IndexLane Asset Weight Snapshot WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

A WordPress administrator tool for measuring the CSS and JavaScript resources declared in selected pages, attributing their observed server-side cost, and comparing stored snapshots.

The repository and WordPress slug remain indexlane-cwv-asset-snapshot; the displayed product name changed in 0.2.0 because the plugin does not calculate Core Web Vitals.

Product contract

Scan selected pages, measure the CSS/JS resources declared in their HTML, attribute the cost, and show what changed. It does not calculate Core Web Vitals.

For up to ten same-site pages, 0.2.0:

• Discovers external and inline CSS/JavaScript in document order.
• Retains head/body, async, defer, module, media, and preload evidence.
• Fetches each unique same-site asset once in resumable batches of three.
• Records status, redirects, Content-Length, returned/decoded bytes, encoding, type, caching validators, completeness, and SHA-256 for complete bodies.
• Attributes concrete URL paths to WordPress core, plugins, themes, uploads, unknown same-site sources, or external domains.
• Aggregates known bytes by page, resource type, and owner, plus sitewide/page-specific assets and probable blocking candidates.
• Stores snapshots, compares them with the preceding scan, and exports the stored evidence without rescanning.
• Leaves third-party measurement disabled unless an administrator explicitly opts in.

Measurement language and limits

The report describes observed server-side response bodies and headers. WordPress HTTP requests do not expose browser transfer size, browser cache state, JavaScript execution cost, JavaScript-discovered requests, LCP, CLS, or INP.

Initial safeguards are:

• 10 pages
• 150 unique assets
• 5 MiB per resource
• 50 MiB of resource bodies per scan
• 3 redirects
• 8-second HTTP timeout
• latest 20 scans or 90 days of terminal history

Truncated, failed, capped, and incomplete evidence produces an explicit partial or failed result. It is never converted into an “OK” judgment.

Data handling and security

• Administrator-only screen requiring manage_options.
• Nonce-protected AJAX batches and CSV export.
• Same-site validation for selected pages and WordPress safe HTTP requests.
• Off-site resources are not requested by default.
• One custom scan table stores versioned JSON evidence and summary metadata.
• Response bodies are not stored. Complete bodies are represented by SHA-256; inline declarations are represented by byte count and SHA-256.

Installation

1. Copy indexlane-cwv-asset-snapshot into wp-content/plugins/.
2. Activate IndexLane Asset Weight Snapshot.
3. Open Tools → Asset Weight Snapshot.
4. Enter one same-site URL or path per line and start the snapshot.

Development

PHP 7.4+ and WordPress 6.0+ are supported.

composer install
composer check

For a local WordPress integration check:

php tests/wp-integration.php
php tests/wp-integration.php --export > /tmp/indexlane-asset-weight-snapshot.csv

The script defaults to ../_wordpress/wp-load.php; pass another bootstrap path when needed.

Repository layout

The bootstrap remains in indexlane-cwv-asset-snapshot.php. URL policy, fetchers, HTML discovery, ownership, persistence, reporting, scan orchestration, and the admin UI live in separate classes under includes/. Static admin assets live under assets/.

License

GPLv2 or later.