WordPress must-use plugin: purges the site's nginx fastcgi_cache zone whenever public content changes, keeps Polylang cache-friendly, adds `wp nitida cache purge`.
WordPress must-use plugin: closes the default anonymous surface (XML-RPC, user enumeration, fingerprints, comments, login errors, application passwords). Same file on every site nitida runs.
WordPress plugin: allows SVG uploads and sanitizes every one with enshrined/svg-sanitize, so an uploaded SVG cannot run script. Activate per site.
WordPress must-use plugin: converts JPEG/PNG uploads to WebP in place via Imagick, archives originals, and adds `wp webp` bulk commands.
WordPress must-use plugin: unserializes the active theme's theme_mods option once per request instead of on every get_theme_mod() call.
WordPress must-use plugin: a Customizer field for the GA4 measurement ID, handed to GDPR Cookie Compliance so Google Analytics loads only after the visitor consents.