Table of contents of the article:
WP-Optimize, one of the most popular performance plugins for WordPress websites , has been accused of cheating on benchmarks. Gijo Varghese , a developer and performance enthusiast, found evidence showing that WP-Optimize disables JavaScript when tested with benchmarking tools.
Gijo Varghese , a self-described “ web performance enthusiast ,” the alleged inventor of the JS Delay technique and developer of the FlyngPress optimization plugin , who we covered in the JS Delay post, shocked WordPress users around the world over the weekend when he tweeted a screenshot of how WP-Optimize is allegedly preventing selected JavaScript files from loading when users test their sites through popular performance testing tools.
When a site loads, JavaScript files are only loaded when the user agent/browser is not Lighthouse/GTmetrix/Headless Chrome/Pingdom ,” Varghese said. No JS = high scores. But for real users, these JS files are loaded!
Varghese confirmed he was testing the free version of WP-Optimize, used on over a million WordPress sites. UpdraftPlus acquired WP-Optimize in 2016 and claims the tool " has everything you need to keep your website fast and fully optimized ." A commercial version is also being promoted via the free plugin hosted on WordPress.org.
“ Tell me, UpdraftPlus, how am I supposed to continue to trust your company with my clients’ backups when you use these deceptive and fraudulent practices? ” said customer Adam Lowe in response to Varghese’s discovery of the plugin not loading JS for performance tools.
“ Wow, all I can say is what a total disappointment ,” said WordPress agency owner and developer Brian Jackson.
This kind of alleged deception is eerily similar to a scam reported by someone who hired a performance freelancer on Upwork who artificially manipulated Google Pagespeed results. Other participants in the discussion on Twitter likened it to Volkswagen's emissions scandal, in which the automaker was found activating its emissions controls only during laboratory tests to meet EPA requirements after a breach. Vehicles on the road emitted up to 40 times more nitrogen oxides while driving, compared to how they performed in rigged lab tests.
Wp Optimize does not reflect the actual user experience
Varghese and several other participants in the conversation concluded that this is why site owners should focus on what real-world users are experiencing, rather than performance tool test scores.
Even when focusing on real user experiences, site owners often rely on tests to diagnose problems and see how they can improve a site's performance. They don't expect a plugin to hide JS files from performance tools. Tricking tests has eroded WP-Optimize's credibility.
“ Oh. If true, this is both shortsighted and inexcusable ,” said UpdraftPlus customer Johnathon William. “ And I wonder if I can trust their other product, UpdraftPlus, which I use to back up several client sites .”
I contacted UpdraftPlus and lead developer David Anderson said the company was unaware of the problem with the code, but reported some of the background. UpdraftPlus has been briefly in talks with the author of the Fast Velocity Minify plugin about joining forces, in which it would keep the minification module within WP-Optimize and gain more users. They ultimately failed to reach an agreement, but during that time the developers of WP-Optimize forked and adapted Fast Velocity Minify under the GPL. The developers who worked on that adaptation are no longer with the company.
“In the commit in our source repository, 2,5 years ago (January 2020), the commit was labeled 'Resolve' Add CSS and JS Minification GPL code from 'Fast Velocity Minify' - Part 6 ′,” Anderson said. “Part of a series of initial code merges that have been refactored to be cleaner and use our coding style preferences (but not change any functionality). So the apparent intention of merging those lines was to bring the refactored code back without making any changes at that stage.
“According to the commit history (ie the 'git fault' function) there have been no changes to that code since then, ie it is as imported. (WP Optimize history is also public in WordPress SVN). "
After a cursory review of the code, Anderson concluded that his team may need to review it, as they were unaware of what was added two years ago.
As I try to trace that function through the code within the plugins, the intention at first glance seems to be that if the website visitor is a 'bot', code that is useless to bots will not be executed.
He said.
“However, with that said, 1) the bot names seem to be heavily obfuscated / redacted, which is weird (why?) And 2) there are a lot of more obvious bots that aren't listed there, like the Googlebot itself. If that feature had been submitted to me for review today, I would definitely wonder why this is the case. I don't mind rereading 32 months ago, but I remember it was a long series of great patches, so it wasn't going through closely line by line. We knew we had identified FVM as a good plug-in and our main goal was to adapt it to our structure and style, and these were the things I was personally looking at as a final reviewer. "
In summary, UpdraftPlus's development team was unaware of this code until the Twitter thread was posted over the weekend.
"I am certainly happy to have brought it to our intentions," Anderson said. “The associated code comments on a related snippet in its original source that is meant to prevent unnecessary bot requests, but upon closer inspection of what that line got at the time, it's something we'd like to look into, as it looks questionable. / weird, and we'll do that by assigning it to a team member who is our JavaScript optimizations expert ”.
Anderson also said that if JavaScript optimization experts fail to find a legitimate purpose for the code, it "will definitely be removed," with a clear and unambiguous disclosure for the reasoning behind it.
Meanwhile, UpdraftPlus has posted a notice in the plugin's support forum to inform users that the code is currently under investigation.
To be clear and to reassure users: the code in question is not dangerous, a virus, an infection, useful for hackers or something like that, ”Anderson said. “The charge is that its only purpose in existence is actually to cheat the speed tests. That code, in this case, does not belong to WP Optimize and we will remove it with a new version. The integrity of our products and the trust of our customers are essential to us (and deliberately putting things in compromising open source code which is, frankly, a stupid thing to do).
The code in question is not ours is Wp Optimize's answer
WP-Optimize lead developer David Anderson gave WPTavern an interesting explanation. According to Anderson, the code disabling JS files when he detects the benchmarking tools dates back 2,5 years, when the company was considering joining forces with the Fast Velocity Minify plugin.
During the decision period, the WP-Optimize developers forked and adapted Fast Velocity Minify . Ultimately, they couldn't agree. This is when Anderson suspects the code is mixed up in the WP-Optimize code. That code hasn't been touched for 2,5 years, and the developers weren't aware of those lines.
David Anderson added that if the JavaScript optimizer can't find a purpose for the code, they will definitely remove it. David Anderson, developer of WP-Optimize said;
The code in question is not dangerous, a virus, an infection, useful to hackers, or anything of the sort. The accusation is that its sole purpose in existence is actually to cheat speed tests. This code, in that case, does not belong to WP Optimize, and we will remove it with a new release. The integrity of our products and our customers' trust are essential to us (and deliberately putting things into open source code that compromise that is, frankly, a stupid thing to do).
Our advice on optimizing the Core Web Vitals
For our part, we dismiss this interesting yet sterile conversation and the problematic issues raised, reminding our readers that Labs-type data indicates but does not prove . What matters is the actual user experience data (CRUX data) and the related Core Web Vitals scores, which will determine rewards or penalties from Google.
Field data is determined by tracking all users who visit a page and measuring a specific set of performance metrics for each of those users' individual experiences. Because field data is based on real user visits, it reflects the actual devices, network conditions, and geographic locations of your users.
We therefore refer you to this reading: Core Web Vitals and CRUX data to understand how to cheat and deceive speed and performance tests such as Google Pagespeed Insight are not useful in real life and that you can pass the Core Web Vitals requirements even with scores in the orange zone and not necessarily in the green zone (above 90) as you can see for example from the following image of one of our customers who with a score of 78, still passes the evaluation of Google's Essential Web Signals.
If you have a website developed on a popular CMS like WordPress for example and you are evaluating a performance optimization service that can bring real added value and a real improvement in the speed of your site and Core Web Vitals values , please contact us.
