Qaiyo Access Manager · Free WordPress plugin · Pro version coming soon

A gallery plugin that ships zero dependencies.

Five layouts, a built-in lightbox with deep linking, HappyFiles live sync and one-click ZIP transfer between sites — all free, with no jQuery, no Swiper and no PhotoSwipe on your frontend. Pro adds the agency layer: bulk transfer, site-to-site sync, private client delivery and image-rights tracking.

Free foreverZero JS dependencies11 built-in languages11 built-in languages
Performance SurgeonDiagnosticsBrowser metricsLoopback testscanned 2 min agohttps://example.com/anonymous loopbackRun scanSERVER TIME412 msDB QUERIES118SQL TIME186 msLCP2.41 sCRITICALSlow query on every page load−124 mswoocommerce/includes/class-wc-query.php:412 · SELECT meta_key FROM wp_postmeta …WARNINGjQuery Migrate loaded on the front end−38 mswp-includes/js/jquery/jquery-migrate.min.js · one-click fix availableINFOEmoji detection script enqueued−22 mswp-includes/formatting.php · print_emoji_detection_script
Lightbox, deep linking & share

A link that opens the exact photo

The built-in lightbox is keyboard- and swipe-navigable, shows a counter and captions, and writes the open image into the URL. Send that link and the recipient lands on the same picture, in the same gallery.

  • Per-query timing paired to the calling plugin, file and line via SAVEQUERIES
  • Duplicate-query detection and bloated autoloaded-option detection
  • Per-callback hook timing with plugin attribution — no per-call backtraces
  • Blocking external HTTP calls made while the page renders
  • Asset inventory — every enqueued script and style with its owner
Slowest queries118 queries · 186 ms totalSOURCETIMEWooCommerceincludes/class-wc-query.php:412124 msSlider Revolutioninc_php/framework/db.class.php:8841 msYoast SEOsrc/repositories/indexable.php:20317 ms×7 duplicateidentical get_option('rewrite_rules') calls
Browser metricsheadless render · desktopLCP2.41 sCLS0.04TTFB0.48 sLONG TASKS BLOCKING THE MAIN THREADelementor-frontend214 msjquery + migrate88 mswp-emoji-release41 ms
Real visitor render · real browser metrics

Measured the way your visitors experience it.

A tokened, anonymous loopback request captures the logged-out front-end page — not your admin-skewed view — and a real browser render supplies the Core Web Vitals that go with it.

  • Largest Contentful Paint, Cumulative Layout Shift and long tasks from an actual render
  • Navigation timing and TTFB, next to the server-side numbers that explain them
  • Built-in loopback test tells you immediately if your host blocks self-requests
  • Zero overhead on live traffic/span> — instrumentation only runs for a tokened scan
Safe one-click fixes

Diagnosis is half of it. The other half is a toggle.

The rule engine turns raw measurements into ranked findings, each with an estimated saving — and offers a reversible toggle for the common wins. No source file is ever rewritten.

  • Findings ranked by estimated millisecond saving, so the biggest win is first
  • Every fix is a toggle you can undo — nothing is permanent
  • A tiny must-use scan helper, active only during a scan, removed on deactivation
  • Scans run on your own site — no data is sent to any third party
One-click fixes−98 ms enabledDisable emoji detection scriptwp-emoji-release.min.js · −22 msRemove jQuery Migratejquery-migrate.min.js · −38 msDisable wp-embed.jswp-embed.min.js · −14 msDequeue front-end Dashiconsdashicons.min.css · −24 msStop autoloading a bloated optionelementor_remote_info_library · 412 KB
Every measurement is a rule

Sixteen diagnostic rules in the free plugin. Use only what you need.

Nothing below is held back behind an upsell — every rule ships in the free version on WordPress.org, and an untouched site behaves exactly like stock WordPress.
Slow queryQuery countDuplicate queriesAutoload bloatSlow hookBlocking HTTPAsset countObject cacheBrowser LCPBrowser CLSBrowser TTFBLong tasksjQuery MigrateEmoji scriptwp-embed.jsFront-end DashiconsLoopback test11 languages

Need continuous monitoring? Pro adds seven modules on top — see what Pro adds.

Free vs Pro

What you get in Free, and what Pro adds

Qaiyo Web Performance Surgeon
Funkció Free $0 Pro Coming in 2027
Measurement
Anonymous visitor render via tokened loopback Tartalmazza Tartalmazza
SQL, hook, HTTP and asset attribution to plugin/file/line Tartalmazza Tartalmazza
Real-browser LCP, CLS, TTFB and long tasks Tartalmazza Tartalmazza
Ranked findings with estimated millisecond savings Tartalmazza Tartalmazza
Safe, reversible one-click fixes Tartalmazza Tartalmazza
11 bundled languages Tartalmazza Tartalmazza
Monitoring over time — Pro only
Saved scan history, sparkline trends, regression flags Nem tartalmazza Tartalmazza
Scheduled daily / weekly scans with email alerts Nem tartalmazza Tartalmazza
Multi-URL scanning + aggregated site health score Nem tartalmazza Tartalmazza
Logged-in profile scan (anonymous vs logged-in) Nem tartalmazza Tartalmazza
Per-plugin load breakdown, ranked Nem tartalmazza Tartalmazza
Autoload cleanup with backup before deletion Nem tartalmazza Tartalmazza
CSV export & branded PDF report Nem tartalmazza Tartalmazza
Licensing & automatic updates Nem tartalmazza Tartalmazza
Performance Surgeon Pro

One scan finds the problem. Pro keeps it from coming back.

Free tells you what is slow right now. Pro saves every scan, watches for regressions, scans on a schedule and reports on your whole site — not just one URL.

  • Scan history & trends — sparklines for server time, query count and LCP, with a clear “regressed since last scan” flag per URL
  • Scheduled scans & email alerts — daily or weekly WP-Cron runs, alerting you when a page crosses your threshold
  • Multi-URL scanning — home, shop, product and checkout in one run, side by side, with an aggregated site health score
  • Logged-in profile scan — measure the page a logged-in customer gets, next to the anonymous render
  • Per-plugin load breakdown — SQL + hook time and asset count per plugin, ranked
  • Autoload cleanup — stop autoloading what you do not need, and remove orphaned options with a backup first
  • PDF / CSV export — download history as CSV or hand a client a branded report
Server time · last 8 scansRegressed +64 mshttps://example.com/shop/348 ms412 msPer-plugin load breakdownWooCommerce148 msElementor Pro102 msYoast SEO46 msContact Form 717 ms
Pricing

Simple, transparent pricing — not per-feature, not per-user

No hidden fees. No per-user pricing. No “Agency tier” at triple the price.

Free
$0
Forever free · WordPress.org
Unlimited sites
  • Full diagnostics on a real visitor render
  • 16 diagnostic rules, ranked findings
  • Real-browser LCP, CLS, TTFB, long tasks
  • Five reversible one-click fixes
  • 11 bundled languages
Download from WordPress.org
Pro Yearly
$80
Per year · Renews annually
8 sites
  • Everything in Free, plus:
  • Scan history, trends & regression flags
  • Scheduled scans + email alerts
  • Multi-URL scan & site health score
  • Logged-in profile scan
  • Per-plugin load breakdown
  • Autoload cleanup with backup
  • CSV export & branded PDF report
  • Licensing & automatic updates
Coming in 2027
Pro Lifetime
$240
One time · Pay once, keep forever
24 sites
  • Everything in Pro Yearly, plus:
  • Pay once — no renewals, ever
  • All future Pro modules included
  • Updates for the lifetime of the plugin
  • 3× the site allowance of Yearly
  • Best value from ~3 years on
Coming in 2027
FAQ

Frequently asked questions

No. Measurement only runs for a tokened scan request; every normal page load exits on the first line of the scan helper at zero cost.

They are honest estimates based on measured data, shown under instrumentation. Treat them as a prioritised guide, not a guarantee.

Never. Each fix is a runtime toggle stored in one option — flip it off and your site is exactly as it was.

In a dedicated table in your own database ({prefix}qwps_scan_history). Nothing is sent to any external service, and deleting the plugin removes the table.

The built-in Loopback test tab tells you straight away, with the response code and the reason, so you know it is the host and not the plugin.

Because that is the page your visitors and Google actually get. The admin bar, editor scripts and admin-only queries distort every number you would measure while logged in.

Pro is a standalone, optional add-on that reuses the free plugin’s measurement and rule engine. The free version is fully functional on its own; Pro requires it to be active

“Stop autoloading” is reversible and available for any non-protected option. Deletion is only offered for options that cannot be matched to anything currently installed, and is gated behind a downloadable backup and an explicit confirmation.

Through the Qaiyo Licensing Server and the Qaiyo SDK bundled in Pro. Updates appear on the WordPress Plugins page exactly like any other premium plugin.

Changelog

v1.4.0

Latest
  • New: **Performance score** — every scan now produces a single 0–100 score from its findings and measured server time, shown on a speedometer gauge.
  • New: the score appears as a card in the shared **Qaiyo ecosystem** dashboard widget and settings panel (provided by Qaiyo Admin Booster), alongside the cards other Qaiyo plugins report. Nothing is required for this to work — if Admin Booster is not installed, no card is reported and nothing changes.
  • The score is now the single source of truth across the plugin: the Pro add-on's multi-URL site health score reads the same formula, so the number on the dashboard always matches the number on the scan page.
  • Fixed: uninstalling the plugin left the XML-RPC usage-monitor option behind in the database.
  • Fixed: the score-band label ("Poor" / "Needs work" / "Good") on the Qaiyo ecosystem card could render with glitchy, incorrect-looking glyphs in some browsers. It was placed inside the SVG gauge as a small `` element, which some browser/OS combinations render inconsistently at small sizes; it is now plain HTML text under the gauge instead. The translated strings themselves were always correct — this was a rendering issue, not a translation bug.

v1.3.0

  • Fixed: on sites behind a full-page cache or CDN, a scan could report "no measurements came back" even with the scan helper installed. The scanner now detects and purges known caching plugins before scanning, and — if that still fails — names the caching layer it found instead of a generic message.
  • Fixed: "Turn off XML-RPC" could be offered even when the endpoint was in real use by something outside this site (a publishing app, an automation tool). It now watches for real XML-RPC calls for at least 7 days before recommending anything, and never recommends it while recent real traffic is seen.
  • Fixed: findings for a page builder's own rendering step (e.g. Elementor building the page from its saved layout) recommended adding conditional tags to code you cannot edit. These are now labelled as the builder's own baseline cost, with guidance that is actually actionable.
  • Fixed: a caching plugin writing its own page cache after render could be flagged as "slow" with advice to cache its own output. This is now recognised as the cache doing its job, not a bug.
  • Fixed: WordPress's own wp_enqueue_scripts() dispatcher could appear as a separate "slow hook" finding, double-counting time already reported under the individual plugin callbacks it fires.

v1.2.0

  • New one-click fix: remove the "?ver=" query string from static assets, for proxies and CDN setups that will not cache a versioned URL. Off by default and reversible — the version is also what busts caches after an update, so turn it on only if your caching layer needs it.
  • Fixed: the Qaiyo plugin group in the admin sidebar could break apart on sites where another plugin (WooCommerce, Elementor, an admin-menu tool) reorders the admin menu.

v1.1.0

  • New: image checks — oversized images (with the wasted kilobytes) and images rendering without width/height.
  • New: duplicate asset detection — the same library loaded by two different plugins, or the same file behind two handles.
  • New: large-DOM finding, based on the element count from the real browser render.
  • New: "Server & environment" tab showing WordPress's own Site Health performance checks (object cache, page cache, PHP/database version, cron, debug mode).
  • New: each scan is compared with the previous scan of the same URL, so you can see whether a change helped.
  • New one-click fixes: remove the legacy RSD/Windows Live Writer head links, turn off XML-RPC (only offered when nothing appears to need it), and stop self-pingbacks.

v1.0.1

  • Deferred the scan/measurement classes to admin and scan requests only, so normal front-end page loads stay lighter.
  • The enabled-fixes option is now autoloaded, removing an extra database read on every front-end request.
  • Aligned all internal version constants with the plugin header and tidied a few developer-facing code annotations.
  • Added a SECURITY.md with a vulnerability-disclosure contact.

v1.0.0

  • First public release on WordPress.org.
  • File- and function-level performance attribution for SQL, hooks, HTTP and assets, measured on a real anonymous visitor render via a tokened loopback.
  • Real-browser metrics (LCP, CLS, long tasks, navigation timing) captured from an actual render.
  • Rule engine with ranked findings, estimated time savings, and safe reversible one-click fixes.
  • Tabbed admin page (Diagnostics, Browser metrics, Loopback test) with the Qaiyo design system.
  • Bundled translations for 11 languages.
  • Clean uninstall: removes the plugin's option, cached transient and scan-helper on deletion.
Explore Qaiyo plugins

One family of plugins, one design system, built the same way

Every Qaiyo plugin is GPL licensed, ships 11 languages and looks and behaves the same inside your admin. Install only what you need.

Qaiyo Access Manager

Decide which role and which user sees each plugin and post type — in wp-admin, the REST API and the front end.

Qaiyo Admin Booster

Page collections, smart filters, bulk page creation and upload controls — a back end that keeps up with you.

Qaiyo Clean Gallery

Dependency-free galleries: five layouts, a built-in lightbox, HappyFiles live-link and one-click ZIP export.

Qaiyo Smart Appointment

Booking with fluid, gap-based slots — mixed durations pack into the time you actually have free.

Qaiyo Social Video Embed

TikTok, YouTube Shorts and Vimeo in one mixed gallery — click-to-play, channel feed import, no API key.

Qaiyo Testimonials

Six built-in testimonial layouts with a visual Display Builder, Schema.org rich snippets and a Gutenberg block.

Qaiyo Text Marquee Slider

Infinite scrolling ticker strips: up to three rows, per-row direction, icons, separators and fade edges.

Qaiyo Web Performance Surgeon

File- and function-level performance diagnostics on a real visitor render, with safe one-click fixes.