Khukuri Speed X-Ray

Khukuri Speed X-Ray is a diagnostic tool, not an optimizer. It never modifies your site, never minifies, never converts images, never caches. It scans, explains in plain English, and tells you exactly what to do — including recommending other well-known free plugins by name when they are the right fix.

What it does

• Measures your server — response time (TTFB, 3-sample median), PHP version, gzip/Brotli compression, page-cache and CDN detection, database health (autoloaded options size, expired transients).
• X-rays your homepage — every script, stylesheet, image and iframe is inventoried and weighed. Each asset is traced back to the plugin or theme that loaded it, so you get a per-plugin cost table: this plugin costs you 412 KB and 9 requests on every page view.
• Audits your images — the 10 heaviest images with size, format, missing lazy-loading, missing dimensions (CLS risk), and a specific fix for each one.
• Identifies third-party weight — YouTube embeds, chat widgets, tracking pixels, remote fonts — with an honest explanation of what each one costs.
• Asks Google — pulls your PageSpeed Insights scores (mobile + desktop) and real-visitor Core Web Vitals (LCP, INP, CLS) from the CrUX field data when available.
• Turns it all into a prioritized fix list — ~30 rules produce plain-English cards sorted critical → warning, each with an explanation a non-technical site owner can follow, a specific recommendation, a difficulty badge, and a conservative impact estimate (always labeled as an estimate).

What it deliberately does NOT do

• It does not optimize anything. Diagnosis only. Your site is never modified.
• It does not compete with your optimization plugins — it detects WP Rocket, LiteSpeed Cache, Autoptimize, Smush and others, and tells you what they already have covered.
• It does not fake precision. Where a measurement is approximate (TTFB measured server-to-self, transfer sizes capped at the 30 largest assets), the report says so.
• It does not name paid hosts, sell anything, or show ads. There is no Pro version.

Privacy

All scanning runs from your own server and Google’s public PageSpeed API. This plugin sends no data to the plugin author. Ever. No telemetry, no phoning home. Scan results live in one table in your own database.

External services

This plugin connects to one external service: the Google PageSpeed Insights API (v5), used to fetch performance scores and Core Web Vitals data for the page you are scanning.

• What is sent: the public URL of the page you choose to scan (your homepage, or any additional page you add in Settings), and, if you supply one, your own free Google API key. No visitor data, no personal data, and nothing from your database is sent.
• When it is sent: only when you, the site administrator, click “Run new scan” in the plugin’s admin page. Nothing is sent automatically, on a schedule, or on the frontend.
• Results are cached locally for 30 minutes to avoid repeat requests.

Service provider: Google LLC — Google APIs Terms of Service, Google Privacy Policy.

No other third-party or remote service is called by this plugin. During a scan, the plugin also inspects the HTML of your own site to identify third-party scripts (e.g. Google Analytics, Google Fonts, YouTube embeds, chat widgets) that your theme or other plugins already load — this is local text analysis of your own page’s markup, not a request to those services.