Qaiyo Web Performance Surgeon

Most performance tools tell you that your site is slow. Qaiyo Web Performance Surgeon tells you what is slow, where it comes from, and how much you would save by fixing it — then fixes the safe ones in one click.

It measures a real, anonymous visitor render (not your logged-in admin view) by running a tokened loopback request, and attributes every cost back to the exact plugin, file and line responsible.

Features

• File- and function-level attribution — every slow query, hook and asset is traced to the exact plugin, file and line responsible, not just “the database is slow”.
• Measures the real visitor render — a tokened, anonymous loopback captures the logged-out front-end page, not your admin-skewed view.
• Estimated time saving per finding — every issue is ranked with an honest millisecond estimate, so you fix the biggest wins first.
• Database profiling — per-query timing, duplicate-query detection and bloated autoloaded-option detection.
• Hook and callback timing — per-callback cost with plugin attribution, captured with low overhead (no per-call backtraces).
• Blocking HTTP detection — flags slow external requests made while the page renders.
• Asset inventory — enqueued scripts and styles listed with their owning plugin.
• Real browser metrics — Largest Contentful Paint, Cumulative Layout Shift, long tasks and navigation timing from an actual browser render.
• Image checks — finds images served far larger than they are displayed (with the wasted kilobytes) and images that render without width/height, which makes the page jump.
• Duplicate asset detection — spots the same library shipped twice by different plugins, or the same file registered under two handles.
• Server & environment tab — the performance checks WordPress itself runs (object cache, page cache, PHP and database versions, cron, debug mode), collected in one place.
• Compared with your last scan — every scan shows whether server time, query count and findings went up or down since the previous scan of the same URL.
• Safe one-click fixes — reversible toggles for common wins; no source files are ever modified.
• Zero overhead on live traffic — measurement only runs for a tokened scan request; normal visits pay nothing.
• Available in 11 languages.

What it measures

• Database — every query with its execution time, paired to the calling plugin/file/line (via SAVEQUERIES), plus duplicate-query and autoloaded-option detection.
• Hooks — per-callback timing with plugin attribution, captured without per-call backtraces (low overhead).
• HTTP — outbound requests made during render, flagging blocking external calls.
• Assets — enqueued scripts and styles with their owners.
• Browser — real LCP, CLS, long tasks and navigation timing, captured from an actual browser render.

Diagnosis and one-click fixes

The rule engine turns raw measurements into ranked findings with an estimated time saving for each, and offers safe, reversible one-click fixes for common wins:

• Disable the emoji detection script
• Disable wp-embed.js
• Remove jQuery Migrate
• Dequeue front-end Dashicons
• Stop autoloading a bloated option
• Remove the legacy RSD / Windows Live Writer links from the page head
• Turn off XML-RPC (only offered when nothing on the site appears to need it)
• Stop self-pingbacks when you link between your own posts

Every fix is a toggle you can undo — no source files are ever rewritten.

Privacy

Scans run on your own site. No data is sent to any third party.

1. Upload the plugin to /wp-content/plugins/ and activate it.
2. Open Performance Surgeon in the admin menu.
3. Install the scan helper when prompted (a tiny must-use plugin that only activates during a scan and is removed on deactivation).
4. Enter a URL and run a scan.

1.1.0

• New: image checks — oversized images (with the wasted kilobytes) and images rendering without width/height.
• New: duplicate asset detection — the same library loaded by two different plugins, or the same file behind two handles.
• New: large-DOM finding, based on the element count from the real browser render.
• New: “Server & environment” tab showing WordPress’s own Site Health performance checks (object cache, page cache, PHP/database version, cron, debug mode).
• New: each scan is compared with the previous scan of the same URL, so you can see whether a change helped.
• New one-click fixes: remove the legacy RSD/Windows Live Writer head links, turn off XML-RPC (only offered when nothing appears to need it), and stop self-pingbacks.

1.0.1

• Deferred the scan/measurement classes to admin and scan requests only, so normal front-end page loads stay lighter.
• The enabled-fixes option is now autoloaded, removing an extra database read on every front-end request.
• Aligned all internal version constants with the plugin header and tidied a few developer-facing code annotations.
• Added a SECURITY.md with a vulnerability-disclosure contact.

1.0.0

• First public release on WordPress.org.
• File- and function-level performance attribution for SQL, hooks, HTTP and assets, measured on a real anonymous visitor render via a tokened loopback.
• Real-browser metrics (LCP, CLS, long tasks, navigation timing) captured from an actual render.
• Rule engine with ranked findings, estimated time savings, and safe reversible one-click fixes.
• Tabbed admin page (Diagnostics, Browser metrics, Loopback test) with the Qaiyo design system.
• Bundled translations for 11 languages.
• Clean uninstall: removes the plugin’s option, cached transient and scan-helper on deletion.