=== Qaiyo Web Performance Surgeon ===
Contributors: qaiyo
Tags: performance, optimization, diagnostics, database, profiling
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Diagnose what actually slows your site down — file- and function-level attribution of SQL, hooks, HTTP and assets, measured on a real visitor render.

== Description ==

Most performance tools tell you *that* your site is slow. Qaiyo Web Performance Surgeon tells you **what** is slow, **where** it comes from, and **how much** you would save by fixing it — then fixes the safe ones in one click.

It measures a real, anonymous visitor render (not your logged-in admin view) by running a tokened loopback request, and attributes every cost back to the exact plugin, file and line responsible.

= Features =

* **File- and function-level attribution** — every slow query, hook and asset is traced to the exact plugin, file and line responsible, not just "the database is slow".
* **Measures the real visitor render** — a tokened, anonymous loopback captures the logged-out front-end page, not your admin-skewed view.
* **Estimated time saving per finding** — every issue is ranked with an honest millisecond estimate, so you fix the biggest wins first.
* **Database profiling** — per-query timing, duplicate-query detection and bloated autoloaded-option detection.
* **Hook and callback timing** — per-callback cost with plugin attribution, captured with low overhead (no per-call backtraces).
* **Blocking HTTP detection** — flags slow external requests made while the page renders.
* **Asset inventory** — enqueued scripts and styles listed with their owning plugin.
* **Real browser metrics** — Largest Contentful Paint, Cumulative Layout Shift, long tasks and navigation timing from an actual browser render.
* **Image checks** — finds images served far larger than they are displayed (with the wasted kilobytes) and images that render without width/height, which makes the page jump.
* **Duplicate asset detection** — spots the same library shipped twice by different plugins, or the same file registered under two handles.
* **Server & environment tab** — the performance checks WordPress itself runs (object cache, page cache, PHP and database versions, cron, debug mode), collected in one place.
* **Compared with your last scan** — every scan shows whether server time, query count and findings went up or down since the previous scan of the same URL.
* **Safe one-click fixes** — reversible toggles for common wins; no source files are ever modified.
* **Zero overhead on live traffic** — measurement only runs for a tokened scan request; normal visits pay nothing.
* **Available in 11 languages.**

= What it measures =

* **Database** — every query with its execution time, paired to the calling plugin/file/line (via SAVEQUERIES), plus duplicate-query and autoloaded-option detection.
* **Hooks** — per-callback timing with plugin attribution, captured without per-call backtraces (low overhead).
* **HTTP** — outbound requests made during render, flagging blocking external calls.
* **Assets** — enqueued scripts and styles with their owners.
* **Browser** — real LCP, CLS, long tasks and navigation timing, captured from an actual browser render.

= Diagnosis and one-click fixes =

The rule engine turns raw measurements into ranked findings with an estimated time saving for each, and offers safe, reversible one-click fixes for common wins:

* Disable the emoji detection script
* Disable wp-embed.js
* Remove jQuery Migrate
* Dequeue front-end Dashicons
* Stop autoloading a bloated option
* Remove the legacy RSD / Windows Live Writer links from the page head
* Turn off XML-RPC (only offered when nothing on the site appears to need it)
* Stop self-pingbacks when you link between your own posts

Every fix is a toggle you can undo — no source files are ever rewritten.

= Privacy =

Scans run on your own site. No data is sent to any third party.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/` and activate it.
2. Open **Performance Surgeon** in the admin menu.
3. Install the scan helper when prompted (a tiny must-use plugin that only activates during a scan and is removed on deactivation).
4. Enter a URL and run a scan.

== Frequently Asked Questions ==

= Does it slow down my live site? =

No. Measurement only runs for a tokened scan request; every normal page load exits on the first line of the scan helper at zero cost.

= Why does it install a must-use plugin? =

To capture the *whole* request — including the earliest database queries — the SAVEQUERIES flag must be set before WordPress loads its database layer. A tiny must-use loader does this, but only during a scan. It is removed automatically when you deactivate the plugin.

= Are the estimated savings exact? =

They are honest estimates based on measured data, shown under instrumentation. Treat them as a prioritised guide, not a guarantee.

== Changelog ==

= 1.1.0 =
* New: image checks — oversized images (with the wasted kilobytes) and images rendering without width/height.
* New: duplicate asset detection — the same library loaded by two different plugins, or the same file behind two handles.
* New: large-DOM finding, based on the element count from the real browser render.
* New: "Server & environment" tab showing WordPress's own Site Health performance checks (object cache, page cache, PHP/database version, cron, debug mode).
* New: each scan is compared with the previous scan of the same URL, so you can see whether a change helped.
* New one-click fixes: remove the legacy RSD/Windows Live Writer head links, turn off XML-RPC (only offered when nothing appears to need it), and stop self-pingbacks.

= 1.0.1 =
* Deferred the scan/measurement classes to admin and scan requests only, so normal front-end page loads stay lighter.
* The enabled-fixes option is now autoloaded, removing an extra database read on every front-end request.
* Aligned all internal version constants with the plugin header and tidied a few developer-facing code annotations.
* Added a SECURITY.md with a vulnerability-disclosure contact.

= 1.0.0 =
* First public release on WordPress.org.
* File- and function-level performance attribution for SQL, hooks, HTTP and assets, measured on a real anonymous visitor render via a tokened loopback.
* Real-browser metrics (LCP, CLS, long tasks, navigation timing) captured from an actual render.
* Rule engine with ranked findings, estimated time savings, and safe reversible one-click fixes.
* Tabbed admin page (Diagnostics, Browser metrics, Loopback test) with the Qaiyo design system.
* Bundled translations for 11 languages.
* Clean uninstall: removes the plugin's option, cached transient and scan-helper on deletion.

== Upgrade Notice ==

= 1.1.0 =
Image and duplicate-asset checks, a Server & environment tab, before/after comparison with your last scan, and three more safe one-click fixes.

= 1.0.1 =
Lighter front-end footprint (deferred scan classes, autoloaded fixes option) and internal version/annotation tidy-up.

= 1.0.0 =
First public release on WordPress.org.
