A2 Optimized WP – Turbocharge and secure your WordPress site vs Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Boosting performance and securing your WordPress site has never been easier with the A2 Optimized WP plugin from A2 Hosting. Get customized desktop and mobile performance scores for your site, including: Server speed (Time to First Byte) Page load speed (Largest Contentful Paint) User perception (First Contentful Paint) Visual stability (Cumulative Layout Shift) Website browser speed (First Input Delay) Using these scores, A2 Optimized WP generates specific, personalized recommendations for improving your site: Performance Security Best practices compliance With just a few clicks you’ll give your WordPress site the boost it needs with stable, industry-proven optimizations and improvements. Vulnerability disclosure program Performance optimizations Our plugin is optimized to work best in the A2 Hosting environment, so items marked with an asterisk (*) are only available for sites hosted at A2 Hosting. If you are not an A2 Hosting customer, join today! Page caching * Allows site visitors to save copies of your web pages on their device or browser. When they return to your website in the future, your site files load faster. * This optimization improves Time to First Byte (TTFB) and reduces bandwidth usage. Gzip compression * Turns on Gzip compression to make text files smaller. * This optimization improves Time to First Byte (TTFB) and reduces bandwidth usage. Redis object caching (*) * Stores commonly used elements such as menus, widgets, and database sets in memory. * This optimization improves Time to First Byte (TTFB). Minify HTML pages * Removes extra spaces, tabs, comments, and line breaks from HTML pages. * This optimization improves First Contentful Paint (FCP) and First Input Delay (FID). Automatic database optimizations * Periodically cleans MySQL databases of expired transients (a type of cached data used in WordPress) as well as trashed and spam comments. Also optimizes database tables. * This optimization improves Time to First Byte (TTFB) for uncached pages. Compress images on upload (*) * Automatically compresses images when they are uploaded to your site. * This optimization improves First Contentful Paint (FCP), Largest Contentful Paint (LCP), and First Input Delay (FID). Turbo Web Hosting (*) *Takes advantage of A2 Hosting’s Turbo Web Hosting platform to provide faster serving of static files, pre-compiled .htaccess files for improved performance, PHP opcode caching, and more. *This optimization can improve multiple benchmarks. Use system cron instead of WordPress cron (*) * Replaces the WordPress virtual “cron job” with a genuine, system-defined cron job. * This optimization reduces the load on WordPress and ensures scheduled tasks run at precise, correct intervals. Minify inline CSS and JavaScript * Removes extra spaces, tabs, comments, and line breaks from inline CSS and JavaScript. * This optimization improves First Contentful Paint (FCP) and First Input Delay (FID). Disable WooCommerce AJAX Cart Fragments * Disables WooCommerce AJAX Cart Fragments on your homepage and enables the “redirect to cart page” option. * This optimization improves WooCommerce performance. Security optimizations Our plugin is optimized to work best in the A2 Hosting environment, so items marked with an asterisk (*) are only available for sites hosted at A2 Hosting. If you are not an A2 Hosting customer, join today! Lock editing of plugins and themes from wp-admin * Prevents misuse of built-in editing capabilities for the WordPress admin. Change login URL (*) * Changes the login page URL from the default wp-login.php to a random URL. * Helps prevent bots from brute-force attacking your login page. Add CAPTCHA for comments and login (*) * Adds a CAPTCHA to comment forms and login pages to deter bots from posting spam comments and running brute-force attacks.. Block unauthorized XML-RPC requests * Rejects XML-RPC requests except for whitelisted services, such as Jetpack. Deny direct access to configuration files * Displays a “403 Forbidden” error when visitors or bots try to access WordPress configuration files. Best practices recommendations Regenerate wp-config salts * Generates new values for wp-config.php salts and security keys for increased security. Recent post limit *Checks the number of recent posts per page, which should be less than 15 for most sites. RSS post limit * Checks the number of posts in RSS feeds, which should be less than 20 for most sites. Recent posts showing on home page * Checks whether the home page displays recent posts, and offers to use a static page instead for faster performance. Permalink structure * Checks that the permalink structure is configured to fully optimize page caching and get additional SEO benefits. Unused themes * Checks if there are any non-default, unused themes that should be deleted. Inactive plugins * Checks if there are any inactive plugins that should be deleted. Hosted with A2 Hosting * Checks if your site is hosted with A2 Hosting for faster page load times and more optimizations.

Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate. Really simple, Effective and Performant WordPress Security Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features. We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is: Lightweight: Every security feature is developed with a modular approach and with performance in mind. Disabled features won’t load any redundant code. Easy-to-use: 1-minute configuration with short onboarding setup. Security Features Easy SSL Migration Migrates your website to HTTPS and enforces SSL in just one click. 301 redirect via PHP or .htaccess Secure cookies Let’s Encrypt: Install an SSL Certificate if your hosting provider supports manual installation. Server Health Check: Your server configuration is every bit as important for your website security. WordPress Hardening Tweak your configuration and keep WordPress fortified and safe by tackling potential weaknesses. Prevent code execution in the uploads folder Prevent login feedback and disable user enumeration Disable XML-RPC Disable directory browsing Username restrictions (block ‘admin’ and public names) and much more.. Vulnerability Detection Get notified when plugins, themes or WP core contain vulnerabilities and need appropriate action. Login Protection Allow or enforce Two-Factor Authentication (2FA) for specific user roles. Users receive a two-factor code via Email. Improve Security with Really Simple Security Pro Protect your site with all essential security features by upgrading to Really Simple Security Pro. Advanced SSL enforcement Mixed Content Scan & Fixer. Detect files that are requested over HTTP and fix them to HTTPS, both Front- and Back-end. Enable HTTP Strict Transport Security and configure your site for the HSTS Preload list. Firewall Really Simple Security Pro includes a performant and efficient WordPress firewall, to stop bots, crawlers and bad actors with IP and username blocks. 404 blocking – Blocks crawlers as they trigger unusual numbers of 404 errors. Region blocking – Only allow/block access to your site from specific regions. Automated and customisable Firewall rules. IP blocklist and allowlist. Security Headers Security headers protect your site visitors against the risk of clickjacking, cross-site-forgery attacks, stealing login credentials and malware. Independent of your Server Configuration, works on Apache, LiteSpeed, NGINX, etc. Protect your website visitors with X-XSS Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and CORS headers. Automatically generate your WordPress-tailored Content Security Policy. Vulnerability Measures When a vulnerability is detected in a plugin, theme or WordPress core you will get notified accordingly. With Vulnerability Measures, you can configure simple but effective measures to make sure that a critical vulnerability won’t remain unattended. Force update: An update process will be tried multiple times until it can be assumed development of a theme or plugin is abandoned. You will be notified during these steps. Quarantine: When a plugin or theme can’t be updated to solve a vulnerability, Really Simple Security can quarantine the plugin. Advanced Site Hardening Choose a custom login URL Automated File Permissions check and fixer Rename and randomize your database prefix Change the debug.log file location to a non-public folder Disable application passwords Control admin creation Disable HTTP methods, reducing HTTP requests Login Protection Secure your website’s login process and user accounts with powerful security measures. Two-Step verification (Email login) 2FA (two factor authentication) with TOTP Passwordless login with passkey login Enforce strong passwords and frequent password change Limit Login Attempts With Limit Login Attempts you can configure a threshold to temporarily or permanently block IP addresses or (non-existing) usernames. You can also throw a CAPTCHA after a failed login (hCaptcha or Google reCaptcha) Access Control Restrict access to your site for specific regions. Add specific IP addresses or IP ranges to the Blocklist or Allowlist. Useful Links Documentation Security Definitions Translate Really Simple Security Issues & pull requests Feature requests Love Really Simple Security? If you want to support the continuing development of this plugin, please consider buying Really Simple Security Pro, which includes some excellent security features and premium support. About Really Simple Plugins Our mission is to make complex WordPress requirements really easy. Really Simple Security is developed by Really Simple Plugins. For generating SSL certificates, Really Simple Security uses the le acme2 PHP Let’s Encrypt client library, thanks to ‘fbett’ for providing it. Vulnerability Detection uses WP Vulnerability, an open-source initiative by Javier Casares. Want to join as a collaborator? We’re on GitHub as well!