=== xSpeed – AI Cache & Performance Optimizer === Contributors: asif2bd, wpdevteam, seakashdiu Tags: caching, performance, speed, optimization, minify Requires at least: 6.0 Tested up to: 7.0 Requires PHP: 7.4 Stable tag: 1.0.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Ultra-fast WordPress caching & performance plugin. Page cache, minify, GZIP, lazy load, fonts, object cache, CDN — one switch, no bloat, no upsells. == Description == Your visitors decide to stay or leave in under 3 seconds. **xSpeed** makes sure they stay. Most caching plugins bury you in settings, charts, and upgrade popups. xSpeed does the opposite — install it, flip one switch, and your site loads faster. No bloat, no upsells nagging you, no PhD required. Built by the team at **WPDeveloper** — trusted by over 7 million WordPress users worldwide. = What Does xSpeed Do? = xSpeed is a full-site performance plugin. It caches your pages, shrinks your code, compresses your files, and serves everything as fast as your server physically can — including an AI-powered audit that tells you exactly what's slowing your site down. The result: pages that load in milliseconds, not seconds. Better Google PageSpeed scores. Happier visitors. Better SEO rankings. = The Speed Advantage No Other Free Plugin Offers = When xSpeed caches a page, it doesn't just save it — it serves it directly from the server, bypassing PHP entirely. That means: * **With xSpeed static cache:** 5–15ms response time * **Without it (PHP-served cache):** ~85ms response time That's up to **17× faster** page delivery on cache hits. No other free caching plugin does this across Apache, nginx, and LiteSpeed automatically. = Features at a Glance = **Page Caching** Your pages are saved as static HTML files and served instantly to visitors — before WordPress even loads. The cache rebuilds itself automatically whenever you publish a post, switch themes, or update a plugin. You never have to think about it. * Static-file rewrite path (bypasses PHP entirely — 5–15ms TTFB) * Auto-purge on publish, update, comment, theme change * One-click cache purge from the admin bar * Exclude specific URLs (e.g. `/cart`, `/checkout`, `/my-account`) * Set your own cache expiry (1–720 hours) * Separate mobile cache for phone and tablet visitors * Per-post cache rules — custom expiry or disable caching for individual posts **Code Minification** Strips all the unnecessary whitespace, comments, and characters from your HTML, CSS, and JavaScript without breaking anything. * Minify HTML, CSS, and JavaScript * Combine CSS and JS files to reduce HTTP requests * Defer or delay JavaScript so it doesn't block page rendering * Async CSS loading * Removes `?ver=` query strings from asset URLs * Safe-minify: automatically skips already-minified files and falls back if anything looks off **GZIP Compression** Makes every file your server sends smaller — so browsers download them faster. * Auto-configures GZIP on Apache and LiteSpeed * Shows a ready-to-paste config snippet for nginx and IIS * Detects if your server already has GZIP active — no double-configuration **Lazy Load** Images, videos, and iframes load only when a visitor scrolls to them — not all at once on page load. * Lazy load images, iframes, and videos * Automatic CLS (Cumulative Layout Shift) fix so your layout doesn't jump **Fonts Optimization** Web fonts are one of the most common causes of slow-loading pages. * Adds `font-display: swap` so text is visible immediately while fonts load * Preloads above-the-fold font files for instant rendering * Removes the blank-text flash caused by slow Google Fonts responses **Browser Cache** Tells browsers to remember your static files (images, CSS, JS) so returning visitors load your site even faster. * Sets proper `Cache-Control` and `Expires` headers * Works automatically — no manual configuration needed **Cache Preloader** Warms up your cache automatically so the very first visitor after a purge still gets a fast page. * Sitemap-driven cache warmer * Auto-warms cache when you publish or update content **Object Cache (Redis / Memcached)** Speed up database-heavy WordPress installs with server-side object caching. * Connect Redis or Memcached in seconds * View status and flush cache from the dashboard **CDN Support** Serve your static files from a CDN for faster global delivery. * Pull-zone URL rewriting for any CDN provider * Built-in Cloudflare integration: connect your zone, auto-purge on publish, toggle dev mode **Database Optimization** A bloated database slows down every page load. xSpeed keeps yours clean. * Optimize database tables * Remove post revisions, spam, trash, transients, and orphaned meta * Schedule automatic cleanup so it runs on autopilot **Disable Bloat** Turn off WordPress features you don't use — each one is a request your server doesn't have to make. * Disable dashicons on the frontend * Remove oEmbed, RSS feeds, XML-RPC, jQuery Migrate, REST API authentication headers **AI-Powered Site Audit (Pro)** xSpeed Pro scans your specific site and tells you exactly which performance features will help the most — with severity ratings and concrete reasons, not generic advice. = Smart Enough to Stay Out of Trouble = xSpeed handles the edge cases other plugins miss: * **Multisite ready** — each site in the network gets its own cache and settings. * **LiteSpeed server?** — xSpeed detects LiteSpeed Cache's server module and steps back to avoid conflicts. * **WooCommerce?** — logged-in customers and checkout pages are never cached. * **WordPress Site Health** — xSpeed adds its own health check under Tools → Site Health so you always know your cache config is working correctly. * **Works on any server** — Apache, nginx, LiteSpeed, IIS, and any standard PHP host. = Designed for Everyone = **Non-technical users:** A 3-step setup wizard walks you through first-time configuration in under 2 minutes. Settings auto-save — there's no Save button to forget. **Developers:** REST API at `/wp-json/xspeed/v1/`, developer filters (`xspeed_skip_minify`, `xspeed_cache_skip_for_post`, `xspeed_cache_expiry_for_post`), `WP_DEBUG` awareness, and a React 18 + TypeScript admin UI under 80 KB gzipped. **Agencies:** Use the `xspeed_branding` filter to white-label the dashboard for clients. = Completely Private = xSpeed never collects personal data, stores IP addresses, uses tracking cookies, or contacts any third-party server. Every optimization runs locally on your server. The only external request it makes is a quick check to your own site's home URL to confirm GZIP is active — and even that is rate-limited to once per hour. (See "External services" below.) = Backed By a Team You Trust = xSpeed is developed by the trusted team at WPDeveloper, a leading WordPress marketplace used and loved by millions of users. = Loved xSpeed? = If xSpeed makes your site faster, please leave a review on WordPress.org — it really helps! == Installation == 1. Go to **Plugins → Add New** in your WordPress admin and search for **xSpeed**. 2. Click **Install Now**, then **Activate**. 3. Navigate to **xSpeed** in your sidebar. 4. The setup wizard will guide you through the rest — it takes about 2 minutes. That's it. Your site is now faster. == Frequently Asked Questions == = Will this break my site? = Very unlikely. xSpeed includes safety checks for every optimization: minification falls back to the original if anything looks off, and the cache bypasses logged-in users, admin pages, AJAX, and REST requests automatically. If something ever looks wrong, you can toggle any feature off individually. = Does it work with WooCommerce? = Yes. Add `/cart`, `/checkout`, and `/my-account` to the Excluded URLs list and xSpeed will skip caching those pages. Logged-in customers are never served cached pages regardless. = Does it work with my server? = xSpeed works on Apache, nginx, LiteSpeed, IIS, and any standard PHP host. Static-cache rewriting and GZIP auto-configuration work out of the box on Apache and LiteSpeed. For nginx and IIS, xSpeed shows you a ready-to-paste config snippet. = Does it support WordPress Multisite? = Yes. Each site in the network has its own independent cache and settings. = Will it conflict with LiteSpeed Cache? = No. xSpeed detects LiteSpeed's server-level caching module and steps back automatically to avoid double-caching. Otherwise, only run one page-cache plugin at a time. = How do I exclude a page from being cached? = Go to **xSpeed → Settings**, paste the URL path (e.g. `/cart`) into the Excluded URLs field — one path per line. Changes save automatically. = How do I clear the cache? = Click **Purge** in the xSpeed dashboard, or use **Purge xSpeed Cache** in your admin bar. The cache also clears itself automatically whenever you publish or update content. = Can I use xSpeed alongside Cloudflare? = Yes. The built-in Cloudflare module connects your zone and auto-purges Cloudflare's cache whenever xSpeed purges its own — so both caches stay in sync. = Can I disable minification temporarily for debugging? = Yes. Either toggle the option off in the admin UI, enable `WP_DEBUG` (xSpeed automatically skips HTML minification when debug is on), or use the `xspeed_skip_minify` filter. == Screenshots == 1. Cache panel — master toggle, status, and live stats (cached pages, cache size, last purge). 2. Minification — minify and combine HTML, CSS, and JavaScript with defer/delay options. 3. Lazy Load — defer images, iframes, and videos until they scroll into view, with CLS-fix. 4. Cache Preloader — sitemap-driven cache warmer that keeps the first visitor fast. 5. Object Cache — connect Redis or Memcached, view status, and flush from the dashboard. 6. CDN — pull-zone URL rewriting for faster global static-asset delivery. 7. Cloudflare — connect your zone, auto-purge on publish, and toggle development mode. 8. Custom Cache Rules — per-URL and per-post caching rules with custom expiry. 9. Disable Bloat — switch off unused WordPress features (dashicons, oEmbed, RSS, XML-RPC, and more). 10. Heartbeat Control — throttle the WordPress Heartbeat API to reduce admin-ajax load. 11. AI-Powered Site Audit (Pro) — site-specific recommendations with severity ratings and concrete reasons. == External services == xSpeed contacts exactly one external endpoint, and only your own site: = Self-hosted gzip probe = * **What it does:** Issues a single `GET` request to your site's home URL (`home_url('/')`) with an `Accept-Encoding: gzip` header to detect whether your web server is already serving gzipped responses. The response body is discarded; only the `Content-Encoding` header is read. * **When it runs:** On demand when the admin dashboard loads server status, throttled to once per hour via a transient (`xspeed_gzip_active`). * **Where the request goes:** Your own site (`home_url()`). xSpeed does not contact any third-party server, analytics endpoint, license server, or telemetry collector. * **What is sent:** No personal data, no site identifiers, no payload — just a standard HTTP `GET` from your server back to your server. == Third-party libraries == This plugin bundles the following GPL-compatible third-party libraries: = matthiasmullie/minify = Used for CSS and JavaScript minification. * Source: https://github.com/matthiasmullie/minify * License: MIT = matthiasmullie/path-converter = Dependency of `matthiasmullie/minify`. * Source: https://github.com/matthiasmullie/path-converter * License: MIT = React / React DOM / Scheduler = Used for the xSpeed admin interface bundle. * Source: https://github.com/facebook/react * License: MIT = lucide-react = Used for admin interface icons. * Source: https://github.com/lucide-icons/lucide * License: ISC == Changelog == = [1.0.4] – 2026-06-14 = **One-click object cache, parity exclusions & admin polish.** Object Cache: - New: One-click Object Cache setup for Redis and Memcached — tests the connection, installs its own drop-in, and writes the wp-config constants (fully reversible). No drop-in plugin or PHP extension required. - Improved: Dashboard now reports a degraded object cache honestly when the drop-in can't reach its backend, instead of implying caching is healthy. Admin UX: - New: WP admin submenu now mirrors the in-dashboard navigation, so the menu and dashboard tabs stay in sync. - Improved: Settings changes apply live across dashboard navigation — no full page reload needed. - Improved: Menu icon now recolors to the active accent state correctly. - Improved: Success notifications are anchored to a single consistent position (bottom-center). - Fixed: Long panel titles no longer push the subtitle off-screen. - Fixed: Number-input spinners render consistently across browsers (Firefox no longer clips the value). Cache exclusions: - New: Exclusion lists now ship pre-populated with LiteSpeed / WP Rocket-parity defaults (16 URLs, 20 cookies, 28 query params), so a fresh install caches correctly out of the box. - New: Exclusion rules now support regex via a `~` prefix (e.g. `~utm_[a-zA-Z0-9_-]+`), alongside glob and substring, with ReDoS guards. Bug fixes: - Fixed: Browser Cache no longer emits an "Array to string conversion" warning on multi-valued Cache-Control headers (also clears a false "nginx config required" notice). License: - Fixed: Activating a Pro license now unlocks the Pro panels immediately — no full page reload needed. = [1.0.3] – 2026-06-07 = **Topology-aware UX, nginx HIT counting, admin polish.** Cache topology & UX: - New: Topology-aware rewrite banner — the dashboard now detects containerized hosts (xclude, Kinsta, RunCloud Atomic, etc.) where the `$document_root` assumption doesn't hold, and tells the user exactly what to expect on their stack instead of silently failing. - New: Unified nginx server-block snippet — one consolidated, copy-pasteable snippet (collapsible in the UI) replaces the previous fragmented sections. - New: Nginx-served HITs are now counted — a dedicated access_log captures cache hits served directly by nginx (no PHP), so the dashboard "HITs in last 24h" stat is accurate on nginx setups. - New: `X-XSpeed-Cache` response header — cache hits are now visible in the response headers, with a distinct value per serve layer (`HIT (nginx)` for the fast static path, `HIT (php)` for the drop-in fallback) so you can confirm a page was cached and tell exactly which layer served it. - Improved: Browser Cache notice is topology-aware and renders its snippet in a proper code block. Admin UX: - New: Third-party admin notices are suppressed on xSpeed admin screens (`page=xspeed*` only) — other plugins' "rate us" / promo notices no longer crowd the xSpeed dashboard. - New: Aligned sticky title-bar across the sidebar and content panels for a cleaner scroll experience. - Improved: Browser Cache + GZIP notices probe-gate themselves — once the underlying issue is resolved, the notice dismisses on its own instead of lingering. Benchmark: - Fixed: "Without cache" leg of the dashboard speed test now appends a cache-buster query string. Previously it was hitting the cache and reporting an artificially-fast baseline, making the speedup number look small. = [1.0.2] – 2026-06-02 = **Static-rewrite cache, Site Health & Fonts.** Static-rewrite cache + Site Health: - New: Static-file rewrite path — cached HTML is served directly by Apache / nginx / LiteSpeed, bypassing PHP entirely on cache hits (5-15ms TTFB vs ~85ms via the PHP drop-in). - New: .htaccess static-cache block — installed automatically on cache enable, removed cleanly on disable. Block precedes WordPress's own rules so static files match first. - New: nginx config snippet — copy-pasteable server { } block surfaced in the dashboard when nginx is detected (PHP can't write nginx config). Avoids the "if is evil" pitfall via a named-location fallback. - New: LiteSpeed LSCache coexistence — xSpeed detects LSCache's server-level module and steps back instead of double-caching. - New: Active rewrite probe — Health module pings the cache directory and confirms the rewrite is actually serving static bytes (not just present in .htaccess). - New: WordPress Site Health integration — Tools → Site Health now lists an xSpeed check covering static-rewrite status + nginx config requirements. - New: Persistent banner — Cache panel warns the admin when caching is on but the static-rewrite block isn't engaged (slow fallback path). - New: Copy-to-clipboard button on every config-snippet panel (nginx, GZIP, object-cache). Fonts: - New: Fonts module — adds `font-display: swap` to enqueued web fonts so visible text doesn't wait on a slow Google Fonts response, and exposes a preload list for above-the-fold font files. - New: FontsModule tests covering the swap rewrite + preload `` emission. Improvements & fixes: - Improved: Server-type detection is cached so CLI / cron contexts see the same server type as web requests. - Improved: Drop-in (advanced-cache.php) and WP_CACHE constant are preserved across plugin upgrades; auto-heal hook tightened to admin_init to avoid REST/cron noise. - Improved: Plugin Check pass — i18n textdomains, WP_Filesystem coverage, SQL preparation, sanitization, and plugin/readme headers all cleaned up for WordPress.org review. - Fixed: nginx snippet rewritten to avoid the try_files trap that broke pretty permalinks. - Fixed: Rewrite condition normalized for trailing-slash + non-trailing-slash URLs. - Fixed: WP-Rocket-style canonical pattern — server-level conditional rewrite. - Fixed: Minify tag-rewrite filters bail in non-frontend contexts (REST / admin / cron). - Fixed: wp.org release zip now ships `vendor/` — resolves the 1.0.1 activation fatal. - Improved: Release pipeline rebuilt — `.distignore`-driven dist build, CI verify step, version-named artifact on every run. - Improved: Plugin version read from the PHP header — single source of truth. = [1.0.1] – 2026-06-01 = **Foundation release — full feature set + Pro hooks.** Module architecture + LiteSpeed parity floor: - New: Module architecture — every feature now ships as a self-contained Module (Cache, Health, Preloader, Heartbeat, Minify, GZIP, Lazy Load, Disable Bloat, Database, CDN, Cloudflare, Object Cache, Browser Cache). - New: Health module — 24-hour hit/miss counter + activity log. - New: Preloader module — sitemap-driven cache warmer with content-publish auto-warm. - New: Cache exclusion intelligence — glob URL patterns, cookie patterns, User-Agent bypass, ignored query parameters. - New: Per-device cache (mobile-separate). - New: Per-post cache rules — don't-cache + custom expiry meta box. - New: Minification — CSS / JS / HTML minify, combine, defer JS, delay JS, async CSS, remove ?ver= query strings. - New: Lazy Load module — images / iframes / videos + auto CLS-fix. - New: Disable Bloat module — 6 ergonomic toggles (dashicons, oEmbed, RSS, XML-RPC, jQuery Migrate, REST auth). - New: Database module — optimize tables, scheduled cleanup, autoload analysis. - New: CDN module — pull-zone URL rewriting. - New: Cloudflare module — zone connect, auto-purge, dev-mode toggle. - New: Object Cache module — Redis / Memcached config + status + flush. - New: Browser Cache module — Cache-Control + Expires headers. - New: Settings search across the entire dashboard with keyword highlighting. - New: 3-step setup wizard on first activation with preset chooser and benchmark. - New: Sidebar grouping under domain headers (Cache / Performance / Network / Insights / Tools). - New: Sidebar tooltips + search shortcut in the collapsed rail. - New: xspeed_branding filter — agencies can rebrand the dashboard. - New: xspeed_cache_skip_for_post + xspeed_cache_expiry_for_post filters. Pro-essentials (everything xSpeed Pro depends on, bundled here so any Pro release works against this single Free version): - New: xspeed_module_descriptor filter — Pro hooks this to swap its panels to LicenseLockedPanel when license is invalid. - New: AI Privacy module — GDPR off-switch + xspeed_ai_can_collect_data filter that Pro AI features must consult before recording visitor data. - New: Pro upsell teasers — in-context inline cards on Cache, Minify, Lazy Load, Browser Cache and Disable Bloat panels. - New: Locked Pro module rows in the sidebar — shows what Pro offers with a clear upgrade prompt. - New: Pro Audit on the Cache panel — site-specific scan listing the top Pro features that would help THIS site, with severity chips and concrete reasons (not generic marketing copy). - New: Sidebar slot for the license module (appears when xSpeed Pro is installed). - New: Global 36px form-control height baseline across the dashboard. - New: filemtime() cache busting on admin asset URLs. Improvements & fixes: - Improved: React panel registry — modules auto-render in the dashboard. - Improved: Portal-based save indicator — zero layout shift. - Improved: Distribution zip prunes dev dependencies (composer install --no-dev). - Fixed: 5 duplicate module icons + regression test. = [1.0.0] – 2026-05-27 = - Initial release.