What this prompt does
This prompt audits and optimizes a WordPress site for both performance and security, starting from your stated [current_issues]. On performance it covers a caching strategy with object cache via [cache_backend], database optimization including autoloaded options, an image pipeline (WebP, lazy loading, responsive), asset minification and deferral, and CDN configuration with [cdn_provider]. On security it covers a hardening checklist, security headers, login protection via [login_protection], malware scanning, and a backup strategy of [backup_frequency] to [backup_destination].
The structure works because it treats TTFB and PageSpeed as engineering problems with specific levers, not vague advice. Stating [current_issues] anchors the recommendations to your actual numbers. The output is grounded in concrete artifacts — .htaccess rules and wp-config.php constants — so every recommendation maps to a change you can make and verify rather than a generic tip.
When to use it
- Your site has measurable problems like high TTFB or a low PageSpeed score in
[current_issues] - You're setting up object caching with a
[cache_backend]like Redis - You need a CDN configured with
[cdn_provider]and proper browser cache headers - You want login protection via
[login_protection]such as rate limiting and 2FA - You need a real backup strategy at
[backup_frequency]to[backup_destination] - You want security headers and a hardening checklist mapped to concrete config
Example output
Expect a structured audit: a layered caching plan, a database cleanup and autoloaded-options audit, an image optimization pipeline, an asset optimization plan, CDN settings for [cdn_provider], a hardening checklist, security headers (CSP, HSTS, X-Frame-Options), login protection config, a backup plan, and concrete .htaccess rules plus wp-config.php constants to apply each change.
Pro tips
- State
[current_issues]with real numbers — "TTFB > 2s, PageSpeed 45" anchors the advice far better than "site is slow" - Match
[cache_backend]to what your host actually offers; Redis object cache needs the server extension installed - Roll out CSP carefully — the generated header can break scripts, so test in report-only mode first
- Verify
[login_protection]choices like renaming the login URL won't conflict with plugins or your CI - Confirm
[backup_destination]credentials and test a restore — a backup you can't restore isn't a backup - Treat the
.htaccessandwp-config.phpsnippets as a baseline and apply them incrementally, measuring after each change
