DEV Community: Piotr

A Native AI Text Engine Inside WordPress — No API Key, Offline

Piotr — Fri, 04 Sep 2026 21:08:15 +0000

GOMAX ULTIMATE 5.55.0 adds Native Intelligence: a pure-PHP text engine that runs entirely inside the plugin — extracting keywords, summarizing posts, suggesting tags, measuring how similar two texts are and scoring spam — with no external service, no API key, and it works offline on any host. It's not a large language model; it's fast, deterministic statistics that give you useful "AI-like" results without sending your content anywhere or paying per request.

This is the local brain that makes GOMAX smart on its own. For deep writing you can still add a model, but for the everyday tasks — tagging, summarizing, spotting spam — the plugin now does it itself.

Key takeaways

Keyword extraction. extract_keywords finds the most distinctive terms in a post or any text, weighted by how rare they are across your site.
Extractive summaries. summarize returns the most important sentences of a post — a quick TL;DR with no hallucination risk.
Tag suggestions. suggest_tags proposes tags, matched to your existing tags and categories plus new keyword candidates.
Text similarity. similarity scores how alike two pieces of text are from 0 to 1 — useful for de-duplication and related content.
Spam scoring. score_spam gives a 0-100 heuristic score with reasons, to triage leads and comments.
Offline and free. It's deterministic statistics running on your own server — no AI key, no external calls, no per-use cost.

Statistics, not a language model — and why that's a feature

Native Intelligence uses well-understood techniques: TF-IDF (which words make a document distinctive), cosine similarity (how much two texts overlap) and simple heuristics. That means it's reliable and repeatable — the same input always gives the same output — and it can't hallucinate because it isn't generating new text, only measuring and extracting from what's there. It also costs nothing to run and keeps your content entirely on your server.

A large language model is better for writing — long-form drafts, creative rewrites, nuanced reasoning. Native Intelligence is better for understanding at scale — tagging thousands of posts, summarizing, scoring, routing — instantly and privately. GOMAX uses the local engine by default and lets you add a model only where deep generation is actually needed.

What you can do with it today

Auto-suggest tags and categories for new posts.
Generate a quick summary for a listing, a meta description draft, or an internal note.
Score incoming leads and comments for spam before they clutter your inbox.
Measure whether two articles are too similar (and might compete in search).
Pull the key terms out of any content to guide your SEO.

Because it's all local and instant, an AI assistant can run these across your whole site without cost or privacy concerns — the statistical groundwork for smarter automation.

Frequently asked questions

Is this a large language model like ChatGPT? No. It's a pure-PHP statistical engine (TF-IDF, cosine similarity, heuristics). That makes it fast, deterministic and private, and it can't hallucinate — but for long-form writing you'd still add a model. GOMAX uses this engine locally and lets you plug in a model only for deep generation.

Do I need an API key or an internet connection? No. Native Intelligence runs entirely on your own server with no external service and no key. It works offline on any typical WordPress host.

Does my content get sent anywhere? No. All processing happens locally on your site. Nothing about your content leaves the server — a genuine privacy-first design.

How good are the summaries? They're extractive — the engine selects the most important existing sentences rather than writing new ones. That means they're accurate to your content and never invent anything, though they read like highlights rather than a rewritten paragraph.

Is the spam score reliable? It's a heuristic score for triage, based on signals like links, spam-associated phrases and excessive capitals. It's a helpful first filter with reasons attached, not an absolute verdict — review borderline cases.

AI Sales Concierge for WooCommerce: A Live Chatbot That Sells

Piotr — Fri, 04 Sep 2026 12:08:07 +0000

An AI sales concierge is a proactive, human-like chat assistant that greets your visitors, understands what they need, recommends the right product, adds it to the cart, captures their email, and follows up — all on its own. It turns the traffic you already have into orders, which is where most stores actually leak revenue. This guide explains how the GOMAX ULTIMATE Sales Concierge works and how to switch it on in a couple of clicks.

Why a concierge, not just a chat widget

Most chat widgets sit in the corner and wait. A concierge behaves like a good shop assistant: it notices when someone lingers or is about to leave, opens with a relevant question, listens, and points the visitor to the one product that fits — with a real "add to cart" button, not a vague answer. The job is conversion: you have visitors and leads, and the concierge helps them buy.

What it does

Site-wide floating launcher. A chat button appears on every page, so you never have to place a shortcode.
Proactive, gentle opening. It opens on its own — at most once per visit and always closeable — when a visitor shows exit-intent (the cursor heads for the tab bar) or after they dwell on a page. On the cart or checkout it asks a context-aware question like "did something stop your order?".
Email first. It asks for the visitor's email before the conversation, so a lead is captured even if they don't buy right away. It never asks for the email twice.
Recommends and sells. It suggests one best-fit product with a one-line reason and shows a real Add to cart button that deep-links to your cart page with the item already added.
Emails you every conversation. A digest of each chat lands in your inbox so a human can follow up.

Grounded follow-up emails — no empty promises

The concierge can also email each visitor a follow-up recommendation. The important part is how it writes them: it distils the visitor's problem, searches your own published articles, and then writes the email using only those articles and your live product catalogue. A hard rule stops it inventing features, and any link it includes is checked against the real articles it found. If your product genuinely can't do something, it says so and offers the closest real option instead. The result is a truthful, specific solution — the opposite of a generic "thanks for chatting" blast.

How to set it up

In WordPress, go to GOMAX → Sales Concierge. 2. Click Create my Sales Concierge bot. GOMAX builds a sales assistant from your live WooCommerce products and turns the concierge on. 3. Set the email address that should receive conversations, and adjust the proactive timings if you like. 4. Use Send me a sample recommendation to see a real, grounded follow-up in your inbox — then flip on Email the visitor a grounded recommendation when you're happy with the quality.

You can edit the bot's wording any time under GOMAX → Chatbots. The public front-end chat must be enabled in GOMAX Tool Access for the bot to reply.

Privacy and ownership

Like the rest of GOMAX, the concierge is pay-once and privacy-first. It runs on your own WordPress with your own AI key (bring-your-own-key), and your customer data stays on your site — no third-party SaaS holding your conversations or your leads.

FAQ

Does it replace my team? No — it handles the first, repetitive part of a sale (greet, qualify, recommend, capture the email) and hands you every conversation so a human can close the ones that need it.

Will it make things up to get a sale? No. Recommendations in the follow-up email are grounded in your real articles and products, with an explicit no-invention rule. If GOMAX can't do something, it says so.

Which products can it recommend? Whatever is published and visible in your WooCommerce store — it reads your live catalogue, so it always sells your real products at your real prices.

Is it a subscription? No. It's part of GOMAX ULTIMATE, which is a pay-once plugin with no mandatory subscription.

Find Which WordPress Posts to Refresh First With a Decay Monitor

Piotr — Thu, 03 Sep 2026 21:08:15 +0000

GOMAX ULTIMATE 5.54.0 adds a content decay monitor that scans your published pages and hands you a worst-first priority list of what to refresh — flagging stale posts, thin content and pages missing a featured image or meta description — so you spend your editing time on the pages that will recover the most traffic, all computed on your own server. Content quietly loses rankings as it ages; this tells you exactly where to intervene.

Refreshing old content is one of the most reliable ways to regain search traffic. The hard part is knowing which of your hundreds of posts to start with. This monitor answers that in one call.

Key takeaways

A refresh priority list. analyze returns your pages ranked worst-first, so you know exactly what to update next.
The right signals. It flags stale pages (not updated in a set number of months), thin content, and missing featured image or meta description.
Smart prioritization. Staler, longer evergreen pages rank higher because they recover the most traffic when refreshed.
A freshness score. Every page gets a 0-100 score plus days since its last update, and retrieve_summary gives your site's average.
Self-hosted. It runs on your own content locally — no external service.

Why content decays — and why refreshing works

Search results reward pages that are current, complete and comprehensive. As competitors publish newer content and your own posts sit untouched, they slip down the rankings even if nothing about them changed — that's content decay. The fix isn't always new content; often it's refreshing what you already have: updating facts, expanding thin sections, adding an image, tightening the meta description. Google frequently rewards a good refresh with a ranking bump, and it's far less work than writing from scratch.

How the monitor prioritizes

It looks at each published page and combines a few signals:

Staleness — how long since it was last modified, against a threshold you set (six months by default).
Depth — thin pages under 300 words are flagged; and among stale pages, longer evergreen ones are prioritized because they have the most to gain.
Completeness — is there a featured image and a meta description?

From these it computes a freshness score and a refresh priority, then sorts so the highest-impact pages are at the top. Pair it with the SEO Content Analyzer to see how to improve a page and the Internal Linking Engine to add links to it, and you have a complete refresh workflow.

A simple monthly routine

Run retrieve_summary to see how much of your library is going stale. 2. Run analyze for the prioritized list. 3. Take the top few pages, refresh them (update, expand, add an image), and re-link to them from related posts.

An AI assistant can run this whole loop — find the decaying pages, rewrite the weak parts, and add internal links — turning content maintenance into a scheduled task.

Frequently asked questions

How does it decide what's "stale"? By how long since a page was last updated, compared to a threshold you choose (six months by default). You can set it shorter for fast-moving topics or longer for evergreen content.

Does older automatically mean worse? No — age is one signal. The priority also considers depth and completeness, and it ranks longer evergreen pages higher because refreshing them tends to recover the most traffic. A short, current page won't be flagged just for being old if it's fine.

Will it change my content? No. It's a read-only monitor that tells you what to work on. You (or an AI assistant) decide what to refresh and make the edits.

Does it need Google Search Console or analytics? No. It works from your own content signals — last-updated date, length and completeness — so it runs without connecting any external data source. Nothing leaves your site.

How does it fit with the other SEO tools? It answers "which pages," the SEO Content Analyzer answers "how to fix this page," and the Internal Linking Engine answers "where to add links." Together they form a full content-improvement workflow.

See what a one-prompt GOMAX page looks like

Piotr — Wed, 02 Sep 2026 06:16:02 +0000

A live GOMAX-built page — scroll to explore
Most “AI website” tools hand you a rough draft you then have to rebuild. GOMAX is different: you describe the page in one prompt and it assembles a real, on-brand WordPress experience — layout, motion, imagery and interaction — that you can edit live.

The demo above is a live GOMAX-built preview. Scroll it: the hero, the parallax, the horizontal gallery and the count-up are all rendered in the page — no page-builder, no template, no video file.

One prompt, one editable block

Because every element lands as a real GOMAX block, nothing is locked. Change the copy, swap the colours or restyle a section from the same conversation — the page stays yours, self-hosted, pay-once.

Automatic Internal Link Suggestions and Orphan-Page Finder for WordPress

Piotr — Tue, 01 Sep 2026 21:08:16 +0000

GOMAX ULTIMATE 5.53.0 adds an internal linking engine that reads your published content, works out which posts are most topically related using local TF-IDF similarity, and suggests exactly which internal links to add — plus it finds "orphan" pages that nothing links to — all computed on your own server with no external service and no AI key. Internal links are one of the most under-used SEO levers, and this makes them a two-minute job instead of a manual audit.

Search engines follow internal links to discover and rank pages, and links pass authority between related content. Yet most sites link almost at random. This engine turns your own content into a map and tells you where the missing links are.

Key takeaways

Relevant link suggestions. For any post, suggest_links returns the most topically related published posts to link to, ranked by a similarity score.
Smart anchors, no duplicates. Each suggestion includes a suggested anchor (the target's title) and skips targets you already link to.
Orphan-page finder. retrieve_orphans lists published pages that no internal link points to — the pages search engines tend to overlook.
Local and private. It uses TF-IDF content similarity computed on your own server; nothing is sent to an external service, and no AI key is required.
Foundation for more. The same statistical model underpins GOMAX's semantic recall for its AI features.

Why internal links matter so much

When a page has no internal links pointing to it, search engines struggle to find it and rarely rank it — it's effectively invisible no matter how good it is. And when related posts don't link to each other, the ranking authority they could share stays trapped. Fixing internal linking is one of the highest-return, lowest-effort SEO tasks, but doing it by hand means re-reading your whole site. The engine does that reading for you.

How it works

It builds a keyword profile of each published post and page — the words that make it distinctive, weighted by how rare they are across your site (that's TF-IDF). To suggest links for a post, it compares that post's profile to every other and ranks the closest matches by cosine similarity. Because it looks at topics, not just shared keywords, the suggestions are genuinely related, not coincidental.

For orphans, it checks which pages are referenced by internal links anywhere in your content and lists the ones that aren't — so you know exactly which pages need a link pointing to them.

A simple workflow

Run retrieve_orphans to see which pages are invisible to internal linking. 2. For each orphan (or any post), run suggest_links to find the best related posts. 3. Add a link from those related posts to the target, using the suggested anchor or a natural phrase.

An AI assistant can do this end to end: find the orphans, get the suggestions, and edit the posts to add the links — turning a tedious audit into an automated task.

Frequently asked questions

Does it use an external service or an AI key? No. The similarity is computed locally with TF-IDF on your own content. There's no external API and no AI key required — it works entirely on your server.

What is an orphan page and why is it bad? An orphan page is one that no internal link points to. Search engines discover pages by following links, so orphans are hard to find and rarely rank, even if the content is excellent. Adding a few internal links fixes that.

Will it add the links for me automatically? It suggests, it doesn't auto-edit — so you stay in control. It gives you the target, the suggested anchor and the similarity, and you (or an AI assistant) add the link where it reads naturally.

How does it pick the anchor text? It suggests the target post's title as a starting anchor. You can use that or write a more natural phrase in the sentence where the link fits — descriptive anchors are best for SEO and readers.

Does it handle large sites? It analyzes your most recently updated published posts and pages up to a sensible cap, so it stays fast. For very large sites it focuses on the freshest content, which is usually where linking matters most.

Score Your Articles for SEO and Readability Before You Publish

Connect WordPress to Slack, Discord, Brevo and Zapier — Your Keys

Piotr — Mon, 31 Aug 2026 21:08:16 +0000

GOMAX ULTIMATE 5.52.0 expands its marketing integrations so you can sync contacts to Brevo (Sendinblue), send notifications to a Slack or Discord channel, and POST any audience segment as JSON to your own Zapier, Make, n8n or custom endpoint — all bring-your-own-key, opt-in, and triggered explicitly, with credentials that stay on your site. On top of the existing GA4, Mailchimp and CSV options, GOMAX now reaches the tools most small businesses actually use.

The philosophy hasn't changed: nothing syncs automatically, you supply your own keys or webhook URLs, and your data goes only where you send it.

Key takeaways

Brevo contact import. sync_audience_to_brevo pushes a segment's contacts into your Brevo list, with your own API key.
Slack & Discord. send_notification { target, text } posts a message to a channel through your own incoming-webhook URL — great for "new lead" or "big order" pings.
Generic HTTP push. sync_audience_to_http POSTs a segment as JSON to any endpoint you own — Zapier, Make, n8n or a custom script — so you can connect to anything.
Still GA4, Mailchimp and CSV. The new platforms sit alongside the existing ones.
BYOK and masked. Every credential is yours, stored on your site, and returned masked; syncs are opt-in and manual.

Reach the tools you already use

Not everyone runs their marketing on Mailchimp. Brevo is popular with small businesses; Slack and Discord are where teams and communities live; and Zapier/Make/n8n connect to hundreds of other apps. By adding a Brevo bridge, channel notifications and a generic JSON push, GOMAX lets you plug WordPress into your existing stack without a middleman service holding your data or charging per task.

How each one works

Brevo: add your API key (and optionally a list ID), then sync a segment — GOMAX imports the contacts with their first and last names, updating any that already exist.
Slack / Discord: paste an incoming-webhook URL from the app, then call send_notification with your message. Use it from an assistant or a workflow to announce new leads, orders or alerts.
Generic HTTP: set a webhook URL for Zapier, Make, n8n or your own server, and sync_audience_to_http sends the whole segment as JSON — from there, connect it to anything those platforms support.

Every sync supports a dry run so you can preview how many contacts would be sent before anything leaves your site.

Frequently asked questions

Do I need a paid connector service? No. These are direct, bring-your-own-key bridges. You supply an API key (Brevo) or a webhook URL (Slack, Discord, Zapier/Make/n8n), and GOMAX talks to that service directly — no third-party connector holding your data or metering your usage.

Where are my API keys and webhook URLs stored? On your own site, and they're returned masked when you read the settings back. They're never exposed in plain text through the API.

Will anything sync automatically? No. Every integration is opt-in and triggered explicitly by you or your assistant. Nothing is sent in the background, and each sync offers a dry-run preview first.

Can I connect to an app that isn't listed? Yes — that's what the generic HTTP push is for. Point it at a Zapier catch-hook, a Make or n8n webhook, or your own endpoint, and you can route your segments into virtually any app those platforms support.

Do I still need consent to sync contacts? Yes. Only sync contacts who have given marketing consent. GOMAX tracks marketing consent per lead, and the same rule applies to every platform.

Automatic Transactional Emails for WordPress and WooCommerce

Piotr — Sat, 29 Aug 2026 21:08:20 +0000

GOMAX ULTIMATE 5.51.0 lets you install a ready library of transactional email templates and have them sent automatically when real events happen — a welcome email the moment a lead is captured, an order-received email when a WooCommerce order is placed, and a completion email when it's fulfilled — all with merge tags, from your own site, with no marketing consent required because they're a direct response to the customer's action. Transactional emails are the ones customers actually expect; now they go out on their own.

You no longer have to hand-write and manually send these. Seed the templates, assign one to an event, switch it on, and GOMAX handles the rest.

Key takeaways

Ready templates. One action installs professional templates for welcome, order received, order completed, abandoned-cart reminder, free-download follow-up and review request.
Event-triggered. Assign a template to "new lead", "order created" or "order completed" and it sends automatically when that happens.
Merge tags. Personalize with {{first_name}}, {{order_number}}, {{order_total}}, {{order_url}} and more — filled from the event.
No consent hurdle. Transactional emails bypass marketing consent (they answer the customer's own action) but still respect your daily send cap and are logged.
Self-hosted. Sent through your site's mail, personalized locally — nothing goes to a vendor cloud.

Transactional vs marketing — and why it matters

Marketing emails need opt-in consent. Transactional emails don't, because the customer triggered them: they filled in your form, or they placed an order, and they expect a reply or a receipt. GOMAX keeps the two separate. These new automatic emails are transactional by design, so they send without the marketing-consent gate — while your marketing campaigns still require proper consent, exactly as they should.

How to set it up

Seed the library. Install the ready templates in one step; they land in your template list with merge tags already in place. 2. Customize (optional). Edit any template's subject and body to match your brand and voice. 3. Assign and enable. Point "new lead" at the welcome template, "order created" at the order-received template, and "order completed" at the completion template, and turn each on.

From then on, when someone becomes a lead or an order changes state, the matching email goes out — personalized with the person's name, the order number, the total and a link to view the order.

What you can automate

Welcome every new enquiry so no lead goes cold in the first hour.
Confirm every order with a branded "we've got it" that reassures the buyer.
Close the loop when an order completes, and optionally ask for a review.
Reuse the abandoned-cart and free-download follow-up templates in your own flows.

Frequently asked questions

Do these emails need marketing consent? No. They're transactional — a direct response to something the customer did (submitting a form, placing an order), so they don't require marketing opt-in. Your marketing campaigns still do, and GOMAX keeps that distinction.

Will they duplicate WooCommerce's own order emails? They're additional and optional. WooCommerce sends its standard emails; GOMAX's transactional emails are extra touches you choose to enable (a warmer confirmation, a completion note, a review request). Turn on only the ones you want.

Can I customize the templates? Yes. The seeded templates are ordinary saved templates — edit the subject and body freely, and use merge tags like {{first_name}} and {{order_number}} to personalize them.

What stops them from being abused or over-sending? They obey your daily email cap and every send is logged, so volume stays under control. Each trigger is off until you enable it and assign a template.

Does any of this use an external email service? No. Emails are sent through your site's own mail system and personalized locally. Nothing about your customers is sent to GOMAX or a third party.

WordPress Webhooks Without Zapier: Signed, First-Party, Self-Hosted

Score Your Articles for SEO and Readability Before You Publish

Piotr — Fri, 28 Aug 2026 21:07:55 +0000

GOMAX ULTIMATE 5.50.0 adds an on-page SEO content analyzer that grades any WordPress post — or a raw draft you haven't published yet — for focus-keyword usage and readability, returning a 0-100 score with specific fixes, all computed on your own server. It's the "content analysis" layer that sits alongside GOMAX's technical SEO audit: the audit checks the plumbing, this checks the writing.

The powerful part is that it works on content, not just on a saved URL — so an AI assistant can write an article, score it, fix the weak spots, and only then publish. No more guessing whether a draft is optimized.

Key takeaways

Focus-keyword analysis. Checks the keyword in the title, meta description, first paragraph, a subheading, the URL slug and an image alt, plus keyword density.
Structure checks. Title and meta length, word count, subheadings, internal links and images.
Readability scoring. Flesch reading ease, average sentence length, overly long paragraphs and transition-word usage (English-oriented).
Works before publishing. Score raw draft content — not just a live URL — so you can fix an article before it goes out.
Self-hosted. Runs on your own site and reads the focus keyword and meta from Yoast, RankMath or AIOSEO when present.

Audit vs analyze: two different questions

GOMAX already had a technical SEO audit that answers "is this page set up right?" — title tag, meta, one H1, canonical, alt text, thin content. This new analyzer answers a different question: "is this written right for its keyword and its reader?" Both matter, and they don't overlap. A page can pass every technical check and still miss its focus keyword entirely or read like a legal document.

What it scores

Give it a post (or raw content) and a focus keyphrase, and it returns a graded checklist:

Keyword: is the keyword in the title, meta, opening paragraph, a subheading, the URL and an image alt? Is the density in a healthy 0.5–2.5% range, or is it stuffed or absent?
Structure: is the title 30–60 characters, the meta 120–160, the content at least 300 words? Are there subheadings, an internal link, an image?
Readability: what's the Flesch reading ease? Are sentences short enough on average? Are there giant paragraphs? Are transition words present to keep it flowing?

Each failing check comes with a plain fix, and bulk_analyze scores your recent posts worst-first so you know exactly where to spend an afternoon of editing.

Why "before publishing" changes the workflow

Traditional on-page tools grade a post inside the editor after you've written it. Because this analyzer can score raw content passed to it, it fits an AI-assisted workflow: the assistant drafts, scores, sees "keyword not in first paragraph, Flesch 48, no internal link," fixes those, re-scores, and publishes a piece that's already optimized. The feedback loop happens before anything goes live.

Frequently asked questions

How is this different from GOMAX's existing SEO audit? The audit checks technical setup (title tag, meta, H1, canonical, alt text, thin content). This analyzer checks the writing itself — focus-keyword placement and density plus readability. They answer different questions and are meant to be used together.

Can it score a draft that isn't published yet? Yes — that's a key feature. analyze_content takes raw content, a title, a meta description and a focus keyword, so you (or an AI assistant) can grade and fix an article before it's ever saved or published.

Where does it get the focus keyword from? You can pass one directly, or for a published post it reads the focus keyword and meta description from Yoast, RankMath or AIOSEO if you use one of those. Without a keyword it still scores structure and readability and simply skips the keyword checks.

Is the readability score reliable for non-English content? The readability metrics (Flesch and syllable-based measures) are designed for English and are most accurate there. The keyword and structure checks work regardless of language.

Does anything get sent to an external service? No. All analysis runs locally on your own server. Nothing about your content is sent to GOMAX or any third party.

Optimize WordPress Images to WebP Locally, Without a Cloud Service

Piotr — Wed, 26 Aug 2026 21:07:57 +0000

GOMAX ULTIMATE 5.49.0 adds a local image optimizer that recompresses, downscales and converts your WordPress media to WebP using your own server's GD or Imagick — so your images never get uploaded to a third-party optimization service, and there's no per-image fee or monthly quota. Big, heavy images are the number-one cause of slow pages; now you can fix them in bulk, on your own hardware, with your originals safely backed up.

Most popular image optimizers send every upload to their cloud to be processed and bill you by the image or by the month. GOMAX does the work in-house: the same GD/Imagick your server already uses to make thumbnails now also compresses and converts your library.

Key takeaways

Local, no cloud. Compression, downscaling and WebP conversion run on your server — images never leave the site, and there's no external service or quota.
See the savings first. analyze scans your media for oversized, heavy and legacy JPG/PNG images and estimates what you'll save.
Bulk and resumable. optimize_bulk processes a batch at a time and remembers where it left off, so even a large library finishes without timing out.
WebP with a safe fallback. Generate WebP copies and, optionally, serve them by rewriting to `` — browsers that don't support WebP still get the original.
Reversible. Originals can be backed up before optimization, and restore_original reverts any image.

Why local optimization is the better default

Sending your images to someone else's cloud has three costs: money (per-image or subscription), privacy (your media on a third party's servers), and dependency (if their service changes or disappears, so does your optimization). Doing it locally removes all three. The trade-off used to be capability — but modern PHP with GD or Imagick handles WebP well, and for the vast majority of sites the local result is excellent. It fits a pay-once, privacy-first product perfectly: the optimizer is built into the plugin you already own, and it works on your terms.

What it does to each image

Recompress at a quality you choose — big savings on over-large JPEGs and PNGs.
Downscale anything wider than your max width (huge phone-camera uploads are the usual culprit).
Strip metadata (EXIF/camera data) as part of re-encoding.
Generate a WebP copy alongside the original when your server supports it.

You can then turn on WebP delivery, which rewrites image tags on the front end to serve the WebP version with the original as a fallback — no theme edits required. And because every original can be backed up first, you can always roll an image back if you want the untouched file.

Frequently asked questions

Do my images get uploaded to a third-party service? No. All processing happens on your own server using its GD or Imagick libraries. Your images never leave the site, and there's no external optimization service, quota or per-image fee.

Will it work on my hosting? Recompression and downscaling work anywhere WordPress makes thumbnails. WebP generation needs GD or Imagick with WebP support — retrieve_capabilities tells you exactly what your server can do, and the optimizer falls back gracefully if WebP isn't available.

Is it safe — can I undo it? Yes. Keep the "back up originals" setting on (it's the default) and the untouched file is saved before optimization, so restore_original can revert any image at any time.

How does WebP get served to visitors? Optionally. When you enable WebP delivery, GOMAX rewrites tags to `` elements that offer the WebP version with the original as a fallback, so browsers that don't support WebP still see the image. It requires no changes to your theme.

Will a big media library time out? No. optimize_bulk processes a limited batch per call and tracks which images are done, so you call it repeatedly until nothing remains — even thousands of images finish without a timeout.

Audit Core Web Vitals in WordPress Without PageSpeed or a Cloud Service

Native WordPress Backups With Off-Site to Your Own FTP or WebDAV

Piotr — Tue, 25 Aug 2026 21:08:15 +0000

GOMAX ULTIMATE 5.48.0 adds a native backup engine that dumps your WordPress database and zips your uploads on your own server — on a schedule, with rotation — and copies each backup off-site to your own FTP or WebDAV storage, with no third-party backup plugin and nothing ever passing through a vendor cloud. Backups are the one thing every site needs and the one thing that shouldn't depend on someone else's service; now GOMAX does it itself.

Until now, GOMAX could ask another backup plugin to run — useful, but it meant relying on a separate tool. This release makes backups first-party: the engine lives inside the plugin you already own, and the copies go wherever you tell them.

Key takeaways

Native, self-hosted. A gzipped SQL dump of every table and a ZIP of your uploads, created on your own server — no backup plugin required.
Scheduled with retention. Turn on daily or weekly backups and keep the newest N; older ones rotate away automatically.
Off-site to your storage. Copy each backup to your own FTP or WebDAV endpoint — bring-your-own credentials, which stay on your site and are masked when read back.
Selectable scope. Back up just the database, just the uploads, or the full set.
Manage and verify. List backups, verify one is readable and valid, delete old ones, and test the off-site connection — all from the API.

Why native and off-site matters

The golden rule of backups is that a backup on the same server as the site isn't really a backup — if the server is lost, so is the copy. That's why off-site matters. But most off-site backup services want your data flowing through their cloud, on their subscription. GOMAX takes the opposite approach: the backup is created locally and pushed to storage you control — your FTP account, your WebDAV endpoint, your rules. It fits a pay-once, privacy-first, self-hosted product exactly: the capability is built in, and the data goes only where you send it.

How it works

Create. run_backup with a scope of db, uploads, or full writes the files into a protected wp-content/gomax-backups folder (locked down so the web can't read it).
Schedule. Set daily or weekly with a retention count; a background job runs the backup and rotates out anything beyond your keep-limit.
Off-site. Configure an FTP or WebDAV target with your own credentials and every new backup is uploaded there automatically. test_offsite confirms the connection before you rely on it.
Manage. list_backups shows the catalog with sizes and dates, verify_backup checks a backup is intact, and delete_backup removes one.

The database dump is written table-by-table in chunks and gzipped, so it stays memory-friendly, and the uploads ZIP is size-guarded so a huge media library doesn't blow up the request — for very large sites you can scope to the database and lean on off-site storage.

Frequently asked questions

Do I still need a backup plugin like UpdraftPlus? No — the native engine backs up your database and uploads on its own. GOMAX can still hand off to a detected backup plugin if you have one, but it's no longer required.

Where are the backups stored, and are they safe from the public? In a protected wp-content/gomax-backups folder with a deny rule and an index guard so the files aren't web-accessible. For true safety, enable the off-site copy so a backup also lives on storage you control.

Does my data go through GOMAX or any cloud? No. Backups are created on your own server and, if you enable off-site, uploaded directly to your own FTP or WebDAV endpoint. Nothing passes through GOMAX or a vendor cloud, and your off-site credentials stay on your site (masked when read back).

What if my uploads folder is huge? The uploads ZIP is size-guarded to avoid overwhelming the server; if it's too large it's skipped with a note. For big media libraries, back up the database on a schedule and copy media off-site separately, or run scoped backups.

Can I check a backup is actually good? Yes. verify_backup confirms the files are readable and non-empty and, for the gzipped database dump, that it opens correctly — so you know a backup is valid before you ever need it.

A Self-Hosted WordPress Security Suite: Lockouts, Rate Limits, Integrity

Piotr — Mon, 24 Aug 2026 21:08:15 +0000

GOMAX ULTIMATE 5.47.0 turns GOMAX's security scorecard into a full protection suite: you can switch on login-attempt lockouts, rate-limiting for public API calls, author-enumeration and REST-users blocking, one-click XML-RPC disable, a core-file integrity check against WordPress's official checksums, and a malware-pattern scan of your uploads folder — every one opt-in, reversible, and running entirely on your own site. The scorecard tells you what's weak; now GOMAX can actually stop the common attacks.

Most WordPress break-ins don't use exotic exploits — they brute-force logins, hammer XML-RPC, harvest usernames, and hide PHP in the uploads folder. This release closes those doors, with each protection off by default so you enable exactly what you want.

Key takeaways

Login lockouts. After a set number of failed logins, the offending IP is locked out for a chosen window — with an email alert and a security.lockout webhook.
API rate-limiting. Unauthenticated calls to the GOMAX REST namespace (your public agent endpoints) are rate-limited per IP; logged-in admins are never limited.
Close enumeration & XML-RPC. Block ?author=N username harvesting, hide the REST users endpoint from anonymous visitors, and disable XML-RPC in one switch.
Integrity & malware checks. Compare core files to the official WordPress checksums, and scan the uploads folder for executable PHP and suspicious code patterns.
Full visibility. A security event log, a lockout list, and one-click unlock — all on your own server, nothing sent anywhere.

What each protection does

Login protection watches failed logins per IP. Cross the threshold and that IP is blocked for the lockout window; you get an email and a webhook so your other tools know. A successful login clears the counter.
Rate-limiting caps how many requests an unauthenticated visitor can make to GOMAX's REST endpoints in a time window — the practical defence for public AI-agent endpoints against abuse and scraping. You stay unaffected when logged in.
Author-enumeration blocking stops the classic ?author=1 trick that reveals usernames; REST-users protection hides /wp/v2/users from anonymous callers for the same reason.
XML-RPC disable shuts down a legacy endpoint that's a frequent brute-force and pingback-DDoS vector, if you don't use it.
Integrity check downloads the official checksums for your exact WordPress version and flags any core file that's been modified or is missing — a fast way to spot tampering.
Uploads scan looks for .php files that shouldn't be in /uploads and for suspicious patterns (eval, base64_decode, shell_exec…), which are common signs of an injected backdoor.

Safe by default, reversible always

Nothing here changes until you turn it on, and everything can be turned back off just as easily — these are settings, not irreversible edits to your site. That means you can tighten security gradually and roll back instantly if a protection is too strict for your workflow. And because it's first-party, the lockout list, the event log and the scans all live on your own server; the only outbound request is the integrity check reading WordPress's official checksums.

Frequently asked questions

Will login lockouts lock me out too? Only if you exceed the failed-attempt threshold from your IP — and you can set the threshold and lockout duration. If it ever happens, unlock_ip releases any IP immediately, and a successful login clears the counter automatically.

Does rate-limiting affect me as the admin? No. Logged-in users (including you) are never rate-limited. The limit only applies to unauthenticated requests to GOMAX's public REST endpoints, which is exactly where abuse comes from.

Is disabling XML-RPC safe? For most modern sites, yes — few things still need it. If you use the WordPress mobile app or certain pingback features you may want it on, so it's an opt-in switch you can reverse anytime.

How does the integrity check work without a security cloud? It fetches the official file checksums for your WordPress version from api.wordpress.org (WordPress's own service) and compares them to your files locally. Nothing about your site is uploaded — it only downloads the reference checksums.

What should I do if the uploads scan finds PHP files? Investigate them. Legitimate media uploads are images, PDFs and documents — executable PHP in the uploads folder is a common sign of a backdoor. The scan lists the files so you can review and remove anything you didn't put there.

One WordPress Site-Health Score: Security, Speed, SEO, Links, Database

Piotr — Sun, 23 Aug 2026 21:08:14 +0000

GOMAX ULTIMATE 5.46.0 rolls all of GOMAX's maintenance auditors — security, performance, accessibility, link health and database — into a single command that returns one 0-100 site-health score, a grade, and a prioritized list of the most important things to fix, with an optional weekly or monthly email report. Instead of running five checks and stitching the results together in your head, you get one number and one to-do list — computed entirely on your own site.

Individually, each auditor answers one question well. But an owner really wants the overall answer: "how healthy is my site right now, and what should I fix first?" Site Health is that answer.

Key takeaways

One command, one score. run_report runs each pillar and combines them into a single weighted 0-100 score and grade.
Prioritized actions. The report merges the biggest issues across every pillar into one list, sorted by severity, so you fix what matters most first.
Permission-respecting. Each pillar keeps its own permission — grant a pillar's read access to include it; anything not granted is simply skipped and reported, never failed.
Scheduled email digest. Turn on a weekly or monthly report and GOMAX emails you a formatted health summary automatically.
Self-hosted. Every pillar runs on your own server; nothing about your site leaves it.

What it combines

Site Health aggregates the modules GOMAX already runs locally:

Security — headers and WordPress hardening posture.
Performance — Core Web Vitals hygiene from your rendered pages and server.
Accessibility — WCAG checks across your key pages.
Link health — broken links and images in your content.
Database — bloat and reclaimable table overhead.

Each contributes a score; the overall number is a weighted blend, so a serious security gap moves the needle more than a little database bloat.

Why one score matters

Five separate reports are five decisions about where to spend your time. A single health score plus a ranked action list turns that into one decision: do the top item, re-run, watch the number climb. It's the same principle behind a credit score or a fitness ring — aggregate the signals so a human (or an AI assistant) can act without drowning in detail. And because each finding still carries its pillar, severity and fix, you can always drill back down.

Set it and forget it

Enable the scheduled report and pick weekly or monthly. GOMAX runs the combined audit and emails you a clean summary — overall score, per-pillar table, and the top actions — so site health lands in your inbox on a cadence instead of being something you remember to check. Prefer on demand? Send one immediately whenever you want.

Frequently asked questions

Do I need to enable every pillar? No. Site Health includes whichever pillars you've granted read permission to; any you haven't are skipped and clearly reported. Enable more pillars for a more complete score.

Does producing the report send my site anywhere? No. Every pillar runs locally on your own server, and the combined report — and the optional email — are generated on your WordPress install. Nothing is sent to GOMAX or any vendor cloud.

How is the overall score calculated? It's a weighted blend of each included pillar's 0-100 score, so higher-impact areas (like security and performance) carry more weight than lighter ones. Pillars that don't produce a numeric score contribute a derived one.

Can it email me automatically? Yes. Turn on the scheduled report and choose weekly or monthly; GOMAX emails a formatted digest with the overall score, a per-pillar table and the top actions. You can also trigger one on demand.

Where do I start after reading the report? Work the top of the prioritized action list — those are the highest-severity, most cross-cutting issues. Fix them, re-run the report, and watch the overall score improve.

DEV Community: Piotr

A Native AI Text Engine Inside WordPress — No API Key, Offline

Key takeaways

Statistics, not a language model — and why that's a feature

What you can do with it today

Frequently asked questions

Related articles

AI Sales Concierge for WooCommerce: A Live Chatbot That Sells

Why a concierge, not just a chat widget

What it does

Grounded follow-up emails — no empty promises

How to set it up

Privacy and ownership

FAQ

Find Which WordPress Posts to Refresh First With a Decay Monitor

Key takeaways

Why content decays — and why refreshing works

How the monitor prioritizes

A simple monthly routine

Frequently asked questions

Related articles

See what a one-prompt GOMAX page looks like

One prompt, one editable block

Automatic Internal Link Suggestions and Orphan-Page Finder for WordPress

Key takeaways

Why internal links matter so much

How it works

A simple workflow

Frequently asked questions

Related articles

Connect WordPress to Slack, Discord, Brevo and Zapier — Your Keys

Key takeaways

Reach the tools you already use

How each one works

Frequently asked questions

Automatic Transactional Emails for WordPress and WooCommerce

Key takeaways

Transactional vs marketing — and why it matters

How to set it up

What you can automate

Frequently asked questions

Related articles

Score Your Articles for SEO and Readability Before You Publish

Key takeaways

Audit vs analyze: two different questions

What it scores

Why "before publishing" changes the workflow

Frequently asked questions

Optimize WordPress Images to WebP Locally, Without a Cloud Service

Key takeaways

Why local optimization is the better default

What it does to each image

Frequently asked questions

Related articles

Native WordPress Backups With Off-Site to Your Own FTP or WebDAV

Key takeaways

Why native and off-site matters

How it works

Frequently asked questions

A Self-Hosted WordPress Security Suite: Lockouts, Rate Limits, Integrity

Key takeaways

What each protection does

Safe by default, reversible always

Frequently asked questions

Related articles

One WordPress Site-Health Score: Security, Speed, SEO, Links, Database

Key takeaways

What it combines

Why one score matters

Set it and forget it

Frequently asked questions

Related articles