Luis Celadita

This plugin is fully compatible with Autoptimize and any cache plugin (Cache Enabler or Wp Super Cache by example)
Some of the tweaks that this plugin automatically applies securely are the following:
<h4>SET HTTP SECURITY HEADERS</h4>
<ul>
<li>X-Frame-Options: SAMEORIGIN</li>
<li>X-XSS-Protection: 1;mode=block</li>
<li>Referrer-Policy: no-referrer-when-downgrade</li>
<li>X-Content-Type-Options: nosniff</li>
<li>Strict-Transport-Security: max-age=15552000</li>
<li>Content-Security-Policy</li>
</ul>
<h4>REMOVE THIS</h4>
<ul>
<li>Remove Really Simple Discovery link from header</li>
<li>Remove wlwmanifest.xml (Windows Live Writer) from header</li>
<li>Remove Shortlink URL from header</li>
<li>Remove WordPress Generator Version from header</li>
<li>Remove s.w.org DNS Prefetch</li>
<li>Remove generator name from RSS Feeds</li>
<li>Remove Capital P Dangit filter</li>
<li>Remove WordPress and WooCommerce meta generator tags</li>
<li>Remove Jquery_migrate</li>
<li>Remove Dashicons in admin bar (only for non logged users)</li>
<li>Remove Post oEmbed</li>
</ul>
<h4>AND MORE AUTO SETTINGS</h4>
<ul>
<li>Change Control Heartbeat API interval (60 seconds)</li>
<li>Disable the XML-RPC interface</li>
<li>Disable PDF thumbnails preview</li>
<li>Disable Self Pingbacks</li>
<li>Limit Post Revisions to 1</li>
<li>Add IDs to posts, pages, and categories</li>
</ul>
Just activate the plugin and test your site’s speed in your favourite tool (GTMetrix, Pingdom Tools, Securityheaders.com, etc.)

AutoTweaks

WP Classic Setup: Removes WP version, dashicons, oEmbed, Jquery Migrate, XMLRPC. Set Http security headers, heartbeat to 60s, Post revisions to 1, etc

Tyron Bache

Mustang WPO (Web Performance Optimization) helps you audit, view, and manage your site’s performance without leaving WordPress.
IMPORTANT: This plugin requires a valid Google Cloud API Key with the PageSpeed Insights API enabled to function. The plugin will not work without this API key.
<h4>Key Features</h4>
<ul>
<li>Dashboard Widget – At-a-glance performance overview on your WordPress dashboard showing Mobile and Desktop scores</li>
<li>PageSpeed Performance Scores in List Tables – View mobile and desktop PageSpeed Performance scores directly in your post/page list tables</li>
<li>Block Editor Integration – Run PageSpeed audits and view results in the Gutenberg editor sidebar</li>
<li>Performance Budgets – Set performance budgets per post type</li>
<li>Global Audit – Audit all your content at once with batched processing</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and Activate – Install the plugin and activate it</li>
<li>Configure API Key – Add your valid Google Cloud API Key with the PageSpeed Insights API enabled in Mustang WPO > Integrations</li>
<li>Set Budgets – Configure performance budgets for different content types</li>
<li>Run Audits – Use the editor sidebar or global audit to measure performance</li>
<li>Monitor Results – View scores in list tables</li>
</ol>
<h4>Performance Budgets</h4>
Set performance budgets for each content type: 
* Max Load Time (LCP) – Largest Contentful Paint in seconds 
* Max CLS – Cumulative Layout Shift (unitless) 
* Max INP – Interaction to Next Paint in milliseconds 
* Max Page Weight – Total page size in MB
<h4>API Integration</h4>
Mustang WPO integrates with Google PageSpeed Insights API v5: 
* Required API Key – A valid Google PageSpeed Insights API key is mandatory 
* Supports both mobile and desktop strategies 
* Handles API quotas and rate limiting (240 requests/minute) 
* Graceful error handling for network issues 
* Secure API key storage with encryption
<h3>Support</h3>
For support, feature requests, or bug reports, please visit the <a href="https://wordpress.org/support/plugin/mustang-wpo/" rel="ugc">WordPress.org support forums</a>.
<h3>Privacy Policy</h3>
Data Collection and Usage:
Mustang WPO requires a Google API key to function. Here’s what data is collected and how it’s used:
Data Sent to Google: 
* URLs of your website pages (for performance analysis) 
* No personal data, user information, or content is transmitted 
* API requests include your website URL and strategy (mobile/desktop)
Data Stored Locally: 
* PageSpeed audit results are stored in your WordPress database 
* Your API key is encrypted and stored securely in your database 
* No data is sent to third parties other than Google PageSpeed Insights API
Google’s Privacy Policy: 
This plugin uses Google PageSpeed Insights API. Google’s collection and use of information is governed by <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google’s Privacy Policy</a>.
API Key Security: 
* Your API key is encrypted using WordPress security salts 
* The full API key is never displayed in plain text 
* API key is stored in your WordPress database, not transmitted to external servers
Rate Limiting: 
The plugin enforces a rate limit of 240 requests per minute to prevent abuse and comply with Google’s API terms.

Mustang WPO – See Your Performance Clearly

Mustang WPO (Web Performance Optimization) helps you audit, view, and manage your site's performance without leaving WordPress.

AutoTweaks vs Mustang WPO – See Your Performance Clearly