Welcome to the WP Ustaad Free Resources Hub. Here you will find battle-tested WordPress speed optimization checklists, copyable production server configurations, security hardening snippets, and development toolkits created by Shariq Moiz. Feel free to use, copy, and implement these blueprints on your client or personal projects.
2026 WordPress Speed & Core Web Vitals Checklist
Essential Production Blueprint
Follow this sequential technical checklist before launching any WordPress website to guarantee sub-second page loads and 95+ PageSpeed scores:
LiteSpeed Cache Production .htaccess Rules
Copy-Paste Performance Snippet
Add these browser caching expiry rules into your root .htaccess file to eliminate Google PageSpeed Insights “Serve static assets with an efficient cache policy” warnings:
## EXPIRES CACHING BY WP USTAAD ##
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/pdf "access plus 1 month"
ExpiresByType text/javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
ExpiresByType application/x-shockwave-flash "access plus 1 month"
ExpiresByType image/x-icon "access plus 1 year"
ExpiresDefault "access plus 2 days"
</IfModule>
## EXPIRES CACHING END ##
WordPress Security Hardening Rules
Block Hackers & Botnets
Drop this block into your .htaccess file to immediately block XML-RPC brute-force attacks and prevent direct access to sensitive configuration files:
## BLOCK XML-RPC & PROTECT WP-CONFIG BY WP USTAAD ##
# 1. Block XML-RPC attacks
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
# 2. Block direct access to wp-config.php
<Files wp-config.php>
order allow,deny
deny from all
</Files>
# 3. Disable directory browsing
Options -Indexes
## SECURITY RULES END ##
Official Web Performance & Security Testing Tools
Benchmark Your Production Site
We recommend benchmarking your WordPress site with these gold-standard diagnostic tools:
- Google PageSpeed Insights – Official Core Web Vitals assessment based on real-world Chrome CrUX data.
- WebPageTest.org – Multi-location waterfall analysis, connection throttling, and TTFB diagnostics.
- Schema.org Validator – Validate your JSON-LD LocalBusiness, Person, and FAQPage structured data.
- SecurityHeaders.com – Audit HTTP security headers (HSTS, Content-Security-Policy, X-Frame-Options).
Want to Share or Feature These Resources?
All snippets and checklists on this page are freely available for developers, educators, and bloggers. If you feature our speed benchmarks or code snippets in your articles or GitHub repositories, please credit WP Ustaad with a link back to https://wpustaad.com/resources/.