Configuration management ensures consistent security, caching, and optimization across all Velocity Stack Editions. This page documents configurations in deployment order — from foundational security through fine-tuned performance.
Key principle: Velocity Stack achieves sub-100ms load times with all security controls active. Performance is built on top of security, not instead of it.
Optimization Process
The configuration process follows a systematic approach:
Establish security baseline (non-negotiable)
Run performance metrics (Pingdom, GTmetrix)
Identify largest bottleneck by content type
Apply targeted optimization
Re-test and measure improvement
Repeat until goal is reached
For Velocity Stack, the goal is maximum speed — as fast as possible while maintaining full security.
1. Application Security
Application Security is configured first, before any performance work. Every optimization runs on top of these controls.
User Security
Setting
Value
Purpose
Login Lockout
Enabled
Brute force protection
Max Login Attempts
3
Lock after 3 failures
Lockout Duration
60 minutes
Delay repeated attempts
Force Logout
480 minutes
Session timeout (8 hours)
Disable Username Enumeration
Enabled
Hide valid usernames
Firewall
Setting
Value
Purpose
Basic Firewall
Enabled
Block common attacks
Pingback Protection
Enabled
Prevent DDoS vector
Block Debug Log Access
Enabled
Hide sensitive logs
Disable XML-RPC
Fully disabled
Remove attack surface
File Security
Setting
Value
Purpose
File Permissions Check
Run and fix
Correct insecure permissions
Application File Editing
Disabled
No UI/capability editor
Application File Access
Block readme, license
Hide version info
Server Rules
Rule
Status
Purpose
Block Directory Browsing
Enabled
Hide folder contents
Disable Trace and Track
Enabled
Prevent XST attacks
Block Malicious Query Strings
Enabled
Filter common exploits
2. Cache Orchestration Layer
Server-Side Caching provides the largest single performance improvement — page caching alone can reduce load times by 90%.
General Settings
Setting
Value
Rationale
Enable Cache
ON
Core functionality
Cache Logged-in Users
OFF
Admin sees live changes
Cache Commenters
OFF
Fresh content after commenting
Cache REST API
ON
Faster API responses
Cache Mobile
ON
Same cache for responsive design
TTL (Time To Live)
Cache Type
TTL
Notes
Default Public Cache
604800 (1 week)
Static content
Default Private Cache
1800 (30 min)
User-specific
Default Front Page
604800 (1 week)
Homepage
Default Feed
604800 (1 week)
RSS feeds
Page Optimization
Setting
Value
Impact
CSS Minify
ON
Reduces CSS file size
CSS Combine
ON
Fewer HTTP requests
Load CSS Async
ON
Non-render-blocking
Unused CSS Removal
ON
Removes unused styles per page
JS Minify
ON
Reduces JS file size
JS Combine
ON
Fewer HTTP requests
Load JS Deferred
ON
Non-render-blocking
HTML Minify
ON
Reduces document size
Image Optimization
Setting
Value
Impact
Auto Request Cron
ON
Automatic optimization queue
Auto Pull Cron
ON
Automatic retrieval
Optimize Original Images
ON
Compress source files
Remove Original Backups
OFF
Keep originals for rollback
WebP Replacement
ON
Modern format, smaller files
Lazy Load Images
ON
Defer offscreen images
Add Missing Dimensions
ON
Prevents CLS
3. CDN Layer
The CDN Layer provides 6 layers of edge caching through a global network.
CDN Layers
Layer
What It Caches
Benefit
Page Cache
Full HTML pages
Fastest possible response
Object Cache
Database queries
Reduces database load
Browser Cache
Static assets locally
Zero requests on repeat visit
CSS Cache
Optimized stylesheets
Combined, minified CSS
JS Cache
Optimized scripts
Combined, minified JS
Image Cache
Optimized images
WebP conversion, compression
CDN Setup
Server-Side Caching → General → Request Domain Key
Wait for key generation (usually instant)
Server-Side Caching → CDN → Enable CDN
Verify CDN status shows “Connected”
4. Global DNS & SSL
Global DNS provides worldwide distribution and SSL termination.
DNS Settings
Record Type
Name
Proxy Status
Notes
A
@ (root)
Proxied
Edge handles root
CNAME
www
DNS only
Required for CDN Layer
CNAME
dev
DNS only
Required for CDN Layer
MX
@
DNS only
Mail routing
TXT
@ (SPF, DMARC)
DNS only
Email authentication
Critical: CDN Layer requires DNS-only mode (gray cloud) for subdomains. Proxied records break CDN functionality.
SSL/TLS Settings
Setting
Value
SSL/TLS Mode
Full (strict)
Always Use HTTPS
ON
Automatic HTTPS Rewrites
ON
Minimum TLS Version
TLS 1.2
5. Application Layer Settings
General
Setting
Value
Timezone
America/New_York (or client TZ)
Date Format
F j, Y
Time Format
g:i a
Permalinks
Setting
Value
Reason
Permalink Structure
/%postname%/
SEO-friendly, cacheable
Reading
Setting
Development
Production
Search Engine Visibility
Discourage indexing
Allow indexing
6. UI Layer
The UI Layer includes cleanup functions that remove unnecessary overhead.
functions.php Sections
Section
Purpose
Impact
1. Enqueue Styles
Load stylesheets, preload fonts
Critical path optimization
2. Disable External Fonts
Remove external font requests
Eliminates 2 HTTP requests
3. Cleanup
Remove emoji, Gravatar, dashicons
Reduces unused assets
4. Custom Copyright
Dynamic footer copyright
Minimal impact
7. Font Optimization (Fine-Tuning)
After major optimizations are in place, font loading often remains as the largest content type. This is the final optimization step.
Default vs. Optimized
Approach
Requests
Payload
External Fonts (4 weights)
2 external
~200KB
Self-hosted (4 weights)
4 local
~200KB
Self-hosted, subsetted (1 weight)
1 local
~10KB
Optimization Steps
Identify which font weights are actually used on the site
Download required weight(s) only
Subset using font editing tool — remove unused glyphs
Export optimized WOFF2 to /fonts/
Preload in functions.php
Disable external font requests
Result: 95% reduction in font payload (~200KB → ~10KB)
Configuration Export/Import
Server-Side Caching
Cache Settings → Toolbox → Export
Download settings file
Store in SDLC Platform repository or template
Application Security
Security Settings → Export/Import
Export settings to file
Store securely (contains security rules)
Configuration Checklist
☐ Application Security configured and active
☐ Firewall rules enabled
☐ Login protection active
☐ Server-Side Caching installed and configured
☐ CDN Layer domain key active
☐ Page caching enabled
☐ CSS/JS optimization enabled
☐ Unused CSS removal complete
☐ Image optimization enabled
☐ Global DNS configured (DNS-only for subdomains)
☐ SSL/TLS set to Full (strict)
☐ Application Layer permalinks set to /%postname%/
