Description
Boosted gives you fast WordPress pages with page caching, image optimization,
CSS/JS handling, an SEO and keyphrase panel, redirects, and a GDPR-style cookie
banner. Core performance, caching, image optimization, SEO, redirects, and
cookie consent features are available free, with optional Pro upgrades for
advanced optimization capabilities.
Open the Cache tab and turn on WP_CACHE – Boosted adds it to wp-config.php
for you. If the file is not writable, the tab shows the one line to add by
hand.
External services
Boosted contacts the third-party services listed below. Every one of them is
reached only after you configure it or explicitly request its suggestions, so a fresh install with
nothing filled in contacts nothing at all. Each entry says what triggers the
request, exactly what is sent, and whether it happens in the WordPress admin or
during a visitor’s page load.
Datamuse related wording
Endpoint: https://api.datamuse.com/words
When: only when an authorized editor clicks Suggest related wording” in the
Boosted SEO Related Wording box on a post or page. No background queries.
What is sent: the phrase explicitly entered (2–100 characters), vocabulary
language (English or Spanish), and a result limit. Post content, titles,
descriptions, visitor data and WordPress credentials are not included.
Where: server-side from the editor. WordPress caches results per user for
15 minutes. Suggestions never change metadata automatically.
Datamuse temporarily logs queries; its documentation says logs are discarded
at the end of the following day. Suggestions are not search-volume data.
Documentation, usage conditions and privacy: https://www.datamuse.com/api/
Datamuse announces mandatory API keys from January 1, 2027. This integration
currently uses its keyless endpoint; authentication will need updating when
that requirement takes effect. Service failures leave core SEO unaffected.
Google PageSpeed Insights API
Endpoint: https://www.googleapis.com/pagespeedonline/v5/runPagespeed
When: only when an administrator runs a PageSpeed measurement, and only once you
have saved your own Google API key. With no key saved, no request is made.
What is sent: the public URL being tested, and your own API key.
Where: the WordPress admin only. Visitors never trigger this.
Google OAuth 2.0 – signing in for Analytics reporting
Endpoint: https://oauth2.googleapis.com/token
When: only once you have saved a GA4 Property ID and a Google service-account
key, and only when a page or widget actually uses the [boosted_ga total_views]
shortcode. Without either field, or without the shortcode on a page, no request
is made.
What is sent: a signed assertion (a JWT) proving the request comes from your own
service account. It is signed with the private key you saved; the key itself is
never sent.
Where: during a front-end page load, because that is when the shortcode renders.
No visitor data is included in the request, and the answer is cached for an hour
so a page showing the number does not sign in on every visit.
Google Analytics Data API
Endpoint: https://analyticsdata.googleapis.com/v1beta/properties/PROPERTY_ID:runReport
(PROPERTY_ID is the GA4 Property ID you saved.)
When: immediately after the sign-in above, and under the same conditions.
What is sent: your GA4 Property ID and a date range. Nothing about the visitor
whose page load happened to trigger it.
Where: during a front-end page load, as above. The answer is cached for an hour,
and a failure for fifteen minutes, so a broken setup does not retry on every
visit.
Google reCAPTCHA – verification
Endpoint: https://www.google.com/recaptcha/api/siteverify
When: when somebody submits a comment on your site, and only once you have saved
both a reCAPTCHA site key and a secret key. Administrators and other users who
can moderate comments are not verified.
What is sent: the reCAPTCHA response token from the visitor’s browser, your
secret key, and the visitor’s IP address.
Where: this one affects your site’s visitors, not just administrators. A visitor
who posts a comment has their IP address sent to Google. If you switch reCAPTCHA
on, say so in your own privacy policy.
Google reCAPTCHA – script
Endpoint: https://www.google.com/recaptcha/api.js
When: loaded in every visitor’s browser on pages with a comment form, once
reCAPTCHA is configured. Google sets its own cookies and collects its own data
from that point; Boosted is not party to it.
Where: your visitors’ browsers.
Google Tag Manager and Google Analytics (gtag)
Endpoints: https://www.googletagmanager.com/gtag/js,
https://www.googletagmanager.com/gtm.js, https://www.googletagmanager.com/ns.html
When: loaded in visitors’ browsers only once you have saved a GA4 Measurement ID
or a Google Tag Manager container ID. With neither saved, no script is added.
What is sent: whatever Google’s own script collects, which is Google’s to
describe rather than Boosted’s. Boosted adds the tag and nothing else.
Where: your visitors’ browsers.
For all of the Google services above:
Privacy policy: https://policies.google.com/privacy
Terms of service: https://policies.google.com/terms
Google APIs terms of service: https://developers.google.com/terms/
Freemius – licensing, opt-in usage tracking and update delivery
Endpoint: https://wp.freemius.com and https://api.freemius.com
When: on activation WordPress shows the Freemius opt-in prompt. Only if you
opt in does the plugin contact Freemius: on activation/deactivation, on
licence activation or check, and on the scheduled update check.
What is sent: site URL, WordPress and PHP versions, plugin version, site
language, admin email address only if you opted in, and licence state when a
licence key is entered. No page content, no visitor data, no settings values,
no secrets.
Where: the WordPress admin only. Visitors never trigger this. You can opt out
at any time from the Freemius account menu; the plugin keeps working with
free behaviour.
Privacy policy: https://freemius.com/privacy/
Terms of service: https://freemius.com/terms/
Cloudflare API – cache purge sync (Boosted Pro only)
Endpoint: https://api.cloudflare.com/client/v4/zones/{zone ID}/purge_cache
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Cloudflare Cache Synchronization and enter your own Cloudflare
zone ID and API token.
When: after Boosted clears pages from its own page cache – when a post is
published, updated or deleted, or when the whole cache is cleared.
What is sent: the URLs of the pages that were cleared (or a request to purge
the whole zone), and your Cloudflare API token as the authorization header. No
page content, no visitor data.
Where: from your server to Cloudflare. Visitors never trigger this.
Privacy policy: https://www.cloudflare.com/privacypolicy/
Terms of service: https://www.cloudflare.com/terms/
AI provider through WordPress – SEO metadata drafts (Boosted Pro only)
This code is not in the free plugin. It applies to Boosted Pro on WordPress 7.0
or later, only after you switch on the AI Meta Description & Title Assistant and
connect an AI provider yourself under Settings > Connectors (for example
Anthropic, Google or OpenAI, each with its own WordPress plugin and your own API
key). Boosted does not contact any AI service itself and never holds an API key;
it asks WordPress’s built-in AI client, which sends the request to the provider
you connected.
When: when you generate drafts under SEO > Automation, up to 10 posts at a time.
What is sent: for each post, its ID, title, focus keyphrase and up to the first
1,500 characters of its text (without HTML, shortcodes or links), plus your site
name. No visitor data. The drafts that come back change nothing until you
approve them.
Where: from your server to the provider you connected. Its terms and privacy
policy are those of that provider.
Google Tag Manager – local copy of gtag.js (Boosted Pro only)
Endpoint: https://www.googletagmanager.com/gtag/js?id={your measurement ID}
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Local Analytics Hosting while Boosted adds Google Analytics to your
site.
When: once a day, from WP-Cron.
What is sent: your Google Analytics measurement ID, to download the current
gtag.js. The file is stored in your uploads folder and served from your site in
place of Google’s copy. No visitor data is sent by the download.
Where: from your server to Google. What Google Analytics itself collects from
visitors is unchanged and is described under Google Tag Manager and Google
Analytics (gtag)” above.
Privacy policy: https://policies.google.com/privacy
Terms of service: https://policies.google.com/terms
What does not leave your site
Cache preloading and the cache self-test request your own pages, on your own
domain, and nowhere else.
Your PageSpeed API key, your reCAPTCHA secret and your Google service-account key
are stored on this site only. They are never shown back to you after saving and
are excluded from a settings export.
The Copy for AI button on Console Logs puts text on your clipboard for you to
paste somewhere yourself. It contains no keys, no settings values and no server
paths, and Boosted sends it nowhere.
External fonts and optional local copies
Free does not download external font stylesheets or font files on the server.
If an administrator enables font resource hints or CSS external preconnect,
Boosted may add a browser preconnect or DNS-prefetch hint for an external
stylesheet already enqueued by the theme or another plugin. This connects the
visitor’s browser to that host and can disclose the visitor’s IP address;
Boosted does not add the third-party stylesheet itself.
Premium can make server-side requests only after an administrator enables Font
Optimization and either Self-host Fonts or Optimize External Font CSS, then
runs a font rebuild. The rebuild examines external font stylesheets previously
found during site analysis. Only Google Fonts and Bunny Fonts stylesheets are
eligible; Boosted downloads those, and it copies
font files locally only when Self-host Fonts is enabled. The request sends the
full stylesheet or font-file URL (including its query), the site’s server IP,
and a browser-like User-Agent. It sends no WordPress credentials or visitor IP.
Cached copies are stored under wp-content/cache/boosted/fonts/.
Google Fonts: https://fonts.googleapis.com and https://fonts.gstatic.com.
Premium may download and locally cache their openly licensed fonts after the
explicit settings and rebuild above. Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
Bunny Fonts: https://fonts.bunny.net. Premium may download and locally cache
its openly licensed fonts after the same explicit settings and rebuild.
Terms: https://bunny.net/tos/ Privacy: https://bunny.net/privacy/
Adobe Fonts (Typekit): https://use.typekit.net. Monotype/Fonts.com:
https://fast.fonts.net. Boosted may recognize these existing external
stylesheets and may add a preconnect hint if that setting is enabled. Boosted
does not download or self-host their font files; the original provider or
theme remains responsible for serving them. Adobe’s standard web-font terms
prohibit self-hosting; Monotype fonts require the site’s own applicable
license and usage reporting. Adobe terms:
Click to access Adobe-Fonts-Product-Specific-Terms-en_US-20240618.pdf
Adobe privacy: https://www.adobe.com/privacy/policies/adobe-fonts.html
Monotype terms: https://www.monotype.com/legal/terms-use
Monotype privacy:
https://www.monotype.com/legal/privacy-policy/website-use-privacy-policy
Any other external font or icon-font stylesheet (for example one a theme loads
from an icon CDN) is treated generically as an external stylesheet. Boosted
does not identify its provider, never requests it on the server and never
copies its files; at most it may add the browser preconnect hint described
above when the administrator enables that setting.
Boosted itself never enqueues a stylesheet or font file from any of the font
providers above. It only works with stylesheets the theme or another plugin
has already added to the page.
Source Code & Build Instructions
All script and style assets shipped in Boosted are provided in full human-readable format.
The uncompiled source files are included directly in the plugin package inside assets/src/:
- Tailwind CSS admin styles source:
assets/src/tailwind.css
Build command:npx tailwindcss -i assets/src/tailwind.css -o assets/tailwind.css - Consent runtime source:
assets/src/consent-runtime.js
Runtime file:assets/consent-runtime.js - Admin script:
assets/admin.js(written and maintained directly as plain, non-minified JavaScript) - Minified admin copies:
assets/admin.min.jsandassets/tailwind.min.cssareassets/admin.jsand
assets/tailwind.css with comments and whitespace removed (JShrink for the script, matthiasmullie/minify
for the stylesheet). Both sources ship beside them, and WordPress loads the sources when SCRIPT_DEBUG is on. - Freemius pricing bundle:
vendor/freemius/freemius-sdk/assets/js/pricing/freemius-pricing.js
Readable upstream source and build instructions: https://github.com/Freemius/pricing-page
Boosted-authored JavaScript is supplied in readable form. The bundled Freemius
pricing script is third-party compiled code; its upstream source is linked above.
Installation
- Upload the
vysedigital-boosteddirectory to/wp-content/plugins/. - Activate Vyse Digital Boosted in WordPress.
- Open the Cache tab and turn on WP_CACHE – Vyse Digital Boosted adds it to wp-config.php for you.
- Configure the plugin from the top-level Boosted menu in WordPress admin.
- Optional – Critical CSS (CSS Loading tab): below it, turn on Defer non-critical CSS” and Critical CSS”. Instead of a headless browser or an external service, Boosted fetches each page with plain PHP and extracts the above-the-fold styles from the page’s own stylesheets – no API key, no Node runtime, nothing to install. It works on every host, and the full sheets are still deferred (not discarded) for everything below the fold.
FAQ
-
What does caching actually do?
-
The first time someone opens a page, Boosted saves the finished HTML to disk.
Every visitor after that is handed that file by a drop-in that runs before
WordPress loads, so no theme, plugin or database query runs at all. Logged-in
users always get a freshly built page, so you never see a cached copy of your
own admin bar. -
Nothing is being cached. What should I check?
-
Three things, in order. Developer mode: if it is on, caching is paused on
purpose. WP_CACHE: the Cache tab shows whether define( ‘WP_CACHE’, true ) is in
wp-config.php, and offers to add it. Another optimization plugin: if one already
owns the caching layer, the Compatibility tab names it, and running two page
caches is worse than running one. -
What changes between Safe, Balanced and Advanced?
-
How much Boosted is willing to rearrange your front end. Safe caches and
minifies but never defers a script, so nothing can break from load order –
start here on a site with lots of plugins. Balanced adds script deferral and CSS
combination. Advanced pushes both further. If something breaks after a change,
step down one level rather than turning everything off. -
Does Boosted minify or combine my JavaScript?
-
It can minify, and it is off by default. The JavaScript page offers opt-in
minification using a parser-backed minifier; Boosted keeps an original copy of
every script and falls back to it on any failure, so nothing is ever rewritten
in place. Scripts are never combined – combining reorders
execution and is the classic way a speed plugin takes a site down – that switch
stays off. Boosted defers scripts instead, which is reversible and does not
rewrite your code. CSS is combined and minified, because the risk there is far
smaller. -
I am working on the site and keep seeing the old version.
-
Turn on developer mode in Settings. It pauses page caching and preloading, lazy
loading, HTML minification, CSS combination, script deferral and the LCP preload
hint, all at once and site-wide, while leaving every one of your settings
exactly as it is. Turn it off when you are done and everything comes back. -
Will this replace or delete my original images?
-
Never. Boosted writes a converted copy next to the original and leaves the
original untouched, so the file in your Media Library is always the file you
uploaded. If you deactivate the plugin, your images are exactly as they were. -
I optimized an image but no WebP or AVIF appeared.
-
Usually the server cannot make that format. The Images tab lists what your PHP
install supports – GD or Imagick, and which formats each can write. AVIF in
particular needs a recent build, and plenty of hosts do not have it. If the
format is supported, the image is probably still queued. -
How long does the queue take?
-
Deliberately longer than it could. Boosted converts three images per cron pass
and reschedules about a minute later, because converting a whole media library
at once is how an optimization plugin gets a site suspended for CPU use. An
image that fails is retried up to three times with a widening gap between
attempts, then left alone rather than retried forever. You can pause and resume
the queue from the Images tab. -
What is lazy loading doing to my images?
-
Images below the fold are told to load only as the visitor approaches them,
which is where most of the saving is. The one image Boosted measures as your
largest visible element is excluded on purpose and given loading priority
instead – lazy-loading your hero image makes the page score worse, not better.
Width and height are filled in where they are missing so the layout does not
jump as images arrive. -
Where do I set the SEO title and description?
-
On the post itself. In the block editor it is the Boosted SEO panel in the
sidebar; on a screen still using the classic editor it is a meta box below the
content. Boosted shows one or the other, never both on the same post, so there
is only ever one place holding the real value. -
What does Boosted add to my pages?
-
On single posts and pages: the title and description, an Open Graph title for
link previews, a canonical URL, and structured data describing the page for
search engines. Archives, category listings and the blog index are left alone
– those are the pages where a guessed description does more harm than none. -
Will this fight with Yoast or Rank Math?
-
Boosted steps aside on the title: if another plugin has already set one, it is
left alone. Even so, running two SEO plugins means two sources for the same
tags. Pick one to own titles and descriptions, and use Boosted for the rest. -
No. Nothing about consent is switched on until you switch it on, because a
banner appearing on a site without warning is its own kind of problem. Turn it
on from the Cookie Consent tab when you are ready. -
How does blocking actually work?
-
Third-party scripts and embeds you have registered are held back before they
load, not cleaned up afterwards. Until a visitor approves the matching category,
the tag simply never runs, so it sets no cookies. The Cookie Consent tab ships
patterns for the common ones – Analytics, Meta Pixel, YouTube, Vimeo, Google
Fonts – and you can add your own. -
What is stored in the audit log?
-
For each answer: when it was given, which categories were accepted, and a
one-way hash standing in for the visitor rather than their raw IP address –
enough to show a regulator you collected consent, without building a list of who
visited. It only records while audit logging is on, and you can export it as CSV
or clear it. -
Why can I not use GA4 and Tag Manager together?
-
Because a container that also loads the Analytics tag counts every pageview
twice, and the numbers look fine until you try to trust them. Boosted makes it a
choice: add the Measurement ID directly, or manage Analytics inside Tag Manager.
If you are already using GTM for anything else, do it there. -
Are my keys included when I export my settings?
-
No. The reCAPTCHA secret, the Analytics service account file and the PageSpeed
key are saved on this site and left out of every export, so a settings file you
email or commit to a repository cannot leak them. Importing settings clears
those fields rather than filling them with someone else’s, and you re-enter them
here. -
How do I show a view count on the site?
-
Use the [boosted_ga total_views] shortcode once reporting is connected.
Connecting it is free; printing the number is also free, and until then the
shortcode renders whatever fallback you give it.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Vyse Digital Boosted – Site Optimization, Cache, SEO & Cookie Consent” is open source software. The following people have contributed to this plugin.
Contributors
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.8.161
- Fixed the not allowed to access this page” screen after activating the plugin. The Freemius opt-in screen now appears as described under External services, and allowing or skipping it opens the Boosted dashboard.
- Settings now save in place on every screen, with a spinner on the Save button and no popup. A message appears only if something could not be applied.
- Fixed the unsaved-changes warning not coming back after the first save.
- Cache Rules now take effect: Do Not Cache URIs, cookies, user agents, query strings, categories and tags, and Cache commenters. Removed the rules that had no effect.
- Visitors who left a comment are no longer served, or stored into, the shared page cache unless Cache commenters is on.
- Visitors arriving with tracking parameters (utm_*, fbclid, gclid and similar) are now served the cached page.
- Saving SEO settings now clears the page cache.
- Fixed an error when running Analyze now on the JavaScript screen; it now says so when there is no cached page to analyze.
- Analyze now on the CSS screen waits until the analysis has really finished before showing the results.
- The Plugins screen shows View details for Boosted instead of Visit plugin site.
- Fixed the confirmation notices that never appeared after clearing or rebuilding caches and running an analysis.
- The admin screens are no longer loaded on visitor page views, and the two largest admin files have minified copies.
- Pro: added Separate Mobile Cache, Logged-in User Caching (private copies per login session), Scheduled Cache Warming and Cloudflare purge sync.
- Pro: added the maintenance tools: Heartbeat API Controller, Database Table Cleanup, Automatic Configuration Backups (kept in the site’s own database) and Stuck Task Recovery.
- Pro: added Automated Preconnect and Delay Third-Party Trackers.
- Pro: added Google News and Video sitemaps, blocking of AI training crawlers in robots.txt and source links in RSS feeds.
- Pro: added Global Privacy Control recognition, the scheduled cookie scan with an email about new unblocked trackers, click-to-load placeholders for blocked embeds and a Do Not Sell or Share” link shortcode.
- Pro: the redirect automation switches now save, and redirect rules can be written to .htaccess (Apache and LiteSpeed) or an NGINX include file.
- Pro: added AI-written SEO title and description drafts through the AI provider connected in WordPress (7.0 and later), orphan content in the site audit, scheduled audits with a score history and email alerts, and a PDF audit report.
- Pro: added brand watermarks (and a play icon for pages with video) on social share images.
- Pro: added Local Analytics Hosting for gtag.js and Critical Request Chain Preload.
- Pro: Remove unused JavaScript now removes the comment reply, embed, media player, lightbox and masonry scripts on pages that do not use them.
- Pro: added regional notices for US state privacy laws, the banner A/B test with real counts, 30-day consent analytics from the audit log, and the PDF consent audit report.
2.8.157
- Consent blocking now only changes attributes on tags WordPress prints; no script or link tags are built by hand.
- Removed third-party icon font hosts from the font provider list.
- File locations are resolved through WordPress functions; the content directory is used only for the advanced-cache.php drop-in.
- Inline CSS and JavaScript that could close their own element are left linked instead of inlined.
- Report downloads send a fixed content type and nosniff.
- Fixed image restore, compression temp files and resized image dimensions.
- Fixed missing SEO automation tables on new installs and removed them on uninstall.
2.8.153
- Resolved all WordPress.org review findings.
- Removed arbitrary custom CSS and custom JavaScript code injection fields from Cookie Consent.
- Updated sabberworm/php-css-parser to v9.5.0 and removed non-permitted bin scripts from vendor dependencies.
- Added uncompiled source code and build instructions in assets/src/ for transparent open-source review.
- Replaced custom shortcode with prefixed vysedigital_boosted_cookie_declaration.
- Adjusted admin dashboard menu position to avoid competing with WordPress core navigation.
- Hardened data escaping, input sanitization, and nonce verification.
2.8.145
- Corrected Free and Premium package detection and update-source reporting.
- Guided Free users to install the separate Premium package after purchase; retained license activation in Premium.
- Moved executable admin scripts and styles into WordPress-enqueued assets.
2.8.135
- Updated Boosted Upgrade submenu item in WordPress admin sidebar to use brand primary color (#6366f1) and external link icon.
2.8.128
- Added a connected SEO platform with typed editor metadata, bounded title templates, canonical and robots controls, social overrides, breadcrumbs, Schema.org graphs, and taxonomy and author metadata.
- Added paginated XML sitemaps with legacy URL compatibility, indexability exclusions, and automatic ownership handoff when another SEO plugin controls output.
- Added preview-first SEO imports for Yoast SEO, Rank Math, and All in One SEO, compare-before-undo health fixes, indexed redirects and 404 statistics, and incremental internal-link indexing.
- Hardened page-cache eligibility and invalidation, outbound HTTP requests, cookie-consent retention and geo overrides, privileged custom code, rollback permissions, and multisite cache behavior.
2.8.119
- Renamed to Vyse Digital Boosted (slug vysedigital-boosted) to clear the directory review name conflict.
- Footer cache marker no longer carries branding or an external link.
- Review link no longer preselects a rating.
- Freemius licensing/usage disclosure added to External services.
- Consent custom CSS/JS now go through the enqueue API.
2.8.87
- Replaced the external-API Critical CSS service with a pure-PHP generator: above-the-fold CSS is now extracted on your own server from the page’s own stylesheets, so no API key, endpoint, Node runtime or external service is involved at all. The Critical CSS generator selector is gone (one backend now) and the switch works on every host.
- Removed the local Node.js backends: the Node runner scripts, the
critical/Playwright npm dependency and the Force-Node generator option no longer ship, so nothing in the plugin requires a Node.js runtime on the server.
2.8.63
- Remove unused CSS is now real on the front end: candidate selectors are stripped from the CSS visitors actually download. Sheets folded into a combined+minified bundle are cleaned before bundling; sheets that can never combine (a theme stylesheet carrying inline customizer CSS is the common one) are served from a cleaned cached copy. Source files are never touched – cleaned output lives in wp-content/cache/boosted/css/.
- Selectors to keep” in the Remove-unused panel: any candidate whose selector contains a listed fragment (for example :hover” or is-open”) is kept forever, protecting states static analysis cannot see.
- The protection rules are conservative: @font-face, @keyframes, @charset and unparseable/malformed sheets are left untouched, and a sheet whose cleaned result is empty keeps its original body rather than going blank.
- Defer/preload of non-critical CSS now points at the URL the page actually serves (external-copy or cleaned hrefs), so the browser preloads the optimized file instead of the original.
2.8.60
2.8.60
- Unused CSS: fixed handle discovery analyzing every stylesheet WordPress has registered – including all core block styles and editor variants that the analyzed page never loads – instead of only the stylesheets the page actually prints. Candidate lists were massively inflated with selectors from stylesheets visitors never receive; they are now scoped to the page’s real stylesheets.
- Unused CSS: new Static analysis mode – pure PHP, no browser, works on every host – is now the default. It compares each stylesheet against the page’s HTML and reports selectors that no element on the page can match; review candidates before removing anything, because it cannot see states that JavaScript or pseudo-classes add. Browser coverage (Node or an external API) remains available as the more accurate option.
- Critical CSS: the switch is hidden when no coverage backend exists on the server (no Node.js runtime and no external API endpoint configured), so there is no longer a control that can be turned on without anything happening behind it. When shown, its description names the actual backend requirement.
- Fixed the external API endpoint option being read as a boolean instead of a URL.
2.8.58
- Unused CSS: Analyze now” now shows a sticky progress bar (page X of Y”) while the background run works, and reloads when it finishes. The panel names the active coverage backend and tells you exactly what is missing when no backend can run – a Node runtime without the Playwright package no longer fails silently, and the panel points to the manual install steps.
- Node-backed features (Unused CSS analysis and the local
criticalpackage backend) are hidden from the admin screens until their coverage backends are available; re-enable them with the BOOSTED_ENABLE_NODE_BACKENDS constant or the boosted_node_backends_enabled filter.
2.8.57
- Unsaved changes detection on every settings screen: as soon as you modify anything, the save button reads Save and Apply Changes” and a Cancel button appears beside it; leaving the page with unsaved changes triggers the browser’s own leave warning, saving or cancelling clears the state.
2.8.49
- CSS Combining and Minification now actually run on the front end. The combiner previously read a queue that WordPress fills only after the print-styles step, so no bundle was ever written and visitor-facing minification was dead. It now reads the live queue, cuts it into same-media runs, splices each bundle at its own position so the cascade is preserved, and marks folded handles done so nothing prints twice.
- Bundled the two CSS runtime libraries (matthiasmullie/minify and sabberworm/php-css-parser) inside the plugin so Minify CSS and CSS parsing work on every install, not just development copies.
2.8.45
- CSS Loading panel: Critical CSS, Font Optimization, Unused CSS, and JS exclusion controls all on a single screen with live switches and status badges.
- Unused CSS: samples your home page and latest content, intersects browser coverage, and reports removal candidates without editing source stylesheets. Analysis runs in the background through WP-Cron.
- CSS Loading: defer, optimize, and remove unused styles with generator selection (Auto / Force Node / Force API) and per-handle exclusion lists.
2.8.12
- Everything in Boosted is free. Console Logs, the [boosted_ga total_views] shortcode and Redirects no longer ask for a licence, and there is nothing left to ask: the paid tier, the Get Pro buttons, the Licence screen and the bundled licensing SDK are all gone, which also takes about 3.9 MB off the download.
- Every redirect you have saved is now live. A site holding forty rules with thirty of them marked “Not running” runs all forty after this update. Nothing is added and nothing is reordered – the dormant rules simply start firing, so it is worth a look at the Redirects screen if you had stopped counting.
- Nothing you saved was deleted. Your consent settings and consent log table are untouched in the database, and stored SEO keyphrases are still registered, so the editor panel finds them where they were left. Everything works exactly as before – no add-on required.
- The Cookie Consent banner is live on every site. The banner prints, audit logs record, and registered scripts stay blocked until consent is given – all without a licence.
- The Boosted SEO / Readability panel is back with its full scoring lists, working on every site and every plan – keyphrase analysis, readability and the rest of the checks all run.
- The Performance screen offers a downloadable report again – Markdown and PDF, on every site. Copy for AI, on the same screen, is unchanged.
Entries before 2.8.12 describe a paid tier that no longer exists. They are left
as they were published, because a changelog is a record of what shipped rather
than a description of what is installed today. Nothing in Boosted is paid for.
2.8.11
- Cookie Consent is now yours to build without a licence. Every field on the screen works and saves – wording, colours, position, categories, the blocking rules, and the Enable banner switch itself – so you can put the banner together and see it before deciding whether to pay. Previously the settings were frozen on a free site and the tab showed a blurred picture of itself.
- What a licence buys is the banner going live. On a free site visitors still see nothing: no banner is printed, nothing is blocked, and no consent is recorded, even with Enable banner saved as on. To see your own saved banner on your own theme, open your site with ?cookie-consent-preview on the end – only administrators see it, and its buttons are inert. The screen says all of this at the top, next to that address.
- The consent log is the one part of the tab that waits for a licence, because until the banner is live there is nothing in it to show.
- Redirects are now included free up to ten rules, and Boosted Pro runs as many as you want. The Redirects screen shows the count from the first rule rather than springing the limit on you at the tenth, and everything else on that screen – the 404 monitor, CSV import and export, and the automatic redirect when a slug changes – is free and unlimited.
- Nothing is deleted when a licence lapses. A site that had forty redirects and let its licence expire keeps all forty; the first ten stay live, the rest are marked Not running” in the table and come straight back when the licence does.
- A CSV import stops at the same ten on a free site. It imports the first ten rows and says that the rest were left out, rather than saving forty rules and quietly running ten of them.
- New Add-Ons tab, holding optional extras that are off until you switch them on. Both of the first two are free. The tab has All, Active and Not Active views, each with its own address, so you can link straight to what is running.
- SVG uploads, cleaned on the way in. Administrators can add SVG files to the media library, and every file is stripped of scripts, event handlers, animation tricks and references to other sites before it is stored – so the copy your visitors get has nothing left in it to run. A file that cannot be read as SVG is refused rather than saved, and nothing but the cleaned version ever reaches your uploads folder. It is administrators only on purpose: an SVG can carry JavaScript, so being allowed to upload one is being allowed to run code on your site.
- Upload size limit, with the real numbers. This lifts a cap set inside WordPress by a theme, another plugin or your host’s own code, which is the case where an upload fails for no visible reason. It cannot lift your server’s limit – no plugin can, those settings are out of reach from inside a page load – so instead of pretending, the screen lists what your server actually allows, what WordPress will accept right now, and which single setting is the one stopping you. That last line is the one to send your host.
- The [boosted_ga total_views] shortcode now needs a licence to print a number. Setting the connection up stays free: the GA4 Property ID, the service account key and the Viewer step over in Analytics can all be done and saved first, and the panel says plainly where you stand. Until a licence is active the shortcode prints your fallback – or nothing, if you have not set one – and Boosted does not call Google at all, so no quota is spent and no visitor waits on it. Nothing you saved is lost if a licence lapses, and the number comes straight back when it returns.
- Sending data to Analytics is the other direction and is free, as it has always been. The GA4 Measurement ID, Google Tag Manager container, Meta Pixel and reCAPTCHA fields on that same screen are not affected by any of the above.
2.8.10
- Fixed a fatal error that could take the front end down. On a site without a licence, loading a URL with ?cookie-consent-preview on it stopped the page with Call to undefined function wp_get_current_user()”. Boosted was asking who the visitor was earlier in the request than WordPress can answer; it now waits until WordPress is ready. Licensed sites and ordinary page loads were never affected.
- Boosted’s own menu is shorter. Account, Contact Us and Support Forum are no longer listed under Boosted. The licence lives on Settings -> Licence, which is where you enter or change a key, and Need help? in the sidebar goes to the support forum. Nothing was removed – the licence screen is the same one as before, reached from one place instead of two.
- The links under Boosted on the Plugins screen now read Get Pro, Settings, Documentation, Deactivate – and on a licensed site, Settings, Documentation, Deactivate. Add-Ons, Activate License and the opt-in/opt-out link are no longer among them.
- The sidebar that follows you down every Boosted screen now has working buttons: Upgrade on a free site, Manage licence on a licensed one, and Support forum on both.
- Rollback now refuses to run on Boosted Pro. Only the free build is published for direct download, so rolling back a licensed copy would have replaced it with the free one; earlier Pro versions are on the licence screen instead. Free installs are unchanged.
- Update checks and rollback no longer assume the plugin folder is named boosted”, so a renamed folder or the Pro build’s own folder name no longer makes Boosted report itself as up to date when an update is waiting.
2.8.8
- Licensing now runs through Freemius. Boosted Pro is activated with a licence key, on Settings -> Licence. A running trial counts as licensed, so the paid tabs work for the whole length of it.
- On activation Freemius asks whether you want to opt in to sharing basic site data – your site address, your admin email, and your WordPress and PHP versions – for support and update notices. Skipping it is a supported answer: the plugin, including the paid tier, works exactly the same either way. Your settings, your content and your visitors’ data stay on your site.
2.8.7
- Boosted is now free with a Pro tier. Console Logs, Cookie Consent, and the SEO and readability analysis in the editor need a licence; everything else – page caching, preloading, image optimization, CSS/JS/font handling, redirects, integrations, the SEO tags themselves and the whole Setup & health side of the plugin – is free and stays free. Without a licence the two paid tabs show what they do and a Get Pro button, the analysis lists are replaced by one line in the editor panel, and the SEO fields keep working exactly as before.
- Cookie Consent can be previewed without a licence. Add ?cookie-consent-preview to any front-end URL and the banner renders with your theme so you can see it before buying. It is inert – nothing is blocked and no consent is recorded – and only administrators see it.
- Rebuilt the Compatibility tab around the plugins you actually have. Every installed plugin gets one row and a verdict – Conflict, Not Compatible, Compatible, or No conflicts detected – instead of a fixed list of plugins the site does not have. Inactive plugins are kept in a collapsed list, and a conflict or an incompatibility now also gets recorded to Console Logs when recording is on.
- Console Logs now says what to do. A Problems and what to do” panel turns each recorded error into numbered steps and a button to the setting that fixes it, five copies of the same failure collapse into one card, and a dagger on a log line jumps to its card. Messages Boosted has no guidance for get a WordPress.org search and a web search built from the message itself.
- Added a Copy for AI button to Console Logs. It copies the recorded problems, your Boosted, WordPress and PHP versions, and the names of any conflicting plugins as plain text to paste into an AI assistant. No settings values, no keys, no server paths, and Boosted sends nothing anywhere.
- The admin now carries the Boosted logo in its header and its own menu icon. Sites on a light admin color scheme will see the menu icon differently to the default dark one.
- Added a © Vyse Digital 2026” credit to the bottom of every Boosted screen.
2.8.2
- Rebuilt the FAQ tab as five sections – Performance, Image Optimizer, SEO, Cookie Consent and Integrations – each answering the questions that tab actually raises, with a sticky index and a link through to the settings it describes.
- Added a Console Logs tab: a status line, and Boosted’s own failures shown like a terminal, so a cache that will not clear or an analytics token that will not refresh is visible from the admin instead of only in a debug.log. Recording is off until you switch it on, and only Boosted’s own messages and PHP errors are recorded.
- Console Logs can be refreshed without reloading the page, filtered to problems only, copied, downloaded as a text file, or cleared. Auto-refresh is available and off by default.
2.8.1
- Rebuilt the admin on a Tailwind component layer with an indigo palette: a new shell, full-width navigation, sticky sidebar, and every tab restyled off the shared panel, field, toggle, callout and badge components.
- Settings saves are now scoped to the form that owns them, so saving one section no longer rewrites the others from defaults.
- Added a global developer mode that pauses every performance feature site-wide – page caching and preloading, lazy loading, HTML minification, CSS combination, script deferral and the LCP preload hint – while keeping your settings intact. Announced with a persistent notice, a toolbar item and a Setup & health row. SEO tags and the cookie consent banner keep running.
- Added an Integrations settings section for Google Analytics 4, Google Tag Manager, Meta Pixel and reCAPTCHA, with keys saved locally and never included in an export.
- Added the [boosted_ga total_views] shortcode for Google Analytics view counts.
- Added Boosted Performance and Boosted SEO panels to the block editor, including per-post SEO and readability analysis.
- Gave the Images optimization settings a form that saves.
2.6.0
- Added an optional Cookie Consent / GDPR module: an equal-choice banner with English and Filipino (Tagalog) presets, configurable position and colors, registered third-party script/embed blocking (Google Analytics, Meta Pixel, YouTube/Vimeo, Google Fonts and more), consent expiry, a version bump to re-request consent, a hashed audit log with search, pagination and CSV export, and a live banner preview.
2.5.9
- Responsive grid pass: card grids now step 3-4 columns -> 2 (md) -> 1 (sm and below), and the sidebar stacks below the content under lg.
- Hardened admin asset loading so the layout shell loads on every Boosted tab.
- Bumped the plugin version from 2.3.0 to 2.5.9.
2.3.0
- Admin UI now spans the full width of the WordPress admin area (removed the fixed 1080px container cap).
- Synced the stable tag with the plugin version header.
0.3.0
- Improved cache clearing safety and failure handling on restricted hosting.
- Improved late stylesheet collection and cache invalidation after upgrades.
- Added X-Boosted-Build diagnostics for cache HIT and MISS responses.
0.2.0
- Added a WP_CACHE status display and nonce-protected enable/disable toggle.
- Added safe wp-config.php detection, marker-based ownership, and admin notices.