WPShadow

All Shadow checks

WordPress performance checks in Shadow

The largest family: caching, compression, minification, image handling, lazy loading, fonts, database tuning, and a long list of checks on the scripts and styles that load in the admin area.

There are 63 checks in this family. Shadow reports what it finds, and nothing is changed until you approve a fix.

In this family

What each check looks at

Active Plugin Count Reasonable

Checks that the number of active plugins is not excessive. Too many plugins slow the site, create maintenance burden, and increase the security attack surface.

Checks whether WordPress is injecting <link rel="prev"> and <link rel="next"> tags into post pages. Google deprecated these tags in 2019 and they no longer influence search rankings or crawling.

Admin Script Concatenation Disabled

Checks whether CONCATENATE_SCRIPTS is explicitly set to false. WordPress bundles admin scripts into a single load-scripts.php request by default; disabling this multiplies the number of individual HTTP requests on every admin page load.

Why it matters. Checks whether CONCATENATE_SCRIPTS has been explicitly set to false, which forces WordPress to serve every admin script as a separate HTTP request instead of combining them through load-scripts.php.

AMP Dev-Mode Assets on Non-AMP Admin Page

Detects data-ampdevmode attributes on scripts or styles present in the admin HTML. These markers are introduced by the AMP plugin (or Jetpack AMP integration) to support AMP validation tooling. Their presence on a standard admin page means the AMP runtime is active where it should not be, adding unnecessary asset requests and JavaScript processing overhead.

Why it matters. Scans the captured admin page HTML for the data-ampdevmode attribute. This attribute is added by the AMP plugin (and Jetpack when AMP integration is active) to mark assets injected specifically for AMP validation. Its presence on a standard (non-AMP) admin page indicates that the AMP validation runtime is being loaded unnecessarily, adding HTTP requests, JS parse overhead, and potential compatibility issues.

Autoloaded Options

Checks whether the total autoloaded options payload exceeds 800 KB, as WordPress loads all autoloaded options on every page request before any content renders.

Autosave Interval Optimized

Checks whether the AUTOSAVE_INTERVAL constant is configured optimally, too short increases database write load, while too long risks data loss on crashes.

Why it matters. Checks whether the WordPress AUTOSAVE_INTERVAL constant is set to a healthy range between 30 and 300 seconds.

Block Library CSS on Classic Theme

Checks whether the WordPress block library stylesheet is loading on a classic (non-block) theme, where most of its styles are unused and represent unnecessary CSS weight on every page.

Blocking Scripts in Admin <head>

Counts synchronous external scripts in the HTML <head> that lack defer or async attributes. Each such script halts the browser's HTML parser until the file is fully fetched and executed, directly delaying time-to-interactive for admin pages. WordPress core itself enqueues very few scripts in <head>; a high count indicates plugins overriding the in_footer argument.

Why it matters. Extracts the <head> section from the captured admin page HTML and counts synchronous <script src> tags that lack both defer and async attributes. Scripts in <head> without defer/async block HTML parsing until the full script file has been downloaded, parsed, and executed; footer scripts are expected and are therefore excluded from this check.

Browser Caching Headers

Checks whether static assets (CSS and JS files) are served with long-lived Cache-Control or Expires headers. Without these headers, return visitors re-download unchanged files on every page view, increasing load times and server bandwidth costs. A max-age of at least seven days is expected for versioned assets.

Why it matters. Detects missing Cache-Control headers causing browsers to re-download assets unnecessarily.

Caching Plugin Active

No page-caching plugin detected. Caching dramatically reduces server load and improves response times for all visitors.

Why it matters. Checks whether a recognised page-caching plugin is active or the WP_CACHE constant has been set, ensuring pages are served from cache.

CDN For Static Assets

Checks whether a CDN is configured to serve static assets, which reduces latency for distant visitors and offloads bandwidth from the origin server.

Compression Enabled

HTTP compression (gzip/brotli) does not appear to be active. Enabling compression can reduce page transfer sizes by up to 70%.

Why it matters. Checks whether HTTP compression (gzip or brotli) is active by inspecting the Content-Encoding header returned for the site homepage.

Critical CSS Strategy

Checks whether a critical CSS strategy is in place to inline above-the-fold styles and eliminate render-blocking CSS requests.

Why it matters. Critical CSS is the subset of CSS required to render above-the-fold content. Inlining it in the <head> eliminates a render-blocking request and directly improves Largest Contentful Paint and First Contentful Paint. This diagnostic checks whether a plugin or configuration handles this.

Critical Resources Preloaded

Checks whether the site uses resource hints such as preload or prefetch to load critical assets earlier and reduce page rendering delays.

CSS Minification

Checks whether CSS assets are being minified to reduce file sizes and improve page load times.

Why it matters. Checks whether a CSS minification strategy is active to reduce payload sizes and improve page load performance.

Dashboard RSS Widgets Active

Checks whether the WordPress News and Plugins dashboards RSS widgets are present. These widgets make outbound HTTP requests to WordPress.org to fetch RSS feeds, adding an external dependency to every dashboard page load.

Dashicons Loaded on Frontend

Checks whether a performance plugin is managing Dashicons loading so the admin icon font is not served to non-logged-in visitors who never need it.

Why it matters. Checks whether the WordPress admin icon font (Dashicons) is being loaded for non-logged-in visitors on the front end, where it is typically not needed and represents unused CSS and font requests.

Database Indexes Missing

Verifies that all expected indexes are present on the core WordPress database tables, wp_posts, wp_postmeta, wp_comments, and wp_options. Missing indexes force MySQL to perform full table scans, which cause slow queries and admin timeouts on sites with more than a few thousand rows.

Why it matters. Checks for missing or inefficient database indexes.

Database Optimization

Checks whether a database optimisation schedule is active and whether the autoloaded options payload is within a healthy threshold.

Database Version Supported

The database server version is outdated or unsupported. Running an end-of-life database engine risks security vulnerabilities and incompatibility.

Why it matters. Verifies that the MySQL/MariaDB version meets WordPress minimum requirements and is within a supported, actively maintained release series.

DB Charset and Collation Correct

The database charset or collation is not set to the recommended utf8mb4 standard. This can cause emoji storage issues and character-encoding bugs.

Why it matters. Validates that the WordPress database uses utf8mb4 charset with an appropriate unicode_ci collation, flagging legacy or mismatched configurations.

Embed Assets

Checks whether WordPress oEmbed scripts are loaded on every front-end page. These scripts are unnecessary overhead on sites that do not publish embeddable content.

Emoji Assets

Checks whether WordPress emoji detection scripts are loaded on every front-end page. Modern browsers handle emoji natively so these assets represent unnecessary HTTP requests.

Emoji Scripts in Admin

Checks whether WordPress emoji detection scripts and inline styles are injected into wp-admin pages. All modern browsers render emoji natively, so these assets add unnecessary overhead to every backend page load for everyone who logs in.

Excessive Inline Scripts in Admin

Counts inline <script> blocks (no external src) on admin pages. Excessive inline scripts indicate plugins bypassing WordPress asset management, which prevents HTTP caching and increases raw HTML payload size.

Excessive Inline Styles in Admin

Counts inline <style> blocks on admin pages. Inline stylesheets cannot be cached separately by the browser, increase raw HTML weight, and may cause a parser blocking penalty inconsistent with WordPress core patterns. High counts are a signal of plugins that do not properly use wp_enqueue_style().

Why it matters. Scans the captured admin page HTML and counts inline <style> blocks. A high number of inline style blocks indicates plugins are injecting CSS directly into the HTML rather than enqueueing stylesheets, which prevents browser caching, inflates raw HTML, and contributes to render-blocking.

Expired Transients Cleared

A large number of expired transients are accumulating in the database. This bloats the options table and slows autoload queries.

Why it matters. Counts expired transient timeout entries in the options table to detect database bloat from uncleaned transients when no external object cache is used.

Extra Image Sizes Trimmed

Checks whether too many image sizes are registered, causing WordPress to generate excessive file variants on every image upload and waste disk space on unused crops.

Font Loading

Checks whether web fonts are loaded with an optimal font-display strategy and whether external font dependencies are managed to avoid render-blocking requests.

Why it matters. Checks whether fonts are loaded optimally using font-display strategies and whether external font dependencies are reduced via local hosting.

Heartbeat Usage

Checks whether the WordPress Heartbeat API interval is controlled to prevent frequent background AJAX requests from consuming PHP workers on the server.

HTTP/2 or HTTP/3 Enabled

Checks whether the site is served over HTTP/2 or HTTP/3 to take advantage of multiplexing, header compression, and improved connection performance.

Why it matters. Detects whether the site is served over HTTP/2 or HTTP/3 by making a cURL HEAD request to the home URL and inspecting the protocol version.

Image Compression Pipeline Active

No image compression plugin is active. Unoptimised images are typically the largest contributor to slow page load times.

Why it matters. Checks whether an automatic image compression/optimisation plugin is active, ensuring uploaded images are compressed to reduce storage and page weight.

Image Dimensions Not Set Causing Layout Shift

Checks whether img tags served by the site include explicit width and height attributes. When dimensions are absent the browser cannot reserve the correct space before the image loads, causing content to shift downward on the page and degrading Cumulative Layout Shift (CLS), a Core Web Vital that affects search ranking.

Why it matters. Flags images without width/height (or a CSS aspect-ratio), which cause Cumulative Layout Shift (CLS) as content jumps down while images load, a Core Web Vitals problem and a reading-experience one.

Image Lazy Loading

Checks that WordPress native image lazy loading has not been disabled, ensuring off-screen images are deferred to improve initial page load performance.

InnoDB Storage Engine Used

Checks whether the WordPress database tables use the InnoDB storage engine, which delivers better performance and crash recovery than the older MyISAM engine.

Why it matters. Queries INFORMATION_SCHEMA to verify all WordPress core tables use the InnoDB storage engine, which supports transactions and row-level locking.

JavaScript Minification

Checks whether JavaScript assets are being minified to reduce file sizes and improve page load performance.

Jetpack Stats Admin Bar Widget

Checks whether the Jetpack Stats admin bar widget is active. This widget loads a live traffic chart image from WordPress.com on every admin page load, adding an outbound HTTP dependency to every wp-admin request.

JPEG Quality

Checks whether the WordPress JPEG image quality setting is within the optimal 60-85 range that balances visual quality with manageable file sizes.

Why it matters. Checks the effective JPEG quality level applied by WordPress during image processing, flagging values that are too high (wasteful) or too low (blurry).

Media Scaling Threshold

Checks whether the WordPress big-image-size threshold is disabled, which causes full-resolution uploads to be stored and potentially served without downscaling.

Modern Image Format Support

Checks whether the server supports WebP image format via GD or ImageMagick, enabling WordPress 5.8+ to generate smaller next-generation image files during uploads.

Non-Critical JS Deferred

Checks whether a performance plugin is active to defer non-critical JavaScript, reducing render-blocking resources that delay page paint.

Why it matters. Checks whether a performance plugin handles JavaScript deferral, or whether the active theme avoids registering a high number of render-blocking scripts.

Object Cache

Checks whether a persistent object cache is active. Without one, WordPress must re-query the database on every request for data that could be served from a fast in-memory cache.

Why it matters. Checks whether a persistent object cache (Redis, Memcached) is active to reduce repetitive database queries on every page request.

Checks whether WordPress is injecting oEmbed discovery link tags into every page that advertise your content as embeddable, unnecessary overhead for sites that do not need their content embedded elsewhere.

OPcache Enabled

Checks whether PHP OPcache is enabled and actively caching compiled bytecode. OPcache eliminates the overhead of parsing and compiling PHP files on every request, typically reducing PHP execution time by 30-70%. It is the single highest-impact PHP configuration change available on most shared and managed hosts.

Why it matters. Checks whether PHP OPcache is enabled and returning a live cache status. OPcache is one of the highest-impact PHP runtime improvements because it avoids reparsing and recompiling PHP files on every request.

Orphaned Comments

Checks for orphaned comments whose parent posts have been deleted and undeleted spam comments that are adding unnecessary database bloat.

Orphaned Post Meta

Checks for postmeta rows whose parent posts have been deleted, which inflate the postmeta table and slow down meta queries.

Orphaned Term Relationships

Checks for term relationship rows whose parent posts have been deleted, adding unnecessary overhead to taxonomy and archive queries.

Page Cache Enabled

Checks whether a full-page caching solution is active on the site. Page caching stores pre-built HTML responses and serves them without executing PHP or querying the database on each visit, typically reducing page generation time by 50-90% and enabling the site to handle traffic spikes gracefully.

Why it matters. Checks if page caching is enabled and working properly.

PHP Memory Limit Optimized

Checks whether the PHP memory_limit is at least 128 MB. A low memory limit causes fatal errors under complex plugins and prevents WordPress from completing large operations.

Why it matters. Checks whether the PHP memory_limit is at least 128 MB, which is the WordPress recommended minimum for reliable operation.

Checks whether WordPress is advertising your xmlrpc.php endpoint via a <link rel="pingback"> tag in every page's <head> and via an X-Pingback HTTP response header, both active even when pingbacks are disabled.

Post Revision Limit Set

Checks whether WordPress post revisions have been limited or disabled, as unlimited revisions can significantly bloat the database over time.

Why it matters. Checks whether WP_POST_REVISIONS is set to a finite number, preventing unlimited revision accumulation that bloats the posts table over time.

Protocol-Relative Asset URLs in Admin

Scans admin page HTML for protocol-relative asset URLs (src="//..." or href="//..."). These URLs block HTTP/2 preconnect hinting, reduce CDN origin detection accuracy, and can cause mixed-content warnings if the server is ever accessed over HTTP.

Why it matters. Scans the captured admin page HTML for protocol-relative URLs (// instead of https://) in script src and link href attributes. Protocol-relative URLs were a legacy technique for mixed HTTP/HTTPS sites but are now considered anti-patterns on HTTPS-only sites.

Responsive Images Enabled

Checks whether WordPress responsive image srcset generation is functioning so browsers can load appropriately sized images for each device and viewport.

Why it matters. Verifies that WordPress is generating srcset and sizes attributes for uploaded images, enabling browsers to request appropriately-sized assets.

Checks whether WordPress is injecting a REST API discovery link into every page that publicly advertises the REST API endpoint URL in page source code to scanners and bots.

Checks whether WordPress is injecting a <link rel="EditURI"> Really Simple Discovery tag into every page, a protocol designed for mid-2000s desktop blogging clients that no longer exist.

Why it matters. Checks whether WordPress is still injecting a <link rel="EditURI"> RSD tag into every page's <head>. RSD was used by desktop blogging clients from the early 2000s and is obsolete on all modern sites.

Checks whether WordPress is injecting RSS autodiscovery <link> tags into every page that broadcast your feed URLs to browsers and feed readers, unnecessary for sites that do not actively promote an RSS subscription audience.

SCRIPT_DEBUG Disabled in Production

Checks that SCRIPT_DEBUG is not set to true. When active on a production site it forces WordPress to serve unminified development builds of all core JavaScript and CSS, inflating page payload for every visitor.

Checks whether WordPress is injecting a <link rel="shortlink"> tag into every page, a legacy sharing feature that predates modern URL shorteners and adds unnecessary overhead.

Transient Cleanup

Checks for expired transients and excessive transient counts accumulating in the options table, which slow database queries on every page load.

Unminified Plugin Assets in Admin

Scans admin page HTML for stylesheet and script URLs that explicitly include minify=false, forcing all admin users to download larger uncompressed asset files on every page load.

Checks whether WordPress is injecting a <link rel="wlwmanifest"> tag into every page that was designed for Windows Live Writer, a blogging client Microsoft discontinued in 2017.

WordPress Generator Meta Tag

Checks whether WordPress is outputting a <meta name="generator"> tag that publicly advertises the exact WordPress version number to anyone viewing the page source.

WordPress Version in RSS Feed

Checks whether the WordPress RSS feed is outputting a <generator> tag that reveals the exact WordPress version, independently of the HTML page generator meta tag.

The other check families

Shadow is free and runs on your own server, with no account. The source is on GitHub, and these descriptions come from it.

Find me online: LinkedIn · Bluesky · X · Mastodon · YouTube · GitHub · WordPress.org