Ultra Web Hosting Performance Toolkit

Ultra Web Hosting Performance Toolkit is a free WordPress plugin we build and maintain. It reports what your hosting stack is actually doing, trims the code WordPress adds to every page, hardens login and comments, and clears every cache layer from one button. This guide covers every setting and what it is for.

01. What the plugin does

Most optimization plugins hand you a list of switches and leave you to guess whether any of them helped. This one starts from the other end. It measures what your settings have removed, reports what your hosting is, and then gives you the switches.

There are five parts to it:

• Twenty optimizations - each one removes code WordPress adds to every page load, or closes off a common attack surface
• A measured summary - how many kilobytes and requests your current settings remove from every page load, and how much is still available. Every figure is read from the real file on disk, not estimated
• An environment report - the path a visitor's request takes through your stack, plus a graded look at your PHP version and handler, web server, database, caching layers, and the wp-config.php and .htaccess settings that affect speed
• Database cleanup - live counts of revisions, spam comments, orphaned metadata and more, with nothing deleted until you choose it
• A cache purge button - clears every caching layer on the site from the admin bar, including whichever caching plugin you use

Everything is a plain on/off toggle. Nothing is locked behind an upgrade, there is no account to create, and the plugin sends no data anywhere unless you switch on the optional Cloudflare purge.

02. Installing and activating

The plugin requires WordPress 5.6 or newer and PHP 7.4 or newer. Every Ultra Web Hosting plan meets both comfortably.

1. Upload the plugin - in your dashboard go to Plugins > Add New > Upload Plugin and choose the zip file
2. Click Install Now, then Activate
3. Open Settings > Ultra Performance to review the tabs

If you prefer SFTP, upload the ultrawebhosting-performance-toolkit folder to /wp-content/plugins/ and activate it from the Plugins screen. See our FileZilla guide if you need a refresher on uploading files.

03. Finding your way around

Everything lives at Settings > Ultra Performance, split across seven tabs:

• Optimizations - the summary panel, then the front-end toggles
• Tuning - numeric settings for the Heartbeat API, post revisions and scheduled tasks
• Security - login protection, XML-RPC, comment spam, file editors, and visitor IP detection
• Cache - the purge button, purge on publish, server cache purging, and Cloudflare
• Database - live counts of what can be cleaned up
• Environment - the request path and the read-only hosting report
• Tools - export and import settings, the command line reference, and reset

Tabs with something needing attention carry a count, so if the Database tab shows a number, that is how many rows are waiting to be cleaned.

04. Reading the summary panel

The Optimizations tab opens with a summary of what your current settings actually do. It shows the total removed from every page load, a bar breaking that down by category, and how much more is available from the optimizations you have switched off.

These are real measurements, taken from the size of the actual files on your server, not estimates. Only removals with a measurable file are counted. Several optimizations trim a line or two of markup from the page head, which is worth doing but not worth inflating a headline figure with.

Underneath sit four status chips covering your object cache, scheduled tasks, remaining savings and database cruft. Each links to the tab that addresses it. A blue chip is an opportunity rather than a warning: several optimizations are deliberately left off on perfectly healthy sites.

05. Front-end optimizations

These all do the same kind of thing: stop WordPress loading something on every page that your site probably does not use. None of them change how your site looks.

The plugin will not let one of these break another script. If a theme or plugin declares one of these files as a dependency, the removal is skipped for that file and the setting is quietly ignored rather than leaving something half-loaded.

06. Tuning

The Tuning tab holds the numeric settings. Each one shows what it is currently doing, so you never have to guess whether a change took effect.

Heartbeat

The WordPress Heartbeat API is a background request your browser makes on a timer. It is the single largest source of idle admin-ajax load on most sites.

• Front end - set to 0 to remove it from public pages entirely. Almost no site needs it there
• Dashboard - WordPress uses 60 seconds. Raising it to 120 halves the background requests from every open admin tab
• Post editor - keep this low, 15 to 30 seconds. Autosave and post locking depend on it, so a long interval risks losing work

Revisions

Revisions to keep caps how many saved drafts WordPress stores per post from now on. Leave it blank for the WordPress default of unlimited. On a site with a few years of history, revisions are usually the largest single source of database bloat. Use the Database tab to remove the ones already stored.

Scheduled tasks

WordPress runs scheduled tasks during visitor page loads. On a busy site an unlucky visitor pays for whatever task is due; on a quiet one, tasks run late or not at all. Handing the job to a real server cron makes it predictable both ways.

The tab shows the exact cron command for your site, with the correct PHP binary detected rather than guessed, and a URL-based alternative for setups without command line access. See How to Create a Cron Job in cPanel for where to put it.

Two values on this tab are shown for reference only. Autosave interval and trash retention are read by WordPress from constants with no filter, so they are changed in wp-config.php rather than here. The panel shows their current values so you can see what is in force.

07. Security and spam

Login protection

Five failed logins from one IP within 30 minutes locks that address out of the login form for 15 minutes. When someone is close to the limit, the login screen tells them how many attempts remain.

Any lockouts appear on the Security tab with the address, the username that was tried, and how long ago, each with an Unlock link. If you lock yourself out and have no second admin account, the lockout clears on its own after 15 minutes.

The plugin steps aside automatically if a dedicated security plugin is already handling brute force protection, so you never get double lockouts. It defers to Wordfence, Solid Security, Sucuri, All-In-One WP Security, WP Cerber, Limit Login Attempts Reloaded, LoginPress, Jetpack Protect, and Imunify Security. When that happens the settings page tells you which plugin is in charge.

Disable the File Editors

Removes the theme and plugin file editors from the admin. Those editors let anyone with administrator access write PHP that runs on your server, which is the first thing an attacker reaches for after stealing a login. This raises the cost of a compromise rather than closing the door entirely, since an administrator can still upload a plugin. Off by default, and ignored if wp-config.php already sets DISALLOW_FILE_EDIT.

Disable XML-RPC

Returns a 403 on xmlrpc.php, closing off a route commonly used to amplify brute force attempts. The card warns you if Jetpack is active on the site, since Jetpack needs XML-RPC. See Blocked by Jetpack if you are troubleshooting a Jetpack connection.

Comment spam protection

Three checks run on every comment from a non-moderator:

1. Honeypot - a hidden field real visitors never see. Bots that fill in every field get blocked
2. Speed trap - comments submitted in under three seconds are rejected as automated. The timestamp is signed, so a comment form served from a page cache cannot be replayed
3. Link limiter - comments with more than two links are held for moderation rather than rejected, so a real comment is never lost

A separate toggle closes comments on posts older than 90 days, which is where spam bots concentrate. It ships off because it overrides your Settings > Discussion choice. For more on this, see How to Disable WordPress Comments, Pingbacks and Trackbacks.

08. Cache management

With the purge button enabled, administrators get a Clear All Caches button in the admin bar. One click clears:

• The WordPress object cache and transients
• PHP OPcache, scoped to your site's own files where possible
• LiteSpeed Cache and AccelerateWP, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize
• Generated CSS from Elementor, Divi, Beaver Builder, Oxygen, GeneratePress, and Brizy
• Cloudflare, if you have set it up

For each caching plugin the button calls that plugin's own flush routine rather than deleting its files behind its back, so it cooperates with your stack instead of fighting it. Anything not installed is skipped silently, and anything that fails is reported rather than passed off as success.

Purge on Publish

This is the option most sites want. It clears caches automatically whenever a post or page is published or updated, so visitors see current content without you clearing anything by hand. Revisions, autosaves and bulk imports are skipped.

Clear the Server Cache

Many hosts run a reverse proxy such as nginx or Varnish in front of WordPress, and a page can stay cached there after every WordPress cache has been cleared. When enabled, the plugin asks that proxy directly to clear itself. The request goes to your own server and nothing leaves the machine.

This does nothing unless your host has configured the proxy to accept it, and the plugin will say so plainly rather than claiming success. Off by default.

09. Setting up Cloudflare purging

Off by default. When enabled, clearing caches also sends a purge to Cloudflare, so visitors are not served an old page from the edge after you have cleared everything on the server. If the plugin detects that requests are arriving through Cloudflare, the Cache tab will recommend setting this up.

You need two values from Cloudflare: an API token and a Zone ID.

1. Open dash.cloudflare.com/profile/api-tokens while signed in to Cloudflare
2. Select Create Token, scroll to the bottom, and choose Create Custom Token
3. Give it a name you will recognise later, such as the name of this site
4. Under Permissions choose Zone, then Cache Purge, then Purge. That one permission is all this needs, and it is far safer than an account-wide key
5. Under Zone Resources choose Include, then Specific zone, then pick your domain from the list. You are not typing an ID at this step
6. Continue to summary, then Create Token, and copy the value straight away
7. Back in the Cloudflare dashboard, select your domain and stay on the Overview page. In the right-hand column under the API heading is the Zone ID, a 32 character string with a copy button
8. Paste both into the Cache tab in WordPress and save

Note that this purges the whole zone, so take care if several sites share one. Our Cloudflare Setup Guide covers the rest of Cloudflare configuration.

10. The environment report

This is the part of the plugin we think earns its place. It changes nothing. It just tells you what you are working with.

The request path

The tab opens with the sequence of hops a visitor's request passes through on its way to your database: CDN, reverse proxy, web server, PHP, WordPress, object cache, database. Each one is lit or dimmed by what was actually detected. A list of components does not tell you how they relate, and the order is the useful part.

The graded report

Below that sits a read-only report, graded so you can see at a glance what is already good and what is worth changing. Green is good, amber suggests a possible improvement, grey is informational. It covers:

• Server - PHP version and handler, web server, reverse proxy, WordPress version against the latest release, database engine and version, HTTPS, and the address the server reports for itself
• Caching layers - OPcache with memory usage, object cache drop-in and which one, and any page cache or CDN it can detect
• WordPress configuration - WP-Cron mode, debug mode, memory limit, maximum upload size
• wp-config.php - page cache flag, revision limit, autosave interval, trash retention, file editor status, forced SSL admin
• .htaccess - GZIP compression, browser caching, ETag handling, whether XML-RPC is blocked at the server level

The most important of these checks also appear in the WordPress Tools > Site Health screen alongside the core checks, so you see them where you already look.

11. Database cleanup

The Database tab counts what can be removed, live, every time you load the page. Nothing is deleted until you tick it and confirm.

It handles post revisions, auto-drafts, trashed posts, spam and trashed comments, expired transients, orphaned post and comment metadata, and cached oEmbed markup. Orphaned metadata is the one people rarely think about: rows left behind by plugins that were removed without cleaning up after themselves.

Two things worth knowing:

• Trashed posts and trashed comments are not ticked by default. Those are things you chose to keep, so removing them is deliberate
• Deletion runs in batches of 500 rows per pass, so a neglected site with tens of thousands of revisions will need a few runs rather than timing out

12. Visitor IP detection

Login protection needs to know which address a request really came from. Headers like X-Forwarded-For and CF-Connecting-IP can be set by anyone, so the plugin only trusts them on a request that actually arrived through a proxy.

Auto-detect is the default and handles this without configuration. It checks the connecting address against Cloudflare's published ranges, then against loopback and private ranges, and falls back to the raw connection when neither matches. A forged header on a request from anywhere else is ignored.

The Security tab shows you what the plugin sees on your own request right now: the address it resolved, which header it came from, and whether your setting matches what the server is actually doing. If you use a CDN other than Cloudflare, switch to Reverse proxy mode and list its ranges.

13. Command line access

Everything on the settings page is available through WP-CLI, which is the practical way to run this across several sites. On our shared hosting you can use WP-CLI over SSH.

# Clear every cache layer
wp ultra-perf purge

# Show which optimizations are active
wp ultra-perf status --format=table

# Report database cruft without deleting anything
wp ultra-perf cleanup --dry-run

# Clean the safe items, or name them explicitly
wp ultra-perf cleanup
wp ultra-perf cleanup --items=revisions,spam_comments

# Review and clear login lockouts
wp ultra-perf lockouts
wp ultra-perf unlock 203.0.113.10

# Move a configuration between sites
wp ultra-perf export > settings.json
wp ultra-perf import settings.json

The export deliberately leaves out your Cloudflare API token, so the file is safe to store in a repository or send to a colleague. Re-enter the token on the destination site.

14. Customizing behavior

Every threshold can be changed with a standard WordPress filter, usually from your theme's functions.php or a small custom plugin. Defaults are shown.

// Comment spam protection
add_filter( 'ultra_spam_max_links',         fn() => 2 );
add_filter( 'ultra_spam_min_time',          fn() => 3 );
add_filter( 'ultra_spam_close_after_days',  fn() => 90 );

// Login protection
add_filter( 'ultra_login_max_attempts',     fn() => 5 );
add_filter( 'ultra_login_lockout_duration', fn() => 15 * MINUTE_IN_SECONDS );
add_filter( 'ultra_login_tracking_window',  fn() => 30 * MINUTE_IN_SECONDS );

// Database cleanup batch size
add_filter( 'ultra_cleanup_batch_size',     fn() => 500 );

// Default colour theme for users who have not chosen one
add_filter( 'ultra_default_theme',          fn() => 'light' );

// Warm the origin before purging the CDN
add_filter( 'ultra_warm_origin_before_cdn_purge', '__return_true' );

Two actions are available if you want to hook your own code in:

do_action( 'ultra_after_cache_purge', $cleared, $failed );
do_action( 'ultra_login_lockout', $ip, $username, $attempts );

The first is the supported way for a host to clear its own proxy cache alongside everything else.

15. Common questions

Will this conflict with my caching plugin?

No. The purge button calls each caching plugin's own flush routine, so it works alongside LiteSpeed Cache, WP Rocket, W3 Total Cache and the others rather than replacing them.

My slider or carousel stopped working after I changed a setting

Turn Remove jQuery Migrate back off, clear all caches, and hard refresh. Some themes and plugins still call methods that modern jQuery removed, and the migrate shim is what patches them back. This is why that setting ships off.

My CSS or JavaScript looks out of date after an update

If you turned on Remove Query Strings, some caching layers may be serving old files because the version string they used for cache-busting is gone. Clear all caches, and if it persists turn that toggle back off.

A comment from a real visitor was held for moderation

That is the link limiter doing its job. Comments with more than two links are queued rather than rejected so you never lose a real one. Approve it from the Comments screen, or raise the limit with the ultra_spam_max_links filter.

Does it slow down my admin?

No. The environment report, the measured summary and the database counts are only calculated when you open the settings page. Nothing runs on the front end except the optimizations you have enabled, and those all remove work rather than adding it.

Do I need this if I already use AccelerateWP?

They do different things and work well together. AccelerateWP handles full page caching, critical CSS, and image optimization at the server level. This plugin trims what WordPress itself loads, hardens login and comments, and gives you one button that clears both. Our Optimize WordPress Performance and Speed guide covers the server-side half in detail.

Quick Recap: Five Things Worth Doing

If you only take five things from this guide, take these:

1. Install it and leave the defaults - they are sensible and safe on a typical site
2. Read the summary panel and the Environment tab - together they tell you what your settings actually removed and what your hosting really is
3. Turn on Purge on Publish - this is what most people want from cache clearing
4. Run the Database cleanup once - most sites carry thousands of revisions and orphaned rows they have never looked at
5. Leave the three off-by-default optimizations off until you have checked them - each can break something quietly rather than obviously

Last updated July 2026 · Browse all WordPress articles