BlockGlow — Enhance, Optimize & Protect

Description

BlockGlow extends the WordPress Block Editor with tools for customizing, optimizing, and protecting your website.

Originally built as a per-block Custom CSS solution for Gutenberg, BlockGlow has evolved into a lightweight toolkit for block customization, performance optimization, and spam protection.

Features include:

  • Per-block Custom CSS with automatic CSS scoping.
  • Live CSS preview inside the block editor.
  • CSS validation and property validation.
  • Automatic CSS file generation and management.
  • LCP (Largest Contentful Paint) resource detection and preloading.
  • Automatic fetchpriority=”high” support for critical images.
  • Honeypot protection for Simple Membership forms.
  • Cloudflare Turnstile integration for Simple Membership forms.
  • CSS file management tools.
  • Secure file handling and capability checks.

Enhance

BlockGlow adds a “BlockGlow — Custom CSS” panel to the inspector of Gutenberg blocks.

Use the Custom CSS editor to apply styles to an individual block without affecting other instances of the same block.

Features include:

  • Per-block Custom CSS.
  • Automatic CSS scoping using a unique BlockGlow ID.
  • Live CSS preview inside the block editor.
  • CSS validation.
  • CSS property validation.
  • CodeMirror-based editor when available.
  • Fallback textarea editor with Tab and Shift+Tab support.
  • Automatic CSS file generation.
  • CSS file cleanup when styles are removed.
  • Graceful fallback to inline styles when CSS file generation is unavailable.
  • CSS Manager for managing generated CSS files.
  • Popup CSS editing for updating CSS from other blocks when supported.

Optimize

BlockGlow includes performance tools designed to help improve page loading and Core Web Vitals.

Current optimization features include:

  • LCP resource detection.
  • LCP image preloading.
  • Automatic fetchpriority=”high” support for critical images.
  • Optional LCP preload support for selected post types.
  • LCP analysis and re-analysis tools.
  • Saved LCP resource management.

When LCP preload is enabled, BlockGlow can detect the LCP resource for a page and save the resource URL for subsequent preloading.

Protect

BlockGlow includes optional protection features designed to help reduce automated spam submissions and registrations.

Current protection features include:

  • Honeypot protection for Simple Membership forms.
  • Cloudflare Turnstile integration for Simple Membership forms.

These protection features can be enabled and configured from the BlockGlow administration area.

External Services

BlockGlow optionally integrates with Cloudflare Turnstile to provide spam and abuse protection for supported Simple Membership forms.

Cloudflare Turnstile is only used when the Cloudflare Turnstile protection feature is enabled and configured by the site administrator.

When enabled, BlockGlow loads the Cloudflare Turnstile JavaScript from Cloudflare’s servers. When a user interacts with a protected form, Turnstile generates a verification token. BlockGlow sends the token to Cloudflare’s Turnstile verification service to verify the request.

Service:
https://www.cloudflare.com/products/turnstile/

Turnstile documentation:
https://developers.cloudflare.com/turnstile/

Cloudflare Privacy Policy:
https://www.cloudflare.com/privacypolicy/

Cloudflare Terms of Service:
https://www.cloudflare.com/terms/

Please review Cloudflare’s documentation and policies for information about how Cloudflare processes data when Turnstile is used.

How CSS Scoping Works

BlockGlow creates a unique BlockGlow ID for each block instance and uses it to scope custom CSS.

For example:

`

[data-blockglow-id=”bg-xxxxxxx”] h2 {
color: red;
}
`

The CSS is scoped to the individual block instance so that styles do not unintentionally affect other blocks.

You can also use & as a shorthand for the BlockGlow wrapper in the Custom CSS editor.

Example:

`

& .my-class {
color: red;
}
`

BlockGlow automatically replaces & with the appropriate BlockGlow selector for the editor preview and front-end output.

Support

BlockGlow is actively developed with a focus on helping WordPress users enhance, optimize, and protect their WordPress websites.

Feature requests, bug reports, and suggestions are welcome.

Installation

  1. Install BlockGlow through the WordPress Plugin Directory or upload the blockglow folder to the /wp-content/plugins/ directory.
  2. Activate BlockGlow through the Plugins screen in WordPress.
  3. Ensure the wp-content/uploads/ directory is writable.
  4. Go to the BlockGlow administration page.
  5. Configure the Enhance, Optimize, and Protect features you want to use.
  6. If using Cloudflare Turnstile, enable the feature and enter your Cloudflare Turnstile site and secret keys.
  7. Start customizing your blocks and configuring the available optimization and protection features.

FAQ

What does BlockGlow do?

BlockGlow provides tools for block-level CSS customization, performance optimization, LCP resource preloading, and optional spam protection.

Does BlockGlow work with the Gutenberg Block Editor?

Yes. BlockGlow is designed for the WordPress Block Editor and provides a Custom CSS panel for Gutenberg blocks.

Will my custom CSS affect other blocks?

Normally, no. BlockGlow automatically scopes custom CSS to the individual block instance using a unique BlockGlow ID.

Where are generated CSS files stored?

Generated CSS files are stored in:

`

wp-content/uploads/blockglow/
`

Files use a naming format similar to:

`

blockglow-.css
`

What happens if BlockGlow cannot create a CSS file?

BlockGlow can fall back to inline CSS when CSS file generation is unavailable.

What performance features are included?

BlockGlow currently provides:

  • LCP resource detection.
  • LCP resource preloading.
  • Automatic fetchpriority=”high” support for critical images.
  • LCP analysis and re-analysis tools.

What protection features are included?

BlockGlow currently provides:

  • Honeypot protection for Simple Membership forms.
  • Cloudflare Turnstile integration for Simple Membership forms.

Is Cloudflare Turnstile required?

No. Cloudflare Turnstile is optional.

It is only used when the Turnstile protection feature is enabled and properly configured.

Does BlockGlow load Cloudflare Turnstile on every page?

BlockGlow only enqueues the Cloudflare Turnstile script when the Turnstile protection feature is enabled and a Turnstile site key has been configured.

How do I delete generated CSS files?

Use the BlockGlow CSS Manager to manage generated CSS files, or remove the Custom CSS from the relevant block and update the post or page.

Is BlockGlow safe for production websites?

BlockGlow is designed for production use and includes nonce validation, capability checks, input sanitization, output escaping, and secure file handling.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“BlockGlow — Enhance, Optimize & Protect” is open source software. The following people have contributed to this plugin.

Contributors

Changelog

2.0.0

  • New: Improved per-block Custom CSS editor.
  • New: Added popup CSS editing for updating other blocks’ custom CSS.
  • New: Added CSS validation and improved CSS editing experience.
  • New: Added LCP preload support for enabled post types.
  • New: Added automatic LCP resource detection and preloading.
  • New: Added LCP analysis and re-analysis tools.
  • Improved: Improved handling of generated CSS files.
  • Improved: Improved BlockGlow administration interface.
  • Improved: Improved CSS preview inside the WordPress Block Editor.
  • Improved: Improved editor iframe compatibility.
  • Improved: Improved security and request validation.
  • Improved: Improved CSS file management with pagination and bulk actions.

1.3.0

  • Security: Added Honeypot protection for Simple Membership registration forms to help reduce spam registrations.
  • Security: Added Cloudflare Turnstile integration for Simple Membership forms.
  • Security: Added a new Protection settings section in the BlockGlow dashboard.
  • Improved: Continued expansion of BlockGlow as an Enhance, Optimize & Protect toolkit for WordPress.

1.2.0

  • Performance: Added a new Performance Optimization tab in the admin dashboard.
  • Performance: Added support for preloading the LCP image and applying fetchpriority=”high” to improve Largest Contentful Paint (LCP) performance and page loading speed.

1.1.7 (2026-01-11)

  • Fixed: Fixed the redirect URL after deleting a CSS file in the BlockGlow admin page.

1.1.6

  • Update: Create a new blockglowId when a block is duplicated or copied.
  • Update: Added pagination and multiple selection for deleting CSS files in the BlockGlow admin page.

1.1.5

  • Admin: Fixed a nonce issue.

1.1.4

  • Admin: Removed the CSS filename when creating the delete nonce.

1.1.3

  • Fixed: Reordered logic in BlockGlow_Admin::handle_delete_file() so nonce validation runs before processing user input.
  • Fixed: Addressed security scanner warnings for missing nonce checks on file deletion requests.
  • Improved: Raw file input is now only read after successful nonce verification and capability checks.

1.1.2

  • Security: Added stricter nonce validation and capability checks for file deletion handlers.
  • Security: Improved inline CSS handling for untrusted users.
  • Admin: Standardized sanitization of request inputs and improved admin enqueue logic.

1.1.1

  • Security: Tightened admin navigation and delete handlers.
  • Admin: Removed the Import/Export submenu and tab from the admin UI.
  • Code Quality: Fixed PHPCS internationalization warnings and added translator context where needed.

1.1.0

  • Minor: Improved editor reliability and added an option to toggle in-editor rendering of custom CSS.

1.0.5

  • Editor: Improved attribute attachment in the block editor.
  • Editor: Added a clientId-based selector fallback.
  • Editor: Added a ToggleControl to enable or disable editor CSS rendering.
  • Editor: Added the generated CSS file path to the block inspector.

1.0.4

  • Security: Improved sanitization and nonce validation.
  • Code Quality: Resolved PHPCS warnings.

1.0.3

  • Security: Replaced use of $_REQUEST with explicit request handling.

1.0.2

  • Security: Added nonce verification and capability checks.
  • Output Safety: Improved inline CSS handling.
  • Editor: Improved fallback textarea styling.
  • Misc: Various bug fixes and code quality improvements.

1.0.1

  • Improved front-end output using data attributes instead of wrapper elements.
  • Switched inline stylesheet handling to WordPress style APIs.
  • Added stronger admin-side security.
  • Improved sanitization and request handling.

1.0.0

  • First release.