Marwan Hatem

SPM by Marwan is a professional-grade diagnostics and intelligence platform designed for WordPress administrators and developers. It provides deep visibility into your WordPress ecosystem, offering real-time monitoring, security auditing, and performance profiling to ensure your site remains fast, secure, and stable.
<h3>The Problem</h3>
Managing a modern WordPress ecosystem is inherently complex. Site owners and developers frequently struggle with:
<ul>
<li>Slow Extensions: Identifying which specific extension is degrading page load times or consuming excessive server resources.</li>
<li>Hidden PHP Errors: Unseen warnings and fatal errors that silently break functionality or create vulnerabilities.</li>
<li>Security Risks: Unmaintained, abandoned, or vulnerable code exposing the site to potential exploits.</li>
<li>Trust Issues: Uncertainty regarding an extension’s origin, development standards, and code quality.</li>
<li>Update Degradation: Performance regressions and unexpected conflicts introduced immediately after updates.</li>
</ul>
<h3>Core Features</h3>
<ul>
<li>Real-Time Monitoring Engine: Actively tracks resource consumption, database queries, and execution times for every active extension. Identifies performance bottlenecks as they happen, preventing systemic slowdowns.</li>
<li>Performance Diagnostics: Deep-dive profiling for individual extensions. Analyzes memory footprint and script execution to provide actionable intelligence on resource utilization.</li>
<li>Security & Integrity Scanner: Proactively audits installed extensions against known vulnerability databases, flags high-risk code patterns, and verifies WordPress core files against official checksums to detect malicious tampering.</li>
<li>Japanese SEO Spam Auto-Fix Engine: A specialized, deep-scanning engine designed to detect and eradicate the notorious “Japanese Keyword Hack”. Features a one-click Auto-Fix that intelligently restores or quarantines hijacked posts to protect your Google ranking without destroying your original content.</li>
</ul>
<h3>Advanced Security: Defeating the Japanese SEO Keyword Hack</h3>
The “Japanese Keyword Hack” is a devastating black-hat SEO attack where hackers exploit vulnerabilities in outdated plugins to inject massive amounts of auto-generated Japanese text and malicious links into your database and core files. This causes Google to flag your site as “hacked,” instantly destroying your SEO ranking.
SPM by Marwan includes a highly specialized engine specifically built to defeat this attack:
<ul>
<li>Deep Database Scanning: Actively crawls your <code>wp_posts</code> and <code>wp_options</code> tables, utilizing advanced Unicode block detection to find injected Japanese Hiragana, Katakana, and Kanji spam hidden within your legitimate content.</li>
<li>Intelligent Auto-Fix (No Data Loss): When you click “Auto-Fix”, the scanner doesn’t just blindly delete your hijacked posts. Instead, it scans the WordPress Revision History for each infected post. It finds the last “clean” version of your post (before the hacker touched it) and seamlessly restores it.</li>
<li>Fail-Safe Quarantining: If a post was created entirely by the hacker (meaning no clean revision exists), or if you have revisions disabled, the engine will safely quarantine the post by setting its status to Draft. This instantly removes the spam from the public internet—stopping the SEO bleed—while preserving the draft in your admin panel so you don’t lose any data.</li>
<li>Orphaned File Detection: Scans your entire server structure to locate and quarantine backdoor PHP scripts that hackers leave behind to reinfect your site after you clean it.</li>
<li>Core Checksum Verification: Verifies every single WordPress core file against the official WordPress.org cryptographic checksums to detect hidden cloaking scripts.</li>
<li>Trust Verification: Evaluates code based on developer reputation, update frequency, repository standing, and code integrity. Establishes a trust score to help you make informed decisions about your technology stack.</li>
<li>Historical Analytics: Maintains a robust ledger of performance and security metrics over time. Visualizes trends to help you understand the long-term impact of specific extensions and updates.</li>
<li>Action Layer (Scan / Safe Mode / Reporting): Provides immediate remediation tools. Execute targeted scans, isolate problematic extensions using Safe Mode, and generate comprehensive diagnostics reports.</li>
</ul>
<h3>External Services</h3>
This plugin utilizes the WordPress.org Plugins API (https://api.wordpress.org) to verify plugin licenses and retrieve information about installed plugins. 
* What data is sent: The names and slugs of your active plugins are sent in the API request. 
* When it is sent: Data is sent when the plugin performs a scheduled background scan or when you manually click “Deep Scan” or “Refresh Now” on the dashboard. 
* Why it is used: To verify that the plugins running on your site are authentic, properly licensed, and available on the official WordPress.org directory, which enhances your site’s security and trust metrics.
For more information, please refer to the <a href="https://wordpress.org/about/privacy/" rel="ugc">WordPress.org Privacy Policy</a>.

SPM by Marwan

Tracks load time and PHP errors for each active extension, storing logs in a custom database table.

Forge12 Interactive GmbH

F12 Profiler analyzes your WordPress site comprehensively and delivers concrete, prioritized recommendations to improve load times. The plugin combines server diagnostics, asset analysis, database optimization, and plugin impact assessment in a modern, clean interface.
<h4>Features</h4>
Analysis & Diagnostics
<ul>
<li>Server analysis (PHP, MySQL, OPcache, web server, SSL, HTTP/2, compression)</li>
<li>Automatic site crawler with load time measurement (desktop & mobile)</li>
<li>Asset analysis (CSS, JS, images) with optimization potential</li>
<li>OPcache status & configuration recommendations</li>
<li>PHP profiler (runtime, queries, hooks, plugin ranking, culprit analysis)</li>
<li>Plugin impact analysis (assets, hooks, queries per plugin)</li>
<li>PageSpeed Insights integration (Lighthouse Scores + Core Web Vitals + CrUX)</li>
<li>Performance score with 6 weighted categories (A-F grades, trend delta)</li>
<li>Recommendation engine with automatic optimization suggestions</li>
</ul>
Optimization Tools
<ul>
<li>Lazy Loading (images and iframes)</li>
<li>Font Display Optimization (font-display: swap/optional/fallback/block)</li>
<li>Script Defer Manager (automatic defer for scripts with exclusion list)</li>
<li>Auto Image Dimensions (prevents Layout Shifts / CLS)</li>
<li>HTML Minification (whitespace, comments, empty attributes)</li>
<li>CSS/JS Minification (file-based cache)</li>
<li>WordPress Bloat Removal (emojis, embeds, Dashicons, jQuery Migrate, XML-RPC, Heartbeat, and more)</li>
<li>Browser Cache (.htaccess-based)</li>
<li>DNS Prefetch & Preconnect (domain detection from asset scan)</li>
<li>Database Analysis (8 categories with detail view)</li>
<li>Autoload Manager (granular wp_options management)</li>
<li>Background Asset Scanner with conflict detection</li>
<li>File-based Page Cache with TTL and URL exclusion (Pro)</li>
<li>CSS/JS Asset Manager – disable, defer, async per page or globally (Pro)</li>
<li>Conditional Loading – shortcode, block, regex, archive, login status, post type, plugin (Pro)</li>
<li>Smart auto-suggestions with source-based plugin detection after full scan (Pro)</li>
<li>Asset Preload Manager – Link headers for critical assets (Pro)</li>
<li>Critical CSS Generator & Applier – above-the-fold CSS per template (Pro)</li>
<li>Unused CSS Removal – per page template, safelist, regex safelist (Pro)</li>
<li>WebP Image Conversion with batch queue and backup (Pro)</li>
<li>LQIP Image Placeholders – 20px blur-up previews with IntersectionObserver (Pro)</li>
<li>Preload Key Requests – LCP images, fonts, critical resources (Pro)</li>
<li>Script Delay – delays third-party JS until first user interaction (Pro)</li>
<li>Local Google Fonts – GDPR-compliant WOFF2 self-hosting (Pro)</li>
<li>YouTube/Vimeo Facade – thumbnail + play button instead of iframe (Pro)</li>
<li>Database Cleanup – one-click per category or bulk action (Pro)</li>
<li>Redis Object Cache Management – drop-in installation/removal (Pro)</li>
<li>Scheduled Crawls & Cleanups via WP-Cron (Pro)</li>
<li>Performance Budgets with email/webhook notifications (Pro)</li>
<li>Settings Import/Export as JSON (Pro)</li>
<li>One-Click Optimizer – automated optimization with backup & restore (Pro)</li>
<li>License Management with activation/deactivation (Pro)</li>
</ul>
User Interface
<ul>
<li>Modern iOS-style design system</li>
<li>React 18 + TypeScript SPA</li>
<li>30+ pages/tools with dedicated configuration</li>
<li>Context-sensitive info sections on all pages</li>
<li>Pro features visible with lock icon and upgrade prompt</li>
</ul>
<a href="https://www.forge12.com/f12-profiler-pro/" rel="nofollow ugc">Get F12 Profiler Pro</a>
<h4>System Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 8.0 or higher</li>
<li>MySQL 5.7 / MariaDB 10.3 or higher</li>
</ul>

F12 Profiler

Excellent! After P3 doesn’t work with PHP7+ anymore, F12 seems finally the one stepping in to fill that gap.

Update [18-Jun-19]. After some small contributions of mine to the dev efforts, the plugin developer has decided to add me to the team, long after this review was written.

Finally an alternative to P3

Comprehensive WordPress performance analysis with crawling, load time measurement, server diagnostics, and integrated optimization tools. Free.

SPM by Marwan vs F12 Profiler