The Hostaan plugin is a WordPress plugin built for Hostaan web hosting. It speeds up the admin panel, checks your site's settings, and lets you change the most important
wp-config.php settings without touching any files. This guide walks through every feature of the new version, one tab at a time.
What the Hostaan plugin is
The plugin is installed automatically on Hostaan WordPress hosting, and you will find it in the left-hand menu of the WordPress admin panel under Hostaan. It is divided into seven tabs: Optimization Checks, Configuration, Backend Performance, Blocking, Access Log, Error Log and Support.
The new version brings three significant changes: an admin panel cache that speeds up heavy WooCommerce views, a managed wp-config block for changing debug and memory settings safely, and country-based blocking that stops unwanted traffic at the server before WordPress even starts.
Optimization Checks
The first tab is a health check for your site. The plugin runs through a set of checks and shows a traffic light for each one: green is fine, yellow needs attention, and red requires action. The robot at the top of the page sums up the overall situation at a glance.
The checks are grouped into four sections:
- WordPress plugins – whether a caching plugin is installed and active, whether several are accidentally active at once, whether an image optimization plugin is present, and whether any plugins are installed that are unsuitable for shared hosting. Redis-based plugins, for example, are flagged as an error, because Redis is not available on shared hosting plans.
- WordPress settings – memory limits (
WP_MEMORY_LIMITat least 64M andWP_MAX_MEMORY_LIMITat least 128M), and whether debugging (WP_DEBUG) has been left on by accident on a production site. Every warning links straight to the Configuration tab to fix it. - PHP settings – the PHP version check. PHP 8.3 or newer is recommended; on an older version the plugin tells you to change the version from the Plesk control panel.
- Server settings – whether the server's Nginx cache is on, and whether country blocking is actually in effect.
Configuration: wp-config.php without editing files
The Configuration tab lets you change five
wp-config.php settings directly in the browser:WP_DEBUG– turn debugging on or offWP_DEBUG_LOG– write errors to a log fileWP_DEBUG_DISPLAY– show errors on the siteWP_MEMORY_LIMIT– memory limit for the public siteWP_MAX_MEMORY_LIMIT– memory limit for the admin panel
Note that
WP_DEBUG_LOG and WP_DEBUG_DISPLAY do nothing unless WP_DEBUG is enabled. The plugin says so next to the setting itself.The plugin writes every setting it manages into a single marked block, placed immediately below the opening
<?php line of the file:/* Hostaan Plugin changes start *//* Hostaan Plugin changes end */If the same settings were previously defined elsewhere in the file, the first save moves them into the block, preserving their values. Conditional definitions such as
if (!defined('WP_DEBUG')) { ... } are left untouched.Saving is designed so the file cannot break. The plugin validates the PHP syntax of the new content before writing, takes a backup of the old file, and writes the change through a temporary file. If any step fails,
wp-config.php is left exactly as it was. Backups are saved with a .php extension so the server cannot serve them in a browser along with your database credentials.If a custom log path has been defined for
WP_DEBUG_LOG, the plugin preserves it as-is and shows it read-only. You can switch it back to an ordinary on/off setting with a separate opt-in.Backend Performance: the admin panel cache
This is the most visible improvement in the new version. The plugin contains two separate caches that speed up the WordPress admin panel — especially the WooCommerce analytics views, which calculate their reports straight from order data and are therefore heavy.
We measured the effect on a test store with 2,000 products and 3,000 orders. Admin pages loaded 47–62% faster:
The admin page cache stores the fully rendered HTML page. When the same page is opened again, WordPress does not have to build it from scratch. By default the cache is valid for 120 seconds.
The WooCommerce analytics cache stores the responses of the analytics REST API, from which the charts and tables of the report views are built. The default is 180 seconds.
Both also have a stale period: when the actual validity period expires, slightly stale content is still shown for a short while as a fresh version is built in the background. That way the page never stalls waiting for a calculation.
The tab offers two ready-made presets:
- Normal – the default. Admin panel 120 s, analytics 180 s, and only the named heavy views are cached: the dashboard, the product list, the order list and the WooCommerce analytics pages.
- Aggressive – longer validity periods (300 s) and a wider set of pages, including the plugins and settings pages.
You can also list the pages and endpoints to cache yourself. The entire cache can be purged with a single button.
What is never stored in the cache. This matters, because the admin panel handles user-specific data:
- Requests from logged-out visitors are never stored — the cache only applies to signed-in administrators.
- Every cache entry is bound to the user, the login session, the language and the user role. One user's page cannot end up in front of anyone else, and when a role changes, the old entries expire by themselves.
- Form submissions and action links are not stored: only ordinary GET requests without a one-time token are cached.
- Cookies are never stored and never replayed from the cache.
- Only complete, successful pages are stored. Redirects and error pages stay out of the cache.
When the cache clears automatically. The plugin does not wait for the validity period to expire; it clears the relevant parts as soon as the data changes. A new or edited order clears the order and revenue reports, editing a product clears the product reports, and changing a plugin or theme clears the dashboard and settings pages. In practice the cache will not show a stale revenue figure after a new order.
Blocking
The Blocking tab lets you block traffic from selected countries. The block is written into the server's
.htaccess file, so blocked traffic never starts WordPress at all — it consumes none of your site's resources.
Countries are chosen from a list containing every country code. There is also a Hostaan recommended set (20 countries), whose contents the plugin tells you before you press the button.
The plugin warns separately about situations where the block is probably not what you intended:
- If Finland is in the selection, the plugin points out that most of your site's visitors are probably Finnish.
- If every country is selected, the plugin points out that nobody would be able to reach the site.
- Blocking the United States also blocks a large share of cloud services.
The administrator's exception address. You can add your own IP address to an exception list so the block does not lock you out. The exception is only accepted for a publicly routable address. Private and reserved addresses are rejected, because the real address is not known in those cases. A shared mobile carrier address is not accepted either, because the same address may belong to thousands of other subscribers. The server's own address is never subject to the block, so scheduled tasks keep working normally.
Cloudflare and other proxies. If the site sits behind Cloudflare or another proxy, WordPress cannot see visitors' real IP addresses and country blocking would not work reliably. In that case the plugin does not enable the block at all, and advises you to do the blocking in Cloudflare's own control panel instead. Removing a block always works.
Saving is verified automatically. The plugin tests that the site is reachable both before and after the change. If the site does not respond correctly afterwards, the change is rolled back by itself and
.htaccess is restored. The rollback only touches the plugin's own block, so rules written by other plugins are preserved.A limitation worth knowing: the block only applies to requests served by Apache. If the server delivers static files such as images directly through Nginx, a blocked visitor can still download them. Geolocation is also always approximate.
Access Log and Error Log
The two log tabs show the last 1,000 lines of the server's Nginx logs directly in the admin panel. The access log shows page requests and the error log shows the server's error messages. The logs are useful when the site is slow or throwing errors and you want to see what the server is actually doing, without a separate SSH connection.
Support
The Support tab contains Hostaan's contact details. You can also contact Hostaan support directly if any of the plugin's checks is unclear.
Frequently asked questions
Will visitors see stale data from the cache?
No. The cache only applies to the admin panel of a signed-in administrator, not to the public side of the site. In addition, the cache is cleared automatically as soon as the related data changes, for example when a new order arrives.
Can another user see my admin panel page?
No. Every cache entry is bound to the user account, the login session and the user role, and permissions are checked again at the point where the page is served.
Can I disable the cache?
Yes. Both caches can be switched off separately on the Backend Performance tab. The cache can also be purged once with a button.
Can changing wp-config settings break the site?
Saving validates the PHP syntax before writing and takes a backup. If something goes wrong, the original file stays in place unchanged.
Why won't country blocking turn on?
The most common reason is that the site sits behind Cloudflare or another proxy, so visitors' real IP addresses do not reach WordPress. Do the blocking in Cloudflare's control panel in that case. The other possible reason is that the server's geolocation is not enabled; the Optimization Checks tab will tell you.
See also our blog post How the Hostaan plugin speeds up the WordPress admin panel, where we report the measurements for a WooCommerce store's admin panel.
