Performance Analyzer

A single read-only tool that scans your site for performance issues and bottlenecks and returns a detailed, scored report. It is self-contained: no external API, nothing leaves the site. It audits the server and WordPress internals in-process, and analyzes a target page (default: the frontpage) via a same-host-enforced loopback fetch.

Enabled by default. Requires manage_options.

What it does and does not measure. Because PHP cannot run a browser, this is not Lighthouse. There are no real Core Web Vitals (LCP/CLS/INP) or executed JavaScript. The page audit analyzes the HTML, response headers, and asset references. Combined with the server/database/config audit, that surfaces the bottlenecks that matter most on a WordPress site.

`emcp-tools/analyze-performance`

Input (all optional):

url: a page on this site to analyze. External hosts are rejected (no SSRF), and off-host redirects are refused. Defaults to the frontpage.
post_id: analyze this post/page’s permalink. Ignored when url is set.
include_page_fetch: set false to skip the loopback fetch and run the server/database audit only (useful when loopback is blocked). Default true.
deep_assets: reserved for bounded asset-size sampling. Default false.

Returns: a report object:

{
  "target":   { "resolved_url": "...", "post_id": null, "is_front_page": true },
  "summary":  { "score": 84, "grade": "B",
                "counts": { "critical": 0, "warning": 4, "pass": 5, "info": 3 } },
  "sections": { "server": [ ... ], "database": [ ... ], "config": [ ... ],
                "page": [ ... ], "assets": [ ... ] },
  "page_fetch": { "ok": true, "status_code": 200, "response_ms": 420, "total_bytes": 84213 },
  "top_recommendations": [ "ranked, highest-severity actionable items..." ]
}

Each finding is { id, category, label, status (pass|warning|critical|info), value, message, recommendation }. The score starts at 100 and subtracts transparent weighted penalties (critical ≫ warning), banded to an A–F grade.

Capability: manage_options. Read-only. It never writes anything.

What it checks

Server / environment: PHP version, memory_limit / WP_MEMORY_LIMIT, OPcache, persistent object cache, page-cache hints, WP_DEBUG in production, image library (Imagick/GD).

Database: total size + largest tables, autoloaded options size (with the top offenders, a very common bottleneck), post-revision count.

Config: active-plugin count, WP-Cron backlog, WP_DEBUG.

Page (from the loopback fetch): HTTP status, response time, HTML weight, gzip/brotli compression, cache headers.

Assets (parsed from the HTML): render-blocking CSS/JS in <head>, CSS/JS/image counts, images missing loading="lazy", third-party domains.

Graceful degradation

If the loopback page fetch is blocked (common on local or firewalled installs, or behind a self-signed certificate), the tool does not fail. It returns the full server/database/config audit with page_fetch.ok = false and the reason, plus a single warning finding. You still get the most actionable results.