98+ without plugins
Full-page caching, Core Web Vitals automatics — image dimensions for CLS, priority hints for LCP — deferred scripts, preloaded fonts, and .htaccess compression that tests itself and rolls back if the site breaks.
Weekly proof
Site-health cards run Google PageSpeed and GTmetrix against your home page every week — Lighthouse scores, LCP, CLS, TBT, report links. Opt-in, keys encrypted, and a failed refresh shows beside — never instead of — the last good result.
New
Every address, counted
Site health checks every public address and counts it by its answer — 200, 301, 404, 500 — with the addresses behind each count one click away, and names the exact fix when a moved site comes up unstyled.
Hardened sign-in
A self-hosted arithmetic challenge — no reCAPTCHA account, no third party — optional TOTP two-factor with recovery codes, escalating lockouts per account and per IP, and a security audit log with every attempt.
One sanitizer boundary
Imported, AI-generated and optimizer-rewritten HTML all pass the same sanitizer — scripts, event handlers and untrusted iframes stripped, legitimate markup kept. SVGs are cleaned; uploads are identified by content, not extension. Every stored credential is encrypted.
Nightly backups
Every file plus the whole database, every night, keeping the last 7 (or 3, 14, 30). One-click restore with the panel available throughout, a safety copy before every restore — and it all works without cron.
Updates from the panel
Upload a small delta package, preview what changes, apply with per-file backup and rollback. Your .env, media and themes are never touched; cumulative packages upgrade from any accepted version.
Made for the $3 host
A web-based setup wizard — no Composer, no SSH — a self-healing installer, and honest degradation everywhere: no cron, no queue worker, no FFmpeg, no Imagick, no intl? Each feature keeps working or says exactly why not, with the fix spelled out in Site health.
WordPress-grade URLs
The full permalink model — blog base, site root, date structures, custom %postname% patterns — with every prior address redirecting automatically when you change it. A redirect manager with prefix rules moves whole branches at once.