WPShadow

All Shadow checks

WordPress performance checks for admin area and plugins in Shadow

What loads in the WordPress admin and how heavy the plugin set is: blocking and inline scripts, unminified plugin assets, widgets on the dashboard, the Heartbeat API and autosave interval.

There are 13 checks on this page. Shadow reports what it finds, and nothing is changed until you approve a fix.

In this family

What each check looks at

Active Plugin Count Reasonable

Checks that the number of active plugins is not excessive. Too many plugins slow the site, create maintenance burden, and increase the security attack surface.

Admin Script Concatenation Disabled

Checks whether CONCATENATE_SCRIPTS is explicitly set to false. WordPress bundles admin scripts into a single load-scripts.php request by default; disabling this multiplies the number of individual HTTP requests on every admin page load.

Why it matters. Checks whether CONCATENATE_SCRIPTS has been explicitly set to false, which forces WordPress to serve every admin script as a separate HTTP request instead of combining them through load-scripts.php.

AMP Dev-Mode Assets on Non-AMP Admin Page

Detects data-ampdevmode attributes on scripts or styles present in the admin HTML. These markers are introduced by the AMP plugin (or Jetpack AMP integration) to support AMP validation tooling. Their presence on a standard admin page means the AMP runtime is active where it should not be, adding unnecessary asset requests and JavaScript processing overhead.

Why it matters. Scans the captured admin page HTML for the data-ampdevmode attribute. This attribute is added by the AMP plugin (and Jetpack when AMP integration is active) to mark assets injected specifically for AMP validation. Its presence on a standard (non-AMP) admin page indicates that the AMP validation runtime is being loaded unnecessarily, adding HTTP requests, JS parse overhead, and potential compatibility issues.

Autosave Interval Optimized

Checks whether the AUTOSAVE_INTERVAL constant is configured optimally, too short increases database write load, while too long risks data loss on crashes.

Why it matters. Checks whether the WordPress AUTOSAVE_INTERVAL constant is set to a healthy range between 30 and 300 seconds.

Blocking Scripts in Admin <head>

Counts synchronous external scripts in the HTML <head> that lack defer or async attributes. Each such script halts the browser's HTML parser until the file is fully fetched and executed, directly delaying time-to-interactive for admin pages. WordPress core itself enqueues very few scripts in <head>; a high count indicates plugins overriding the in_footer argument.

Why it matters. Extracts the <head> section from the captured admin page HTML and counts synchronous <script src> tags that lack both defer and async attributes. Scripts in <head> without defer/async block HTML parsing until the full script file has been downloaded, parsed, and executed; footer scripts are expected and are therefore excluded from this check.

Dashboard RSS Widgets Active

Checks whether the WordPress News and Plugins dashboards RSS widgets are present. These widgets make outbound HTTP requests to WordPress.org to fetch RSS feeds, adding an external dependency to every dashboard page load.

Emoji Scripts in Admin

Checks whether WordPress emoji detection scripts and inline styles are injected into wp-admin pages. All modern browsers render emoji natively, so these assets add unnecessary overhead to every backend page load for everyone who logs in.

Excessive Inline Scripts in Admin

Counts inline <script> blocks (no external src) on admin pages. Excessive inline scripts indicate plugins bypassing WordPress asset management, which prevents HTTP caching and increases raw HTML payload size.

Excessive Inline Styles in Admin

Counts inline <style> blocks on admin pages. Inline stylesheets cannot be cached separately by the browser, increase raw HTML weight, and may cause a parser blocking penalty inconsistent with WordPress core patterns. High counts are a signal of plugins that do not properly use wp_enqueue_style().

Why it matters. Scans the captured admin page HTML and counts inline <style> blocks. A high number of inline style blocks indicates plugins are injecting CSS directly into the HTML rather than enqueueing stylesheets, which prevents browser caching, inflates raw HTML, and contributes to render-blocking.

Heartbeat Usage

Checks whether the WordPress Heartbeat API interval is controlled to prevent frequent background AJAX requests from consuming PHP workers on the server.

Jetpack Stats Admin Bar Widget

Checks whether the Jetpack Stats admin bar widget is active. This widget loads a live traffic chart image from WordPress.com on every admin page load, adding an outbound HTTP dependency to every wp-admin request.

Protocol-Relative Asset URLs in Admin

Scans admin page HTML for protocol-relative asset URLs (src="//..." or href="//..."). These URLs block HTTP/2 preconnect hinting, reduce CDN origin detection accuracy, and can cause mixed-content warnings if the server is ever accessed over HTTP.

Why it matters. Scans the captured admin page HTML for protocol-relative URLs (// instead of https://) in script src and link href attributes. Protocol-relative URLs were a legacy technique for mixed HTTP/HTTPS sites but are now considered anti-patterns on HTTPS-only sites.

Unminified Plugin Assets in Admin

Scans admin page HTML for stylesheet and script URLs that explicitly include minify=false, forcing all admin users to download larger uncompressed asset files on every page load.

The other check families

Shadow is free and runs on your own server, with no account. The source is on GitHub, and these descriptions come from it.

Find me online: LinkedIn · Bluesky · X · Mastodon · YouTube · GitHub · WordPress.org