WordPress optimisation – speed, security and stability

A slow website loses visitors, Google rankings and sales. A hacked website loses trust. WordPress optimisation solves both problems – systematically, measurably and without changing the design you like.

Why WordPress websites become slow

• too many plugins, some of which load scripts on every page;
• heavy “multi-purpose” themes and visual builders;
• unoptimised images weighing several megabytes;
• a database full of revisions, transients, spam comments and leftovers from deleted plugins;
• no caching, or badly configured caching;
• an old PHP version and slow hosting;
• external scripts – chats, pixels, fonts, video – that block loading.

What optimisation includes

1. Audit and measurement

We measure the current state with Google PageSpeed Insights, Lighthouse and real-user data (Core Web Vitals from Search Console): LCP (how fast the main content loads), INP (responsiveness) and CLS (visual stability). We analyse the server, the database, the plugins and the theme.

2. Server and PHP

Moving to PHP 8.3/8.4, configuring OPcache, object caching with Redis, HTTP/2 and HTTP/3, Brotli/Gzip compression and server-level page caching (Nginx FastCGI cache).

3. Plugins and theme

We remove unnecessary plugins, replace heavy ones with lightweight alternatives or a small piece of custom code, and load scripts only where they are needed.

4. Images and fonts

Conversion to WebP/AVIF, correct sizes for every device, lazy loading and locally hosted fonts (faster and better for the GDPR).

5. CSS and JavaScript

Minification, deferring non-critical scripts, critical CSS for the first screen and removing unused code.

6. Database

Cleaning out revisions, transients and leftovers, optimising tables and adding indexes for slow queries (especially important for WooCommerce).

7. Security

Updating the core, theme and plugins, removing vulnerable components, two-factor login for administrators, limiting login attempts, a firewall, correct file permissions and malware scanning.

Cleaning a hacked website

If your website is infected – redirecting to other sites, showing ads, sending spam or flagged by Google as dangerous – we remove the malicious code, close the hole, change all credentials and submit a review request to Google. We then recommend a support plan so it doesn’t happen again.

The result

You receive a before-and-after report with the measured metrics. Our goal for every optimisation is Core Web Vitals in the green zone on mobile, provided the hosting and content allow it – if something prevents it (for example a specific third-party service), we will tell you honestly what it is and what the options are.