Title: Qaiyo Web Performance Surgeon
Author: qaiyo
Published: 2026-07-21
Last modified: 2026-09-23
---
Szukaj wtyczek
# Qaiyo Web Performance Surgeon
Autor: [qaiyo](https://profiles.wordpress.org/qaiyo/)
[Pobierz](https://downloads.wordpress.org/plugin/qaiyo-web-performance-surgeon.1.4.5.zip)
* [Szczegóły](https://pl.wordpress.org/plugins/qaiyo-web-performance-surgeon/#description)
* [Recenzje](https://pl.wordpress.org/plugins/qaiyo-web-performance-surgeon/#reviews)
* [Instalacja](https://pl.wordpress.org/plugins/qaiyo-web-performance-surgeon/#installation)
* [Rozwój](https://pl.wordpress.org/plugins/qaiyo-web-performance-surgeon/#developers)
[Wsparcie](https://wordpress.org/support/plugin/qaiyo-web-performance-surgeon/)
## Opis
Most performance tools tell you _that_ your site is slow. Qaiyo Web Performance
Surgeon tells you **what** is slow, **where** it comes from, and **how much** you
would save by fixing it — then fixes the safe ones in one click.
It measures a real, anonymous visitor render (not your logged-in admin view) by
running a tokened loopback request, and attributes every cost back to the exact
plugin, file and line responsible.
#### Features
* **File- and function-level attribution** — every slow query, hook and asset is
traced to the exact plugin, file and line responsible, not just „the database
is slow”.
* **Measures the real visitor render** — a tokened, anonymous loopback captures
the logged-out front-end page, not your admin-skewed view.
* **Estimated time saving per finding** — every issue is ranked with an honest
millisecond estimate, so you fix the biggest wins first.
* **Database profiling** — per-query timing, duplicate-query detection and bloated
autoloaded-option detection.
* **Hook and callback timing** — per-callback cost with plugin attribution, captured
with low overhead (no per-call backtraces).
* **Blocking HTTP detection** — flags slow external requests made while the page
renders.
* **Asset inventory** — enqueued scripts and styles listed with their owning plugin.
* **Real browser metrics** — Largest Contentful Paint, Cumulative Layout Shift,
long tasks and navigation timing from an actual browser render.
* **Image checks** — finds images served far larger than they are displayed (with
the wasted kilobytes) and images that render without width/height, which makes
the page jump.
* **Duplicate asset detection** — spots the same library shipped twice by different
plugins, or the same file registered under two handles.
* **Server & environment tab** — the performance checks WordPress itself runs (
object cache, page cache, PHP and database versions, cron, debug mode), collected
in one place.
* **Compared with your last scan** — every scan shows whether server time, query
count and findings went up or down since the previous scan of the same URL.
* **Performance score on your dashboard** — your latest scan is condensed into
a single 0–100 score on a speedometer gauge, shown in the shared Qaiyo ecosystem
dashboard widget (provided by Qaiyo Admin Booster) so you see how the site is
doing without opening the plugin.
* **Safe one-click fixes** — reversible toggles for common wins; no source files
are ever modified.
* **Zero overhead on live traffic** — measurement only switches on after a scan
token has been validated against the record that issued it; normal visits pay
nothing.
* **Available in 11 languages.**
#### What it measures
* **Database** — every query with its execution time, paired to the calling plugin/
file/line (via SAVEQUERIES), plus duplicate-query and autoloaded-option detection.
* **Hooks** — per-callback timing with plugin attribution, captured without per-
call backtraces (low overhead).
* **HTTP** — outbound requests made during render, flagging blocking external calls.
* **Assets** — enqueued scripts and styles with their owners.
* **Browser** — real LCP, CLS, long tasks and navigation timing, captured from
an actual browser render.
#### Diagnosis and one-click fixes
The rule engine turns raw measurements into ranked findings with an estimated time
saving for each, and offers safe, reversible one-click fixes for common wins:
* Disable the emoji detection script
* Disable wp-embed.js
* Remove jQuery Migrate
* Dequeue front-end Dashicons
* Stop autoloading a bloated option
* Remove the legacy RSD / Windows Live Writer links from the page head
* Turn off XML-RPC (only offered when nothing on the site appears to need it)
* Stop self-pingbacks when you link between your own posts
* Remove the „?ver=” query string from static assets, for caching layers that skip
versioned URLs
Every fix is a toggle you can undo — no source files are ever rewritten.
#### Privacy
Scans run on your own site. No data is sent to any third party.
## Instalacja
1. Upload the plugin to `/wp-content/plugins/` and activate it.
2. Open **Performance Surgeon** in the admin menu.
3. Install the scan helper when prompted (a tiny must-use plugin that only activates
during a scan and is removed on deactivation).
4. Enter a URL and run a scan.
## Najczęściej zadawane pytania
### Does it slow down my live site?
No. Measurement only starts once a scan token has been validated against the single-
use authorisation record that issued it. A request without a token leaves the scan
helper immediately, and a request carrying a token that was never issued is rejected
before any measurement is switched on — so an ordinary page load is unaffected either
way.
### Why does it install a must-use plugin?
To capture the _whole_ request — including the earliest database queries — the SAVEQUERIES
flag must be set before WordPress loads its database layer. A tiny must-use loader
does this, but only during a scan. It is removed automatically when you deactivate
the plugin.
### Are the estimated savings exact?
They are honest estimates based on measured data, shown under instrumentation. Treat
them as a prioritised guide, not a guarantee.
## Recenzje
Wtyczka nie ma jeszcze żadnej recenzji.
## Kontrybutorzy i deweloperzy
„Qaiyo Web Performance Surgeon” jest oprogramowaniem open source. Poniższe osoby
miały wkład w rozwój wtyczki.
Zaangażowani
* [ qaiyo ](https://profiles.wordpress.org/qaiyo/)
Wtyczka „Qaiyo Web Performance Surgeon” została przetłumaczona na 2 języki. Podziękuj
[tłumaczom](https://translate.wordpress.org/projects/wp-plugins/qaiyo-web-performance-surgeon/contributors)
za ich wkład.
[Przetłumacz wtyczkę “Qaiyo Web Performance Surgeon” na swój język.](https://translate.wordpress.org/projects/wp-plugins/qaiyo-web-performance-surgeon)
### Interesuje cię rozwój wtyczki?
[Przeglądaj kod](https://plugins.trac.wordpress.org/browser/qaiyo-web-performance-surgeon/),
sprawdź [repozytorium SVN](https://plugins.svn.wordpress.org/qaiyo-web-performance-surgeon/)
lub czytaj [dziennik rozwoju](https://plugins.trac.wordpress.org/log/qaiyo-web-performance-surgeon/)
przez [RSS](https://plugins.trac.wordpress.org/log/qaiyo-web-performance-surgeon/?limit=100&mode=stop_on_copy&format=rss).
## Rejestr zmian
#### 1.4.5
* Fixed (could take a site down): the scan helper was written straight over the
live file in wp-content/mu-plugins. Everything in that directory loads on every
single request, so a write that died halfway — a full disk, a quota, a timeout—
left a half-written PHP file that put the whole site, admin included, behind
a parse error. The helper is now staged next to the target, read back byte for
byte, and only then swapped into place in one step. A failed write now leaves
the previous helper exactly as it was.
* Fixed (fatal error): preparing a browser capture for a URL that is not on this
site raised a PHP TypeError instead of reporting the problem. Reachable from
the Browser metrics button with any URL you could type.
* Fixed: on a site whose locale uses a comma as the decimal separator, the dashboard
score gauge could be drawn with a malformed arc.
* Structure: the admin class no longer holds the page markup, the scan storage
and the result formatting all at once. The page is a template, storage and formatting
are their own classes, and the one file write this screen performs now happens
before any output rather than in the middle of it. The rendered page is unchanged,
byte for byte.
* Quality: the plugin now ships with a test suite (PHPUnit + Brain Monkey, 81 tests)
and passes PHPStan at level 5 with no errors. Neither is included in the download.
#### 1.4.4
* Fixed: the `qwps_pro_unlocked_modules` filter was fired from two places with
a different number of arguments. An integration that registered for both arguments(
the shape this plugin’s own documentation described) worked in one code path
and crashed the Pro feature list with a PHP 8 ArgumentCountError in the other.
There is now one function behind it, fired once, with one argument.
* Fixed: uninstalling the plugin on a multisite network only cleaned up the site
the deletion happened on, leaving this plugin’s options and transients behind
on every other site. Cleanup now runs per site.
* Fixed: uninstall left the XML-RPC monitor’s short-lived write-lock transient
behind.
* Housekeeping: removed dead code — a duplicated copy of the „which Pro modules
are unlocked” logic, guards on this plugin’s own always-loaded functions and
classes, and hardcoded fallback URLs that could never be reached.
* Housekeeping: hooks are no longer registered from a constructor, so the plugin’s
classes can be created without silently wiring themselves into WordPress.
* Housekeeping: return types added to 249 of 278 functions (89%). Parameters of
hook callbacks are deliberately left untyped — WordPress and other plugins supply
those values, and a strict type there would turn another plugin’s bad value into
a fatal error on your site.
#### 1.4.3
* New: **must-use plugins are now labelled as such** in „SQL by plugin”, „Hook
time by plugin” and the slowest-query/hook tables, instead of showing a bare
filename that reads the same as an ordinary plugin slug. A must-use plugin (wp-
content/mu-plugins) runs on every single request and never appears on the Plugins
screen, so this may be the only place its cost is visible at all — the report
now says so plainly rather than leaving it to blend in.
#### 1.4.2
* New: **every applied fix can now be undone.** A list of the changes this plugin
has made appears under the diagnosis, each with an Undo button. This was the
missing half of the promise: applying a fix silences the finding that reported
it, so until now there was no way back from the admin — including for „Stop autoloading”,
which is the one people are rightly most careful with. Undoing an autoload change
restores the exact flag that was there before.
* New: **every finding now says what it actually asks of you** — one click, a setting,
a developer, or the cost of the stack you chose — with a count of each above
the list. On a mature site most of what is left is somebody else’s code or the
inherent price of a page builder and a shop, and saying so plainly is more useful
than a list that reads as if all of it were yours to fix.
* New: **findings are marked „Origin” or „Front end”.** A scan deliberately measures
WordPress before any page cache or CDN rewrites the response, because that is
the only place server timings exist. Origin findings are real regardless of caching
and are paid in full on pages that are never cached (cart, checkout, account)
and for every logged-in visitor; front-end findings are read off the HTML your
site produced, which an optimization layer may already clean up before a visitor
sees it. When such a layer is detected, the report now says this at the top instead
of leaving you to infer it.
* Autoload cleanup is no longer offered blind: each option now names what it appears
to belong to, carries a plain risk level, and states outright that stopping autoload
deletes nothing and is reversible.
* Fixed: `rewrite_rules`, `cron`, `sidebars_widgets`, `uninstall_plugins` and the
user-roles option are now protected from the autoload fix. WordPress reads them
on virtually every request, so taking them out of the autoloaded bundle replaces
one bundled read with a separate query — a loss presented as a saving.
#### 1.4.1
* Security: the scan helper switched measurement on when a scan token was merely
_present_, without checking that it was one this site had issued. A request such
as `?qwps_scan=x` could therefore turn on SAVEQUERIES (a backtrace per database
query) and DONOTCACHEPAGE (bypassing the full-page cache) without being logged
in. Both switches now happen only after the token has been validated against
its single-use record, and the helper discards a malformed token before loading
anything at all. Existing scan helpers are rewritten automatically the next time
you open the plugin page — no action needed.
* Security: installing or removing the scan helper writes a PHP file to wp-content/
mu-plugins, so it now requires the „install plugins” capability instead of „manage
options”. This also makes it obey DISALLOW_FILE_MODS, and on multisite it stops
a single-site administrator from placing a file that runs network-wide.
* Hardening: the scan target check now compares the port as well as the host, so
a service on another port of the same hostname is no longer a valid target, and
URLs carrying credentials are rejected. Loopback requests use the safe HTTP helper,
which re-validates redirect targets.
* Hardening: „Stop autoloading a bloated option” now only accepts options that
the autoload rule would actually report (currently autoloaded and over the size
threshold) rather than any option name, and no longer reveals whether an arbitrary
option exists. It also clears the per-option cache entry, which a persistent
object cache needs to stop serving the old value.
* Docs: corrected the readme’s description of when measurement runs, and refreshed
the supported-versions table in SECURITY.md.
#### 1.4.0
* New: **Performance score** — every scan now produces a single 0–100 score from
its findings and measured server time, shown on a speedometer gauge.
* New: the score appears as a card in the shared **Qaiyo ecosystem** dashboard
widget and settings panel (provided by Qaiyo Admin Booster), alongside the cards
other Qaiyo plugins report. Nothing is required for this to work — if Admin Booster
is not installed, no card is reported and nothing changes.
* The score is now the single source of truth across the plugin: the Pro add-on’s
multi-URL site health score reads the same formula, so the number on the dashboard
always matches the number on the scan page.
* Fixed: uninstalling the plugin left the XML-RPC usage-monitor option behind in
the database.
* Fixed: the score-band label („Poor” / „Needs work” / „Good”) on the Qaiyo ecosystem
card could render with glitchy, incorrect-looking glyphs in some browsers. It
was placed inside the SVG gauge as a small `` element, which some browser/
OS combinations render inconsistently at small sizes; it is now plain HTML text
under the gauge instead. The translated strings themselves were always correct—
this was a rendering issue, not a translation bug.
#### 1.3.0
* Fixed: on sites behind a full-page cache or CDN, a scan could report „no measurements
came back” even with the scan helper installed. The scanner now detects and purges
known caching plugins before scanning, and — if that still fails — names the
caching layer it found instead of a generic message.
* Fixed: „Turn off XML-RPC” could be offered even when the endpoint was in real
use by something outside this site (a publishing app, an automation tool). It
now watches for real XML-RPC calls for at least 7 days before recommending anything,
and never recommends it while recent real traffic is seen.
* Fixed: findings for a page builder’s own rendering step (e.g. Elementor building
the page from its saved layout) recommended adding conditional tags to code you
cannot edit. These are now labelled as the builder’s own baseline cost, with
guidance that is actually actionable.
* Fixed: a caching plugin writing its own page cache after render could be flagged
as „slow” with advice to cache its own output. This is now recognised as the
cache doing its job, not a bug.
* Fixed: WordPress’s own wp_enqueue_scripts() dispatcher could appear as a separate„
slow hook” finding, double-counting time already reported under the individual
plugin callbacks it fires.
#### 1.2.0
* New one-click fix: remove the „?ver=” query string from static assets, for proxies
and CDN setups that will not cache a versioned URL. Off by default and reversible—
the version is also what busts caches after an update, so turn it on only if
your caching layer needs it.
* Fixed: the Qaiyo plugin group in the admin sidebar could break apart on sites
where another plugin (WooCommerce, Elementor, an admin-menu tool) reorders the
admin menu.
#### 1.1.0
* New: image checks — oversized images (with the wasted kilobytes) and images rendering
without width/height.
* New: duplicate asset detection — the same library loaded by two different plugins,
or the same file behind two handles.
* New: large-DOM finding, based on the element count from the real browser render.
* New: „Server & environment” tab showing WordPress’s own Site Health performance
checks (object cache, page cache, PHP/database version, cron, debug mode).
* New: each scan is compared with the previous scan of the same URL, so you can
see whether a change helped.
* New one-click fixes: remove the legacy RSD/Windows Live Writer head links, turn
off XML-RPC (only offered when nothing appears to need it), and stop self-pingbacks.
#### 1.0.1
* Deferred the scan/measurement classes to admin and scan requests only, so normal
front-end page loads stay lighter.
* The enabled-fixes option is now autoloaded, removing an extra database read on
every front-end request.
* Aligned all internal version constants with the plugin header and tidied a few
developer-facing code annotations.
* Added a SECURITY.md with a vulnerability-disclosure contact.
#### 1.0.0
* First public release on WordPress.org.
* File- and function-level performance attribution for SQL, hooks, HTTP and assets,
measured on a real anonymous visitor render via a tokened loopback.
* Real-browser metrics (LCP, CLS, long tasks, navigation timing) captured from
an actual render.
* Rule engine with ranked findings, estimated time savings, and safe reversible
one-click fixes.
* Tabbed admin page (Diagnostics, Browser metrics, Loopback test) with the Qaiyo
design system.
* Bundled translations for 11 languages.
* Clean uninstall: removes the plugin’s option, cached transient and scan-helper
on deletion.
## Meta
* Wersja **1.4.5**
* Ostatnia aktualizacja **3 tygodnie temu**
* Włączone instalacje **Mniej niż 10**
* Wersja WordPressa ** 5.8 lub nowszej **
* Testowano do **7.1.3**
* Wersja PHP ** 7.4 lub nowszej **
* Języki
* [English (US)](https://wordpress.org/plugins/qaiyo-web-performance-surgeon/),
[Russian](https://ru.wordpress.org/plugins/qaiyo-web-performance-surgeon/), i
[Spanish (Spain)](https://es.wordpress.org/plugins/qaiyo-web-performance-surgeon/).
* [Przetłumacz na swój język](https://translate.wordpress.org/projects/wp-plugins/qaiyo-web-performance-surgeon)
* Tagi
* [database](https://pl.wordpress.org/plugins/tags/database/)[diagnostics](https://pl.wordpress.org/plugins/tags/diagnostics/)
[optimization](https://pl.wordpress.org/plugins/tags/optimization/)[performance](https://pl.wordpress.org/plugins/tags/performance/)
[profiling](https://pl.wordpress.org/plugins/tags/profiling/)
* [Widok zaawansowany](https://pl.wordpress.org/plugins/qaiyo-web-performance-surgeon/advanced/)
## Oceny
Nie przesłano jeszcze żadnych recenzji.
[Twoja opinia](https://wordpress.org/support/plugin/qaiyo-web-performance-surgeon/reviews/#new-post)
[Zobacz wszystkierecenzje.](https://wordpress.org/support/plugin/qaiyo-web-performance-surgeon/reviews/)
## Zaangażowani
* [ qaiyo ](https://profiles.wordpress.org/qaiyo/)
## Wsparcie
Masz coś do dodania? Potrzebujesz pomocy?
[Zobacz forum wsparcia](https://wordpress.org/support/plugin/qaiyo-web-performance-surgeon/)