How to Make WordPress Super Fast and Secure Without Extra Plugins

Learn how to improve WordPress performance and security without relying on additional optimization or security plugins. This guide covers server configuration, PHP, OPcache, caching, images, database optimization, security hardening, firewalls, backups, and more.

Table of Contents

1. Introduction
2. Choose a Fast Hosting Environment
3. Use a Modern PHP Version
4. Enable PHP OPcache
5. Configure Server-Level Page Caching
6. Configure Browser Caching
7. Enable Brotli or Gzip Compression
8. Optimize Images
9. Remove Unnecessary WordPress Features
10. Optimize CSS and JavaScript
11. Optimize the WordPress Database
12. Use Redis for Object Caching
13. Secure WordPress Without a Security Plugin
14. Protect wp-config.php
15. Protect Sensitive Files
16. Set Correct File Permissions
17. Disable Directory Listing
18. Disable XML-RPC When It Is Not Required
19. Add Security Headers
20. Secure WordPress Login
21. Configure a Firewall
22. Force HTTPS
23. Configure Reliable Backups
24. Monitor WordPress Files and Server Activity
25. Optimize WordPress Cron
26. Reduce Unnecessary Plugins and Themes
27. Measure Website Performance
28. Test WordPress Security
29. Before and After Performance Comparison
30. Complete WordPress Performance & Security Checklist
31. Conclusion 

Step 1: Introduction

Website speed and security are two of the most important factors for a successful WordPress website. A slow website can lead to poor user experience, lower search visibility, and fewer conversions. At the same time, an improperly secured website can become vulnerable to malware, brute-force attacks, unauthorized access, and data loss.

Many WordPress users install several optimization and security plugins to solve these problems. While plugins can be useful, installing too many plugins can also increase database queries, JavaScript and CSS files, memory usage, and maintenance requirements.

The good news is that you can significantly improve WordPress performance and security without installing additional optimization or security plugins.

In this guide, we will optimize WordPress at the server, PHP, database, web-server, and WordPress-code levels. We will also cover caching, images, security headers, file permissions, login protection, firewall configuration, backups, and other important security practices.

Step 2: Choose a Fast Hosting Environment

WordPress optimization starts with the server.

Even perfectly optimized WordPress code will struggle if the website is running on an overloaded or poorly configured server.

For a production WordPress website, use a properly configured VPS or quality managed hosting environment with sufficient CPU, RAM, SSD/NVMe storage, and a modern PHP version.

Recommended components include:

• Nginx or LiteSpeed/Apache
• PHP 8.2 or newer where compatible
• PHP-FPM
• OPcache
• MySQL 8 or MariaDB
• HTTPS
• HTTP/2 or HTTP/3
• CDN/WAF such as Cloudflare

Avoid choosing hosting based only on storage space. CPU performance, RAM, network latency, disk performance, and server configuration can have a much bigger impact on WordPress response time.

Step 3: Use a Modern PHP Version

WordPress performance depends heavily on PHP because WordPress itself is primarily written in PHP. Running an old PHP version can negatively affect performance and security.

Use a modern, supported PHP version that is compatible with your WordPress core, theme, and plugins.

Before changing the PHP version on a production website:

• Take a complete backup.
• Check theme compatibility.
• Check plugin compatibility.
• Test the website on a staging environment if possible.
• Check PHP error logs after upgrading.

Step 4: Enable PHP OPcache

OPcache is one of the most useful PHP performance features. It stores compiled PHP bytecode in memory so PHP does not have to compile the same files repeatedly.

opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=20000
opcache.revalidate_freq=2
opcache.validate_timestamps=1

The correct values depend on your server's available memory and workload. Do not blindly copy production settings without checking your environment.

Step 5: Configure Server-Level Page Caching

Page caching can provide one of the biggest performance improvements for WordPress. Instead of executing WordPress and PHP for every visitor, the web server can return a previously generated HTML response.

If you are using Nginx with PHP-FPM, FastCGI caching can be configured at the server level.

fastcgi_cache_path /var/cache/nginx levels=1:2
keys_zone=WORDPRESS:100m
inactive=60m
use_temp_path=off;

Dynamic areas should generally be excluded from full-page caching:

• /wp-admin/
• /wp-login.php
• Shopping cart pages
• Checkout pages
• My Account pages
• Personalized pages
• Pages for logged-in users

Step 6: Configure Browser Caching

Browser caching allows visitors' browsers to store static resources such as CSS, JavaScript, images, fonts, and icons.

location ~* \.(css|js|jpg|jpeg|png|gif|webp|avif|svg|ico|woff|woff2)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

For versioned static assets, long cache lifetimes can significantly reduce repeat downloads.

Step 7: Enable Brotli or Gzip Compression

Compression reduces the amount of data that needs to be transferred between the server and the visitor's browser.

Brotli is generally preferred when supported, with Gzip as a widely compatible fallback.

• HTML
• CSS
• JavaScript
• JSON
• XML
• SVG

Step 8: Optimize Images

Large images are one of the most common causes of slow WordPress websites. Uploading a 4000px or 5000px image when the website only displays it at 800px wastes bandwidth and increases page loading time.

Image Optimization Best Practices

• Use WebP or AVIF where appropriate.
• Resize images to the required display dimensions.
• Use responsive images.
• Lazy-load below-the-fold images.
• Do not lazy-load the main LCP image unnecessarily.
• Use correct width and height attributes.
• Compress images before uploading them.

<img
    src="product.webp"
    width="800"
    height="800"
    loading="lazy"
    decoding="async"
    alt="Product">

Step 9: Remove Unnecessary WordPress Features

WordPress includes several features that may not be required for every website. Removing unnecessary functionality can help reduce frontend requests and generated markup.

Disable WordPress Emojis

remove_action('wp_head', 'print_emoji_detection_script', 7);
remove_action('wp_print_styles', 'print_emoji_styles');

Remove WordPress Generator Information

remove_action('wp_head', 'wp_generator');

Disable oEmbed Discovery

remove_action('wp_head', 'wp_oembed_add_discovery_links');
remove_action('wp_head', 'wp_oembed_add_host_js');

Step 10: Optimize CSS and JavaScript

CSS and JavaScript can have a major impact on Core Web Vitals and overall page performance.

CSS Optimization

• Remove unused CSS.
• Minify CSS files.
• Load only the CSS required for a page.
• Reduce unnecessary theme frameworks.
• Prioritize critical styles.

JavaScript Optimization

• Defer non-critical JavaScript.
• Delay unnecessary third-party scripts.
• Remove unused libraries.
• Load scripts only where required.

add_action('wp_enqueue_scripts', function () {
    if (!is_page('contact')) {
        wp_dequeue_script('contact-form-7');
    }
}, 100);

The script handle must match the actual handle registered by the theme or plugin.

Step 11: Optimize the WordPress Database

WordPress databases can become larger over time because of revisions, transients, spam comments, expired data, metadata, and other unused records.

• Post revisions
• Spam comments
• Trash
• Expired transients
• Orphaned metadata
• Large autoloaded options

Check Autoloaded Options

SELECT SUM(LENGTH(option_value)) AS autoload_size
FROM wp_options
WHERE autoload = 'yes';

Always create a database backup before performing database maintenance.

Step 12: Use Redis for Object Caching

Redis can be used as an object cache for WordPress. Frequently accessed data can be stored in memory instead of repeatedly requesting the same information from MySQL.

WordPress
    ↓
Object Cache
    ↓
Redis
    ↓
MySQL

Simply installing Redis does not automatically make WordPress use it. WordPress needs an object-cache integration or drop-in to communicate with Redis.

Step 13: Secure WordPress Without a Security Plugin

WordPress security should not depend entirely on a security plugin. A properly configured server, secure authentication, HTTPS, firewall protection, correct file permissions, regular updates, and reliable backups form the foundation of a secure WordPress installation.

Step 14: Protect wp-config.php

The wp-config.php file contains important WordPress configuration information, including database credentials and authentication keys.

define('DISALLOW_FILE_EDIT', true);

Apache:

<Files wp-config.php>
    Require all denied
</Files>

Step 15: Protect Sensitive Files

Never allow sensitive development, configuration, backup, or source-control files to be publicly accessible.

• .env
• .git
• .gitignore
• composer.json
• composer.lock
• SQL database backups
• Debug logs

<FilesMatch "^(\.env|\.git|composer\.(json|lock)|package(-lock)?\.json)$">
    Require all denied
</FilesMatch>

Step 16: Set Correct File Permissions

Incorrect file permissions can create unnecessary security risks.

• Directories: 755
• Files: 644
• Configuration files: more restrictive permissions where appropriate

Avoid using 777 permissions unless there is a very specific and well-understood reason.

Step 17: Disable Directory Listing

Apache

Options -Indexes

Nginx

autoindex off;

Step 18: Disable XML-RPC When It Is Not Required

If your website does not require XML-RPC functionality, you can disable it.

add_filter('xmlrpc_enabled', '__return_false');

Do not disable XML-RPC blindly because some integrations may depend on it.

Step 19: Add Security Headers

Security headers instruct browsers how they should handle content and can reduce several classes of browser-based attacks.

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Other headers worth evaluating include:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)
• Permissions-Policy

Step 20: Secure WordPress Login

• Use strong and unique passwords.
• Enable two-factor authentication for administrators.
• Avoid predictable administrator usernames.
• Remove unused administrator accounts.
• Disable public registration if it is not required.
• Use HTTPS for authentication.
• Limit abusive login attempts using a WAF or server-level protection.

Step 21: Configure a Firewall

Internet
   ↓
Cloudflare / WAF
   ↓
Server Firewall
   ↓
Nginx / Apache
   ↓
PHP-FPM
   ↓
WordPress
   ↓
MySQL

Only expose services that are actually required. MySQL should generally not be exposed directly to the public internet.

Step 22: Force HTTPS

• Install a valid SSL/TLS certificate.
• Redirect HTTP traffic to HTTPS.
• Ensure WordPress URLs use HTTPS.
• Fix mixed-content warnings.
• Ensure scripts, images, fonts, and APIs use HTTPS.

Step 23: Configure Reliable Backups

Security is not complete without backups.

• Regular database backups.
• Regular full website backups.
• Off-server backup storage.
• Multiple backup versions.
• Regular restore testing.

A backup that has never been tested may not be a reliable backup.

Step 24: Monitor WordPress Files and Server Activity

Server-level monitoring and logs can help identify suspicious activity.

find wp-content/uploads -type f -name "*.php"

Also monitor:

• Unexpected file changes.
• New administrator accounts.
• Suspicious cron jobs.
• Failed authentication attempts.
• Web-server access logs.
• PHP error logs.
• Unexpected server processes.

Step 25: Optimize WordPress Cron

On larger websites, relying on page visits to trigger WP-Cron can create unnecessary work during normal requests.

define('DISABLE_WP_CRON', true);

Then configure a real system cron:

*/5 * * * * php /path/to/wordpress/wp-cron.php >/dev/null 2>&1

Step 26: Reduce Unnecessary Plugins and Themes

• Remove unused plugins.
• Remove unused themes.
• Remove abandoned plugins.
• Replace unnecessarily heavy plugins.
• Check which plugins load assets globally.
• Keep required plugins updated.

A plugin is not automatically a performance problem simply because it is installed. What matters is how much work it performs and how it affects the website.

Step 27: Measure Website Performance

Never assume that a website is fast simply because it feels fast on your own computer. Performance should be measured before and after optimization.

• TTFB - Time to First Byte
• LCP - Largest Contentful Paint
• INP - Interaction to Next Paint
• CLS - Cumulative Layout Shift
• Total Blocking Time
• Total page size
• Number of HTTP requests

Useful testing tools include:

• Google PageSpeed Insights
• Google Lighthouse
• Chrome DevTools
• WebPageTest
• GTmetrix

Step 28: Test WordPress Security

• HTTPS is working correctly.
• HTTP redirects to HTTPS.
• Security headers are present.
• Directory listing is disabled.
• wp-config.php cannot be downloaded.
• Environment files are not publicly accessible.
• .git directories are not publicly accessible.
• MySQL is not publicly exposed.
• Unused administrator accounts are removed.
• Two-factor authentication is enabled.
• Backups are working.

Step 29: Before and After Performance Comparison

A professional optimization project should measure the website before and after making changes.

The numbers above are examples only. Actual results depend on the hosting environment, theme, plugins, content, traffic, database, images, and third-party services.

Step 30: Complete WordPress Performance & Security Checklist

Performance Checklist

• Modern PHP version
• PHP-FPM configured
• OPcache enabled
• Server-level page caching
• Browser caching
• Brotli or Gzip compression
• WebP/AVIF images
• Proper image dimensions
• Optimized CSS
• Optimized JavaScript
• Database optimization
• Object caching where appropriate
• CDN configured where beneficial
• Unnecessary plugins removed

Security Checklist

• HTTPS enabled
• Strong administrator passwords
• Two-factor authentication enabled
• Unused plugins and themes removed
• WordPress file editing disabled
• Sensitive files protected
• Directory listing disabled
• XML-RPC disabled if unnecessary
• Security headers configured
• Firewall enabled
• SSH secured
• MySQL not publicly exposed
• Regular backups configured
• Backup restoration tested
• WordPress, plugins, and themes updated
• Server and application logs monitored

Step 31: Conclusion

Making WordPress fast and secure does not necessarily require installing more plugins.

Some of the biggest performance improvements come from the infrastructure underneath WordPress: a properly configured server, modern PHP, OPcache, page caching, compression, optimized images, efficient database queries, and carefully loaded CSS and JavaScript.

Security should follow the same layered approach. HTTPS, firewall protection, secure authentication, correct file permissions, protected configuration files, security headers, regular updates, and reliable backups provide a strong foundation.

The key is to optimize based on measurements rather than blindly applying every available setting. Test the website before making changes, apply one group of optimizations at a time, and measure the results afterward.

With the right server configuration and a clean WordPress implementation, you can build a website that is both fast and secure while keeping the number of WordPress plugins to a minimum.

Need a Faster and More Secure WordPress Website?

If your WordPress website is slow, consuming too many server resources, or needs security hardening, start by measuring the current performance and identifying the actual bottlenecks.

Server configuration, caching, PHP optimization, database tuning, image optimization, code cleanup, and security hardening can often deliver significant improvements without adding another collection of WordPress plugins.