WP-Safety

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Security & Risk Analysis

wordpress.org/plugins/hummingbird-performance

Optimize PageSpeed Performance & Core Web Vitals, Advanced Cache, Minify CSS & JavaScript, Inline Critical CSS, Defer CSS & JS, Smush & Lazy Load, CDN

70K active installs v3.20.0 PHP 7.4+ WP 6.4+ Updated Jul 20, 2026
cachecachingcritical-cssminify-cssperformance
94
A · Safe
CVEs total6
Unpatched0
Last CVEDec 17, 2025
Plugin page Download
Safety Verdict

Is Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Safe to Use in 2026?

Generally Safe

Score 94/100

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

6 known CVEsLast CVE: Dec 17, 2025Updated 1mo ago
Risk Assessment

The "hummingbird-performance" plugin version 3.19.0 presents a mixed security posture. While it demonstrates good practices in many areas, such as a high percentage of properly escaped output and a significant number of nonce and capability checks, several concerning findings warrant attention. The presence of 3 AJAX handlers without authentication checks directly exposes potential entry points to unauthorized access and manipulation. The static analysis also flags the use of the `unserialize` function, which can be a significant risk if not handled with extreme care, as it can lead to object injection vulnerabilities. The vulnerability history of this plugin is also a significant concern. With 6 known CVEs, including one high-severity vulnerability, and a history of diverse attack vectors like CSRF, missing authorization, path traversal, and XSS, it indicates a pattern of past security weaknesses. Although there are currently no unpatched vulnerabilities, the recurring nature of these issues suggests a need for ongoing vigilance and rigorous security testing. The plugin has a substantial attack surface, and while most entry points are protected, the unprotected AJAX handlers and the potential risks associated with `unserialize` are critical areas that need immediate mitigation.

Key Concerns

  • AJAX handlers without authentication checks
  • Dangerous function: unserialize
  • Known high severity CVEs
  • Multiple past vulnerability types
Vulnerabilities
6 published

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Security Vulnerabilities

CVEs by Year

1 CVE in 2022
2022
1 CVE in 2023
2023
3 CVEs in 2024
2024
1 CVE in 2025
2025
Patched Has unpatched

Severity Breakdown

High
1
Medium
5

6 total CVEs

CVE-2025-14437high · 7.5Insertion of Sensitive Information into Log File

Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

Dec 17, 2025 Patched in 3.18.1 (1d)
CVE-2024-43117medium · 4.3Cross-Site Request Forgery (CSRF)

Hummingbird <= 3.9.1 - Cross-Site Request Forgery

Aug 7, 2024 Patched in 3.9.2 (8d)
CVE-2024-43118medium · 4.3Missing Authorization

Hummingbird <= 3.9.1 - Missing Authorization

Aug 7, 2024 Patched in 3.9.2 (8d)
CVE-2024-32792medium · 5.3Missing Authorization

Hummingbird <= 3.7.3 - Missing Authorization

Apr 22, 2024 Patched in 3.7.4 (8d)
CVE-2023-1478medium · 5.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Hummingbird <= 3.4.1 - Unauthenticated Path Traversal

Mar 20, 2023 Patched in 3.4.2 (309d)
CVE-2022-0994medium · 5.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Hummingbird <= 3.3.1 - Admin+ Stored Cross-Site Scripting

Mar 23, 2022 Patched in 3.3.2 (671d)
Version History

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Release Timeline

v3.20.0Current
v3.19.0
v3.18.1
v3.18.01 CVE
CVE-2025-14437
v3.17.21 CVE
CVE-2025-14437
v3.17.11 CVE
CVE-2025-14437
v3.16.01 CVE
CVE-2025-14437
v3.15.01 CVE
CVE-2025-14437
v3.14.11 CVE
CVE-2025-14437
v3.13.11 CVE
CVE-2025-14437
v3.13.01 CVE
CVE-2025-14437
v3.12.01 CVE
CVE-2025-14437
v3.11.01 CVE
CVE-2025-14437
v3.10.01 CVE
CVE-2025-14437
v3.9.41 CVE
CVE-2025-14437
v3.9.31 CVE
CVE-2025-14437
v3.9.21 CVE
CVE-2025-14437
v3.9.13 CVEs
CVE-2024-43117 CVE-2025-14437 CVE-2024-43118
v3.9.03 CVEs
CVE-2024-43117 CVE-2025-14437 CVE-2024-43118
v3.8.13 CVEs
CVE-2024-43117 CVE-2025-14437 CVE-2024-43118
Code Analysis
Analyzed Mar 16, 2026

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Code Analysis

Dangerous Functions
1
Raw SQL Queries
26
27 prepared
Unescaped Output
44
1872 escaped
Nonce Checks
135
Capability Checks
124
File Operations
57
External Requests
24
Bundled Libraries
0

Dangerous Functions Found

unserializereturn @unserialize( $original );core\object-cache.php:1181

SQL Query Safety

51% prepared53 total queries

Output Escaping

98% escaped1916 total outputs
Data Flows · Security
3 unsanitized

Data Flow Analysis

6 flows3 with unsanitized paths
<class-page-cache> (core\modules\class-page-cache.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
3 unprotected

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Attack Surface

Entry Points91
Unprotected3

AJAX Handlers 91

authwp_ajax_wphb_react_gzip_statusadmin\ajax\class-gzip.php:27
authwp_ajax_wphb_react_gzip_rulesadmin\ajax\class-gzip.php:28
authwp_ajax_wphb_react_check_requirementsadmin\ajax\class-setup.php:29
authwp_ajax_wphb_react_remove_advanced_cacheadmin\ajax\class-setup.php:30
authwp_ajax_wphb_react_disable_fast_cgiadmin\ajax\class-setup.php:31
authwp_ajax_wphb_react_cancel_wizardadmin\ajax\class-setup.php:32
authwp_ajax_wphb_react_complete_wizardadmin\ajax\class-setup.php:33
authwp_ajax_wphb_react_settingsadmin\ajax\class-setup.php:34
authwp_ajax_wphb_react_track_user_consent_toggleadmin\ajax\class-setup.php:35
authwp_ajax_wphb_react_hide_tutorialsadmin\class-ajax.php:44
authwp_ajax_wphb_front_clear_cacheadmin\class-ajax.php:47
authwp_ajax_wphb_global_clear_cacheadmin\class-ajax.php:49
authwp_ajax_wphb_clear_cachesadmin\class-ajax.php:51
authwp_ajax_wphb_front_clear_cloudflareadmin\class-ajax.php:53
authwp_ajax_wphb_get_network_sitesadmin\class-ajax.php:62
authwp_ajax_wphb_clear_network_cacheadmin\class-ajax.php:64
authwp_ajax_wphb_notice_dismissadmin\class-ajax.php:72
authwp_ajax_wphb_cf_notice_dismissadmin\class-ajax.php:74
authwp_ajax_wphb_hide_upgrade_summaryadmin\class-ajax.php:76
authwp_ajax_wphb_performance_run_testadmin\class-ajax.php:83
authwp_ajax_wphb_performance_save_settingsadmin\class-ajax.php:85
authwp_ajax_wphb_clear_module_cacheadmin\class-ajax.php:92
authwp_ajax_wphb_page_cache_save_settingsadmin\class-ajax.php:97
authwp_ajax_wphb_fast_cgi_save_settingsadmin\class-ajax.php:99
authwp_ajax_wphb_gutenberg_clear_post_cacheadmin\class-ajax.php:101
authwp_ajax_wphb_preload_canceladmin\class-ajax.php:103
authwp_ajax_wphb_remove_advanced_cacheadmin\class-ajax.php:105
authwp_ajax_wphb_disable_fast_cgiadmin\class-ajax.php:107
authwp_ajax_wphb_switch_cache_methodadmin\class-ajax.php:109
authwp_ajax_wphb_rss_save_settingsadmin\class-ajax.php:114
authwp_ajax_wphb_redis_save_settingsadmin\class-ajax.php:119
authwp_ajax_wphb_redis_toggle_object_cacheadmin\class-ajax.php:121
authwp_ajax_wphb_redis_cache_purgeadmin\class-ajax.php:122
authwp_ajax_wphb_redis_disconnectadmin\class-ajax.php:123
authwp_ajax_wphb_cloudflare_connectadmin\class-ajax.php:126
authwp_ajax_wphb_cloudflare_purge_cacheadmin\class-ajax.php:128
authwp_ajax_wphb_cloudflare_recheck_zonesadmin\class-ajax.php:130
authwp_ajax_wphb_other_cache_save_settingsadmin\class-ajax.php:135
authwp_ajax_wphb_minification_toggle_cdnadmin\class-ajax.php:142
authwp_ajax_wphb_minification_toggle_logadmin\class-ajax.php:144
authwp_ajax_wphb_minification_toggle_viewadmin\class-ajax.php:146
authwp_ajax_wphb_minification_start_checkadmin\class-ajax.php:148
authwp_ajax_wphb_minification_check_stepadmin\class-ajax.php:150
authwp_ajax_wphb_minification_cancel_scanadmin\class-ajax.php:152
authwp_ajax_wphb_minification_finish_scanadmin\class-ajax.php:154
authwp_ajax_wphb_minification_save_extra_optimization_dataadmin\class-ajax.php:156
authwp_ajax_wphb_minification_update_asset_pathadmin\class-ajax.php:158
authwp_ajax_wphb_minification_update_network_settingsadmin\class-ajax.php:160
authwp_ajax_wphb_minification_save_exclude_listadmin\class-ajax.php:162
authwp_ajax_wphb_minification_toggle_safe_modeadmin\class-ajax.php:164
authwp_ajax_wphb_ao_skip_upgradeadmin\class-ajax.php:167
authwp_ajax_wphb_ao_do_upgradeadmin\class-ajax.php:169
authwp_ajax_wphb_advanced_db_delete_dataadmin\class-ajax.php:176
authwp_ajax_wphb_advanced_save_settingsadmin\class-ajax.php:178
authwp_ajax_wphb_advanced_purge_cacheadmin\class-ajax.php:180
authwp_ajax_wphb_advanced_purge_minifyadmin\class-ajax.php:182
authwp_ajax_wphb_advanced_purge_orphanedadmin\class-ajax.php:184
authwp_ajax_wphb_logger_clearadmin\class-ajax.php:190
authwp_ajax_wphb_admin_settings_save_settingsadmin\class-ajax.php:196
authwp_ajax_wphb_reset_settingsadmin\class-ajax.php:198
authwp_ajax_wphb_admin_settings_export_settingsadmin\class-ajax.php:200
authwp_ajax_wphb_admin_settings_import_settingsadmin\class-ajax.php:202
authwp_ajax_wphb_disconnect_siteadmin\class-ajax.php:204
authwp_ajax_wphb_create_configadmin\class-ajax.php:207
authwp_ajax_wphb_upload_configadmin\class-ajax.php:208
authwp_ajax_wphb_apply_configadmin\class-ajax.php:209
authwp_ajax_wphb_clear_critical_css_filesadmin\class-ajax.php:212
authwp_ajax_wphb_gutenberg_create_css_fileadmin\class-ajax.php:215
authwp_ajax_wphb_gutenberg_recreate_css_fileadmin\class-ajax.php:217
authwp_ajax_wphb_gutenberg_revert_css_fileadmin\class-ajax.php:219
authwp_ajax_wphb_gutenberg_get_critical_status_for_single_postadmin\class-ajax.php:221
authwp_ajax_wphb_get_critical_status_for_queueadmin\class-ajax.php:224
authwp_ajax_wphb_react_minify_toggle_delay_jsadmin\class-ajax.php:227
authwp_ajax_wphb_react_minify_toggle_critical_cssadmin\class-ajax.php:229
authwp_ajax_wphb_switch_to_critical_css_from_legacyadmin\class-ajax.php:231
authwp_ajax_wphb_search_postsadmin\class-ajax.php:233
authwp_ajax_wphb_reset_exclusionsadmin\class-ajax.php:235
authwp_ajax_wphb_toggle_safe_modeadmin\class-ajax.php:237
authwp_ajax_wphb_discard_safe_modeadmin\class-ajax.php:238
authwp_ajax_wphb_publish_safe_modeadmin\class-ajax.php:239
authwp_ajax_wphb_safemode_has_changesadmin\class-ajax.php:240
authwp_ajax_get_comments_templatecore\modules\class-advanced.php:81
noprivwp_ajax_get_comments_templatecore\modules\class-advanced.php:82
authwp_ajax_wphb_track_deactivationcore\modules\class-mixpanel-analytics.php:50
authwp_ajax_wphb_analytics_track_eventcore\modules\class-mixpanel-analytics.php:52
authwp_ajax_wphb_pro_resend_confirmationcore\pro\class-pro-ajax.php:30
authwp_ajax_wphb_pro_send_confirmationcore\pro\class-pro-ajax.php:31
authwp_ajax_wphb_pro_disable_notificationcore\pro\class-pro-ajax.php:34
authwp_ajax_wphb_pro_enable_notificationcore\pro\class-pro-ajax.php:35
authwp_ajax_wphb_pro_search_userscore\pro\class-pro-ajax.php:36
authwp_ajax_wphb_pro_get_avatarcore\pro\class-pro-ajax.php:37
WordPress Hooks 299
actionadmin_menuadmin\class-admin.php:73
actionnetwork_admin_menuadmin\class-admin.php:74
actionadmin_headadmin\class-admin.php:76
filtersubmenu_fileadmin\class-admin.php:78
actionadmin_enqueue_scriptsadmin\class-admin.php:79
actionadmin_initadmin\class-admin.php:86
actionadmin_initadmin\class-admin.php:97
actionadmin_initadmin\class-admin.php:98
actionadmin_initadmin\class-admin.php:100
actionadmin_footeradmin\class-admin.php:103
filterplugin_row_metaadmin\class-admin.php:109
filterwpmudev_whitelabel_plugin_pagesadmin\class-admin.php:112
actionadmin_footer-plugins.phpadmin\class-admin.php:115
actionupgrader_process_completeadmin\class-notices.php:78
actionactivated_pluginadmin\class-notices.php:79
actiondeactivated_pluginadmin\class-notices.php:80
actionafter_switch_themeadmin\class-notices.php:81
actionadmin_noticesadmin\class-notices.php:84
actionnetwork_admin_noticesadmin\class-notices.php:85
actionadmin_noticesadmin\class-notices.php:86
actionadmin_noticesadmin\class-notices.php:87
actionnetwork_admin_noticesadmin\class-notices.php:96
actionnetwork_admin_noticesadmin\class-notices.php:97
actionnetwork_admin_noticesadmin\class-notices.php:98
actionnetwork_admin_noticesadmin\class-notices.php:99
actionnetwork_admin_noticesadmin\class-notices.php:100
actionnetwork_admin_noticesadmin\class-notices.php:101
actionadmin_noticesadmin\class-notices.php:102
actionadmin_noticesadmin\class-notices.php:104
actionadmin_noticesadmin\class-notices.php:105
actionadmin_noticesadmin\class-notices.php:106
actionadmin_noticesadmin\class-notices.php:107
actionadmin_noticesadmin\class-notices.php:108
actionadmin_noticesadmin\class-notices.php:109
actionadmin_noticesadmin\class-notices.php:110
actionadmin_enqueue_scriptsadmin\class-page.php:241
actionadmin_noticesadmin\class-page.php:242
actionnetwork_admin_noticesadmin\class-page.php:243
filteradmin_body_classadmin\class-page.php:246
filterwphb_query_strings_disabledadmin\pages\class-advanced.php:142
filterwphb_emojis_disabledadmin\pages\class-advanced.php:148
filterwphb_update_notice_textadmin\pages\class-caching.php:403
actionwphb_sui_header_sui_actions_rightadmin\pages\class-caching.php:803
actionadmin_enqueue_scriptsadmin\pages\class-dashboard.php:113
actionwphb_sui_header_sui_actions_rightadmin\pages\class-dashboard.php:170
filterwphb_active_cache_modulesadmin\pages\class-dashboard.php:186
actionadmin_enqueue_scriptsadmin\pages\class-minification.php:39
actionwphb_sui_header_sui_actions_rightadmin\pages\class-minification.php:300
actionwphb_asset_optimization_noticeadmin\pages\class-minification.php:301
actionadmin_enqueue_scriptsadmin\pages\class-settings.php:29
actionwphb_sui_header_sui_actions_rightadmin\pages\class-uptime.php:220
filterwdp_register_hub_actioncore\api\class-hub.php:54
actionrest_api_initcore\api\class-rest.php:45
actionadmin_initcore\class-core.php:69
filterwpmudev_notices_is_disabledcore\class-core.php:70
actioninitcore\class-core.php:81
actionadmin_bar_menucore\class-core.php:135
actionwp_enqueue_scriptscore\class-core.php:137
actionadmin_enqueue_scriptscore\class-core.php:138
filterscript_loader_tagcore\class-core.php:141
actionwpmudev_hub_connector_first_sync_completedcore\class-hub-connector.php:64
filteradmin_body_classcore\class-hub-connector.php:71
filterwpmudev_hub_connector_localize_text_varscore\class-hub-connector.php:72
filterwpmudev_hub_connector_localize_varscore\class-hub-connector.php:73
actionwp_loadedcore\class-logger.php:101
actionwphb_clear_logscore\class-logger.php:104
actionadmin_initcore\class-logger.php:105
actionwp_body_opencore\class-safemode.php:98
actionwpmudev_scheduled_jobscore\externals\hub-connector\inc\class-actions.php:50
actionafter_switch_themecore\externals\hub-connector\inc\class-actions.php:52
actionactivated_plugincore\externals\hub-connector\inc\class-actions.php:56
actiondeactivated_plugincore\externals\hub-connector\inc\class-actions.php:57
actiondeleted_plugincore\externals\hub-connector\inc\class-actions.php:58
actiondeleted_themecore\externals\hub-connector\inc\class-actions.php:59
actionupgrader_process_completecore\externals\hub-connector\inc\class-actions.php:60
actionshutdowncore\externals\hub-connector\inc\class-actions.php:63
filteradmin_body_classcore\externals\hub-connector\inc\class-admin.php:48
actionwpmudev_hub_connector_uicore\externals\hub-connector\inc\class-admin.php:50
actionadmin_initcore\externals\hub-connector\inc\class-admin.php:52
filterextra_plugin_headerscore\externals\hub-connector\inc\class-admin.php:54
filterwpmudev_hub_connector_localize_varscore\externals\hub-connector\inc\class-admin.php:639
actioninitcore\externals\hub-connector\inc\class-remote.php:60
actionrest_api_initcore\externals\hub-connector\inc\class-rest.php:37
filterupgrader_package_optionscore\externals\hub-connector\inc\class-upgrader.php:212
actionwpmudev-recommended-plugins-register-noticecore\externals\plugin-notice\notice.php:270
actionall_admin_noticescore\externals\plugin-notice\notice.php:272
actionadmin_enqueue_scriptscore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:113
filteradmin_body_classcore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:115
actionadmin_menucore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:121
actionnetwork_admin_menucore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:124
filteradmin_footer_textcore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:144
filterupdate_footercore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:147
filteradmin_footer_textcore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:150
actionadmin_headcore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:306
actionadmin_enqueue_scriptscore\externals\plugins-cross-sell-page\app\submenus\class-cross-sell.php:688
actionrest_api_initcore\externals\plugins-cross-sell-page\core\class-rest-api.php:105
actionfusion_cache_reset_aftercore\integration\class-avada.php:23
filterwphb_do_not_run_ao_filescore\integration\class-avada.php:24
filterwphb_should_delay_jscore\integration\class-breakdance.php:23
actionparse_requestcore\integration\class-builders.php:27
actionfl_builder_after_save_layoutcore\integration\class-builders.php:30
actioncornerstone_load_buildercore\integration\class-builders.php:36
actioncornerstone_before_boot_appcore\integration\class-builders.php:37
actioncornerstone_before_custom_endpointcore\integration\class-builders.php:38
actioncornerstone_before_load_previewcore\integration\class-builders.php:39
actioncornerstone_before_boot_appcore\integration\class-builders.php:42
actionacf/save_postcore\integration\class-builders.php:45
filterwp_hummingbird_is_active_module_minifycore\integration\class-builders.php:79
filterwpdef_maybe_redirect_to_mask_login_urlcore\integration\class-defender.php:28
actioninitcore\integration\class-divi.php:24
actionadmin_print_scriptscore\integration\class-divi.php:25
filterwphb_minify_resourcecore\integration\class-divi.php:26
filterwphb_combine_resourcecore\integration\class-divi.php:27
filterwphb_minification_display_enqueued_filecore\integration\class-divi.php:28
filterwphb_post_cache_purgedcore\integration\class-divi.php:29
actionwphb_ajax_get_comments_templatecore\integration\class-divi.php:30
filterwphb_delay_js_exclusionscore\integration\class-divi.php:31
actionwp_headcore\integration\class-divi.php:59
actionwp_headcore\integration\class-divi.php:62
filterwp_hummingbird_is_active_module_minifycore\integration\class-divi.php:66
filterwphb_dont_add_handle_to_collectioncore\integration\class-elementor.php:25
actionelementor/core/files/clear_cachecore\integration\class-elementor.php:26
actionelementor/maintenance_mode/mode_changedcore\integration\class-elementor.php:27
actionupdate_option__elementor_global_csscore\integration\class-elementor.php:28
actiondelete_option__elementor_global_csscore\integration\class-elementor.php:29
filterwphb_validate_handle_versioncore\integration\class-forminator.php:28
filterwphb_api_request_timeoutcore\integration\class-google-site-kit.php:23
filterwphb_dont_add_handle_to_collectioncore\integration\class-gtranslate.php:23
actionadmin_initcore\integration\class-gutenberg.php:36
actionenqueue_block_editor_assetscore\integration\class-gutenberg.php:56
actionadmin_initcore\integration\class-opcache.php:51
actionwphb_clear_cache_urlcore\integration\class-opcache.php:79
actioninitcore\integration\class-oxygenbuilder.php:23
actionsave_postcore\integration\class-oxygenbuilder.php:31
actionwphb_clear_cache_urlcore\integration\class-siteground.php:39
filterwphb_minification_disable_switcherscore\integration\class-siteground.php:42
actionwphb_asset_optimization_noticecore\integration\class-siteground.php:121
filterwphb_query_strings_disabledcore\integration\class-siteground.php:148
filterwphb_emojis_disabledcore\integration\class-siteground.php:152
actionwphb_advanced_tools_noticecore\integration\class-siteground.php:156
filterwphb_should_cache_exitcore\integration\class-the-events-calendar.php:23
filterwcml_is_cache_enabled_for_switching_currencycore\integration\class-wcml.php:30
filterwphb_page_cache_request_uricore\integration\class-weglot.php:47
filterwphb_should_add_critical_csscore\integration\class-woocommerce.php:32
filterwphb_should_delay_jscore\integration\class-woocommerce.php:33
filterwpcore\integration\class-woocommerce.php:34
filterwphb_minify_resourcecore\integration\class-woocommerce.php:35
filterwphb_combine_resourcecore\integration\class-woocommerce.php:36
filterwp_hummingbird_is_active_module_minifycore\integration\class-woocommerce.php:47
filterwphb_should_cache_request_precore\integration\class-wpengine.php:31
actionwphb_clear_cache_urlcore\integration\class-wpengine.php:34
actioninitcore\integration\class-wph.php:26
filterwphb_cache_contentcore\integration\class-wph.php:45
actionwphb_clear_cache_urlcore\integration\class-wpmudev.php:31
filtercron_schedulescore\modules\background\class-hb-background-process.php:82
filtercron_schedulescore\modules\caching\class-background-process.php:71
filteremoji_svg_urlcore\modules\class-advanced.php:72
filtertiny_mce_pluginscore\modules\class-advanced.php:74
actionwphb_hummingbird_cleanupcore\modules\class-advanced.php:78
filteret_builder_load_requestscore\modules\class-advanced.php:86
actionwp_enqueue_scriptscore\modules\class-advanced.php:87
filterpaginate_linkscore\modules\class-advanced.php:89
actionwp_enqueue_scriptscore\modules\class-advanced.php:97
filterscript_loader_srccore\modules\class-advanced.php:101
filterstyle_loader_srccore\modules\class-advanced.php:102
filterwp_resource_hintscore\modules\class-advanced.php:106
filterwp_resource_hintscore\modules\class-advanced.php:109
filtercomments_templatecore\modules\class-advanced.php:113
filterwp_revisions_to_keepcore\modules\class-advanced.php:116
filterwphb_buffercore\modules\class-advanced.php:117
filteroption_page_commentscore\modules\class-advanced.php:954
filtercomments_templatecore\modules\class-advanced.php:955
filteroption_comment_ordercore\modules\class-advanced.php:956
filtercomments_templatecore\modules\class-advanced.php:964
filteroption_page_commentscore\modules\class-advanced.php:996
filteroption_page_commentscore\modules\class-advanced.php:1168
filtercomments_templatecore\modules\class-advanced.php:1180
filteroption_comment_ordercore\modules\class-advanced.php:1187
actioninitcore\modules\class-background-processing.php:66
actioninitcore\modules\class-background-processing.php:67
filterwp_hummingbird_is_active_module_cloudflarecore\modules\class-cloudflare.php:46
actioninitcore\modules\class-cloudflare.php:56
actionwphb_cloudflare_apo_clear_cachecore\modules\class-cloudflare.php:58
actionwphb_cache_directory_clearedcore\modules\class-cloudflare.php:59
actiondeleted_postcore\modules\class-cloudflare.php:62
actiondelete_attachmentcore\modules\class-cloudflare.php:63
actiontransition_post_statuscore\modules\class-cloudflare.php:64
actiontransition_comment_statuscore\modules\class-cloudflare.php:65
actioncomment_postcore\modules\class-cloudflare.php:66
actionswitch_themecore\modules\class-cloudflare.php:70
actioncustomize_save_aftercore\modules\class-cloudflare.php:71
filterwp_hummingbird_is_active_module_critical_csscore\modules\class-critical-css.php:92
filterwp_hummingbird_default_optionscore\modules\class-critical-css.php:93
filterwphb_dont_combine_handlescore\modules\class-critical-css.php:102
filterwphb_should_cache_exitcore\modules\class-critical-css.php:103
filterwphb_buffercore\modules\class-critical-css.php:104
actionwphb_cs_process_queue_croncore\modules\class-critical-css.php:106
actionwphb_cs_ping_queue_croncore\modules\class-critical-css.php:107
actionadmin_initcore\modules\class-critical-css.php:108
actionwp_footercore\modules\class-critical-css.php:109
actionwp_headcore\modules\class-critical-css.php:110
actionafter_switch_themecore\modules\class-critical-css.php:111
filterwphb_minify_resourcecore\modules\class-critical-css.php:112
actioncornerstone_before_boot_appcore\modules\class-delayjs.php:45
actioncornerstone_before_custom_endpointcore\modules\class-delayjs.php:46
actioncs_preview_frame_loadcore\modules\class-delayjs.php:47
filterwphb_buffercore\modules\class-delayjs.php:49
actionwphb_get_delay_js_exclusioncore\modules\class-delayjs.php:55
actionwp_print_footer_scriptscore\modules\class-delayjs.php:58
actionwpmudev_hub_template_footercore\modules\class-delayjs.php:60
actionadmin_initcore\modules\class-delayjs.php:63
actionwphb_load_exclusion_list_schedule_single_eventcore\modules\class-delayjs.php:64
filterwphb_minify_resourcecore\modules\class-delayjs.php:65
filterwp_hummingbird_is_active_module_gravatarcore\modules\class-gravatar.php:43
filterget_avatar_datacore\modules\class-gravatar.php:70
filterwp_hummingbird_is_active_module_minifycore\modules\class-minify.php:140
filterwphb_dont_add_handle_to_collectioncore\modules\class-minify.php:142
filterwphb_block_resourcecore\modules\class-minify.php:143
filterwphb_minify_resourcecore\modules\class-minify.php:144
filterwphb_combine_resourcecore\modules\class-minify.php:145
filterwphb_defer_resourcecore\modules\class-minify.php:146
filterwphb_inline_resourcecore\modules\class-minify.php:147
filterwphb_preload_resourcecore\modules\class-minify.php:148
filterwphb_async_resourcecore\modules\class-minify.php:149
filterwphb_send_resource_to_footercore\modules\class-minify.php:150
filterwphb_cdn_resourcecore\modules\class-minify.php:151
filterwphb_minify_scan_urlcore\modules\class-minify.php:152
filterwphb_minification_display_enqueued_filecore\modules\class-minify.php:155
filterstyle_loader_tagcore\modules\class-minify.php:158
actiontemplate_redirectcore\modules\class-minify.php:161
filterwphb_block_resourcecore\modules\class-minify.php:167
filterwphb_minify_resourcecore\modules\class-minify.php:168
filterwphb_combine_resourcecore\modules\class-minify.php:169
actioninitcore\modules\class-minify.php:209
actionbefore_delete_postcore\modules\class-minify.php:210
actionwphb_minify_process_queuecore\modules\class-minify.php:212
actionwp_enqueue_scriptscore\modules\class-minify.php:214
actionwphb_process_fontscore\modules\class-minify.php:217
actionlogin_initcore\modules\class-minify.php:220
filterprint_styles_arraycore\modules\class-minify.php:232
filterprint_scripts_arraycore\modules\class-minify.php:233
actionwp_footercore\modules\class-minify.php:234
filterwp_resource_hintscore\modules\class-minify.php:236
filterstyle_loader_tagcore\modules\class-minify.php:241
filterwp_hummingbird_is_active_module_mixpanel_analyticscore\modules\class-mixpanel-analytics.php:48
actionwphb_mixpanel_usage_tracking_value_updatecore\modules\class-mixpanel-analytics.php:49
actionadmin_initcore\modules\class-mixpanel-analytics.php:51
actionadmin_initcore\modules\class-page-cache.php:96
actioninitcore\modules\class-page-cache.php:98
actionwphb_page_cache_preload_pagecore\modules\class-page-cache.php:100
actionwphb_clear_page_cachecore\modules\class-page-cache.php:112
actionwp_update_nav_menucore\modules\class-page-cache.php:113
actionwphb_clear_cache_urlcore\modules\class-page-cache.php:114
actionedit_postcore\modules\class-page-cache.php:117
actiontransition_post_statuscore\modules\class-page-cache.php:118
actionpost_submitbox_misc_actionscore\modules\class-page-cache.php:121
filterpost_updated_messagescore\modules\class-page-cache.php:122
actioncomment_postcore\modules\class-page-cache.php:125
actionupdate_option_page_on_frontcore\modules\class-page-cache.php:128
actionupdate_option_page_for_postscore\modules\class-page-cache.php:129
actionwd_save_setting_security_headerscore\modules\class-page-cache.php:132
actionsave_post_wp_navigationcore\modules\class-page-cache.php:135
actioncustomize_save_aftercore\modules\class-page-cache.php:138
filterwidget_update_callbackcore\modules\class-page-cache.php:139
actionsave_post_wp_global_stylescore\modules\class-page-cache.php:141
filterwp_hummingbird_is_active_module_page_cachecore\modules\class-page-cache.php:155
actiontemplate_redirectcore\modules\class-page-cache.php:156
actionwphb_init_performance_scancore\modules\class-performance.php:33
filterwp_hummingbird_is_active_module_rediscore\modules\class-redis.php:36
filterwp_hummingbird_redis_errorcore\modules\class-redis.php:38
actionwphb_deactivatecore\modules\class-redis.php:41
actionwp_feed_optionscore\modules\class-rss.php:32
filterwp_hummingbird_is_active_module_uptimecore\modules\class-uptime.php:32
filterwphb_buffercore\modules\minify\class-fonts.php:36
filterwphb_minify_file_contentcore\modules\minify\class-fonts.php:37
filterwp_hummingbird_default_optionscore\modules\minify\class-fonts.php:38
actionwphb_minify_clear_filescore\modules\minify\class-housekeeper.php:32
filterupload_mimescore\modules\minify\class-minify-group.php:1431
actionwp_headcore\modules\minify\class-minify-group.php:1780
filterscript_loader_tagcore\modules\minify\class-minify-group.php:1816
filterscript_loader_tagcore\modules\minify\class-minify-group.php:1830
actionwp_headcore\modules\minify\class-minify-group.php:1868
actionwp_footercore\modules\minify\class-minify-group.php:1880
actionwp_headcore\modules\minify\class-minify-group.php:1933
actionwp_footercore\modules\minify\class-minify-group.php:1945
filterscript_loader_tagcore\modules\minify\class-minify-group.php:1981
filterscript_loader_tagcore\modules\minify\class-minify-group.php:1995
actionwphb_admin_do_meta_boxes_wphbcore\pro\admin\class-pro-admin.php:44
actionwphb_admin_do_meta_boxes_wphb-notificationscore\pro\admin\class-pro-admin.php:47
actionwphb_activatecore\pro\modules\class-reports.php:43
actionwphb_admin_do_meta_boxes_wphb-notificationscore\pro\modules\class-reports.php:44
filteroption_page_commentscore\views\comment-template.php:33
actionadmin_noticeswp-hummingbird.php:99
actionnetwork_admin_noticeswp-hummingbird.php:100
actioninitwp-hummingbird.php:165
actioninitwp-hummingbird.php:166
actioninitwp-hummingbird.php:167
actionadmin_initwp-hummingbird.php:211
actionplugins_loadedwp-hummingbird.php:355

Scheduled Events 13

wphb_database_report
wphb_clear_logs
wphb_hummingbird_cleanup
wphb_cs_process_queue_cron
wphb_cs_ping_queue_cron
wphb_get_delay_js_exclusion
wphb_load_exclusion_list_schedule_single_event
wphb_minify_process_queue
wphb_minify_clear_files
wphb_database_report
wphb_performance_report
wphb_performance_report
wphb_uptime_report
Maintenance & Trust

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2
Last updatedJul 20, 2026
PHP min version7.4
Downloads5.7M

Community Trust

Rating94/100
Number of ratings1,488
Active installs70K
Alternatives

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Alternatives

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

wp-optimize

A
92

Get caching and more with this powerful cache plugin. Cache, optimize images, clean your database and minify for maximum performance.

1.0M 5 CVEs
WP Super Cache

WP Super Cache

wp-super-cache

A
95

A very fast caching engine for WordPress that produces static html files.

1.0M 12 CVEs
Breeze Cache

Breeze Cache

breeze

A
89

Breeze is a caching plugin developed by Cloudways. Breeze uses advance caching systems to improve site loading times exponentially.

400K 10 CVEs
Redis Object Cache

Redis Object Cache

redis-cache

A
100

A persistent object cache backend powered by Redis®¹. Supports Predis, PhpRedis, Relay, replication, sentinels, clustering and WP-CLI.

400K No CVEs
Jetpack Boost – Website Speed, Performance and Critical CSS

Jetpack Boost – Website Speed, Performance and Critical CSS

jetpack-boost

A
99

Speed up your WordPress site with one-click optimizations like Page Cache, Critical CSS, and Image CDN to improve Core Web Vitals.

200K 2 CVEs
Developer Profile

Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Developer Profile

WPMU DEV - Your All-in-One WordPress Platform

9 plugins · 2.4M total installs

73
trust score
Avg Security Score
91/100
Avg Patch Time
352 days
View full developer profile
Detection Fingerprints

How We Detect Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/hummingbird-performance/admin/assets/css/common.min.css/wp-content/plugins/hummingbird-performance/admin/assets/css/dashboard.min.css/wp-content/plugins/hummingbird-performance/admin/assets/css/free.min.css/wp-content/plugins/hummingbird-performance/admin/assets/js/common.min.js/wp-content/plugins/hummingbird-performance/admin/assets/js/dashboard.min.js/wp-content/plugins/hummingbird-performance/admin/assets/js/free.min.js/wp-content/plugins/hummingbird-performance/admin/modules/performance/assets/css/performance.min.css/wp-content/plugins/hummingbird-performance/admin/modules/performance/assets/js/performance.min.js+5 more
Generator Patterns
Hummingbird
Script Paths
hummingbird-performance/admin/assets/js/common.min.jshummingbird-performance/admin/assets/js/dashboard.min.jshummingbird-performance/admin/assets/js/free.min.jshummingbird-performance/admin/modules/performance/assets/js/performance.min.jshummingbird-performance/modules/asset-optimization/assets/js/asset-optimization.min.jshummingbird-performance/modules/minify/assets/js/minify-settings.min.js+1 more
Version Parameters
hummingbird-performance/admin/assets/css/common.min.css?ver=hummingbird-performance/admin/assets/css/dashboard.min.css?ver=hummingbird-performance/admin/assets/css/free.min.css?ver=hummingbird-performance/admin/assets/js/common.min.js?ver=hummingbird-performance/admin/assets/js/dashboard.min.js?ver=hummingbird-performance/admin/assets/js/free.min.js?ver=hummingbird-performance/admin/modules/performance/assets/css/performance.min.css?ver=hummingbird-performance/admin/modules/performance/assets/js/performance.min.js?ver=hummingbird-performance/modules/asset-optimization/assets/css/asset-optimization.min.css?ver=hummingbird-performance/modules/asset-optimization/assets/js/asset-optimization.min.js?ver=hummingbird-performance/modules/minify/assets/js/minify-settings.min.js?ver=hummingbird-performance/modules/minify/assets/css/minify-settings.min.css?ver=hummingbird-performance/modules/minify/assets/js/minification-header.min.js?ver=

HTML / DOM Fingerprints

CSS Classes
sui-tab-itemsui-tab-item--activesui-noticesui-buttonsui-accordionsui-accordion-itemsui-accordion-titlesui-accordion-content+2 more
HTML Comments
<!-- wp:hummingbird-performance/performance-report --><!-- wp:hummingbird-performance/uptime-monitor --><!-- Hummingbird Assets --><!-- end Hummingbird Assets -->+4 more
Data Attributes
data-a11y-dialog-headlinedata-iddata-moduledata-plugindata-typedata-modal-open+8 more
JS Globals
HummingbirdAdminhbDashboardwpHummingbird
REST Endpoints
/wp-json/hummingbird/v1/performance/scan/wp-json/hummingbird/v1/performance/report/wp-json/hummingbird/v1/uptime/scan/wp-json/hummingbird/v1/uptime/report/wp-json/hummingbird/v1/assets/optimize
FAQ

Frequently Asked Questions about Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN