighted checklist, no black-box scoring)
* Added: real SSL/HTTPS certificate checker — actual certificate inspection (issuer, expiry date, days remaining), not just an is_ssl() check
* Added: granular comment controls (posts-only, pages-only, trackbacks/pingbacks, comment widgets, comment feeds) alongside the existing site-wide toggle
* Added: custom code injection (header/body/footer) and read-only wp-config.php/file-permission guidance (deliberately never auto-modifies these — see plugin README)
* Deliberately NOT added this round: real malware/file-integrity scanning against WordPress.org checksums, and automated wp-config.php modification. Both are separate, larger undertakings; see README for reasoning.

= 3.3.0 =
* Added (free): change autosave interval, disable self-pingbacks, remove author comment links, disable RSS feeds / remove feed links, disable password strength meter, blank favicon response, disable REST API for guests, disable global styles, separate core block styles, granular Heartbeat control (frontend/dashboard), custom code injection (header/body/footer)
* Added (Pro): WooCommerce cart fragments disable, WooCommerce non-shop-page asset dequeuing, Click-to-Load for Google Maps, Speculative Loading (native browser prerender-on-hover)
* Deliberately NOT added: a custom login URL changer. A bug in that specific feature can lock an admin out of their own site, and it can't be verified against a live install from here — flagged rather than rushed.

= 3.2.2 =
* Fixed: WordPress.org automated review failure ("Plugin Updater detected"). Root cause: `is_premium` was set to `true`, which per Freemius's own SDK documentation is only correct for a separate premium-only build — it caused Freemius's self-update checker (FS_Plugin_Updater) to activate, which WP.org prohibits for hosted plugins. Corrected to `is_premium: false` (this is a single-codebase serviceware product) and `has_premium_version: false`, verified against the SDK source that Pro-feature license gating is unaffected by this change.
* Changed: Author URI (plugin header + composer.json) now points to https://github.com/odealing

= 3.2.1 =
* Fixed: fatal error "Call to undefined function wp_get_current_user()" when Script Manager was enabled. current_user_can() depends on wp_get_current_user() (defined in wp-includes/pluggable.php), which WordPress loads AFTER plugin files — Script_Manager::init() called it directly at plugin-bootstrap time instead of deferring to a hook. Now deferred to WordPress's own `init` action. Audited every other init() method in the plugin for the same pattern; none had it.

= 3.2.0 =
* Fixed: critical error on activation — fs_dynamic_init() (Freemius SDK) can throw a real exception, and the plugin's bootstrap call was completely unguarded. Now wrapped in try/catch throughout, so any Freemius-side issue reports Pro as unlicensed instead of crashing the site
* Fixed: an Imagick::queryFormats() call that could throw on misconfigured servers, now guarded the same way
* Added: impact badges (LCP, FCP, TBT, INP, CLS, TTFB, Bytes, Requests, etc.) on every feature explaining which metric it actually affects, plus a glossary
* Added: "Requires" notes on features with real dependencies (e.g. Cache Preloader needs Page Cache enabled)
* Improved: richer, more specific descriptions throughout explaining *why* each feature helps, not just what it does

= 3.1.2 =
* Fixed: the actual Freemius SDK (v2.13.4) is now bundled at /freemius/ — Pro licensing works immediately with no separate install/build step

= 3.1.1 =
* Fixed: uninstall cleanup now runs via Freemius's own `after_uninstall` hook instead of a standalone uninstall.php, so it runs in the correct sequence relative to Freemius's own uninstall handling (reason survey, account/license cleanup, tracking) rather than outside it

= 3.1.0 =
* Added: four more Pro features — Cache Preloader, Click-to-Load Embeds (YouTube facade), Self-Hosted Analytics, Database Optimizer (9 Pro features total)
* Added: License tab with real Freemius account integration (activate/manage license, view plan)
* Added: Pro Features showcase with feature grid and upgrade CTA
* Added: interface polish — tab transitions, hover states, staggered card animations (respects prefers-reduced-motion)

= 3.0.0 =
* Added: Cleanup & Privacy features (jQuery Migrate removal, query string removal, head cleanup, XML-RPC disable, dashboard widget cleanup, disable comments, lazy load iframes)
* Added: Pro tier via Freemius — Delay JavaScript Execution, Script Manager (live toolbar panel), CDN URL rewriting, custom resource hints, Core Web Vitals email alerts
* Added: Freemius SDK integration scaffold (safe before real credentials are configured)

= 2.0.0 =
* Added: Core Web Vitals Monitor using Google's PageSpeed Insights API (FCP, LCP, TBT, CLS, Speed Index, overall score, with history)
* Added: Elementor-specific optimization module (experiment status, font-display fix, optional asset dequeuing on non-Elementor pages)
* Added: Compatibility detection for WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, SiteGround Optimizer, WP Fastest Cache, Cache Enabler, Autoptimize, WP-Optimize, NitroPack — built-in page cache auto-disables when a conflicting caching plugin is active
* Added: server-level compression/caching rules via one-click `.htaccess` application (with Nginx-equivalent snippet)
* Added: safe, string-aware CSS minification for local stylesheets
* Redesigned: tabbed admin interface
* Fixed: LCP image priority previously only applied on single posts/pages — now correctly applies to the first rendered image on any page type (homepage, archives, search)

= 1.0.0 =
* Initial release: WebP conversion, LCP image priority, JPEG quality tuning, render-blocking cleanup, self-hosted Google Fonts, optional page cache, database housekeeping

== Upgrade Notice ==

= 3.4.0 =
Adds a full Security tab (hardening, Security Score, real SSL certificate checking, granular comment controls). Settings preserved.

= 3.3.0 =
Large feature batch: 11 new free tweaks (autosave, feeds, REST API, custom code injection, and more) and 4 new Pro features (WooCommerce optimization, Maps click-to-load, Speculative Loading). Settings preserved.

= 3.2.2 =
Fixes the WordPress.org "Plugin Updater detected" automated review failure by correcting the Freemius is_premium configuration. Required before resubmitting.

= 3.2.1 =
Fixes a fatal error ("Call to undefined function wp_get_current_user()") that occurred when Script Manager was enabled. Update immediately if you use that feature.

= 3.2.0 =
Fixes a critical activation error caused by an unguarded Freemius SDK call. Update recommended for anyone who hit this. Also adds impact badges and richer feature descriptions throughout.

= 3.1.0 =
Four more Pro features (Cache Preloader, Click-to-Load Embeds, Self-Hosted Analytics, Database Optimizer), a real License management tab, and interface polish. Settings preserved.

= 3.0.0 =
Adds a Pro tier (Delay JS, Script Manager, CDN rewriting, resource hints, CWV email alerts) plus several new free cleanup features. Settings are preserved.

= 2.0.0 =
Major update: Core Web Vitals Monitor, Elementor support, caching-plugin compatibility, and a fix for LCP priority not applying to homepage/archive pages. Settings are preserved; review the new Monitor and Elementor tabs after updating.
