WordPress Performance and Security Hardening

What this prompt does

This prompt audits and optimizes a WordPress site for both performance and security, starting from your stated [current_issues]. On performance it covers a caching strategy with object cache via [cache_backend], database optimization including autoloaded options, an image pipeline (WebP, lazy loading, responsive), asset minification and deferral, and CDN configuration with [cdn_provider]. On security it covers a hardening checklist, security headers, login protection via [login_protection], malware scanning, and a backup strategy of [backup_frequency] to [backup_destination].

The structure works because it treats TTFB and PageSpeed as engineering problems with specific levers, not vague advice. Stating [current_issues] anchors the recommendations to your actual numbers. The output is grounded in concrete artifacts — .htaccess rules and wp-config.php constants — so every recommendation maps to a change you can make and verify rather than a generic tip.

When to use it

• Your site has measurable problems like high TTFB or a low PageSpeed score in [current_issues]
• You're setting up object caching with a [cache_backend] like Redis
• You need a CDN configured with [cdn_provider] and proper browser cache headers
• You want login protection via [login_protection] such as rate limiting and 2FA
• You need a real backup strategy at [backup_frequency] to [backup_destination]
• You want security headers and a hardening checklist mapped to concrete config

Example output

Expect a structured audit: a layered caching plan, a database cleanup and autoloaded-options audit, an image optimization pipeline, an asset optimization plan, CDN settings for [cdn_provider], a hardening checklist, security headers (CSP, HSTS, X-Frame-Options), login protection config, a backup plan, and concrete .htaccess rules plus wp-config.php constants to apply each change.

Pro tips

• State [current_issues] with real numbers — "TTFB > 2s, PageSpeed 45" anchors the advice far better than "site is slow"
• Match [cache_backend] to what your host actually offers; Redis object cache needs the server extension installed
• Roll out CSP carefully — the generated header can break scripts, so test in report-only mode first
• Verify [login_protection] choices like renaming the login URL won't conflict with plugins or your CI
• Confirm [backup_destination] credentials and test a restore — a backup you can't restore isn't a backup
• Treat the .htaccess and wp-config.php snippets as a baseline and apply them incrementally, measuring after each change