FBS Secure Optimize – Speed Optimization, Security Headers & Malware Scanner

FBS Secure Optimize (engineered by FBS Fusion) is a modern, lightweight performance and security suite built around 6 Independent Zero-Overhead Modules.

Most sites don’t need bloated, all-or-nothing plugins that slow down wp-admin or clash with existing caching layers. With FBS Secure Optimize, every engine has its own 1-Click Master Toggle in the Module Control Center:

• Disabled Modules = Zero Runtime Overhead: Any module you toggle off is completely bypassed at boot—zero frontend hooks, zero database queries, and zero conflicts with WP Rocket, LiteSpeed Cache, FlyingPress, Autoptimize, Cloudflare, or WooCommerce.
• Auto-Hide Clean Interface: Turning a module off automatically hides its configuration panels and tabs so your dashboard stays focused and clutter-free.

6 Independent Modules Included Free

1. Asset & Core Web Vitals Optimizer (with 1-Click Universal Cache Purge)
Boost Lighthouse Performance, Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), and Total Blocking Time (TBT) without jQuery bloat or fragile script bundling:
* Non-Blocking Google Fonts & Preconnect: Converts render-blocking Google Fonts stylesheets to asynchronous media="print" swap with <noscript> fallback, enforces display=swap, and injects preconnect hints for fonts.googleapis.com and fonts.gstatic.com.
* Auto-Inline Small Local CSS (<= 8 KB): Automatically inlines tiny render-blocking theme and plugin CSS files into <head> while safely rewriting relative url(...) paths and caching minified output.
* Zero-CLS Missing Image width & height Injection: Automatically detects local <img> tags missing explicit dimensions and injects cached width and height attributes to prevent layout shifts.
* LCP-Safe Native Lazy Loading: Adds native loading="lazy" and decoding="async" to offscreen images while stripping lazy-loading and applying fetchpriority="high" on your first above-the-fold hero image.
* Delay Third-Party Analytics & Pixels (TBT/INP): Optional 1-click toggle to delay heavy third-party trackers (GTM, GA4, Meta Pixel, Microsoft Clarity, Hotjar, LinkedIn, TikTok) until first user interaction or a 3.5s fallback—automatically bypassed on WooCommerce cart, checkout, and account pages.
* Top Admin Bar & Dashboard 1-Click “Purge Cache”: Instantly clears FBS inlined CSS & CLS dimension caches, WordPress Object Cache (Redis/Memcached), PHP OPcache, and triggers compatible cache flushes across LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Fastest Cache, WP Super Cache, Autoptimize, SiteGround, Breeze, and WP Engine.
* Iframe & Video Lazy Loading: Defers embedded maps and video players until visitors scroll near them.
* Safe Non-Critical JS Deferring: Adds defer to frontend scripts while automatically excluding jQuery core and sensitive checkout/account flows.
* Core Bloat Removal: Strip inline emoji scripts/styles, disable frontend Dashicons for logged-out visitors, dequeue unused oEmbed scripts, and clean <head> RSD, WLW, and shortlink tags.
* Heartbeat API Throttling: Throttles admin-ajax.php polling to 60 seconds to prevent CPU spikes and 502 timeouts on shared or VPS hosting.

2. Database & Autoload Cleaner
Keep MySQL lean for sub-200ms Server Time to First Byte (TTFB):
* 1-Click & Scheduled Cleanup: Safely remove post revisions, old auto-drafts (> 7 days), spam and trashed comments, expired transients, and orphaned postmeta rows.
* MySQL Table Optimization: Run OPTIMIZE TABLE across core tables manually or automatically via daily, weekly, or monthly WP-Cron schedules.
* Built-In Autoload Bloat Inspector: Instantly audit total autoloaded wp_options size (in KB) alongside your Top 5 Heaviest Autoloaded Options so hidden database bottlenecks never go unnoticed.

3. HTTP Security Headers
Achieve a hardened browser security posture without breaking stylesheets, fonts, or payment gateways:
* Toggleable X-Content-Type-Options: nosniff (MIME-sniffing defense)
* Toggleable X-Frame-Options: SAMEORIGIN (clickjacking protection)
* Toggleable Referrer-Policy: strict-origin-when-cross-origin
* Toggleable Permissions-Policy (restricts unauthorized camera, microphone, geolocation, and USB access)
* Optional Strict-Transport-Security (HSTS) for HTTPS sites
* Hide core generator meta tags and asset version fingerprinting (?ver=)

4. Unified Login Brute-Force Shield
Stop automated credential-stuffing and brute-force bots before they exhaust PHP workers:
* Automatic IP Lockouts: Lock out attacking IPs after a configurable number of failed login attempts and lockout window.
* Trusted IP Allowlist: Whitelist your office or developer IPs so you are never locked out.
* Username Enumeration Masking: Replace verbose login failure hints with generic error messages so attackers cannot harvest valid usernames.
* Live Telemetry & 1-Click Reset: View recent failed login attempts (IP, username, UTC timestamp) and clear active lockouts in one click.

5. Core Hardening & 1-Click Uploads PHP Shield
Close the most common entry points used in automated site compromises:
* 1-Click wp-content/uploads/ PHP Execution Shield: Generates hardened .htaccess rules blocking direct execution of backdoor .php, .phtml, and .phar shells uploaded into media folders.
* Disable XML-RPC & X-Pingback: Eliminates amplified system.multicall brute-force and pingback DDoS vectors.
* Block Username Harvesting: Stops ?author=1 archive scans and restricts unauthenticated REST API /wp/v2/users enumeration.
* Lock Theme & Plugin File Editors: Blocks arbitrary PHP code editing inside wp-admin via capability mapping (map_meta_cap).
* High-Risk Plugin Detector: Alerts you if risky file-manager or database-admin plugins are left active in production, with 1-click deactivation.

6. 6-Layer Malware, Core Checksum & Hidden-Admin Scanner
Built from real-world forensic incident response to uncover threats traditional scanners miss:
* Layer 1 — Root Directory PHP Audit: Flags unauthorized .php drop-ins sitting in your site root (ABSPATH).
* Layer 2 — Official Core MD5 Checksums: Verifies every file inside wp-admin/ and wp-includes/ against official api.wordpress.org cryptographic MD5 hashes.
* Layer 3 — Zero-Tolerance uploads/ Shell Scan: Detects disguised PHP webshells inside wp-content/uploads/.
* Layer 4 — mu-plugins Persistence Audit: Inspects Must-Use plugins where stealth malware often hides from the standard Plugins screen.
* Layer 5 — Heuristic Signature & wp_options DB Scan: Scans plugins, themes, and database options for obfuscated eval(base64_decode(...)), gzinflate, shell execution, and injected script payloads, complete with a Safe Read-Only Code Snippet Preview modal.
* Layer 6 — Stealth pre_user_query Hidden-Admin Detector: Compares high-level WP_User_Query results against raw database capabilities usermeta rows to expose rogue administrator accounts hidden by malicious hooks.

Unlock Active Defense with FBS Secure Optimize Pro

Need real-time attack blocking and 1-click threat eradication? FBS Secure Optimize Pro extends the free plugin with 5 additional independent modules:
* Early-Boot Web Application Firewall (WAF): Blocks SQL Injection (SQLi), Cross-Site Scripting (XSS), Directory Traversal, Null-Byte exploits, and bad-bot user-agents at priority 0 (includes safe Learning Mode).
* 429 Anti-Bot Flood Rate Limiter: Sliding-window per-IP request throttling (HTTP 429 Too Many Requests) to prevent scraper floods from triggering 502 Bad Gateway crashes.
* Real-Time Admin Capability Guard: Locks an Approved Administrator Whitelist and automatically disarms unauthorized privilege escalation while destroying rogue sessions.
* 1-Click Malware & Rogue-User Eradication: Delete flagged backdoor files, malicious database rows, and stealth admin accounts directly from the 6-Layer Scanner.
* Custom CSP Header Builder & Scheduled Daily Scans: Test Content-Security-Policy directives in Report-Only mode before enforcing Grade A+ headers, plus automated daily scan email alerts.

External Services

When an administrator manually clicks Run 6-Layer Deep Scan inside wp-admin (or enables scheduled scans in Pro), the plugin connects to the official public WordPress.org Core Checksums API (https://api.wordpress.org/core/checksums/1.0/) to fetch official MD5 file hashes for your installed core version and locale.
* Data sent: Only your WordPress version string and locale (for example, version=7.1&locale=en_US), solely when a scan runs.
* Privacy: Zero personal data, visitor IPs, user accounts, or site content is ever transmitted. Governed by the WordPress.org Privacy Policy.