Fortify & Accelerate Your WordPress Store in 5 Minutes.
Modular performance optimization and fortress security suite. Eradicate bloat with 1-click Asset Optimization, Database cleanup, and HTTP Security Headers. Protect your site with a Login Brute-Force Shield, WordPress Core Hardening, and a 6-Layer Malware Scanner.
Everything Your WordPress Store Needs to Thrive
1. Speed & Database Optimizer
Eradicate frontend bloat for 99+ Core Web Vitals. Auto WebP conversion, WooCommerce Cart-Fragments optimization, and inline critical CSS for LCP. Clean orphaned database entries and autoload options.
- Zero jQuery dependency on storefront
- Auto WebP image conversion
- WooCommerce Cart-Fragments optimizer
- Inline critical CSS for LCP
- Database & autoload cleanup
2. Grade A+ Headers, Core Hardening & Login Shield
Deploy enterprise-grade security headers that block XSS, clickjacking, and MIME-sniffing attacks. Automatic HSTS CSP for HTTPS sites, core hardening, and brute-force protection.
- Strict-Transport-Security (HSTS) with preload
- Content-Security-Policy upgrade-insecure-requests
- IP lockout after 5 failed login attempts
- Disable XML-RPC & Theme/Plugin File Editors
- 1-Click wp-content/uploads/ PHPExecution Shield
3. 6-Layer Malware & Hidden-Admin Scanner
Deep-dive read-only diagnostics for malicious scripts, obfuscated payloads, database backdoors, and hidden administrator accounts. 6 comprehensive scanning layers including base64 detection and core file checksum validation.
- Base64 encode/decode backdoor detection
- Obfuscated eval() pattern scanner
- Hidden admin account detector (pre_user_query)
- WordPress.org core file checksum validation
- Zero-tolerance uploads/ PHP shell scan
4. Early-Boot WAF Firewall & Anti-Bot Rate Limiter
Unlock real-time attack blocking with the Pro extension. Blocks SQL Injection, XSS, and bad-bots at Priority 0 before WordPress even loads—protecting your server resources.
- SQLi, XSS & Directory Traversal protection
- 429 Anti-Bot Flood Request Throttling
- Real-Time Admin Capability Guard
- 1-Click Malware & Rogue-User Eradication
- Custom CSP Header Builder & Scheduled Scans
Compare Free (v2.1.0) vs. FBS Secure Optimize Pro
Start free on WordPress.org and upgrade to Pro for enterprise-grade firewall protection and active threat removal tools.
| Capability / Feature | Free Core (v2.1.0) | Secure Optimize Pro |
|---|---|---|
| Asset & Bloat Optimizer (CWV Fixes) | ✔ | ✔ Included |
| Database & Autoload Cleaner (MySQL Optimization) | ✔ | ✔ Included |
| HTTP Security Headers (Grade A+ Enforcement) | ✔ | ✔ Included |
| Login Brute-Force Shield & IP Lockouts | ✔ | ✔ Included |
| 6-Layer Forensic Malware Scanner | Read-Only Audit | Audit + 1-Click Clean |
| Early-Boot Web Application Firewall (WAF) | — | ✔ PRO |
| 429 Anti-Bot Flood IP Rate Limiter | — | ✔ PRO |
| Real-Time Admin Capability Guard | — | ✔ PRO |
| Stealth Hidden-Admin Account Detector | ✔ | ✔ Included |
| 1-Click Malware & Rogue-User Eradication | — | ✔ PRO |
| Custom CSP Header Builder & Policy Tester | — | ✔ PRO |
| Scheduled Daily Security Scans & Alerts | — | ✔ PRO |
| Priority Direct Engineer Support | WP.org Forum | ✔ Priority Support |
Frequently Asked Questions
No. Every engine is controlled by an Independent Module Toggle in the Module Control Center. If another plugin already handles script deferring or lazy loading, simply toggle Asset & Bloat Optimizer off—disabled modules are bypassed at boot and register zero frontend hooks, while you continue enjoying Database Cleanup, Autoload Inspection, Security Headers, Login Protection, Core Hardening, and the 6-Layer Malware Scanner.
Yes. Turning any module off in Module Control Center immediately hides its configuration panel (and hides the corresponding top navigation tab if all modules in that group are disabled) while safely preserving your saved preferences in case you re-enable it later.
Yes. Unlike aggressive lazy-loaders that delay your top hero banner and hurt Largest Contentful Paint (LCP), FBS Secure Optimize automatically skips lazy-loading on the first image in your content and adds fetchpriority="high". Likewise, JavaScript deferring automatically excludes jQuery core and sensitive cart/checkout pages.
No. The free HTTP Security Headers module ships with safe, standards-compliant defaults (X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, and Permissions-Policy) that never block third-party CSS, fonts, or payment scripts. Every header is individually toggleable.
Sophisticated malware often creates a backdoor administrator account and hooks pre_user_query or users_list_table_query_args so the rogue account is completely invisible on your Users → All Users screen. Layer 6 of our scanner cross-checks standard user queries against raw usermeta capability rows in MySQL to expose any hidden or stealth-elevated administrator immediately.
Never automatically. In the Free edition, the 6-Layer Scanner performs a 100% safe, read-only forensic audit and lets you inspect suspicious code inside the Safe File Snippet Preview modal so core or custom files are never accidentally deleted. One-click deletion and auto-disarming are optional tools available in Pro.
Absolutely! Our senior engineering team builds bespoke WordPress extensions, ERP/CRM integrations, and 95–100 Lighthouse PageSpeed overhauls on staging first. Request a free technical audit or custom quote here →