Optimize a Wordpress Site (July/2022)

Wordpress is a very comfortable framework to create a site on.

You automatically inherit a slew of amazing plugins which enable you to create many sorts of dynamic sites with statistics, admin site and many other benefits.

But unfortunately, you also inherit many problems which come with the Wordpress installation.

Just to name a few

  • Wordpress is a heavy framework, instead of having a lean HTML/PHP site, you now have this monster you need to reign in. - I am talking optimization/speed wise
  • Wordpress is very popular (it powers more than 30% of the internet sites as of today), so it is a target to many a hacker.
  • Wordpress has lots of security issues as each plugin is created by a different developer and you won't know where the security breach came from.
  • Wordpress is slow as it does lots of tasks behind the scenes (as it has lots of not-so-needed functionalities).

So what are the initial steps one should do when creating a fresh wordpress site ?

General Guidelines

  • Make sure you have a SSL certificate
  • Use a fast DNS (Cloudflare)
  • Consider the web server in use, Apache WWW has the worst performance while nginx is much better but might be complicated to configure. (OpenLiteServer seems like the best fit)
  • Take care of the www redirect
  • Have a backup plugin (Updraft, or maybe a server backup [not controlled in WP])

Security

  • Use CloudLinux for much better security
  • Block all not used ports on your server
  • Your server should have a good firewall (waf?), putting in jail all of those knocking on the ftp/ssh/mail ports.
  • Use a CDN (cloudflare?) with a DDOS attack protection service.
  • Wordpress security Plugins
    • Blackhole (J. Karr)
    • Remove all unneeded parts from wordpress - this also helps against attackers (Machete/Unbloater, Block XML-RPC, Block Rest-API)
    • Plugin with a firewall, plugin/theme integrity check, login protection, virus scan (Wordfence, consider offloading protection to the server instead of WP)

Optimization

  • Browser side caching (wprocket/htaccess editing) - so browsers will not even ask for some of the site's assets
  • DB caching - Object caching (Redis)
  • CDN (Cloudflare with proxied DNS)
  • Server Brotly compression (better than GZIP)
  • HTTP3/2
  • Server side caching (Opcache)
  • Remove all unneeded parts from wordpress  (Machete/Unbloater)
  • Wordpress caching plugin (WPRocket/LSCWP)
Hold a minimal amount of plugins, those that you hold should always be updated and from a casually maintained source.

These are the basics - A good starting point.


Additional points to consider

  • Convert all DB tables to InnoDB instead of MyIsam
  • Disable WP cron jobs (using wpconfig.php) and enable Linux cron jobs every 15m
  • Disable pingbacks or even all comments sitewide
  • Enable (Cloudflare?) image hotlinking protection
  • For large sites, enable more memory: define( 'WP_MEMORY_LIMIT', '256M' );
  • Consider eliminating automatic updates
  • Define PHP workers smartly (heavy sites can use 4 static workers per CPU) while small sites might use dynamic workers

Comments

Post a Comment

Popular posts from this blog

Profiling Java @ 2019

A good profiler can really help you in your work while coding Java (I assume while coding any coding language but I am referring to Java here) It can find memory leaks (Which object and how many of it takes the most of your limited memory?), CPU bottlenecks and other surprising data like the time consumed by each network call / DB query etc. Thus it is not so surprising to find many different java profilers around. I will try to map here the Java profiling tools lying around My short list of requirements will include the following: Profiler Requirements Constantly updated profiler (how a profiler built to profile Java6 will behave with Java11?) Clear GUI - As I will want to dive into the profiling data - it will be much simpler using UI Free (With a big advantage to the open sourced ones) (Optional) Remote profiling List of Profilers Dead Profilers (At least 5 years without an update) JIP - Java Interactive Profiler  - Last update 2010 Profiler4J - Last U...
Read more

Ant Explorer graphical Ant build tool

Every serious java developer needs to create or edit some ant building script. Eclipse offers nice ant handling features which make the task much easier, eclipse's plugin (which is embeded into eclipse since version 3.1 or so) understands the ant scripting language thus enables not only syntax coloring but also nice mouse hovering which reveals values of properties, variable names which enables finding the source of each variable and also some nice debugging features. But, there is one field in which eclipse's ant handling lacks perfection, its in viewing the whole build file in one gaze graphically feature, that feature isn't supported by eclipse. Luckily enough, it is supported by YWorks, which created a nice and free util which loads an ant script file and shows it in a beautiful and so very useful way. I think that this util (which was released as a standalone as well as an eclipse and idea) is a must for any serious java developer. Unluckily, YWorks have remo...
Read more

Start Working with AutoIT

I have decided I needed a quick GUI creator which can create a small exe file displaying the GUI, with no system dependencies like a .NET framework or Java runtime. What options do I have for a Quick GUI Creator? Maybe there are many options I am not aware of, but after extensive searching I found these two: Auto Hot keys AutoIT (Saw some recommendations to try Delphi or Pascal for this task but I passed) Both tools began from the same code source, autohotkeys branched off and continued to be open source while AutoIT is more commercial. I have compared the two (well, not actually compared, just google'd out other's comparisons) and found out that the AutoHotKeys is slightly better and is more open sourced (which makes it the better solution) but lacks in one field which is crucial for me - the script syntax is awful!  That tipped the balance (as a programmer i couldn't stand AHK's syntax) so I chose AutoIT. How to get Started with AutoI...
Read more