Ultra Performance Tweaks WordPress Plugin

Ultra Performance Tweaks is a free WordPress plugin we build and maintain. It trims the code WordPress adds to every page, hardens login and comments, clears every major cache from one button, and shows you a graded report of what your hosting stack is actually doing. This guide covers every setting and what it is for.

01. What the plugin does

Most optimization plugins hand you a list of switches and leave you to guess whether any of them helped. Ultra Performance Tweaks starts from the other end. It reports what your hosting is, grades it, and then gives you the switches.

There are four parts to it:

• Seventeen optimizations - each one removes code WordPress adds to every page load, or closes off a common attack surface
• An environment report - a read-only look at your PHP version and handler, web server, reverse proxy, database engine, caching layers, and the wp-config.php and .htaccess settings that affect speed
• Database cleanup - live counts of revisions, spam comments, orphaned metadata and more, with nothing deleted until you choose it
• A cache purge button - clears every caching layer on the site from the admin bar, including whichever caching plugin you use

Everything is a plain on/off toggle. Nothing is locked behind an upgrade, there is no account to create, and the plugin sends no data anywhere unless you switch on the optional Cloudflare purge.

02. Installing and activating

The plugin requires WordPress 5.6 or newer and PHP 7.4 or newer. Every Ultra Web Hosting plan meets both comfortably.

1. Upload the plugin - in your dashboard go to Plugins > Add New > Upload Plugin and choose the zip file
2. Click Install Now, then Activate
3. Open Settings > Ultra Performance to review the tabs

If you prefer SFTP, upload the ultra-performance-tweaks folder to /wp-content/plugins/ and activate it from the Plugins screen. See our FileZilla guide if you need a refresher on uploading files.

03. Finding your way around

Everything lives at Settings > Ultra Performance, split across seven tabs:

• Optimizations - the front-end toggles that remove code from your pages
• Tuning - numeric settings for the Heartbeat API and post revisions
• Security - login protection, XML-RPC, comment spam, and visitor IP detection
• Cache - the purge button, purge on publish, scheduled purge, and Cloudflare
• Database - live counts of what can be cleaned up
• Environment - the read-only hosting report
• Tools - export and import settings, the command line reference, and reset

A blue bar at the top shows how many optimizations are currently active. Tabs with something needing attention carry a count, so if the Database tab shows a number, that is how many rows are waiting to be cleaned.

04. Front-end optimizations

These all do the same kind of thing: stop WordPress loading something on every page that your site probably does not use. None of them change how your site looks.

Heartbeat and revisions

Two numeric settings sit on the Tuning tab. The WordPress Heartbeat API is a background request your browser makes on a timer to check for post locks and autosave. It is the single largest source of idle admin-ajax load on most sites.

• Front end - set to 0 to remove it from public pages entirely. Almost no site needs it there
• Dashboard - WordPress uses 60 seconds. Raising it to 120 halves the background requests from every open admin tab
• Post editor - keep this low, 15 to 30 seconds. Autosave and post locking depend on it, so a long interval risks losing work

Revisions to keep caps how many saved drafts WordPress stores per post from now on. Leave it blank for the WordPress default of unlimited, or set a number. On a site with a few years of history, revisions are usually the largest single source of database bloat. Use the Database tab to remove the ones already stored.

05. Security and spam

Login protection

Five failed logins from one IP within 30 minutes locks that address out of the login form for 15 minutes. When someone is close to the limit, the login screen tells them how many attempts remain.

Any lockouts appear on the Security tab with the address, the username that was tried, and how long ago, each with an Unlock link. If you lock yourself out and have no second admin account, the lockout clears on its own after 15 minutes.

The plugin steps aside automatically if a dedicated security plugin is already handling brute force protection, so you never get double lockouts. It defers to Wordfence, Solid Security, Sucuri, All-In-One WP Security, WP Cerber, Limit Login Attempts Reloaded, LoginPress, Jetpack Protect, and Imunify Security. When that happens the settings page tells you which plugin is in charge.

Disable XML-RPC

Returns a 403 on xmlrpc.php, closing off a route commonly used to amplify brute force attempts. Turn this off if you use the legacy WordPress mobile app or Jetpack, both of which need XML-RPC. See Blocked by Jetpack if you are troubleshooting a Jetpack connection.

Comment spam protection

Three checks run on every comment from a non-moderator:

1. Honeypot - a hidden field real visitors never see. Bots that fill in every field get blocked
2. Speed trap - comments submitted in under three seconds are rejected as automated. The timestamp is signed, so a comment form served from a page cache cannot be replayed
3. Link limiter - comments with more than two links are held for moderation rather than rejected, so a real comment is never lost

A separate toggle closes comments on posts older than 90 days, which is where spam bots concentrate. It ships off because it overrides your Settings > Discussion choice, so switch it on deliberately. For more on this, see How to Disable WordPress Comments, Pingbacks and Trackbacks.

06. Cache management

With the purge button enabled, administrators get a Clear All Caches button in the admin bar. One click clears:

• The WordPress object cache and transients
• PHP OPcache, scoped to your site's own files where possible
• LiteSpeed Cache and AccelerateWP, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize
• Generated CSS from Elementor, Divi, Beaver Builder, Oxygen, GeneratePress, and Brizy
• The nginx reverse proxy cache on our servers
• Cloudflare, if you have enabled it

For each caching plugin the button calls that plugin's own flush routine rather than deleting its files behind its back, so it cooperates with your stack instead of fighting it. Anything not installed is skipped silently.

Purge on Publish and scheduled purge

Purge on Publish is the option most sites want. It clears caches automatically whenever a post or page is published or updated, so visitors see current content without you clearing anything on a timer. Revisions, autosaves, and bulk imports are skipped.

Scheduled purge is for a narrower case: pages that go stale without WordPress knowing, such as content pulled from an external feed, or prices updated by a background job. Most sites should leave it off. Every purge empties the cache, so the next visitor to each page waits while it is rebuilt, which on a large site means a wave of slow requests each time it runs.

Cloudflare

Off by default. When you enable it and supply an API token, clearing caches also sends a purge to Cloudflare. A scoped token with only the Cache Purge permission is enough and safer than an account-wide key. Note that it purges the entire zone, so take care if several sites share one. Our Cloudflare Setup Guide covers getting a token.

07. The environment report

This is the part of the plugin we think earns its place. It changes nothing. It just tells you what you are working with, graded so you can see at a glance what is already good and what is worth changing. Green is good, amber suggests a possible improvement, grey is informational.

It covers:

• Server - PHP version and handler, web server, reverse proxy, WordPress version against the latest release, database engine and version, whether HTTPS is active
• Caching layers - OPcache with memory usage, object cache drop-in and which one, and any page cache or CDN it can detect
• WordPress configuration - WP-Cron mode, debug mode, memory limit, maximum upload size
• wp-config.php - page cache flag, revision limit, autosave interval, trash retention, file editor status, forced SSL admin
• .htaccess - GZIP compression, browser caching, ETag handling, whether XML-RPC is blocked at the server level

The most important of these checks also appear in the WordPress Tools > Site Health screen alongside the core checks, so you see them where you already look.

08. Database cleanup

The Database tab counts what can be removed, live, every time you load the page. Nothing is deleted until you tick it and confirm.

It handles post revisions, auto-drafts, trashed posts, spam and trashed comments, expired transients, orphaned post and comment metadata, and cached oEmbed markup. Orphaned metadata is the one people rarely think about: rows left behind by plugins that were removed without cleaning up after themselves.

Two things worth knowing:

• Trashed posts and trashed comments are not ticked by default. Those are things you chose to keep, so removing them is deliberate
• Deletion runs in batches of 500 rows per pass, so a neglected site with tens of thousands of revisions will need a few runs rather than timing out

09. Visitor IP detection

Login protection needs to know which address a request really came from. Headers like X-Forwarded-For and CF-Connecting-IP can be set by anyone, so the plugin only trusts them on a request that actually arrived through a proxy.

Auto-detect is the default and handles this without configuration. It checks the connecting address against Cloudflare's published ranges, then against loopback and private ranges, and falls back to the raw connection when neither matches. A forged header on a request from anywhere else is ignored.

The Security tab shows you what the plugin sees on your own request right now: the address it resolved, which header it came from, and whether your setting matches what the server is actually doing. If you use a CDN other than Cloudflare, switch to Reverse proxy mode and list its ranges.

10. Command line access

Everything on the settings page is available through WP-CLI, which is the practical way to run this across several sites. On our shared hosting you can use WP-CLI over SSH.

# Clear every cache layer
wp ultra-perf purge

# Show which optimizations are active
wp ultra-perf status --format=table

# Report database cruft without deleting anything
wp ultra-perf cleanup --dry-run

# Clean the safe items, or name them explicitly
wp ultra-perf cleanup
wp ultra-perf cleanup --items=revisions,spam_comments

# Review and clear login lockouts
wp ultra-perf lockouts
wp ultra-perf unlock 203.0.113.10

# Move a configuration between sites
wp ultra-perf export > settings.json
wp ultra-perf import settings.json

The export deliberately leaves out your Cloudflare API token, so the file is safe to store in a repository or send to a colleague. Re-enter the token on the destination site.

11. Customizing behavior

Every threshold can be changed with a standard WordPress filter, usually from your theme's functions.php or a small custom plugin. Defaults are shown.

// Comment spam protection
add_filter( 'ultra_spam_max_links',         fn() => 2 );
add_filter( 'ultra_spam_min_time',          fn() => 3 );
add_filter( 'ultra_spam_close_after_days',  fn() => 90 );

// Login protection
add_filter( 'ultra_login_max_attempts',     fn() => 5 );
add_filter( 'ultra_login_lockout_duration', fn() => 15 * MINUTE_IN_SECONDS );
add_filter( 'ultra_login_tracking_window',  fn() => 30 * MINUTE_IN_SECONDS );

// Database cleanup batch size
add_filter( 'ultra_cleanup_batch_size',     fn() => 500 );

To allow ten failed logins before a 30 minute lockout:

add_filter( 'ultra_login_max_attempts',     fn() => 10 );
add_filter( 'ultra_login_lockout_duration', fn() => 30 * MINUTE_IN_SECONDS );

Two actions are available if you want to hook your own code in:

do_action( 'ultra_after_cache_purge', $cleared );
do_action( 'ultra_login_lockout', $ip, $username, $attempts );

12. Common questions

Will this conflict with my caching plugin?

No. The purge button calls each caching plugin's own flush routine, so it works alongside LiteSpeed Cache, WP Rocket, W3 Total Cache and the others rather than replacing them.

My CSS or JavaScript looks out of date after an update

If you turned on Remove Query Strings, some caching layers may be serving old files because the version string they used for cache-busting is gone. Clear all caches, and if it persists turn that toggle back off.

A comment from a real visitor was held for moderation

That is the link limiter doing its job. Comments with more than two links are queued rather than rejected so you never lose a real one. Approve it from the Comments screen, or raise the limit with the ultra_spam_max_links filter.

Does it slow down my admin?

No. The environment report and database counts are only calculated when you open the settings page. Nothing runs on the front end except the optimizations you have enabled, and those all remove work rather than adding it.

Do I need this if I already use AccelerateWP?

They do different things and work well together. AccelerateWP handles full page caching, critical CSS, and image optimization at the server level. This plugin trims what WordPress itself loads, hardens login and comments, and gives you one button that clears both. Our Optimize WordPress Performance and Speed guide covers the server-side half in detail.

Quick Recap: Five Things Worth Doing

If you only take five things from this guide, take these:

1. Install it and leave the defaults - they are sensible and safe on a typical site
2. Read the Environment tab - it tells you what your hosting actually is, which is more useful than any single toggle
3. Turn on Purge on Publish - this is what most people want, not a scheduled purge
4. Run the Database cleanup once - most sites carry thousands of revisions and orphaned rows they have never looked at
5. Leave Remove Query Strings off if you run WooCommerce - a stale checkout script breaks purchases silently

Last updated July 2026 · Browse all WordPress articles