Khukuri Speed X-Ray
Khukuri Speed X-Ray
Description
Khukuri Speed X-Ray is a diagnostic tool, not an optimizer. It never modifies your site, never minifies, never converts images, never caches. It scans, explains in plain English, and tells you exactly what to do — including recommending other well-known free plugins by name when they are the right fix.
What it does
- Measures your server — response time (TTFB, 3-sample median), PHP version, gzip/Brotli compression, page-cache and CDN detection, database health (autoloaded options size, expired transients).
- X-rays your homepage — every script, stylesheet, image and iframe is inventoried and weighed. Each asset is traced back to the plugin or theme that loaded it, so you get a per-plugin cost table: this plugin costs you 412 KB and 9 requests on every page view.
- Audits your images — the 10 heaviest images with size, format, missing lazy-loading, missing dimensions (CLS risk), and a specific fix for each one.
- Identifies third-party weight — YouTube embeds, chat widgets, tracking pixels, remote fonts — with an honest explanation of what each one costs.
- Asks Google — pulls your PageSpeed Insights scores (mobile + desktop) and real-visitor Core Web Vitals (LCP, INP, CLS) from the CrUX field data when available.
- Turns it all into a prioritized fix list — ~30 rules produce plain-English cards sorted critical warning, each with an explanation a non-technical site owner can follow, a specific recommendation, a difficulty badge, and a conservative impact estimate (always labeled as an estimate).
What it deliberately does NOT do
- It does not optimize anything. Diagnosis only. Your site is never modified.
- It does not compete with your optimization plugins — it detects WP Rocket, LiteSpeed Cache, Autoptimize, Smush and others, and tells you what they already have covered.
- It does not fake precision. Where a measurement is approximate (TTFB measured server-to-self, transfer sizes capped at the 30 largest assets), the report says so.
- It does not name paid hosts, sell anything, or show ads. There is no Pro version.
Privacy
All scanning runs from your own server and Google’s public PageSpeed API. This plugin sends no data to the plugin author. Ever. No telemetry, no phoning home. Scan results live in one table in your own database.
External services
This plugin connects to one external service: the Google PageSpeed Insights API (v5), used to fetch performance scores and Core Web Vitals data for the page you are scanning.
- What is sent: the public URL of the page you choose to scan (your homepage, or any additional page you add in Settings), and, if you supply one, your own free Google API key. No visitor data, no personal data, and nothing from your database is sent.
- When it is sent: only when you, the site administrator, click “Run new scan” in the plugin’s admin page. Nothing is sent automatically, on a schedule, or on the frontend.
- Results are cached locally for 30 minutes to avoid repeat requests.
Service provider: Google LLC — Google APIs Terms of Service, Google Privacy Policy.
No other third-party or remote service is called by this plugin. During a scan, the plugin also inspects the HTML of your own site to identify third-party scripts (e.g. Google Analytics, Google Fonts, YouTube embeds, chat widgets) that your theme or other plugins already load — this is local text analysis of your own page’s markup, not a request to those services.
Faq
Not by itself — and any diagnostic tool that claims otherwise is overselling. It tells you precisely why your site is slow and what to change, so the fixes you make (or the plugins you install) are the right ones instead of guesses.
No. Nothing loads on your site’s frontend — not a single byte of CSS or JS. The scanner runs only when you click “Run scan” in the admin, and its assets load only on its own admin page.
No. The PageSpeed API works without a key for light use. If you scan very frequently and hit quota errors, you can paste a free API key from Google Cloud Console into the settings.
Google’s API can be slow or temporarily unavailable. The scan retries once, then shows the rest of the report with a clear notice. Results are cached for 30 minutes, so re-scanning immediately reuses the previous PageSpeed result.
Google only publishes field data (CrUX) for sites with enough Chrome traffic. Smaller sites see lab scores only — that’s normal, and the report says so instead of pretending.
Yes, and it’s designed to be complementary: if you run WP Rocket, LiteSpeed Cache, Autoptimize, WP Super Cache, W3 Total Cache, Smush, ShortPixel, Imagify, Perfmatters or FlyingPress, the report shows a “You already have this covered” section instead of redundant advice.
By default, your scan history is left alone. If you tick “Delete all scan history on uninstall” in the settings, uninstalling removes the plugin’s table and options completely.
Reviews
Changelog
1.0.2
- Tightened the same-site check used before measuring an asset’s transfer size: it now requires an exact host match (or a subdomain of the site’s own host) instead of matching on “/wp-content/” appearing anywhere in a URL, which could have caused a cross-origin URL to be fetched server-side.
- Renamed the plugin to Khukuri Speed X-Ray.
1.0.1
- Action cards for image, plugin and render-blocking issues now list the actual affected files, each linking to the file itself.
- Fixed image sizes showing as “unknown” on the heaviest-images table when a page had many scripts/styles (images now get their own reserved measurement quota instead of being crowded out).
- Added a clear notice with a direct link to get a free PageSpeed API key when Google’s free daily quota is exhausted, instead of a raw API error string.
- Centered table headers for visual consistency across the plugin cost, image audit, third-party and history tables.
1.0.0
- Initial release: staged scanner (server checks, page composition, asset weighing, PageSpeed Insights), ~30-rule diagnostic engine, plugin cost attribution, image audit, third-party analysis, scan history with trend chart.