內容簡介
Vyse Digital Boosted 是一款專為 WordPress 設計的外掛，提供頁面快取、圖片優化、CSS/JS 處理、SEO 管理、重定向及 GDPR 風格的 Cookie 同意通知，幫助網站提升效能與搜尋引擎排名。
【主要功能】
• 頁面快取加速網站載入速度
• 圖片優化減少載入時間
• SEO 關鍵字面板提升搜尋排名
• 重定向管理簡化網址變更
• GDPR Cookie 同意通知增強合規性
• 可選 Pro 升級提供進階優化功能
外掛標籤
開發者團隊
② 後台搜尋「Vyse Digital Boosted – Site Optimization, Cache, SEO & Cookie Consent」→ 直接安裝（推薦）
原文外掛簡介
Boosted gives you fast WordPress pages with page caching, image optimization,
CSS/JS handling, an SEO and keyphrase panel, redirects, and a GDPR-style cookie
banner. Core performance, caching, image optimization, SEO, redirects, and
cookie consent features are available free, with optional Pro upgrades for
advanced optimization capabilities.
Open the Cache tab and turn on WP_CACHE – Boosted adds it to wp-config.php
for you. If the file is not writable, the tab shows the one line to add by
hand.
External services
Boosted contacts the third-party services listed below. Every one of them is
reached only after you configure it or explicitly request its suggestions, so a fresh install with
nothing filled in contacts nothing at all. Each entry says what triggers the
request, exactly what is sent, and whether it happens in the WordPress admin or
during a visitor’s page load.
Datamuse related wording
Endpoint: https://api.datamuse.com/words
When: only when an authorized editor clicks “Suggest related wording” in the
Boosted SEO Related Wording box on a post or page. No background queries.
What is sent: the phrase explicitly entered (2–100 characters), vocabulary
language (English or Spanish), and a result limit. Post content, titles,
descriptions, visitor data and WordPress credentials are not included.
Where: server-side from the editor. WordPress caches results per user for
15 minutes. Suggestions never change metadata automatically.
Datamuse temporarily logs queries; its documentation says logs are discarded
at the end of the following day. Suggestions are not search-volume data.
Documentation, usage conditions and privacy: https://www.datamuse.com/api/
Datamuse announces mandatory API keys from January 1, 2027. This integration
currently uses its keyless endpoint; authentication will need updating when
that requirement takes effect. Service failures leave core SEO unaffected.
Google PageSpeed Insights API
Endpoint: https://www.googleapis.com/pagespeedonline/v5/runPagespeed
When: only when an administrator runs a PageSpeed measurement, and only once you
have saved your own Google API key. With no key saved, no request is made.
What is sent: the public URL being tested, and your own API key.
Where: the WordPress admin only. Visitors never trigger this.
Google OAuth 2.0 – signing in for Analytics reporting
Endpoint: https://oauth2.googleapis.com/token
When: only once you have saved a GA4 Property ID and a Google service-account
key, and only when a page or widget actually uses the [boosted_ga total_views]
shortcode. Without either field, or without the shortcode on a page, no request
is made.
What is sent: a signed assertion (a JWT) proving the request comes from your own
service account. It is signed with the private key you saved; the key itself is
never sent.
Where: during a front-end page load, because that is when the shortcode renders.
No visitor data is included in the request, and the answer is cached for an hour
so a page showing the number does not sign in on every visit.
Google Analytics Data API
Endpoint: https://analyticsdata.googleapis.com/v1beta/properties/PROPERTY_ID:runReport
(PROPERTY_ID is the GA4 Property ID you saved.)
When: immediately after the sign-in above, and under the same conditions.
What is sent: your GA4 Property ID and a date range. Nothing about the visitor
whose page load happened to trigger it.
Where: during a front-end page load, as above. The answer is cached for an hour,
and a failure for fifteen minutes, so a broken setup does not retry on every
visit.
Google reCAPTCHA – verification
Endpoint: https://www.google.com/recaptcha/api/siteverify
When: when somebody submits a comment on your site, and only once you have saved
both a reCAPTCHA site key and a secret key. Administrators and other users who
can moderate comments are not verified.
What is sent: the reCAPTCHA response token from the visitor’s browser, your
secret key, and the visitor’s IP address.
Where: this one affects your site’s visitors, not just administrators. A visitor
who posts a comment has their IP address sent to Google. If you switch reCAPTCHA
on, say so in your own privacy policy.
Google reCAPTCHA – script
Endpoint: https://www.google.com/recaptcha/api.js
When: loaded in every visitor’s browser on pages with a comment form, once
reCAPTCHA is configured. Google sets its own cookies and collects its own data
from that point; Boosted is not party to it.
Where: your visitors’ browsers.
Google Tag Manager and Google Analytics (gtag)
Endpoints: https://www.googletagmanager.com/gtag/js,
https://www.googletagmanager.com/gtm.js, https://www.googletagmanager.com/ns.html
When: loaded in visitors’ browsers only once you have saved a GA4 Measurement ID
or a Google Tag Manager container ID. With neither saved, no script is added.
What is sent: whatever Google’s own script collects, which is Google’s to
describe rather than Boosted’s. Boosted adds the tag and nothing else.
Where: your visitors’ browsers.
For all of the Google services above:
Privacy policy: https://policies.google.com/privacy
Terms of service: https://policies.google.com/terms
Google APIs terms of service: https://developers.google.com/terms/
Freemius – licensing, opt-in usage tracking and update delivery
Endpoint: https://wp.freemius.com and https://api.freemius.com
When: on activation WordPress shows the Freemius opt-in prompt. Only if you
opt in does the plugin contact Freemius: on activation/deactivation, on
licence activation or check, and on the scheduled update check.
What is sent: site URL, WordPress and PHP versions, plugin version, site
language, admin email address only if you opted in, and licence state when a
licence key is entered. No page content, no visitor data, no settings values,
no secrets.
Where: the WordPress admin only. Visitors never trigger this. You can opt out
at any time from the Freemius account menu; the plugin keeps working with
free behaviour.
Privacy policy: https://freemius.com/privacy/
Terms of service: https://freemius.com/terms/
Cloudflare API – cache purge sync (Boosted Pro only)
Endpoint: https://api.cloudflare.com/client/v4/zones/{zone ID}/purge_cache
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Cloudflare Cache Synchronization and enter your own Cloudflare
zone ID and API token.
When: after Boosted clears pages from its own page cache – when a post is
published, updated or deleted, or when the whole cache is cleared.
What is sent: the URLs of the pages that were cleared (or a request to purge
the whole zone), and your Cloudflare API token as the authorization header. No
page content, no visitor data.
Where: from your server to Cloudflare. Visitors never trigger this.
Privacy policy: https://www.cloudflare.com/privacypolicy/
Terms of service: https://www.cloudflare.com/terms/
AI provider through WordPress – SEO metadata drafts (Boosted Pro only)
This code is not in the free plugin. It applies to Boosted Pro on WordPress 7.0
or later, only after you switch on the AI Meta Description & Title Assistant and
connect an AI provider yourself under Settings > Connectors (for example
Anthropic, Google or OpenAI, each with its own WordPress plugin and your own API
key). Boosted does not contact any AI service itself and never holds an API key;
it asks WordPress’s built-in AI client, which sends the request to the provider
you connected.
When: when you generate drafts under SEO > Automation, up to 10 posts at a time.
What is sent: for each post, its ID, title, focus keyphrase and up to the first
1,500 characters of its text (without HTML, shortcodes or links), plus your site
name. No visitor data. The drafts that come back change nothing until you
approve them.
Where: from your server to the provider you connected. Its terms and privacy
policy are those of that provider.
Google Tag Manager – local copy of gtag.js (Boosted Pro only)
Endpoint: https://www.googletagmanager.com/gtag/js?id={your measurement ID}
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Local Analytics Hosting while Boosted adds Google Analytics to your
site.
When: once a day, from WP-Cron.
What is sent: your Google Analytics measurement ID, to download the current
gtag.js. The file is stored in your uploads folder and served from your site in
place of Google’s copy. No visitor data is sent by the download.
Where: from your server to Google. What Google Analytics itself collects from
visitors is unchanged and is described under “Google Tag Manager and Google
Analytics (gtag)” above.
Privacy policy: https://policies.google.com/privacy
Terms of service: https://policies.google.com/terms
What does not leave your site
Cache preloading and the cache self-test request your own pages, on your own
domain, and nowhere else.
Your PageSpeed API key, your reCAPTCHA secret and your Google service-account key
are stored on this site only. They are never shown back to you after saving and
are excluded from a settings export.
The Copy for AI button on Console Logs puts text on your clipboard for you to
paste somewhere yourself. It contains no keys, no settings values and no server
paths, and Boosted sends it nowhere.
External fonts and optional local copies
Free does not download external font stylesheets or font files on the server.
If an administrator enables font resource hints or CSS external preconnect,
Boosted may add a browser preconnect or DNS-prefetch hint for an external
stylesheet already enqueued by the theme or another plugin. This connects the
visitor’s browser to that host and can disclose the visitor’s IP address;
Boosted does not add the third-party stylesheet itself.
Premium can make server-side requests only after an administrator enables Font
Optimization and either Self-host Fonts or Optimize External Font CSS, then
runs a font rebuild. The rebuild examines external font stylesheets previously
found during site analysis. Only Google Fonts and Bunny Fonts stylesheets are
eligible; Boosted downloads those, and it copies
font files locally only when Self-host Fonts is enabled. The request sends the
full stylesheet or font-file URL (including its query), the site’s server IP,
and a browser-like User-Agent. It sends no WordPress credentials or visitor IP.
Cached copies are stored under wp-content/cache/boosted/fonts/.
Google Fonts: https://fonts.googleapis.com and https://fonts.gstatic.com.
Premium may download and locally cache their openly licensed fonts after the
explicit settings and rebuild above. Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
Bunny Fonts: https://fonts.bunny.net. Premium may download and locally cache
its openly licensed fonts after the same explicit settings and rebuild.
Terms: https://bunny.net/tos/ Privacy: https://bunny.net/privacy/
Adobe Fonts (Typekit): https://use.typekit.net. Monotype/Fonts.com:
https://fast.fonts.net. Boosted may recognize these existing external
stylesheets and may add a preconnect hint if that setting is enabled. Boosted
does not download or self-host their font files; the original provider or
theme remains responsible for serving them. Adobe’s standard web-font terms
prohibit self-hosting; Monotype fonts require the site’s own applicable
license and usage reporting. Adobe terms:
Click to access Adobe-Fonts-Product-Specific-Terms-en_US-20240618.pdf
Adobe privacy: https://www.adobe.com/privacy/policies/adobe-fonts.html
Monotype terms: https://www.monotype.com/legal/terms-use
Monotype privacy:
https://www.monotype.com/legal/privacy-policy/website-use-privacy-policy
Any other external font or icon-font stylesheet (for example one a theme loads
from an icon CDN) is treated generically as an external stylesheet. Boosted
does not identify its provider, never requests it on the server and never
copies its files; at most it may add the browser preconnect hint described
above when the administrator enables that setting.
Boosted itself never enqueues a stylesheet or font file from any of the font
providers above. It only works with stylesheets the theme or another plugin
has already added to the page.
Source Code & Build Instructions
All script and style assets shipped in Boosted are provided in full human-readable format.
The uncompiled source files are included directly in the plugin package inside assets/src/:
Tailwind CSS admin styles source: assets/src/tailwind.css
Build command: npx tailwindcss -i assets/src/tailwind.css -o assets/tailwind.css
Consent runtime source: assets/src/consent-runtime.js
Runtime file: assets/consent-runtime.js
Admin script: assets/admin.js (written and maintained directly as plain, non-minified JavaScript)
Minified admin copies: assets/admin.min.js and assets/tailwind.min.css are assets/admin.js and
assets/tailwind.css with comments and whitespace removed (JShrink for the script, matthiasmullie/minify
for the stylesheet). Both sources ship beside them, and WordPress loads the sources when SCRIPT_DEBUG is on.
Freemius pricing bundle: vendor/freemius/freemius-sdk/assets/js/pricing/freemius-pricing.js
Readable upstream source and build instructions: https://github.com/Freemius/pricing-page
Boosted-authored JavaScript is supplied in readable form. The bundled Freemius
pricing script is third-party compiled code; its upstream source is linked above.
