DEV Community: Piotr

Clean and Optimize Your WordPress Database Safely (No Bloat, No Risk)

Piotr — Wed, 19 Aug 2026 21:07:57 +0000

GOMAX ULTIMATE 5.44.0 adds a built-in database cleanup and optimization tool that reports exactly what bloat is sitting in your WordPress database — old revisions, expired transients, trashed posts, spam comments, orphaned metadata — then clears the categories you choose (dry-run first) and optimizes your tables to reclaim wasted space, all on your own server. Over time every WordPress database fills with junk that slows queries and inflates backups; now you can see it and safely remove it without another plugin sending your data anywhere.

The catch with database cleanup is trust: delete the wrong rows and you break your site. GOMAX handles that by previewing every cleanup, keeping recent revisions, and using WordPress's own delete functions so related data is never left orphaned.

Key takeaways

See the bloat first. analyze reports counts for revisions, auto-drafts, trashed posts, spam/trashed comments, pingbacks, expired transients, oEmbed cache and orphaned post/comment/term meta — plus each table's size and reclaimable overhead.
Clean only what you choose. Pick the categories to clear; everything is dry-run by default so you preview before anything is deleted.
Safe by design. Revisions keep the newest few per post, and posts/comments are removed through WordPress's delete APIs so nothing is left orphaned.
Reclaim space. optimize_tables runs OPTIMIZE TABLE to recover the overhead left behind after big deletes.
Set and forget. An optional daily auto-clean keeps the database tidy — off by default, and entirely on your own server.

What actually bloats a WordPress database

Most of it accumulates silently:

Post revisions — every save can create one; a single old page might have dozens.
Auto-drafts and trashed posts — abandoned drafts and "deleted" content that still lives in the database.
Spam and trashed comments — often the largest table on a busy blog.
Expired transients — temporary cached values that were supposed to expire but linger in the options table.
Orphaned metadata — post/comment/term meta whose parent was deleted, left behind by plugins that didn't clean up.
oEmbed cache and pingbacks/trackbacks — more low-value rows.

None of this is doing useful work, but it all makes queries slower and backups bigger.

Cleaning without the risk

The workflow is deliberately cautious:

Analyze to see the counts and table overhead. 2. Cleanup as a dry-run to confirm exactly how many items each category would remove. 3. Cleanup for real by passing dry_run:false. Revisions keep the newest keep_revisions per post, posts and comments are deleted with WordPress's own functions (so their meta and relationships go too), and big categories are removed in batches you can repeat until they're clear. 4. Optimize tables to reclaim the freed space.

Because it runs on your own database and never sends anything out, it fits a pay-once, self-hosted, privacy-first approach — no cloud service, no subscription, no data leaving your site.

Pairs with performance

A bloated database is a common hidden cause of slow response times, and oversized autoloaded options in particular drag every page load. This module pairs naturally with GOMAX's performance auditor: the auditor flags the symptom (slow TTFB, heavy autoload), and the database tool clears the cause.

Frequently asked questions

Is it safe to delete post revisions and transients? Yes. Expired transients are meant to be discarded and WordPress regenerates them as needed. Revisions are just old copies — and the tool keeps the newest few per post by default, so you retain recent history. Everything is previewed with a dry-run before deletion.

Will cleanup break my site or leave orphaned data? No. Posts and comments are removed using WordPress's own delete functions, so their metadata and relationships are cleaned up too. Orphaned-meta categories specifically target rows whose parent is already gone.

Does this send my database anywhere? No. It operates only on your own database on your own server. Nothing is sent to GOMAX or any vendor cloud — it's a self-hosted, pay-once tool.

What does optimizing tables do? After large deletions, tables can hold empty "overhead" space. OPTIMIZE TABLE compacts them to reclaim that space, which can shrink your database and speed up queries.

Can it run automatically? Yes. There's an optional daily auto-clean that clears your chosen categories a batch at a time. It's off by default, so nothing runs until you enable it.

Find and Fix Broken Links in WordPress, Self-Hosted and Fast

Find and Fix Broken Links in WordPress, Self-Hosted and Fast

Piotr — Mon, 17 Aug 2026 21:08:18 +0000

GOMAX ULTIMATE 5.43.0 adds a built-in broken-link and broken-image checker: it inventories every link and image in your published content, verifies them in resumable batches so it never times out, shows you exactly which are dead and which posts they appear in, and lets you fix a bad URL everywhere at once â€” all from inside your own site, with the results stored in your own database. Dead links quietly hurt SEO and trust; now you can find and fix them without a third-party service.

Traditional broken-link checkers either run heavy background scans that slow your site or send your content to a cloud service. GOMAX does neither: it builds the link inventory from your database, checks links only when you (or an optional daily batch) ask, and caches results so re-checks are cheap.

Key takeaways

Full inventory. It collects the links and images from your posts, pages and products into one list, noting whether each is internal or external.
Resumable, cached checks. Links are verified in small batches (HEAD first, GET fallback, short timeouts). Call it repeatedly until everything's checked â€” no timeouts, no hammering.
Actionable results. Broken links are reported with their HTTP status and the exact posts they appear in, so you know where to fix them.
Bulk fix in one step. Replace a dead URL across all your content at once, with a dry-run preview first â€” or add a redirect.
Self-hosted. The inventory and results live in your database; the only outbound requests are the link checks themselves.

Why broken links matter

Every dead link is a small tax on your site. For visitors it's a frustrating dead end; for search engines it's a signal that a page isn't well maintained, and broken outbound links can dilute the trust your content passes on. Broken images look even worse â€” they're visible failures on the page. The problem is that links rot silently: a partner renames a page, a product URL changes, an image gets deleted, and nothing tells you until a visitor hits it.

A regular check catches this early. The trick is doing it without bogging down your site or shipping your content to someone else's servers â€” which is exactly what a first-party checker is for.

How it works

The workflow is three simple steps:

Collect. Build or refresh the inventory from your content. This is a fast, database-only pass that lists every link and image and which posts use it.
Check. Verify the links in resumable batches. Each check uses a HEAD request with a GET fallback (many servers mishandle HEAD), a short timeout, and caches the result so it isn't re-checked until it's stale. Run it until nothing is left unchecked.
Fix. Review the broken list â€” each entry shows the status code and the posts it appears in â€” then either bulk-replace the URL across your content (with a dry-run preview) or add a redirect for a moved internal page.

If you'd rather not think about it, enable the optional daily auto-check and GOMAX will keep the inventory fresh a small batch at a time. It's off by default, so no outbound traffic happens unless you ask for it.

Fixing at scale

The bulk replace is the time-saver. When a URL has moved, you don't have to open every post â€” replace it once and GOMAX updates every place it appears, after showing you exactly which posts will change. For moved internal pages, a redirect is often the cleaner fix, and the broken-link report points you there too.

Frequently asked questions

Will the checker slow down my website?
No. Building the inventory is a database-only operation, and link checking runs in small resumable batches that you trigger (or an optional daily batch). It doesn't run heavy scans on every page load, and results are cached so re-checks are cheap.

Does it send my content to an external service?
No. The inventory and all results are stored in your own database. The only outbound requests are the link checks themselves â€” GOMAX visiting each URL to see if it responds â€” and nothing about your site is sent to GOMAX or a vendor cloud.

Can it fix broken links, or only find them?
Both. It reports every broken link with the posts it appears in, and you can bulk-replace a URL across all your content in one step (with a dry-run preview first) or add a redirect for a moved internal page.

Does it check images too?
Yes. It inventories both links () and images (), so broken images are caught alongside dead links.

Why does checking happen in batches?
So it never times out on large sites. Each run verifies a capped number of links and remembers where it left off, so you call it repeatedly until everything's checked. Cached results mean subsequent runs only re-check links that have gone stale.

Audit Core Web Vitals in WordPress Without PageSpeed or a Cloud Service

Piotr — Sat, 15 Aug 2026 21:08:19 +0000

GOMAX ULTIMATE 5.42.0 adds a built-in Core Web Vitals auditor that reads your own rendered pages and your server environment, then returns a 0-100 performance score with each issue mapped to a specific vital and a concrete fix â€” without calling Google PageSpeed, Lighthouse, or any external service. It catches the front-end and server problems that actually move LCP, CLS and INP, and it does it entirely on your own site.

Most "speed test" tools send your URL to a cloud service, run one lab test, and hand you a number. That's useful occasionally, but it means your pages leave your server and you can't audit staging or members-only pages. GOMAX takes a different route: it analyses the same HTML a browser receives, plus your WordPress environment, locally.

Key takeaways

Score pages and the site. Audit a single URL, post or path, or sample your key pages for an overall score and the issues that recur across the theme.
Mapped to the vitals. Every finding is tied to LCP, CLS, INP or TTFB, so you know which metric you're improving.
Front-end and server together. It checks markup (image dimensions, render-blocking assets, lazy loading, DOM size, fonts) and environment (page cache, object cache, PHP version, compression, autoloaded options).
Concrete fixes. Each issue includes a plain fix â€” add width/height, defer head scripts, enable a page cache, upgrade PHP.
No cloud, no hammering. No external PageSpeed/Lighthouse call and no third-party assets are fetched. Nothing leaves your server.

What it checks

On the front end, parsed straight from the rendered HTML:

Layout shift (CLS): images and iframes missing width/height (or an aspect-ratio), and web fonts loaded without display=swap.
Largest paint (LCP): render-blocking scripts in the `withoutdefer/async, too many blocking stylesheets, below-the-fold images that aren't lazy-loaded, missingpreconnect` for third-party origins, and legacy JPG/PNG images that could be WebP/AVIF.
Interactivity (INP): an excessively large DOM and heavy inline CSS/JS.

On the server, read from your WordPress environment:

Whether a page cache is active (it detects common caching plugins and cache drop-ins).
Whether a persistent object cache (Redis/Memcached) is in use.
Your PHP version, whether responses are gzip/brotli compressed, and how big your autoloaded options are (a common hidden cause of slow TTFB).

Why local and first-party is the right call

A single external lab score is easy to game and easy to misread. What reliably predicts good Core Web Vitals in the field is following the well-known best practices â€” reserving space for media, not blocking the first paint, caching, and a modern PHP. GOMAX audits exactly those signals from your own markup and environment, so you get an actionable checklist rather than one opaque number, and you can run it on any page including ones you'd never expose to a public tester. It fits a pay-once, privacy-first product: no per-scan metering, no data leaving the site.

From score to fixes

Because each issue names the vital it affects and the fix, the workflow is simple: run scan_site, look at the top recurring issues (they're usually theme- or plugin-level and fixing one helps every page), apply the fixes, and re-scan to confirm the score moved. Pair it with the built-in accessibility auditor and SEO tools and you're covering the three things search engines and users care about most â€” speed, accessibility and findability â€” from one plugin.

Frequently asked questions

Is this the same as a Google PageSpeed or Lighthouse score?
No. Those run a lab test in a headless browser and measure timings. This auditor checks the best-practice signals that predict Core Web Vitals from your HTML and server, without calling any external service. It's an actionable hygiene score, not a lab measurement â€” use both if you like.

Does scanning send my pages to a third party?
No. It fetches and analyses your own pages on your own server and reads your WordPress environment locally. No external performance API is used and no third-party assets are downloaded.

Which issues should I fix first?
Start with the "serious" ones â€” render-blocking head scripts, missing image dimensions, and no page cache â€” and with any issue that appears on many pages in a site scan, since those are usually theme- or plugin-level and fixing them helps everywhere.

Will it tell me if my caching or PHP is the problem?
Yes. retrieve_server_health (and every page scan) reports whether a page cache and object cache are active, your PHP version, whether compression is on, and how large your autoloaded options are â€” common server-side causes of slow response times.

Can I track improvements over time?
Yes. Every scan is scored and stored, so list_scan_history shows the trend as you apply fixes.

Audit WordPress Accessibility (WCAG) Without an External Service

Piotr — Thu, 13 Aug 2026 21:08:17 +0000

GOMAX ULTIMATE 5.41.0 adds a built-in accessibility auditor that reads your own rendered WordPress pages, checks them against WCAG 2.1, and returns a 0-100 score with each issue mapped to a specific success criterion and a fix â€” no external scanning service, no data leaving your site. It also generates a ready-to-publish accessibility statement, which laws like the European Accessibility Act increasingly expect.

Accessibility has moved from "nice to have" to "legally required" for a lot of businesses. But most WordPress owners either paste in a third-party overlay widget (which experts widely criticize) or send their URLs to an external scanner. GOMAX takes the opposite approach: the audit runs inside the plugin you already own, on your own server.

Key takeaways

Scan any page or the whole site. Audit one URL, post or path, or sample your key pages for a site-wide score and the issues that recur most.
Every issue is WCAG-mapped. Sixteen machine-detectable checks, each tied to a success criterion, with a count, sample offenders and a concrete fix.
A score you can track. Each scan returns a 0-100 score and grade, with history so you can watch it improve.
A statement you can publish. Generate an accessibility statement targeting WCAG 2.1 A/AA/AAA, prefilled with your contact and latest results.
Honest about limits. Automated checks catch roughly 40% of WCAG issues; contrast and reading order are flagged for manual review rather than faked.

What it checks

The auditor parses your page's HTML and flags the issues that can be detected reliably from markup, including:

Images without alt text (WCAG 1.1.1)
Form controls with no accessible name â€” inputs, selects and textareas lacking a label or aria-label (1.3.1, 4.1.2)
Empty links and buttons â€” icon-only controls with no text or aria-label (2.4.4, 4.1.2)
A zoom-blocking viewport â€” user-scalable=no or a capped maximum-scale (1.4.4)
Heading problems â€” missing or multiple ``, or skipped levels (1.3.1, 2.4.6)
Missing landmarks, page language or title, and no skip link (1.3.1, 2.4.1, 3.1.1, 2.4.2)
Untitled iframes, header-less data tables, duplicate ids, positive tabindex, generic link text and autoplaying media

Each finding comes with a plain-language fix â€” for example, "give every field a label or aria-label," or "remove positive tabindex and rely on natural DOM order."

Why in-plugin and self-hosted matters

Sending every page to an external accessibility API means your content â€” including unpublished or members-only pages â€” leaves your server. Overlay widgets, meanwhile, don't fix the underlying markup and can even introduce new barriers. A first-party auditor avoids both problems: it reads the same HTML a browser would, reports real issues against the actual standard, and keeps everything on your own site. That fits a pay-once, privacy-first product with no per-scan metering.

From audit to statement

Once you've scanned, you can generate an accessibility statement in one step. It states your commitment, your target conformance level (A, AA or AAA), a feedback contact, and a note that the site is assessed with automated and manual review â€” reflecting your latest score. Publish it at a page like /accessibility and link it in your footer. It's a starting point to adapt to your exact legal obligations, not legal advice.

Frequently asked questions

Does this replace a full manual accessibility audit?
No, and it doesn't pretend to. Automated tools reliably catch roughly 40% of WCAG issues â€” things like missing alt text and unlabeled fields. Colour contrast and reading order still need a human, so the auditor reports those as manual checks rather than guessing.

Is it better than an accessibility overlay widget?
Overlays sit on top of your site and don't fix the underlying HTML; accessibility experts broadly recommend against relying on them. This auditor instead shows you the real markup issues so you (or the AI assistant) can fix them at the source.

Will scanning send my pages to a third party?
No. The auditor fetches and analyzes your own pages on your own server. No external accessibility service is used and nothing leaves your site.

Does it help with the European Accessibility Act?
It helps you find and track WCAG issues and generate an accessibility statement, both of which support EAA-style requirements. It is a tool, not legal advice â€” confirm your specific obligations for your business.

Can I scan the whole site or just one page?
Both. Scan a single URL, post or path, or run a site scan that samples your home page, shop and recent content to produce an overall score and the top recurring issues to fix first.

Handle GDPR Data Requests and Retention in WordPress, Self-Hosted

Piotr — Wed, 12 Aug 2026 21:07:55 +0000

GOMAX ULTIMATE 5.40.0 plugs directly into WordPress's own Export and Erase Personal Data tools and adds automatic data-retention purges, so when someone asks "what do you hold on me?" or "delete my data," the answer covers your leads, messages and form entries too â€” and old personal data is cleaned up on a schedule, all on your own site. Two of the trickiest parts of GDPR â€” data-subject requests and data minimization â€” become built-in, not a scramble across half a dozen plugins.

Most WordPress owners can technically run a data export or erasure from Tools â†’ Export/Erase Personal Data. The problem is coverage: core only knows about the data it stores. Your CRM leads, contact-form entries and sent messages are invisible to it unless each plugin registers with the privacy API. GOMAX now does exactly that â€” and goes further with retention.

Key takeaways

Native DSAR coverage. GOMAX registers with WordPress's built-in personal-data exporter and eraser, so requests you run from Tools â†’ Export/Erase Personal Data automatically include GOMAX leads, messages and form entries.
One erasure engine. The same logic powers the WordPress tools and the GOMAX export_personal_data / erase_personal_data actions â€” consistent results whichever way a request comes in.
WooCommerce orders are protected. Orders are preserved for legal retention and reported, never silently deleted.
Automatic data-retention purges. Set how many days to keep leads, messages and form entries; a daily job deletes anything older. Zero days means keep forever.
Preview before you purge. A dry-run shows exactly what would be removed before anything is deleted â€” and it all stays on your server.

Why this matters for compliance

GDPR gives people the right to access their data and the right to be forgotten, and it expects organizations to practise data minimization â€” not keeping personal data longer than necessary. Those are two different obligations, and WordPress out of the box only partly helps with the first and not at all with the second.

By registering with the WordPress privacy API, GOMAX makes the official workflow complete: an admin fulfilling a request through Tools â†’ Erase Personal Data now erases the requester's GOMAX records in the same pass, and an export request returns them grouped and labelled. There's nothing extra to remember and no separate export to stitch together by hand.

Data-subject requests, done right

Run a request the way you already do â€” from WordPress Tools, or via GOMAX's own actions if you're driving it through an AI assistant. Either way:

Access / portability: everything GOMAX holds for the email is returned â€” leads and their activity, messages sent to them, and any native form entries that contain the address.
Erasure: those first-party records are deleted, and the response tells you plainly what was removed and what was retained (WooCommerce orders, for legal reasons).
Safety first: the GOMAX erase action is dry-run by default, so you always see the plan before committing.

Data retention: keep only what you need

The new retention engine is where minimization becomes automatic. Choose a window per data type â€” for example keep leads 365 days, messages 180 days, form entries 90 days â€” and enable it. From then on a daily job removes anything past its window, and every purge is logged. Prefer to keep something indefinitely? Set its window to zero.

Before enabling, run the purge as a dry-run to see counts for exactly what would be deleted. Nothing leaves your site at any point; the purge runs against your own database on your own schedule.

Frequently asked questions

Does this work with the normal WordPress privacy tools?
Yes â€” that's the whole point. GOMAX registers with WordPress's native personal-data exporter and eraser, so requests you run from Tools â†’ Export/Erase Personal Data automatically include GOMAX leads, messages and form entries alongside core data.

Will erasing a person's data delete their WooCommerce orders?
No. Orders are preserved for legal retention and reported in the result, never deleted. GOMAX only removes its own first-party records (leads, messages, form entries).

What does data retention actually delete?
Whatever you configure: leads (and their activity), sent messages, and native form entries older than the day-count you set for each. Zero days means that store is kept forever. A daily job runs the purge when retention is enabled.

Can I see what will be removed before it happens?
Yes. Both erasure and the retention purge support a dry-run that returns exact counts, so you can review before anything is deleted.

Where does any of this data go?
Nowhere but your own site. GOMAX ULTIMATE is self-hosted and privacy-first â€” exports, erasures and purges all run on your WordPress install, and nothing is ever sent to GOMAX or a vendor cloud.

WordPress Webhooks Without Zapier: Signed, First-Party, Self-Hosted

Piotr — Mon, 10 Aug 2026 21:07:55 +0000

GOMAX ULTIMATE 5.39.0 lets your WordPress site POST a signed JSON event straight to any URL you choose â€” your own server, n8n, Make, Zapier or a Slack relay â€” the moment an order, lead, review or low-stock warning happens, with no middleman subscription and no data ever passing through a vendor cloud. You point a webhook at an endpoint, pick the events, and GOMAX delivers them reliably with a signing secret, automatic retries and a delivery log.

Webhooks are how modern software talks to itself: "this happened, here's the data, do something." On WordPress that usually means renting a connector service that sits between your site and your tools, watching your data go by. GOMAX flips that â€” the webhook fires from your site directly to your endpoint, and nothing is in the middle.

Key takeaways

Fire events to your own URLs. New order, order status change, order completed, new lead, low stock, new user, published post, new comment/review â€” delivered as JSON to the endpoints you configure.
Every delivery is signed. GOMAX signs the body with a per-webhook secret using HMAC-SHA256, so your receiver can verify the request genuinely came from your site.
Reliable by design. Delivery is asynchronous (it never slows down the shopper or the admin), with automatic retry and exponential backoff, plus a delivery log you can inspect and replay.
No middleman, pay-once. There's no per-task metering and no third-party connector â€” events go straight from your WordPress install to your destination.
You stay in control. Two GPT permissions (read and manage) are off by default, and events only ever go to the URLs you set.

Why "first-party" webhooks matter

Connector platforms are convenient, but they mean your orders, customer emails and lead details flow through someone else's servers, often on a monthly plan that charges per task. For a store that values privacy â€” or just doesn't want another subscription â€” that's the wrong trade.

A first-party webhook removes the intermediary. When an order is created, your site signs the event and POSTs it to, say, your self-hosted n8n instance or a small script on your own VPS. The data goes from you to you. That fits a pay-once, self-hosted philosophy exactly: the capability lives inside the plugin you already own, and the events reach only the endpoints you trust.

How it works

Create a webhook with the URL and the events you care about, and GOMAX returns a signing secret â€” once. From then on, whenever a matching event occurs, GOMAX builds a JSON payload like this and POSTs it to your URL:

Headers include X-GOMAX-Event, X-GOMAX-Delivery, X-GOMAX-Timestamp and X-GOMAX-Signature: sha256=â€¦.
The signature is HMAC-SHA256("{timestamp}.{raw body}", secret). Your receiver recomputes it with the shared secret and compares â€” if they match, the event is authentic and hasn't been tampered with.
The body carries the event name and a data object (for an order: id, number, status, total, currency, customer email, and more).

Delivery happens after the response is sent to the visitor, so checkout and admin actions never wait on your endpoint. If your receiver is down or returns an error, GOMAX retries with increasing delays and records every attempt â€” status, HTTP code and error â€” in a delivery log you can review, and you can replay any delivery on demand.

What you can build with it

Push new orders into a self-hosted dashboard, spreadsheet or accounting tool.
Send new leads to your CRM or a Slack/Discord channel the instant they're captured.
Trigger an n8n or Make flow on low stock to reorder or notify a supplier.
Post a message when a new review lands, or when a specific post goes live.

Because it's plain signed HTTP, anything that can receive a POST can consume it â€” no proprietary SDK required.

Frequently asked questions

Do I need Zapier or another connector service?
No. That's the point. GOMAX delivers events directly from your WordPress site to your own endpoint. Zapier, Make or n8n can receive the webhook if you want to build a flow there, but nothing has to sit between your site and your data.

How does my receiver know the event is genuine?
Each delivery is signed with your webhook's secret using HMAC-SHA256 over "{timestamp}.{body}", sent in the X-GOMAX-Signature header. Your endpoint recomputes the signature with the same secret and compares â€” a match proves authenticity and integrity, and the timestamp lets you reject replays.

Will webhooks slow down my checkout or admin?
No. Deliveries run asynchronously after the page response is sent, so the shopper and the admin never wait on your endpoint. Failures retry in the background with exponential backoff.

What happens if my endpoint is temporarily down?
GOMAX retries automatically with increasing delays and logs every attempt with its HTTP status. You can also inspect the delivery log and manually replay any delivery once your endpoint is back.

Where does the event data go?
Only to the URLs you configure. GOMAX ULTIMATE is self-hosted and privacy-first â€” no event data is ever sent to GOMAX or any vendor cloud.

Give AI Shopping Agents a Real Price Quote Before Checkout

Piotr — Sun, 09 Aug 2026 21:08:19 +0000

An AI shopping agent can now get a full, accurate price quote for a WooCommerce cart â€” line prices, tax, coupon discount and a shipping estimate â€” before it ever sends the buyer to your checkout, and it happens entirely on your own site with no Stripe integration and no card data touching anything but your store. GOMAX ULTIMATE 5.38.0 adds the "quote" step of agentic commerce, the piece that lets ChatGPT, Gemini or Perplexity tell a shopper exactly what they'll pay before they click buy.

Discovery and a pre-filled checkout link were already there. The missing link was the number in the middle: a quote. Without it, an agent can find your product and hand the buyer a checkout URL, but it can't answer "so what's my total, with tax and shipping to my address, if I use code SAVE10?" Now it can.

Key takeaways

create_quote prices a cart the way checkout will: per-line price and tax, coupon discount, a shipping estimate for the buyer's destination, and a totals breakdown â€” plus a ready, signed checkout URL.
validate_coupon tells an agent whether a code is real, expired, over its usage limit, or below its minimum spend â€” and how much it actually saves.
retrieve_shipping_options returns the shipping methods and costs available to a destination, read straight from your WooCommerce shipping zones.
retrieve_product gives an agent deep detail â€” full description, every variation, attributes, gallery, dimensions, cross-sells â€” so it can answer buyer questions accurately.
Every one of these is computed read-only: no cart is mutated, no order is created, nothing is charged. Payment always completes on your own checkout, and no card data ever passes through GOMAX. No Stripe required.

Why a quote is the piece that was missing

Agentic commerce standards (ACP/UCP) describe a simple flow: an agent discovers products, requests a quote, then the buyer pays. Most WordPress setups can do discovery (a product feed) and payment (the normal checkout), but nothing in between. So the agent is flying blind on price â€” it can't confirm the tax for the buyer's country, whether a coupon is valid, or what shipping will cost.

GOMAX ULTIMATE 5.38.0 fills that gap without asking you to adopt a payment-delegation platform. The quote is calculated from your live WooCommerce data â€” the same tax rules, the same coupons, the same shipping zones your checkout uses â€” so the number the agent shows the buyer matches what they'll see when they land on your store.

How the quote is calculated (safely)

The important design decision: nothing mutates your store's cart or session. On a live shop, a shopper could be checking out in one tab while an AI agent requests a quote in another. So the quote is built read-only:

Line prices and tax come from WooCommerce's own price helpers, honoring each product's tax class.
Coupons are validated against the real coupon object â€” type, amount, expiry, usage limit, minimum/maximum spend, and product/category restrictions â€” and the discount is computed against the qualifying lines.
Shipping is read from the shipping zone that matches the buyer's destination, returning each method's cost where it's statically determinable (flat rate, free-shipping thresholds, local pickup). Methods whose cost depends on a live cart calculation are flagged so the agent knows the final figure is confirmed at checkout.

The result is a totals object â€” items_subtotal, discount, tax, shipping, total â€” plus a signed checkout_url that pre-fills the cart (and the coupon) when the buyer opens it. The buyer pays on your checkout, exactly as always.

What this means for a store owner

You get to appear inside AI shopping experiences as a store that can actually be shopped â€” not just listed. When a buyer asks an assistant "add two of these and tell me the total to Poland with free shipping," the agent has a real endpoint to answer with. And because it's all self-hosted and pay-once, you're not renting that capability from a marketplace or handing your catalog and customers to a third party.

Frequently asked questions

Do I need Stripe or a payment platform for this?
No. The quote and everything around it are read-only and payment-agnostic. The buyer pays on your normal WooCommerce checkout. Programmatic payment delegation (where an agent pays for the buyer) is a separate, emerging standard you can add later â€” it is not required for AI agents to discover, quote, and send buyers to your store.

Is the quoted total exactly what the buyer pays?
It's an accurate estimate built from your live tax rules, coupons and shipping zones. Taxes and shipping are always finally confirmed on the checkout â€” the quote flags any shipping method whose cost is only resolved there â€” so the buyer never sees a surprise.

Does requesting a quote change my store's cart or create an order?
No. Quotes, coupon checks, shipping options and product lookups are all computed without touching the cart or session and without creating an order. Nothing is charged until the buyer completes checkout.

Which AI agents can use it?
Any agent that can call a public REST endpoint â€” ChatGPT shopping, Gemini, Perplexity, AI browsers. The quote and product routes are public but protected by GOMAX's Agent Passport, so you keep policy control (allow, rate-limit or block) over who calls them.

Where does the data go?
Nowhere but your own site. GOMAX ULTIMATE is privacy-first and self-hosted â€” the quote is computed on your WordPress install and no card data or customer data is sent to GOMAX or any vendor cloud.

Register a Custom Post Type Without Code (Let AI Build Your Content Model)

Piotr — Fri, 07 Aug 2026 21:07:54 +0000

You can now register a WordPress custom post type without writing a line of code or installing a separate CPT plugin â€” you describe the content type you want ("a Portfolio with an archive and a project-type taxonomy") and an AI assistant registers it for real, so it survives every page load and shows up in wp-admin and the block editor. GOMAX ULTIMATE 5.37.0 turns your AI from something that only fills in content into something that designs the content model itself.

Most WordPress sites outgrow "posts and pages" fast. A studio needs a Portfolio. A consultancy needs Case Studies. A local business needs Events and Testimonials. The traditional answer is either hand-written register_post_type() code in a theme's functions.php (fragile, disappears when you switch themes) or yet another plugin whose settings screen you have to learn. GOMAX ULTIMATE removes both.

Key takeaways

register_post_type creates a new content type with your labels, an optional archive page, a menu icon, the fields it supports, and REST/Gutenberg enabled â€” persisted so it loads on every request, not just once.
register_taxonomy adds a custom taxonomy (e.g. "Project Type" or "Event Category") and attaches it to the post types you choose.
retrieve_registered_types lists everything you've created so you always know your own content model.
unregister_post_type and unregister_taxonomy cleanly remove a GOMAX-registered type while keeping its content safe in the database.
Everything runs on your own WordPress install â€” no code, no theme edits, and no data leaving your site.

Why "without code" actually matters here

A custom post type is not just a label. It is a rewrite rule, a set of admin menu entries, REST endpoints, block-editor support, and capability mapping. Get one piece wrong and you get 404s on your archive, a missing "Add New" button, or a type that vanishes on the next deploy. When you register a post type by hand, you own all of that.

GOMAX ULTIMATE registers the type on WordPress's own init hook from a stored definition, exactly the way a well-written plugin does. That is the important detail: the definition is saved as an option and re-registered on every load, so the Portfolio you created by chatting is a first-class WordPress content type â€” indexable, editable, exportable, and REST-available â€” not a one-time trick that evaporates.

What you can ask for

Because the AI is talking to a real register_post_type call, you can specify the things that normally send people to Stack Overflow:

Singular and plural labels â€” "Case Study" / "Case Studies", used across the whole admin UI.
A public archive â€” turn has_archive on to get a browsable listing page for the type.
A menu icon â€” any Dashicon (dashicons-portfolio, dashicons-calendar-alt, dashicons-star-filled).
Supported fields â€” title, editor, thumbnail (featured image), excerpt, custom fields, and more.
REST / block editor â€” on by default, so the type works with Gutenberg, headless front-ends, and the rest of GOMAX ULTIMATE's tools.
A rewrite slug â€” control the URL segment, e.g. /work/ instead of /portfolio/.

For taxonomies you choose whether they behave like categories (hierarchical) or like tags, and which post types they attach to.

A concrete example

Ask your assistant: "Create a Portfolio post type with an archive, the portfolio icon, support for title, editor and featured image, and add a hierarchical 'Project Type' taxonomy attached to it."

Behind the scenes GOMAX ULTIMATE calls register_post_type for the Portfolio, flushes rewrite rules so the archive resolves immediately, then calls register_taxonomy for Project Type and links it. You refresh wp-admin and there it is: Portfolio in the sidebar with its icon, an Add New screen, a working /portfolio/ archive, and a Project Type box in the editor. No FTP, no functions.php, no second plugin.

When a client project ends and you want the type gone, unregister_post_type removes it from the UI while leaving every entry in the database â€” so nothing is destroyed and you can re-register later if you change your mind.

Frequently asked questions

Does this write to my theme's functions.php?
No. The definition is stored as a GOMAX ULTIMATE option and registered on the WordPress init hook, so it is independent of your theme. Switching themes will not lose your custom post types.

Will the custom post type survive updates and caching?
Yes. It is re-registered on every page load from the saved definition, exactly like a purpose-built CPT plugin, and rewrite rules are flushed when it's created so archives resolve right away.

What happens to my content if I unregister a type?
Nothing is deleted. unregister_post_type and unregister_taxonomy remove the type from the admin UI and front-end registration, but all posts and terms remain in the database. Re-registering the type brings them back.

Can it edit or remove post types created by other plugins?
No. For safety it only manages types GOMAX ULTIMATE itself registered and refuses to overwrite or unregister post types owned by other plugins or the WordPress core.

Is any of this sent to an outside service?
No. Registration happens entirely on your own WordPress install. GOMAX ULTIMATE is privacy-first and pay-once â€” your content model and your data never leave your server.

Run Big WordPress Jobs on Slow Hosting (Without Timeouts)

Piotr — Wed, 05 Aug 2026 21:08:53 +0000

Big multi-step operations — bulk-editing hundreds of products, importing records, migrating content — are exactly where cheap or flaky hosting bites. The host's execution-time limit cuts the request off, or a firewall kills a long-running call, and the job half-finishes: some items updated, some not, and no clean way to know where it stopped. The fix isn't a faster server; it's a resumable, chunked queue. Run the work in small batches, track exactly how far you got, and resume from that point if anything fails. A job that can resume can always finish, even on a host that can't hold a long request.

Why big jobs fail on weak hosts

Shared and budget hosting typically caps how long a single request can run (often 30 seconds) and may sit behind a firewall that terminates long or unusual requests. A one-shot "update all 800 products" call blows straight past that limit. The result is the worst outcome: a partial change with no record of what completed. You can't safely re-run it (you'd double-apply) and you can't easily tell what's left.

The fix: preflight, then chunk, then resume

Three ideas make big jobs reliable on any host:

1. Preflight. Before starting, check whether the host can handle the work: is the REST API reachable, how much memory and execution time is available, is WP-Cron working? From that you get a sensible batch size for this specific host — small on a constrained one, larger on a capable one.

2. Chunk. Instead of one giant request, process the steps a batch at a time, each well within the host's limits. Ten small requests always beat one that times out.

3. Resume. Track a cursor — how many steps completed. If a step fails, stop there and remember the position. Fix the cause, run again, and it picks up from exactly that step. No double-applying, no guessing what's left.

Why "stop on failure" beats "push through"

A queue that skips failures and barrels on leaves you with a silent mess. A better design stops on the first failing step and holds its position, so you see precisely what broke and can retry from there once it's fixed. Combined with a background drain that advances the job a batch at a time on a schedule, even a very large job completes steadily without you babysitting a long request.

In GOMAX ULTIMATE this is the action queue: a preflight that reports host readiness and a recommended batch size, an enqueue step that queues your operations, and a runner you call repeatedly (or let run hourly) that processes a batch, resumes on demand, and stops cleanly on a failing step so you can retry from that point. Every queued step is a real, permission-checked operation — so an AI assistant can run a big change on a modest host without it half-finishing.

Key takeaways

Big one-shot jobs half-finish on hosts with short execution limits or firewalls.
A preflight check tells you if the host is ready and what batch size to use.
Chunking keeps every request within the host's limits.
Resuming from a tracked cursor means a job can always finish.
Stopping on the first failure beats pushing through and leaving a silent mess.

Frequently asked questions

Why do bulk operations time out in WordPress? Because the host caps how long a single request can run (often 30 seconds), and a big one-shot job exceeds that. A firewall may also kill long requests. Chunking the work avoids both.

What is a resumable job queue? A queue that tracks how many steps completed, so if it stops it can continue from that exact point instead of restarting or double-applying work.

How does a preflight check help? It verifies the host is ready (REST reachable, enough memory and execution time) and recommends a batch size suited to that host before you start a big job.

What happens if a step fails? A well-designed queue stops on the failing step and remembers its position, so you can fix the cause and resume from there rather than re-running everything.

Do I need better hosting to run big jobs? Not necessarily. A resumable, chunked queue lets big operations complete reliably even on constrained shared hosting.

Finish big jobs on any host with GOMAX ULTIMATE — a preflight check and a resumable, chunked action queue, self-hosted and pay-once.

WordPress Cache Warming: Kill the Slow First Visit

A Marketing Dashboard for WordPress (With Reports That Email You)

Piotr — Tue, 04 Aug 2026 21:08:51 +0000

Marketing data spread across five tools is data nobody looks at. The fix is a single dashboard that unites the numbers that actually run your marketing — traffic, campaign ROI, attribution, the lead pipeline, and any open alerts — in one view, and then has that same summary emailed to you and your team on a schedule. A report that lands in your inbox every Monday gets read; a dashboard you have to remember to open doesn't. Together they turn scattered metrics into a habit. The best report is the one that shows up whether or not you go looking.

Why unified beats scattered

Traffic in one analytics tool, ad ROI in the ad platform, leads in a CRM, alerts nowhere — that's the normal state, and it means no one ever sees the whole picture at once. Decisions get made on whichever tab happened to be open. A unified dashboard pulls the key numbers from each area into one place, so you can see how traffic, spend, revenue and pipeline relate — which is the only way to actually judge whether marketing is working.

What belongs on a marketing dashboard

The dashboard should answer the questions you actually ask each week:

Traffic — are visits up or down?
Campaign ROI — total spend, revenue and ROAS, plus the top campaigns.
Attribution — which channels are driving revenue (by last-touch or a fuller model).
Pipeline — how many leads at each stage, and what follow-ups are due.
Open alerts — anything that's crossed a threshold and needs attention now.

Five sections, one call, the whole marketing picture.

Reports that email themselves

A dashboard still requires you to go look. The multiplier is scheduled delivery: the same summary, emailed to you (and your team) automatically every week or month. Now the numbers reach the people who make decisions without anyone remembering to pull them — and a weekly rhythm makes trends visible that a once-in-a-while glance never would. Add a "send now" for the moment you want an instant snapshot.

Keep it first-party

Because all the underlying data — analytics, campaigns, CRM, alerts — already lives on your own site, the dashboard and its reports are computed locally and emailed to you. There's no marketing-intelligence SaaS aggregating your numbers on someone else's servers, and no per-seat cost to give your whole team the weekly report.

In GOMAX ULTIMATE this completes the marketing suite: retrieve_marketing_dashboard returns the unified overview in one call — traffic, campaign ROI, attribution, pipeline and open alerts — and configure_scheduled_report emails that summary weekly or monthly, with a send-now option. It joins campaign ROI, attribution, funnels, audiences, automation, alerts and integrations, all first-party. An AI assistant can read the dashboard and tell you what changed and why.

Key takeaways

Scattered marketing data never gets reviewed; a unified dashboard does.
Put traffic, ROI, attribution, pipeline and alerts in one view.
Schedule the same summary to email you weekly or monthly so it's actually read.
A weekly rhythm surfaces trends a random glance misses.
First-party keeps the whole picture on your own site with no per-seat SaaS.

Frequently asked questions

What should a marketing dashboard show? The metrics you review regularly: traffic trend, campaign ROI (spend, revenue, ROAS), attribution by channel, the lead pipeline by stage, and any alerts that have triggered.

Why schedule marketing reports by email? Because dashboards only help when someone opens them. An emailed report reaches decision-makers automatically and builds a weekly rhythm that surfaces trends.

Can I get a weekly marketing report in WordPress? Yes. A first-party setup can compile the dashboard and email it to you and your team on a weekly or monthly schedule, with an option to send one immediately.

Does a unified dashboard need a third-party service? No. When your analytics, campaigns and CRM already live in WordPress, the dashboard and its reports are computed locally and never leave your site.

What's the difference between a dashboard and a scheduled report? A dashboard is a live view you open; a scheduled report is that same summary delivered to your inbox automatically, so it gets seen without anyone remembering to look.

Get the whole marketing picture with GOMAX ULTIMATE — a unified dashboard and scheduled reports, first-party, self-hosted and pay-once.

Connect WordPress to GA4 and Mailchimp — On Your Terms

Piotr — Sun, 02 Aug 2026 21:07:55 +0000

Being first-party doesn't mean being isolated. You can keep your data on your own site and still bridge it to the tools your team already uses — but on your terms: an opt-in, bring-your-own-key connection where nothing is sent automatically. Export any CRM segment as a CSV that Mailchimp, a Google or Meta customer-match list, or a spreadsheet can import; forward server-side events to Google Analytics 4 with your own Measurement Protocol keys; or push a segment's contacts to a Mailchimp list with your own API key. You choose what leaves and when. Integration should be a door you open, not a pipe someone else attached.

First-party and connected aren't opposites

The privacy-first approach keeps your analytics, CRM and store data on your own server. The worry people have is that this cuts them off from GA4, their email platform, or ad customer-match. It doesn't — as long as the integrations are opt-in and BYOK (bring your own key). You configure your own credentials, and each export or sync happens only when you (or your assistant) trigger it. That's the difference between sharing data deliberately and having it siphoned continuously.

Three ways to bridge, from simplest to deepest

1. CSV export — works everywhere, no API. The universal integration is a CSV. Export a segment (say, "customers who bought over $500") and import it into Mailchimp, upload it as a Google Ads or Meta customer-match audience, or open it in a spreadsheet. No credentials, no connection to maintain — and you see exactly what's in the file before it goes anywhere.

2. GA4 Measurement Protocol — send server-side events. For analytics, you can forward events to Google Analytics 4 directly from the server using your own measurement id and API secret. This captures things client-side tags miss and keeps you in control of what's sent.

3. Mailchimp sync — push contacts with your key. For email, push a segment's contacts to a specific Mailchimp list using your own API key and list id, so your ESP stays in sync with your CRM segments.

Only send what's consented

Bridging data to marketing platforms carries a responsibility: only sync contacts who consented to marketing. Build the audience you export or push from consented leads, keep your credentials server-side, and treat each integration as a deliberate action. Done this way, you get the reach of the big platforms without surrendering ownership or compliance.

In GOMAX ULTIMATE these are the opt-in integrations: export any audience as CSV, forward events to GA4 via the Measurement Protocol, or sync a segment to Mailchimp — all bring-your-own-key, with credentials stored server-side and shown masked. An AI assistant can prepare the export or run the sync on your say-so, and nothing leaves your site unless you trigger it.

Key takeaways

First-party and connected aren't opposites — bridge deliberately, not continuously.
Opt-in, bring-your-own-key integrations keep you in control of what's shared.
A CSV export is the universal bridge to any ESP, Ads customer-match or spreadsheet.
GA4's Measurement Protocol lets you send server-side events with your own keys.
Only sync contacts who consented to marketing, and keep credentials server-side.

Frequently asked questions

Can I connect a first-party WordPress setup to GA4 or Mailchimp? Yes, with opt-in, bring-your-own-key integrations: you configure your own credentials and trigger each export or sync, so data leaves only when you choose.

How do I export a CRM segment for Mailchimp or Google Ads? Export the audience as a CSV and import it into Mailchimp or upload it as a customer-match list in Google Ads or Meta — no API connection required.

What is the GA4 Measurement Protocol? A Google API that lets your server send events to Google Analytics 4 directly, using a measurement id and API secret, capturing things a browser tag might miss.

How do I sync leads to Mailchimp from WordPress? Configure your Mailchimp API key and list id, then push a chosen segment's contacts to that list — ideally only contacts who opted in to marketing.

Does opt-in integration keep my data private? Yes. Nothing is sent automatically; you trigger each export or sync, credentials stay server-side, and you decide exactly which segments are shared.

Bridge your data on your terms with GOMAX ULTIMATE — opt-in, bring-your-own-key GA4, Mailchimp and CSV integrations, self-hosted and pay-once.

WordPress Alerts: Get Emailed Before Small Problems Grow

Piotr — Fri, 31 Jul 2026 21:13:45 +0000

Most site problems are cheap to fix early and expensive to fix late. A traffic drop, a surge of 404s, an AI bill climbing faster than expected, a bestseller running low on stock — each can quietly do damage for days before you happen to check the right dashboard. Threshold alerts solve this by watching your own metrics on a schedule and emailing you the moment a value crosses a line you set. You define "tell me when X passes Y," and the site tells you — instead of you remembering to look. The point of an alert is that you don't have to be watching.

Why "I'll check the dashboards" fails

Dashboards are pull, not push: they only help when you go look, and nobody looks at everything every day. So the traffic dip from a broken deploy, the 404s from a bad migration, or the AI automation quietly spending more than planned all run unnoticed until the damage shows up in revenue. Alerts flip the model — the site pushes you a message when, and only when, something needs attention.

Metrics worth watching

The most useful alerts are tied to the numbers that actually cost you money or customers:

Unresolved 404s — a spike means a migration or deletion broke links; catch it before rankings slip.
AI spend / tokens today — for anyone using AI automations, a runaway cost alert is a financial circuit breaker.
Today's traffic — a sharp drop can mean a broken page, a tracking failure, or a search penalty.
New leads today — both a drought (form broken?) and a surge (a campaign working, or spam) are worth knowing.
Low stock — get told before your bestseller sells out.
Pending orders — orders piling up unfulfilled means a fulfillment problem.

Each is just a metric, an operator (greater or less than), and a threshold.

Keep it first-party and simple

The best alerts run on data you already have, computed locally. There's no need to pipe your metrics to an external monitoring SaaS that charges by the check and sees your business numbers. A first-party alert engine reads your own analytics, CRM, redirects and store, evaluates your thresholds on a schedule, and emails you — with nothing leaving the site.

In GOMAX ULTIMATE this is the alerts engine: create an alert from a metric (404s, AI spend, traffic, new leads, low stock, pending orders), an operator and a threshold; check them all instantly with a dry-run; and let enabled alerts run automatically every hour and email you when a line is crossed. It's all first-party, and an AI assistant can set up the right alerts for your business from a plain-language request.

Key takeaways

Problems are cheap to fix early; alerts catch them before they grow.
Dashboards are pull; alerts push you a message only when needed.
Watch the metrics that cost money: 404s, AI spend, traffic, leads, stock, orders.
An alert is just a metric, an operator, and a threshold.
First-party alerts read your own data and email you — nothing leaves the site.

Frequently asked questions

What should I set up alerts for on my WordPress site? The metrics that cost you money or customers: a spike in 404s, AI spend over budget, a drop in traffic, low stock, unfulfilled orders, and unusual lead volume.

How do threshold alerts work? You pick a metric, an operator (greater or less than) and a threshold. On a schedule the site checks the metric and emails you if it crosses the line.

Can I get a low-stock alert for WooCommerce? Yes. A low-stock alert counts products at or below a stock level you set and notifies you before they sell out.

Do I need a monitoring service for this? No. A first-party alert engine reads your own analytics, CRM and store data and emails you, so you avoid a per-check monitoring SaaS and keep your numbers private.

How often are alerts checked? Typically on an hourly schedule, plus on demand whenever you want to evaluate them immediately with a preview that doesn't send email.

Get told before it hurts with GOMAX ULTIMATE — first-party threshold alerts on traffic, spend, stock and more, self-hosted and pay-once.

DEV Community: Piotr

Clean and Optimize Your WordPress Database Safely (No Bloat, No Risk)

Key takeaways

What actually bloats a WordPress database

Cleaning without the risk

Pairs with performance

Frequently asked questions

Related articles

Find and Fix Broken Links in WordPress, Self-Hosted and Fast

Key takeaways

Why broken links matter

How it works

Fixing at scale

Frequently asked questions

Audit Core Web Vitals in WordPress Without PageSpeed or a Cloud Service

Key takeaways

What it checks

Why local and first-party is the right call

From score to fixes

Frequently asked questions

Audit WordPress Accessibility (WCAG) Without an External Service

Key takeaways

What it checks

Why in-plugin and self-hosted matters

From audit to statement

Frequently asked questions

Handle GDPR Data Requests and Retention in WordPress, Self-Hosted

Key takeaways

Why this matters for compliance

Data-subject requests, done right

Data retention: keep only what you need

Frequently asked questions

WordPress Webhooks Without Zapier: Signed, First-Party, Self-Hosted

Key takeaways

Why "first-party" webhooks matter

How it works

What you can build with it

Frequently asked questions

Give AI Shopping Agents a Real Price Quote Before Checkout

Key takeaways

Why a quote is the piece that was missing

How the quote is calculated (safely)

What this means for a store owner

Frequently asked questions

Register a Custom Post Type Without Code (Let AI Build Your Content Model)

Key takeaways

Why "without code" actually matters here

What you can ask for

A concrete example

Frequently asked questions

Related articles

Run Big WordPress Jobs on Slow Hosting (Without Timeouts)

Why big jobs fail on weak hosts

The fix: preflight, then chunk, then resume

Why "stop on failure" beats "push through"

Key takeaways

Frequently asked questions

Related articles

A Marketing Dashboard for WordPress (With Reports That Email You)

Why unified beats scattered

What belongs on a marketing dashboard

Reports that email themselves

Keep it first-party

Key takeaways

Frequently asked questions

Related articles

Connect WordPress to GA4 and Mailchimp — On Your Terms

First-party and connected aren't opposites

Three ways to bridge, from simplest to deepest

Only send what's consented

Key takeaways

Frequently asked questions

Related articles

WordPress Alerts: Get Emailed Before Small Problems Grow

Why "I'll check the dashboards" fails

Metrics worth watching

Keep it first-party and simple

Key takeaways

Frequently asked questions