Changelog

What's new in xSpeed Cache

Every release, every fix, every improvement — tracked in one place.

xSpeed Cache Free

v1.2.1

2026-08-27

Self-hosted videos no longer download in full before anyone presses play, the autopilot now undoes a change that makes the site slower instead of calling it verified, and the diagnosis finally reports the content problems it was measuring all along.

Optimization

Fixed A self-hosted video with its own preload setting is no longer skipped. "Lazy-load HTML5 videos" now overrides a player's preload="auto" or "metadata", which is where the setting was meant to help — a page carrying a 924KB video no longer transfers it before anyone presses play. Autoplaying videos are left alone.

New The click-to-play facade now covers self-hosted videos that have a poster image, not just YouTube and Vimeo embeds. The file downloads on click; without JavaScript the original video is still there.

New Each optimization step is now measured, and a change that makes the page measurably slower is undone instead of being reported as verified. A change inside normal run-to-run variation is reported as unchanged rather than claimed as a win.

Fixed An image the theme has already marked as the most important one on the page is no longer lazy-loaded, which delayed the very image it was told to prioritise.

Diagnosis and reporting

Fixed The reported score came from the oldest audit on record rather than the newest, so re-measuring never moved the number. The newest successful run is now used, and a failed audit is never presented as the current score.

Fixed Page weight, heavy videos and DOM size were measured but never shown. The content problems only a person can fix are now reported alongside the settings the plugin can change itself.

New The last audit's own named opportunities, with their measured savings, now feed the diagnosis — routed to either the settings the plugin can change or the content a person has to.

Reliability

Fixed A missing plugin file no longer takes down wp-admin. xSpeed now stops cleanly and names the file that is missing, so the Plugins screen still loads and the plugin can be switched off to recover.

Fixed An unresolvable class is reported with the path of the file that is missing, rather than only the class name, so an interrupted update or a quarantined file can be identified from the log.

Caching

New The cache is cleared when a plugin, theme or WordPress core is updated, so a page is never served from markup the updated code no longer produces. It clears network-wide on multisite, can be switched off, and leaves the cache alone for a plugin you installed but never activated or for a nightly language-pack update.

Improved Visitors arriving with a tracking parameter such as utm_source, fbclid or gclid are now served from the fast path instead of loading WordPress in full.

Fixed Add-ons can now read the signal that says the cache was already cleared by an update, so the cache is no longer cleared a second time.

Settings and AI tools

New A setting that is accepted but has no effect on your server now says so. Enabling Brotli on a server without Brotli support reported plain success while nothing changed; the tools that flip the setting now report the same warning the dashboard shows.

Fixed A URL field that is posted to now rejects an address that cannot be called. An email address entered in one of these fields was silently accepted and the feature then failed with nothing on screen to explain why.

Fixed Score history now reports whether each audit succeeded, and the error when one did not, so a failed run is no longer indistinguishable from a run that returned no score.

Dashboard

Fixed Switching tabs on Health & insights no longer jumps the page back to the top.

Fixed A shorter tab is no longer padded out to the height of the tallest one, which left a screen of blank space below the content. Tab strips are also fully wired for screen readers and keyboard navigation.

Setup wizard

Fixed The wizard opens with Balanced selected instead of no preset, warns in both directions when a setting is changed away from the preset, and uses the same labels throughout.

Fixed A brand-new install showed all three preset cards as inactive, because nothing had been configured yet. The cache lifetime also starts at 7 days rather than empty.

v1.2.0

2026-08-24

One command now measures your site, applies the settings that help, and undoes anything that breaks. Four cache-poisoning routes are closed, importing from W3 Total Cache carries settings across faithfully instead of a handful, and combined JavaScript keeps running in the order the page expects.

Security

Fixed A page rendered with a query string is no longer stored under the bare URL's cache key, where it would then be served to every visitor asking for the plain URL.

Fixed Percent-encoded query keys can no longer poison the cache. Two spellings of the same key resolved to different cache keys, so a crafted URL could seed the entry a normal request would later read.

Fixed An allow-listed tracking parameter no longer lets a crafted URL overwrite a cached page.

Fixed A search-results page no longer poisons the homepage through the cache key.

Optimization

New wp xspeed optimize and the optimize_site AI tool make the whole tuning loop one command. It measures the site, applies the recommended settings one at a time, re-checks the page after each change, and reverts anything that breaks it — then reports what it applied, what it undid and why, and what it could not reach at all (page weight, hotlinked images, DOM size) rather than claiming a win it did not make.

New Images hosted on another domain get their real dimensions resolved, so lazy loading and the preloader no longer skip them.

Migration

Fixed Importing from W3 Total Cache brought across 8 of 510 settings. Page cache, browser cache, object cache, exclusions and compression now map to their xSpeed equivalents.

Fixed Disabling W3 Total Cache's master Minify switch is now respected. Its child CSS/JS settings stay populated while the master is off, so reading them alone imported minification and combination as enabled on a site that had deliberately turned them off.

Fixed An encrypted Redis password that cannot be read is now reported rather than silently dropped, so the object cache no longer fails to connect with nothing on screen to explain why.

Fixed An object-cache endpoint written as tls://host:port imported a host that could never resolve. The host and port are now imported and the dropped transport is stated, since xSpeed connects over plain TCP.

Fixed Compression enabled only for "other" file types no longer imports GZIP as switched off.

Fixed A partial import no longer switches off the plugin it imported from, and no longer shows a finished "Imported" state with no way to retry.

Fixed WP Super Cache is detected and imported. Its settings are stored under different keys than the importer looked for, so it reported nothing to import.

Fixed Page caching is actually enabled by an import that says it is.

Cache

Fixed Ignored query parameters are matched by whole name rather than as substrings, so utm_source no longer matches an unrelated parameter that merely contains it.

Fixed Purging a URL on a non-standard port deleted nothing.

Fixed Query-string requests skip only the cache write, not the HTML transforms, so those pages keep their minification and lazy loading.

CSS & JavaScript

Fixed Combined JavaScript is split by print group, so scripts registered for the footer are no longer hoisted into the head and run before first paint.

Fixed The combined bundle is carried on an existing handle rather than a new one, preserving inline payloads attached to it and the surrounding cascade order.

Fixed Configuration a page builder attaches late — Elementor writes elementorFrontendConfig on wp_footer, long after combining runs — now prints ahead of the combined bundle instead of behind it, so scripts no longer initialise against a config that does not exist yet.

CDN

Fixed Changing the CDN URL clears Elementor's render caches, which stored the previous URLs in their markup.

Interface

New The MCP server appears on the Overview as a capability card, so an AI connection can be set up without hunting for the panel.

Fixed The setup wizard and the ⌘K search palette no longer render underneath the WordPress admin menu.

Fixed Opening a panel no longer shifts the page behind it when the dashboard is scrolled away from the top.

Fixed The Apply button on a Pro recommendation works instead of failing silently. Free and Pro name their recommendations differently, and only Free's were understood by the button both of them use.

MCP server

Fixed OAuth discovery keeps working when another plugin claims /.well-known/.

Server configuration

Fixed URL exclusions are mirrored into the generated nginx snippet, so nginx no longer serves cached copies of pages xSpeed was told to exclude.

v1.1.8

2026-08-20

Importing settings from another caching plugin no longer switches that plugin off without asking. Purging CSS or JavaScript now also clears the pages that link them, a failed save no longer reports success, and another MCP plugin's AI connections keep working alongside xSpeed.

Migration

Fixed Importing settings no longer deactivates the plugin you imported from as an unavoidable side effect. The panel now offers both outcomes — "Import & switch to xSpeed" and "Import settings only". Previously the only way to decline was Cancel, which also abandoned the import; WP-CLI and MCP did the opposite and left both plugins running silently. All three now behave the same way.

Fixed On a multisite network, a single site's administrator can no longer switch off a network-activated caching plugin for every site on the network. WordPress refuses the same action from its own Plugins screen.

Fixed Choosing to leave the other plugin running now raises a Health item naming the plugin and the risk, so two page caches competing for the drop-in don't go unnoticed. It clears itself once the plugin is switched off.

Fixed LiteSpeed's exclusion lists are stored as JSON and were imported literally, so imported exclusions never matched anything.

Cache

Fixed Purging CSS or JavaScript now also purges the pages that link those files. Cached pages could keep pointing at deleted combined assets, leaving them unstyled until another page purge happened to occur.

Fixed A single POST request no longer keeps a visitor on the uncached path for the rest of their visit. One form submission or comment previously meant every later page was generated from scratch.

Fixed The cache now purges when any module's settings change, not only the cache module's.

CSS & JavaScript

Fixed "Defer" and "Delay" now apply to the external script itself rather than to an inline block queued before it, so execution order is preserved.

Fixed Combined JavaScript keeps its declared dependencies, so scripts no longer run before the libraries they need.

Improved Inline style and script blocks are now minified, and anything deliberately skipped says why.

Settings & interface

Fixed A failed save no longer shows the green "Settings saved" toast, and the failure stays visible instead of disappearing with it.

Fixed Settings writes carrying keys that would be silently dropped are now refused rather than accepted and discarded.

Fixed A cleared URL field stays cleared instead of reverting to its previous value.

Fixed Sub-sections of a disabled feature now collapse with it.

Fixed A failing server snippet now identifies the problem instead of showing only a status code.

MCP server

Fixed xSpeed no longer answers another MCP plugin's OAuth discovery URLs. Its rule could match every .well-known discovery address on the site and return xSpeed's details, which stopped AI assistants connecting to other MCP plugins correctly.

Security

Fixed The MCP server's dynamic client registration is now bounded — limits on stored clients, redirect URIs, name and URI length, plus per-IP rate limiting on the registration endpoint.

Fixed MCP and WP-CLI settings writes are now gated on the Pro licence, matching the dashboard.

v1.1.7

2026-08-17

On a multisite network, a change to one site no longer wipes every other site's cache. Cache cleanup no longer deletes stylesheets a live page is still using, and a consent banner styled by another plugin stays styled.

Cache

Fixed On a multisite network, each site's cache is now cleared on its own. Changing a setting, publishing a post, or clicking Purge on one site previously deleted the cached pages of every other site on the network, so the cache was rarely warm for anyone.

Fixed Cache cleanup no longer deletes a combined stylesheet or script that cached pages are still pointing at. Those pages carried on being served while their CSS and JavaScript returned "not found", leaving a site unstyled and unresponsive — and invisible to the owner, whose own browser still held the old copy.

CSS & JavaScript

Fixed "Load CSS Asynchronously" no longer breaks a stylesheet another plugin has already made non-render-blocking. A cookie-consent banner in that position loaded with none of its styling applied, both logged in and logged out.

Settings

New List settings — cache exclusions, ignored parameters and the rest — now show the stock value beside the box you edit, with a Reset action to restore it. These are lists where one wrong entry can quietly stop a whole section of the site being cached, and there was previously no way to see how far a list had drifted.

Improved The box you edit is now labelled, and Reset sits on it rather than beside the defaults.

Accessibility

Fixed Hint text, captions and status pills now meet the AA contrast minimum in light mode. The worst affected was the "Off" state pill — the only thing communicating whether a feature was on.

v1.1.6

2026-08-13

A search-results page could be cached and served as your home page. Combining CSS no longer strips a site's styling, Pro settings can no longer be changed without an active licence, and an AI assistant now reports this site's tier and audits the page you actually asked for.

Security

Fixed A single search request could replace your cached home page. With search caching on, one visit to a search URL was stored as the site's front page, so every later visitor — and search engines — were served those results instead. The cached copy was handed out by the web server without WordPress running, so it kept being served until the cache was cleared. Search pages are now kept out of that store entirely.

CSS & JavaScript

Fixed Combining CSS files could leave a site completely unstyled — no missing files, no errors, just the theme's styling gone. WordPress can inline a stylesheet it considers small, and doing so dropped the combined file that every other stylesheet had been folded into. Combining now happens on the finished page, after WordPress has made those decisions, so what you see in the browser is what was combined.

Fixed A stylesheet saved with a byte-order mark — common in files edited on Windows — no longer breaks the styling of every file combined after it.

Fixed Fonts and stylesheets brought in by an @import rule are no longer dropped when their file is combined with others.

AI assistants & WP-CLI

Fixed On a site without an active Pro licence, Pro settings can no longer be changed through WP-CLI or an AI assistant. The dashboard already showed them locked; four write routes and the image recommendation did not enforce it, so a change made that way appeared to succeed.

Fixed A refused change is now reported as a refusal. It previously returned success over settings it had not written, in both the REST response and the command's exit code.

New run_score runs an external performance audit from any install, and honours the provider you configured — asking for GTmetrix no longer silently runs PageSpeed Insights instead.

Fixed An AI assistant asking what this site is now gets the truth about its tier. On a Pro site with a lapsed licence it previously reported the licence as active.

Improved A PageSpeed audit started from an assistant now measures the page you asked for. It previously measured the home page whatever URL was given, and reported success.

Cache

Fixed Turning the page cache off, or uninstalling xSpeed, now removes the WP_CACHE setting it added to your wp-config.php. It was only removed when written exactly one way, so most sites kept a stale setting behind after the cache was switched off — including after the plugin was deleted.

Compatibility

Fixed wp xspeed purge no longer clears the page cache on Apache servers without mod_headers, where the cache could not be served from disk anyway.

Accessibility

Fixed Two buttons — the nginx snippet's copy control and the MCP panel's tool list — now show a focus ring again when reached by keyboard. They suppressed the outline entirely, which left anyone navigating by Tab with no indication of where they were.

Settings

Improved Duration fields now show what the number means in plain words — "6 hours", "1 day 12 hours" — for every value, not only round ones.

v1.1.5

2026-08-11

AI assistants can change your settings again, and the cache preloader works on sites without a readable sitemap.

AI & agents

Fixed An AI assistant can read and change your xSpeed settings again. The two tools that do this were dropped from the catalog on every site, so an assistant — including the one connected through the Hub — was told they did not exist and could only fall back to raw commands.

New wp xspeed settings list / get / update — read and change any module's settings from the command line, and from an AI assistant through the same commands.

Improved Settings for Pro features are no longer readable or writable over WP-CLI or an AI connection on a site without an active licence. The dashboard already hid them; these two surfaces did not.

Improved Credentials still cannot be set from the command line or an AI assistant. Asking to now names the field it refused rather than reporting success over an unchanged key.

Preloading

Fixed On a site whose sitemap can't be read, the preloader now warms your most recent pages straight from your content instead of silently queueing nothing. This affected two common setups that are not misconfigurations: sites discouraging search engines (where WordPress disables the sitemap outright, standard on staging and pre-launch sites), and SEO plugins that serve their own sitemap at a path we were never told about.

Fixed When a crawl can't start at all, the preloader panel now says "Couldn't start" and names the reason, rather than reporting "Ready" over an empty run.

Improved The explanation appears while the crawl is running, not only once it finishes — on a large site that is the difference between watching an unexplained crawl for hours and knowing why on the first tick.

Fixed wp xspeed preloader status no longer fails with an internal error after a crawl that ended with nothing queued. An AI assistant asking why a preload failed now gets the actual reason instead of a type error.

Branding

Improved New xSpeed Cache logo and wordpress.org banners.

v1.1.4

2026-08-10

Stored credentials are now encrypted, exclusions are enforced by the server itself, and the cache cleans up after itself.

Security

Fixed Stored credentials — API tokens, keys, and object-cache passwords — are now encrypted at rest and never returned in full by the dashboard, REST API, or an AI assistant. They were previously readable in plain text by anyone who could reach those endpoints. Existing values are encrypted automatically on upgrade; nothing needs re-entering.

Improved An AI assistant can no longer write credentials unless you explicitly grant it that permission when connecting.

Improved Cloudflare settings are verified when you save them, so a wrong token or zone is reported straight away instead of failing silently on the next purge.

Caching

New Expired cache entries and orphaned minified assets are now collected on a schedule, so the cache directory no longer grows without bound on a busy site.

Fixed Excluded cookies and bypassed user agents are now enforced on the fast path the web server serves directly. Previously they applied only while a page was cold, so a warm page could serve the shared anonymous copy to carts, members and bypassed bots.

Fixed Sites using TranslatePress now cache the translated page rather than the untranslated one.

Improved Response headers now distinguish a cache miss from a deliberate bypass, so a quick header check shows whether a page is about to be cached or was skipped on purpose. Previously both came back with no header at all.

Improved With debug mode on, a bypassed response also names which rule skipped it — logged-in, excluded URL, query parameter, and so on.

Fixed Cache hits are now counted on every server, not only nginx, so Apache and LiteSpeed sites no longer show a permanent 0% hit ratio.

Improved The static-rewrite check now reports a known blocker (such as Separate Mobile Cache) instead of a bare "inactive", and says the same thing in the dashboard, WP-CLI, REST and MCP.

Improved The hit ratio now excludes 404s and bot traffic, and reports the origin only when a CDN sits in front — so the number reflects what your visitors actually experience.

Compression

Fixed GZIP is no longer reported as inactive when the check itself couldn't complete. A blocked loopback request is not evidence that compression is missing, and telling you your server was misconfigured because we couldn't reach it was the bug. Only a check that positively proves GZIP is absent now warns.

Optimization

Fixed The CDN now serves CSS, JavaScript and fonts, not just images from post content. Font files also get the CORS header they need when loaded cross-origin.

Fixed LCP preload now picks the largest image on the page instead of the first one, so the preload helps the image that actually decides your LCP score rather than competing with it.

Fixed Brotli is detected on nginx by asking the server, so a host with ngx_brotli installed is no longer told to install it. A check that can't complete now says so rather than reporting Brotli as unavailable.

Fixed The Compression page no longer promises an nginx snippet that isn't on it — it links to the snippet instead, and the link is there whether or not compression is already working.

Dashboard & Admin UX

Fixed Enter now inserts a newline in the "one per line" settings fields (Excluded URLs, Excluded Cookies, and the rest). Typing a list previously merged every line into one.

Fixed The Setup Wizard starts from your site's real settings, so re-running it and pressing Apply no longer silently switches off options you had turned on. A cache expiry that isn't one of the presets is shown as its own option and named before anything overwrites it.

Fixed The Recent activity feed shows setting names as they appear on screen instead of internal storage keys, and no longer writes connection details or account identifiers into the log.

Fixed Links to Tools → Migration now open that page rather than dropping you on the Overview.

New Settings fields can now link to their documentation; the PageSpeed API key field points at the setup guide.

Fixed External Score now lives in one place, under Health & insights. It previously rendered a second copy of the same settings and run history inside the Health page's PageSpeed tab.

AI & agents

Fixed A read-only MCP connection can now read status through every per-command tool. It previously refused the whole tool if any of its actions could write, so an assistant with read-only access could not inspect state at all. Write actions are still refused, and an unrecognised action is refused rather than allowed.

v1.1.3

2026-08-05

A redesigned dashboard, a homepage cache-poisoning fix, and caching that survives a plugin update.

Security

Fixed A crafted URL could poison the homepage cache, causing search-results content to be served to every visitor from the cached homepage.

Caching

Fixed Updating the plugin no longer silently disables page caching until the next admin login — the drop-in is restored on activation.

Fixed Cache hits served statically by Apache are now reported and counted, instead of showing a permanent 0% hit ratio.

Improved Health now explains when the fast static-cache path is unavailable because the server lacks mod_headers, and what to change, instead of suggesting a fix that cannot work.

Improved Fresh installs now start on the recommended profile, so sites set up by WP-CLI or a skipped wizard get compression, browser caching, and minification by default.

Dashboard & Admin UX

New Redesigned dashboard — new typography, colour system, navigation rail, and top bar, with grouped navigation and a consistent module-settings layout.

New Command palette for jumping to any setting.

New A dedicated Pro page describing what each Pro feature does.

New "Avg saved" card on the Overview, showing the real per-request time saved from your latest benchmark.

Improved License, Branding, and Multisite are now cards of their own, so the license form is one click away instead of three.

Improved Fonts now lives in one place under Optimization, and the page that used to host it is now "Media Optimization".

Fixed Recommendation links on the Overview now open the screen they point at, and "Get the snippet" opens the snippet.

Fixed The brand mark no longer renders black against the dark rail in light mode.

Optimization

New Delay JavaScript now also covers scripts printed directly into the page — analytics, pixels, and chat widgets that previously bypassed it entirely.

New The delay-JavaScript failsafe timer is now configurable, so it can be tuned or switched off instead of firing mid-measurement.

Fixed Delayed scripts are now matched correctly when minification rewrites their URLs.

Fixed HTML minification now says when it is deliberately suppressed by debug mode, instead of reading as on while changing nothing.

AI / MCP

New Stored PageSpeed Insights and GTmetrix history is now readable from your AI assistant.

Fixed Removed fifteen duplicate tools that shadowed the typed ones, trimming the tool list.

Fixed An unrecognised migration command now reports an error instead of silently succeeding.

v1.1.2

2026-07-30

A new Overview dashboard, click-to-play video embeds, and a full audit trail for AI actions.

Dashboard & Admin UX

New Overview screen is now the landing page, showing cache status, key stats, recommendations, and recent activity at a glance.

New PageSpeed and GTmetrix scores on the dashboard.

New Stat cards open into drill-downs so you can see what is behind each number.

Improved Notice buttons now take you straight to the control they refer to.

Improved Deactivating the plugin now asks for feedback, so problems reach us instead of going unreported.

Optimization

New Click-to-play facade for YouTube and Vimeo embeds — the player loads only when a visitor presses play, cutting page weight.

Fixed Minified HTML no longer loses the space between inline elements, which could run words together.

AI / MCP

New Audit trail recording every AI tool call, with an activity panel showing what was run and whether it changed anything.

New Every xSpeed CLI command is now available as its own MCP tool.

Fixed AI tool calls failed with a server error instead of running. Every tool works again.

Onboarding

Improved Account connection moved to the final step, so caching is set up before you are asked to sign in.

Fixed Returning from account setup now resumes on the right step.

Fixed Each "next step" card in the wizard now goes to its own destination.

Health

Fixed No longer tells you to configure your server when the check could not reach a verdict.

v1.1.1

2026-07-27

Actionable dashboard insights, richer AI tooling, and smarter health detection.

Dashboard & Admin UX

New Impact hero showing the real-world speed gain your cache is delivering, with a one-click next-best-action to apply the top recommendation.

New Benchmark history and daily hit-ratio trend charts, annotated with the setting changes that moved them.

AI / MCP

New Purge a single URL, read site health, test the object cache connection, and verify Cloudflare credentials directly from your AI assistant.

Health

New Detects third-party cookies that would poison the page cache and names the plugin responsible.

New Warns when the cache lifetime is shorter than the preloader interval, which would leave pages permanently uncached.

Optimization

New Delay individual scripts by name instead of all-or-nothing, so you can defer heavy third-party embeds while leaving critical scripts alone.

Fixed Lazy-loaded images now get correct width and height even when the theme strips WordPress' image size class, preventing layout shift.

Caching

Improved Benchmark now reports the real compressed transfer size alongside the uncompressed page weight.

Object Cache

Fixed A failed write to Redis or Memcached no longer leaves a stale value served from the backend.

v1.1.0

2026-07-22

New xSpeed Hub — connect one AI assistant to manage caching across all your sites.

xSpeed Hub

New "xSpeed Hub" tab in the MCP Server panel — connect this site to your xspeedcache.com account so a single AI connection can manage caching across all your WordPress sites.

New One-click "Connect via xspeedcache.com" — sign in and approve, no token to copy.

Improved The connect flow carries your admin email so account setup is one click for new users.

Dashboard & Admin UX

Improved Benchmark and AI audit now sit above the cache settings for a clearer, action-first layout.

Improved The dashboard menu now reads "xSpeed Cache".

v1.0.9

2026-07-15

Redesigned dashboard navigation, improved settings experience, and caching reliability fixes.

Dashboard & Admin UX

New Redesigned settings navigation with dedicated pages for Optimization, Cache, Compression, Cloudflare, Health, and AI & Agents.

New Branded loading skeleton for a smoother dashboard loading experience.

Improved Clearer and searchable settings navigation.

Improved Enhanced search with tab and section-level results.

Improved Cleaner Free dashboard with streamlined Pro sections.

Optimization

Fixed Improved CSS combination compatibility with page builders.

Fixed Resolved frontend rendering issues on block themes.

Caching

Fixed Admin bar cache purge issue.

Fixed Hit counter reset reliability.

v1.0.8

2026-07-13

MCP support for AI assistants, LCP optimization, and admin experience improvements.

AI / MCP

New MCP server support for Claude and other MCP-compatible AI assistants.

New Secure OAuth 2.1 connection for remote AI assistants.

New Read-only and read/write access controls with dashboard management.

New MCP dashboard with available tools and permissions.

Performance

New Resource Hints with LCP image preload and font preconnect.

Fixed Improved LCP image loading by preventing lazy loading on the hero image.

Dashboard & Admin UX

New Settings shortcut from the WordPress Plugins page.

Improved Updated admin menu organization and dashboard navigation.

Improved Better Pro license messaging and settings search experience.

Fixed Checkbox rendering in both light and dark mode.

Reliability

Fixed Improved cache permission handling on non-NGINX servers.

v1.0.7

2026-07-02

Improved reliability, granular cache management, Redis compatibility, and asset optimization fixes.

Caching

New Granular cache purge options for Page/Static, CSS/JS, Object Cache, and REST Cache.

Fixed Improved compatibility with previously installed caching plugins.

Fixed Purge All now properly clears optimized assets, object cache, and triggers CDN/edge purges.

Object Cache

Fixed Redis 6+ ACL compatibility for managed hosting environments.

Improved Object cache write verification for better reliability.

Improved Site-specific object cache flushing for shared Redis environments.

Improved Persistent object cache group flushing.

Asset Optimization

Fixed Combined CSS now preserves inline styles and stylesheet order.

Fixed Combined CSS files are regenerated correctly after cache purge.

Fixed Relative asset paths are preserved in optimized CSS.

Dashboard & Admin UX

Fixed Dashboard layout issue with large WordPress admin menus.

Fixed Admin menu and toolbar overlay issues.

Fixed Pro sidebar item ordering.

Migration

Fixed Mobile cache migration compatibility for NGINX static cache.

v1.0.6

2026-06-25

New caching surfaces, conditional settings, Pro warming features, and a large round of QA fixes.

Caching

New REST response cache layer with per-route TTL — repeated REST reads are served from cache instead of re-running the handler.

New Feed, 404, and search-results caching seams — feeds replay their content-type, cacheable 404s share one per-host entry, and search pages cache per normalized term (opt-in).

New xspeed_should_cache write-side filter so add-ons can opt requests in or out of the cache.

New Maintenance-aware serving — the cache stands down (via a drop-in sentinel) while the site is in maintenance, so visitors never get a stale "we'll be right back" page cached.

Improved Query-form feeds (/?feed=rss2) and conditional GET now return 304 Not Modified for unchanged responses, saving bandwidth for aggregators.

Fixed The PHP serve path and drop-in now honor the per-entry .meta (status, content-type, TTL) on every fast path, so cached 404s/feeds serve correctly.

Fixed The cache drop-in is version-stamped, so serve-logic changes reach existing sites on update instead of running stale.

Fixed Cache is purged when a user or term changes, not just on post edits.

Settings

New Conditional fields — settings can declare dependsOn (with AND/OR groups) so dependent options only show/enable when their parent is on.

Fixed Out-of-schema option keys (e.g. a module's stored entries) are preserved across schema-driven saves, preventing silent data loss.

Fixed media fields validate that the value is an image URL, so a non-image/malformed URL can't be stored and render as a broken image.

White-label

Fixed The "footer credit" and "hide help links" controls now actually take effect (on the Help & Support panel) instead of being inert.

Fixed A deleted/404 brand-logo image falls back to the built-in mark instead of showing a broken image.

Migration

New One-Click Profiles and Save & Share surfaced in the Migration panel, with a friendlier import/preview UX.

Fixed Only enabled source-plugin settings are counted and imported.

Reliability

Fixed Module REST callbacks can no longer leak a database error, stray output, or an uncaught exception into a JSON response (which previously broke a panel with "Unexpected token '<'"); errors are contained and logged, and the response stays valid JSON.

Admin UX

New Opt-in usage analytics (WP Insights) — nothing is sent without explicit consent; helps prioritize what to build next.

Improved Sidebar grouping cleanup, conditional Pro ordering, and deep-link/scroll behavior for submenu navigation.

Improved Pro upgrade links now point to the pricing page.

Pro (requires xSpeed Cache Pro)

New Predictive Cache Warming and Scheduled Cache Prewarming are wired into the dashboard — warm your hottest or about-to-be-popular URLs on a schedule.

New Brotli compression (served where supported, GZIP fallback) via the new compression extension seam.

v1.0.5

2026-06-18

Migration into Free, white-label onboarding, LiteSpeed cache ownership & accurate hit counting.

Migration

New One-click migration from other caching plugins (LiteSpeed Cache, WP Rocket, W3 Total Cache, etc.) is now part of the Free plugin — import your existing exclusions and settings on activation instead of starting from scratch.

LiteSpeed

Fixed On LiteSpeed/OpenLiteSpeed, xSpeed Cache now tells LSCache to stand down (X-LiteSpeed-Cache-Control: no-cache) and owns the cache itself, so the X-XSpeed-Cache header is emitted, hits are counted, and the dashboard no longer falsely reports a PHP fallback.

Fixed LiteSpeed cache hits route through the drop-in (which both tags and counts them) since OpenLiteSpeed's .htaccess can't tag or log a static hit — giving consistent ~1ms hits and an accurate hit ratio.

Cache hit counting & stats

Fixed Hit/miss counters moved off transients onto a persistent option, so they no longer evaporate when a non-persistent object cache (e.g. an unreachable Redis) is active — the hit ratio was getting stuck at a fake 0%/100%.

Fixed Cache MISSes are now recorded inline so the hit-ratio stat reflects reality instead of being pinned at 100%.

Fixed PHP-served cache HITs are counted correctly and the drop-in device-bucket desync is resolved.

Fixed Homepage now caches via the static rewrite (the rule used a pattern that required a non-empty path, so / fell through to PHP while inner pages were rewritten).

Nginx

Fixed A nginx access_log directive in the generated snippet could take down the whole server when its log file was missing; the path is now resolved lazily so a deleted hits.log can't fail nginx -t.

Fixed The dashboard's nginx server-block snippet now updates optimistically when you toggle cache, instead of showing the pre-toggle state, and the wizard's Done step shows the post-apply block.

Admin UX

New Collapsible sidebar groups for cleaner navigation.

Improved Renamed the "Cache" module label to "Page Cache" for clarity.

Improved Sidebar group icons and chevrons brighten correctly on hover (white in dark mode).

Module fixes

Fixed Lazy Load — four correctness bugs resolved.

Fixed Heartbeat — editor-context detection, CLI set support, and honest frontend copy.

Fixed Database cleaner — expired-transient cleanup gaps and a count mismatch.

Fixed Google Fonts — no longer double-appends display=swap on entity-encoded hrefs.

Fixed Settings now strictly validate boolean fields instead of casting, preventing bad values from silently becoming true/false.

Fixed Object Cache — core option groups marked non-persistent so the drop-in can always be deactivated; degraded backends detected honestly.

Improved Static-rewrite SSL probe verifies the certificate and no longer blocks admin page loads.

v1.0.4

2026-06-14

One-click object cache, parity exclusions & admin polish.

Object Cache

New One-click Object Cache setup for Redis and Memcached — tests the connection, installs its own drop-in, and writes the wp-config constants (fully reversible). No drop-in plugin or PHP extension required.

Improved Dashboard now reports a degraded object cache honestly when the drop-in can't reach its backend, instead of implying caching is healthy.

Admin UX

New WP admin submenu now mirrors the in-dashboard navigation, so the menu and dashboard tabs stay in sync.

Improved Settings changes apply live across dashboard navigation — no full page reload needed.

Improved Menu icon now recolors to the active accent state correctly.

Improved Success notifications are anchored to a single consistent position (bottom-center).

Fixed Long panel titles no longer push the subtitle off-screen.

Fixed Number-input spinners render consistently across browsers (Firefox no longer clips the value).

Cache exclusions

New Exclusion lists now ship pre-populated with LiteSpeed / WP Rocket-parity defaults (16 URLs, 20 cookies, 28 query params), so a fresh install caches correctly out of the box.

New Exclusion rules now support regex via a ~ prefix (e.g. ~utm_[a-zA-Z0-9_-]+), alongside glob and substring, with ReDoS guards.

Bug fixes

Fixed Browser Cache no longer emits an "Array to string conversion" warning on multi-valued Cache-Control headers (also clears a false "nginx config required" notice).

License

Fixed Activating a Pro license now unlocks the Pro panels immediately — no full page reload needed.

v1.0.3

2026-06-07

Topology-aware UX, nginx HIT counting, admin polish.

Cache topology & UX

New Topology-aware rewrite banner — the dashboard now detects containerized hosts (xCloud, Kinsta, RunCloud Atomic, etc.) where the $document_root assumption doesn't hold, and tells the user exactly what to expect on their stack instead of silently failing.

New Unified nginx server-block snippet — one consolidated, copy-pasteable snippet (collapsible in the UI) replaces the previous fragmented sections.

New Nginx-served HITs are now counted — a dedicated access_log captures cache hits served directly by nginx (no PHP), so the dashboard "HITs in last 24h" stat is accurate on nginx setups.

New X-XSpeed-Cache response header — cache hits are now visible in the response headers, with a distinct value per serve layer (HIT (nginx) for the fast static path, HIT (php) for the drop-in fallback) so you can confirm a page was cached and tell exactly which layer served it.

Improved Browser Cache notice is topology-aware and renders its snippet in a proper code block.

Admin UX

New Third-party admin notices are suppressed on xSpeed Cache admin screens (page=xspeed* only) — other plugins' "rate us" / promo notices no longer crowd the xSpeed Cache dashboard.

New Aligned sticky title-bar across the sidebar and content panels for a cleaner scroll experience.

Improved Browser Cache + GZIP notices probe-gate themselves — once the underlying issue is resolved, the notice dismisses on its own instead of lingering.

Benchmark

Fixed "Without cache" leg of the dashboard speed test now appends a cache-buster query string. Previously it was hitting the cache and reporting an artificially-fast baseline, making the speedup number look small.

v1.0.2

2026-06-02

Static-rewrite cache, Site Health & Fonts.

Static-rewrite cache + Site Health

New Static-file rewrite path — cached HTML is served directly by Apache / nginx / LiteSpeed, bypassing PHP entirely on cache hits (5-15ms TTFB vs ~85ms via the PHP drop-in).

New .htaccess static-cache block — installed automatically on cache enable, removed cleanly on disable. Block precedes WordPress's own rules so static files match first.

New nginx config snippet — copy-pasteable server { } block surfaced in the dashboard when nginx is detected (PHP can't write nginx config). Avoids the "if is evil" pitfall via a named-location fallback.

New LiteSpeed LSCache coexistence — xSpeed Cache detects LSCache's server-level module and steps back instead of double-caching.

New Active rewrite probe — Health module pings the cache directory and confirms the rewrite is actually serving static bytes (not just present in .htaccess).

New WordPress Site Health integration — Tools → Site Health now lists an xSpeed Cache check covering static-rewrite status + nginx config requirements.

New Persistent banner — Cache panel warns the admin when caching is on but the static-rewrite block isn't engaged (slow fallback path).

New Copy-to-clipboard button on every config-snippet panel (nginx, GZIP, object-cache).

Fonts

New Fonts module — adds font-display: swap to enqueued web fonts so visible text doesn't wait on a slow Google Fonts response, and exposes a preload list for above-the-fold font files.

New FontsModule tests covering the swap rewrite + preload <link> emission.

Improvements & fixes

Improved Server-type detection is cached so CLI / cron contexts see the same server type as web requests.

Improved Drop-in (advanced-cache.php) and WP_CACHE constant are preserved across plugin upgrades; auto-heal hook tightened to admin_init to avoid REST/cron noise.

Improved Plugin Check pass — i18n textdomains, WP_Filesystem coverage, SQL preparation, sanitization, and plugin/readme headers all cleaned up for WordPress.org review.

Fixed nginx snippet rewritten to avoid the try_files trap that broke pretty permalinks.

Fixed Rewrite condition normalized for trailing-slash + non-trailing-slash URLs.

Fixed WP-Rocket-style canonical pattern — server-level conditional rewrite.

Fixed Minify tag-rewrite filters bail in non-frontend contexts (REST / admin / cron).

Fixed wp.org release zip now ships vendor/ — resolves the 1.0.1 activation fatal.

Improved Release pipeline rebuilt — .distignore-driven dist build, CI verify step, version-named artifact on every run.

Improved Plugin version read from the PHP header — single source of truth.

v1.0.1

2026-06-01

Foundation release — full feature set + Pro hooks.

Module architecture + LiteSpeed parity floor

New Module architecture — every feature now ships as a self-contained Module (Cache, Health, Preloader, Heartbeat, Minify, GZIP, Lazy Load, Disable Bloat, Database, CDN, Cloudflare, Object Cache, Browser Cache).

New Health module — 24-hour hit/miss counter + activity log.

New Preloader module — sitemap-driven cache warmer with content-publish auto-warm.

New Cache exclusion intelligence — glob URL patterns, cookie patterns, User-Agent bypass, ignored query parameters.

New Per-device cache (mobile-separate).

New Per-post cache rules — don't-cache + custom expiry meta box.

New Minification — CSS / JS / HTML minify, combine, defer JS, delay JS, async CSS, remove ?ver= query strings.

New Lazy Load module — images / iframes / videos + auto CLS-fix.

New Disable Bloat module — 6 ergonomic toggles (dashicons, oEmbed, RSS, XML-RPC, jQuery Migrate, REST auth).

New Database module — optimize tables, scheduled cleanup, autoload analysis.

New CDN module — pull-zone URL rewriting.

New Cloudflare module — zone connect, auto-purge, dev-mode toggle.

New Object Cache module — Redis / Memcached config + status + flush.

New Browser Cache module — Cache-Control + Expires headers.

New Settings search across the entire dashboard with keyword highlighting.

New 3-step setup wizard on first activation with preset chooser and benchmark.

New Sidebar grouping under domain headers (Cache / Performance / Network / Insights / Tools).

New Sidebar tooltips + search shortcut in the collapsed rail.

New xspeed_branding filter — agencies can rebrand the dashboard.

New xspeed_cache_skip_for_post + xspeed_cache_expiry_for_post filters.

Pro-essentials

New xspeed_module_descriptor filter — Pro hooks this to swap its panels to LicenseLockedPanel when license is invalid.

New AI Privacy module — GDPR off-switch + xspeed_ai_can_collect_data filter that Pro AI features must consult before recording visitor data.

New Pro upsell teasers — in-context inline cards on Cache, Minify, Lazy Load, Browser Cache and Disable Bloat panels.

New Locked Pro module rows in the sidebar — shows what Pro offers with a clear upgrade prompt.

New Pro Audit on the Cache panel — site-specific scan listing the top Pro features that would help THIS site, with severity chips and concrete reasons (not generic marketing copy).

New Sidebar slot for the license module (appears when xSpeed Cache Pro is installed).

New Global 36px form-control height baseline across the dashboard.

New filemtime() cache busting on admin asset URLs.

Improvements & fixes

Improved React panel registry — modules auto-render in the dashboard.

Improved Portal-based save indicator — zero layout shift.

Improved Distribution zip prunes dev dependencies (composer install --no-dev).

Fixed 5 duplicate module icons + regression test.

v1.0.0

2026-05-27

Initial release.

xSpeed Cache Pro

v1.1.1

2026-08-27

Unused CSS is now measured in a real browser instead of inferred, the external generator endpoint is gone, and an incomplete Pro folder no longer takes every request down with it.

Critical CSS

New Unused CSS is measured by loading the page in a real browser and recording which rules the page actually applies, instead of inferring it from the markup. Rules a script or an interaction brings into use are seen as used, so styles the previous method removed are now kept.

Improved The generator endpoint and its API key have been removed. Both CSS features now measure the page in your own browser or on your own server; there is nothing to point an external service at, and an address that was not a web address used to be accepted here and then silently ignored. Any endpoint you had configured is no longer used.

Fixed The "Never prune these selectors" box on Unused CSS now appears. The setting worked, but the panel had no field for it, so the only way to add a selector was WP-CLI or a filter.

Fixed A relative url() in a stylesheet — an icon font, a background image — no longer breaks when its rules are moved into a combined file or inlined into the page. The reference is rewritten to still point at the original file.

Fixed A stylesheet reached through a query string or an @import is now resolved rather than skipped.

Fixed Interaction states are measured across every control the probe opens, not only the last one left open, so styles that appear on hover or click are no longer dropped as unused.

Fixed A scan that runs out of time is discarded rather than saved half-finished, which previously removed styles the incomplete scan never got to see.

Fixed Captured CSS state is no longer discarded when a language pack or an unrelated plugin is installed.

Compression

Fixed Enabling Brotli on a server without Brotli support no longer reports plain success. The tools that flip the setting now report the same warning the dashboard shows, instead of logging a change that has no effect on what visitors download.

Caching

Fixed The page cache is cleared when Pro itself is updated, so a page is never served from markup the previous version produced.

Reliability

Fixed A missing Pro file no longer takes down every request. Pro stops cleanly and names what is missing, leaving the site and wp-admin usable so the plugin can be reinstalled.

Fixed A Pro build paired with an older Free version now stops with an explanation instead of fataling on the first Free function it expects and does not find.

Fixed An incomplete Pro install no longer breaks the screens that ask which features are active — they now answer correctly instead of failing on the module the broken install is missing.

v1.1.0

2026-08-24

Requires xSpeed 1.2.0 or later. A security fix for stored CSS that could break out of the block it is inlined into, and the Apply button on a Pro recommendation now works. Unused CSS no longer strips stylesheets it should have left alone, and CSS entries are keyed per page rather than shared across pages that only differ by query string.

Security

Fixed Stored CSS can no longer terminate the style block it is inlined into. An HTML parser ends that element at the first "</style" in any case, followed by anything — so CSS containing that sequence closed the block early and everything after it was parsed as markup rather than styles, which could run script on every page that served the entry. The escape matches what a parser actually looks for rather than the literal closing tag, since "</style bogus>" and a newline before the ">" close the element just as effectively. Nothing legitimate is affected: "</style" is already a CSS parse error.

Recommendations

Fixed The Apply button on a Pro recommendation works instead of failing silently. Free and Pro name their recommendations differently — and only Free's names were understood by the button both of them share, so every Pro Apply failed and the error never reached the screen.

Fixed A recommendation that no longer applies now says so, instead of reporting the same failure as one that could not be applied at all.

Unused CSS

Fixed One expired entry no longer causes every stylesheet on the page to be stripped. A single bad entry took the whole page's CSS with it.

Fixed Stylesheets are replaced in contiguous runs and in place, so the cascade order they were enqueued in is preserved and nothing is hoisted past the rules that override it.

Fixed Only one CSS strategy resolves per request, so Critical CSS and Unused CSS no longer both act on the same page.

Fixed A run entry no longer duplicates what it stores, and what it keeps is bounded.

Fixed Entries written before the key change are re-filed on read rather than silently ignored, and an entry that is refused now says why.

Critical CSS

Fixed Entries are keyed on the routed path plus the query parameters that actually select content. Pages differing only by a tracking parameter previously shared one entry, so one page's CSS was served for another.

Fixed Ignored query parameters are matched by whole name rather than as substrings.

Fixed Generation fetches the unoptimized page, so stored CSS reflects the real stylesheet rather than an already-optimized copy.

v1.0.10

2026-08-20

A security release. The Real User Monitoring endpoint and the predictive tracker were both open to anonymous callers with no bound on what they could store, network-wide multisite settings could be changed by a single site's administrator, and the licensing library carried an update-channel exposure.

Security

Fixed The Real User Monitoring beacon no longer accepts data from anonymous callers when the feature is switched off, and what it accepts is bounded. The endpoint is public by necessity — it receives measurements from visitors' browsers — but it stored whatever arrived, in unlimited quantity, whether or not RUM was enabled. It now returns "not found" when disabled, caps each batch, keeps one entry per metric name, and rejects measurements attributed to another site's URLs.

Fixed The predictive tracker only accepts page transitions that belong to this site. It previously recorded any URL a caller sent, so an anonymous request could place an arbitrary address into the prediction data — and from there into the speculation rules the site prints for browsers to prefetch. The host is now checked when the transition is recorded and again when the rules are rendered, so anything already stored is filtered on the way out.

Fixed The predictive tracker is rate-limited, so a single caller can no longer grow the stored prediction data without limit.

Fixed On a multisite network, changing settings that apply to the whole network now requires a network administrator. The routes checked manage_options, which an individual site's administrator holds, so one site's admin could change settings affecting every site. Off a network the check falls back to the site capability, so single-site installs are unaffected.

Fixed The licensing library moves to 2.3.1, closing an exposure in its update channel.

Predictive warming

Fixed The tracker reports what it actually recorded. It inferred success by comparing the buffer size before and after, but the buffer is capped — once full the count stops changing, so on any site busy enough for the feature to be worthwhile it reported "ignored" for every transition, including the ones it had just stored.

Fixed Sites behind a reverse proxy or CDN no longer share one rate-limit counter. Where the proxy does not restore the visitor's address every visitor looked like the same caller, so the site stopped collecting transitions once the shared counter filled. An xspeed_smart_predict_client_ip filter lets a site point the limiter at whichever header its infrastructure sets.

Interface

Fixed A failed save no longer shows the green "Settings saved" toast, and the failure stays visible after the toast fades instead of disappearing with it.

v1.0.9

2026-08-17

Predictive warming now recognises pages that are already cached, instead of re-warming the same ones on every run.

Predictive warming

Fixed The warmer now finds pages the cache has already stored, so "skip pages that are already fresh" works again. It was looking in the wrong place after the free plugin moved cached pages into per-site folders, so every page read as cold and each run spent its whole budget re-warming pages that were already warm.

v1.0.8

2026-08-13

Pro settings are no longer writable on a site whose licence has lapsed, a PageSpeed run from an assistant is finally recorded, and Pro toggles are keyboard-navigable again.

Licensing

Fixed On a site without an active licence, Pro settings can no longer be changed through WP-CLI or an AI assistant. The dashboard already showed those panels locked, but four write routes and the image recommendation bypassed the check entirely — a change made that way was saved and reported as successful.

Fixed A refused change is now reported as one. It previously returned success over settings it had never written, both in the REST response and in the command's exit code, so a script could carry on believing a change had landed.

Speed test

Fixed A PageSpeed run started from an AI assistant is now recorded in the site's run history. It previously ran, returned a score, and stored nothing — so the history the assistant points you at stayed empty. A cached re-read still records nothing, since it is not a new measurement.

Accessibility

Fixed Toggles in Pro settings panels show a focus ring again when reached by keyboard. The indicator disappeared entirely on reaching a toggle, so anyone navigating by Tab had nothing showing which control was focused and pressing Space was a guess. Free's toggles were unaffected, and the two sit side by side on the same screen.

v1.0.7

2026-08-10

Edits are no longer lost while a panel saves, failed image conversions are counted, and the Brotli snippet reaches the nginx users who need it.

Settings & Admin UX

Fixed Anything typed while a Pro panel was saving is no longer overwritten when the save lands. The value on screen is now what gets stored, on all nine panels.

Fixed A "Save failed" message on the Maintenance Cache panel now clears once the next save succeeds, instead of staying on screen indefinitely.

Images

Fixed Bulk conversion now counts failures. A library where every AVIF encode failed previously reported the same green "Done — 0 new file(s) converted" as one that was already fully converted, with no signal anywhere that something had gone wrong. A run that converted nothing but hit failures is now shown in amber, and wp xspeed images bulk --now warns instead of reporting success.

Improved The progress readouts say which unit they're counting. Attachments and files were previously reported as one number, so the running line could look like a counter that had overrun its own total.

Compression

Fixed On nginx, the Brotli snippet is now shown even when Brotli isn't active yet — that snippet is what tells you how to turn it on, so gating it on the thing it enables meant the users who most needed it never saw it.

Improved A detection check that can't complete now says so, and names the likely causes, instead of reporting Brotli as unavailable.

CSS

Fixed Deferred stylesheets now emit valid markup, and are no longer processed twice when Free's Minify has already deferred them — which previously produced duplicate handlers and a no-JS fallback that didn't fall back.

Warming

Fixed One-off prewarm times are read in your site's timezone instead of UTC, so a warm set for 3:00 PM runs at 3:00 PM. A one-off that genuinely will not fire is now flagged, and one that is merely due is no longer mislabelled.

Licensing

Improved The license notice in wp-admin now uses the same colours, spacing, and icon as the dashboard, instead of its own palette that read as a different plugin's notice.

Improved Agency branding still overrides the notice accent, so a white-labelled install keeps its own colour.

Fixed The deactivation dialog no longer promises a 7-day grace window that deactivation never gave. It now says Pro stops immediately and your key is freed for another site.

AI / MCP

Fixed wp xspeed ai status reports the configured provider key instead of "(unset)", and no longer emits a PHP warning.

v1.0.6

2026-08-05

Unused-CSS removal now works out of the box, and a fatal-error fix for sites running the latest Free release.

Reliability

Fixed With this release's Free version active, the site could fail to load entirely. Compatibility with the updated Free plugin is restored.

Unused CSS

New Unused-CSS removal now works without any external service — stylesheets are pruned on your own server, so the feature runs on a default install instead of needing a generator endpoint.

Improved A configured generator endpoint still takes priority, and the result now names which method produced it.

Fixed Stored CSS is no longer cut mid-rule when it hits the size cap, which could leave part of a page unstyled.

Settings & Admin UX

Improved License and Branding now have distinct icons and labels on the Settings screen.

AI / MCP

Fixed Unrecognised commands for images, critical CSS, unused CSS, and migration now report an error instead of silently succeeding.

v1.0.5

2026-07-30

Image-wrapping and licensing fixes, plus more reliable real-user metrics.

Image Optimization

Fixed Wrapped images no longer receive max-width and height overrides that could distort their sizing.

Fixed Logo links are no longer wrapped in a picture element, which could break header layouts.

Licensing

Improved A failed license activation now explains what went wrong and what to do next, instead of failing silently.

Fixed The "What Pro adds" link now opens the Features page.

Performance Monitoring

Fixed Real-user metrics are no longer discarded when the metrics table is missing — it is recreated automatically.

Fixed The metrics beacon is now served from your own site rather than an external host.

v1.0.4

2026-07-27

License activation now connects to the production WPDeveloper store.

Licensing

Fixed License activation and validation now connect to the production WPDeveloper store instead of the pre-launch staging endpoint.

v1.0.3

2026-07-15

Maintenance release with build and release process improvements.

Reliability

Improved Build and release pipeline for more reliable and consistent Pro packages.

v1.0.2

2026-07-13

Bulk image optimization, AI integration, and licensing improvements.

Image Optimization

New Bulk WebP and AVIF conversion for existing media libraries.

New Background image conversion with live progress and storage statistics.

New Configurable output format selection for WebP, AVIF, or both.

Fixed Improved WebP and AVIF delivery for cached pages.

Improved Better image optimization settings and panel experience.

AI / MCP

New MCP support for all Pro modules, enabling control from Claude and other MCP-compatible AI assistants.

Licensing

Improved Enhanced Free and Pro license state detection for more accurate dashboard messaging.

v1.0.1

2026-07-02

Maintenance release with image delivery, cache purge, and migration improvements.

Image Optimization

Fixed Improved WebP and AVIF delivery, including support for CSS background images.

Caching

Fixed CSS optimization cache is now properly cleared during cache purges.

Migration

Fixed W3 Total Cache importer now supports Redis ACL credentials.

v1.0.0

2026-06-25

Initial release of xSpeed Cache Pro. Built as an add-on for xSpeed Cache Free — installs alongside Free and layers 25+ Pro modules into the same dashboard, gated by a single license.

Caching

New REST API Cache — cache read-only REST responses with a TTL you set per route; built for headless / app back-ends.

New Feed Caching — cache RSS / Atom / comment feeds (with correct content-type) so aggregators polling your feed skip a full render.

New 404 Caching — serve a single cached 404 page so bot/scanner floods on nonexistent URLs don't hammer PHP.

New Search Caching — cache internal search-results pages (/?s=…) so popular repeated searches skip a full query.

New Custom Cache Rules — bypass cache or override expiry by URL, post type, category, tag, or author, with priority ordering.

New Maintenance-aware caching — skip caching while the site is in maintenance / coming-soon mode and auto-purge when it goes live.

Performance

New Critical CSS — inline above-the-fold CSS and defer the rest, per template.

New Unused CSS — inline a pruned per-URL stylesheet and strip the originals; pairs with Critical CSS.

New Image Optimization — convert new JPEG/PNG uploads to WebP and AVIF and serve them to capable browsers.

New Smart Image — AI-recommended format + quality settings based on your media library.

New Adaptive Cache — AI-tuned cache TTL based on 24-hour traffic patterns.

New Predictive Cache Warming — proactively warm the hottest URLs, ranked by real traffic, recency, and content, on a schedule.

New Scheduled Cache Prewarming — warm target URLs ahead of scheduled moments (a post going live, a sale, a campaign) so the spike hits a warm cache.

New Smart Predict — predict the next page a visitor is likely to open and prefetch it.

Edge & Network

New Brotli Compression — serve Brotli-compressed responses where the browser and server support it, with automatic GZIP fallback.

New Cloudflare APO — toggle Automatic Platform Optimization, edge cache level, and TTL on your connected Cloudflare zone.

Insights & monitoring

New Real-User Monitoring (RUM) — sample Core Web Vitals (LCP, FCP, CLS, INP, TTFB) from real visitors, charted per page and per device.

New Performance Health — Core Web Vitals health score with AI anomaly detection, reading the data RUM collects.

New PageSpeed — on-demand Google PageSpeed Insights audits; scores + top issues cached for 24 hours.

New Analytics — hit-ratio trends, slowest URLs (from RUM), and recent activity in one view.

New Recommendations — site-specific configuration advice grounded in the active modules, with one-click apply.

New Pluggable AI provider — choose OpenAI, Anthropic, or OpenRouter; powers Adaptive Cache, Smart Image, Smart Predict, Performance Health, and Recommendations.

Operations

New Migration — one-click importers from WP Rocket, W3 Total Cache, and WP Super Cache.

New Advanced Migration — host-tuned profiles, bulk/multisite import, and shareable Save & Share profiles.

New Multisite — network-wide cache control with per-subsite overrides and a network admin panel.

New White Label — rebrand the dashboard chrome (name, logo, footer credit, hide help links) for agencies.

New License — activate xSpeed Cache Pro via the WPDeveloper store with periodic revalidation and a license-locked panel fallback when invalid.

Integration with xSpeed Cache Free

New Layers onto Free's module registry — Pro modules reuse Free's schema-driven panels, stat cards, and form controls for one consistent dashboard.

New Pro REST routes return 404 from the outside when the license is invalid; the dashboard renders a license-locked panel in their place.

xSpeed Hub

v1.1.1

2026-08-23

One press of Analyze now measures mobile and desktop in the background, and a notification bell, a snackbar and the browser tab itself tell you when the result lands. Newly attached sites are measured on arrival, and "Purge all" is on every screen.

Added

New One press now measures mobile and desktop, and tells you when it is done. An audit used to hold the request open until Google answered, which already sat a few seconds under the proxy's 60-second ceiling on a real WordPress page — and ruled out two devices entirely, since that is roughly ninety seconds. Audits are queued now: pressing Analyze answers immediately and the work continues in the background, so duration stopped being a constraint. Both devices run from one press, sequentially, and if one succeeds and the other fails the score that exists is kept with the failure reported beside it, rather than both being thrown away to report a clean failure.

New A notification bell, and status messages that follow you. The Hub could reach you by Slack and email but had nowhere to say anything inside the product, so work finishing minutes after the press that started it could only be seen by whoever was still watching the right tab. Audit results now land in a bell in the header, addressed to the person who pressed the button and readable from anywhere in the app, and a snackbar reports both the start and the finish with a link straight to the report. If you have switched to another tab by the time it lands, the tab itself tells you: the title carries an unread count and the favicon gets a dot, both only while the tab is in the background and both clearing the moment you come back.

New Newly attached sites are measured straight away, so a site's first score is already there rather than waiting for someone to find the Analyze button. Local sites are skipped, since PageSpeed cannot reach them.

Changed

Improved "Test" is now "Analyze" everywhere, and runs a real speed test. On the site row it sat beside a score ring and reported "cache on · 87% hit ratio" — a configuration read wearing the name of a speed test; the same button on a site's own page had the same problem, and everything it reported was already on screen in the Live status panel below it. Both now measure PageSpeed on mobile and desktop, and the cache state is read where it was always shown.

Improved "Purge all" is on every screen now, and no longer styled as the page's primary button. It was limited to Overview and Sites, on the reasoning that it belongs with the screens it acts on — but clearing the cache is usually something you decide after doing something else, and having it disappear exactly then made it feel unreliable rather than focused. Dressing it as the main call to action, meanwhile, invited the stray click its confirmation dialog then has to catch, so it is now a secondary button.

Fixed

Fixed A stale run left behind by a restart is cleared within five minutes rather than up to an hour, so the Analyze button stops being blocked by work that is no longer happening.

Fixed The device control on the Reports tab is a real filter now. It sat above the run history looking like one, but only chose what the next audit would measure — so picking Desktop left every mobile row on screen. The table has its own filter, and the original keeps its actual job.

Fixed The last two native dropdowns were replaced with the app's own, so no control is painted in OS chrome any more.

v1.0.12

2026-08-16

"Make my site fast" is now a single call that measures, applies one change at a time, and puts back anything that broke the page. The Overview shows what each score could reach and what is already going well, and speed tests started from an assistant actually run.

Added

New "Make my site fast" is now one call. Every individual action already existed — turn caching on, minify, warm the cache, run a speed test — but deciding which to use, in what order, and whether the site still worked afterwards was left to the assistant. optimize_site runs the whole sequence deterministically: it measures, applies one setting at a time, re-checks the page after each, and puts back anything that broke it. It reports what it applied, what it undid and why, and what it could not reach at all.

New The Overview shows what each score could reach, not just what it is. Each site now carries a reachable score beside its current one, and each recommendation the estimate of what it would gain. Deliberately conservative: an estimate appears only where the fix actually reaches what Lighthouse measures, and a projection takes the largest gain plus half the rest rather than adding them up.

New The Overview shows what went right, not only what is broken. Three win cards surface crossings of 90, month-over-month gains and healthy streaks, all derived from snapshots the daily pass already collects. A win has to be earned to appear, and when nothing qualifies the row renders nothing rather than padding with encouragement.

New Fleet scores now lead with desktop, with a toggle for mobile. One control switches the whole section, and the score bar is banded so a number reads as good or bad at a glance.

New The Hub now has a favicon. Both the account app and the admin console carry the xSpeed brand mark, as an SVG that stays sharp at every size, with a PNG fallback and an apple-touch icon for iOS home screens.

Fixed

Fixed "Sites, worst first" now actually is worst first. The order came from a composite health score that never read the PageSpeed number at all, so a site scoring 94 on a thin hit ratio ranked above one scoring 43 at 99% — directly under a column showing those very scores. Untested sites now sort last rather than first.

Fixed A red score is no longer labelled "Healthy". The pill meant "no open recommendations", which is not the same thing — a site can satisfy every cache rule and still be slow behind a 12.6s LCP. It now stands down unless the score agrees.

Fixed Speed tests started from an AI assistant now run. The tool was asking the WordPress site to run the audit and report back, so it needed a plugin new enough to know the tool and a successful fetch of the Hub's PageSpeed key; when either failed the site called Google unkeyed and hit the shared rate limit. The Hub now runs the audit itself, exactly as the dashboard does.

v1.0.11

2026-08-13

Settings edits save themselves and survive a reload, each settings group is its own searchable page, and an AI assistant can finally run a speed test — not just read old ones.

Settings

Improved Settings edits now save themselves. A write travels from the Hub to the site's own API and back, and on a slow site that wait was the user's problem: the Save button sat disabled, and two edits made in quick succession could land out of order, leaving the older value on the site. An edit now takes effect locally the moment it is made and is sent a moment later, with only one write per module in flight at a time, so they cannot overtake each other. A change that has not reached the site yet is kept — through a reload, a closed tab, or a site that is temporarily down — and retried, and a value the site would reject is refused with the reason shown against the field rather than being sent and failing. Two browser tabs open on the same settings can no longer overwrite each other's work.

Improved A site's settings are now one page per group, and searching narrows them in place. The Settings tab rendered all seven groups stacked in a single column — 34 modules and 130-odd settings — so Cache ran into Optimization ran into Network and the only way through was scrolling. Each group is now its own page at /sites/<site>/settings/<group>, which means a group is linkable, survives a reload, and the back button steps between groups. Searching keeps that layout rather than replacing it: the group list stays where it is and its counts become a live tally of where the matches are, each module shows only the settings that matched with the rest a click away under "show all", and the matched text itself is marked.

Speed tests

New An AI assistant can now run a speed test, not just read old ones. Asking Claude to test a site's speed previously went nowhere: the Hub offered get_score_history, which reads past audits, and nothing that could start one — so an assistant correctly reported it was unable to help and pointed users back at the dashboard. The new run_speed_test tool runs a real Lighthouse audit (PageSpeed Insights, or GTmetrix where a site has it configured) and returns the score with Core Web Vitals. It is a write tool: it spends the Hub's shared PageSpeed allowance and stores a run, so a read-only connection cannot call it.

Fixed An assistant asked for a PageSpeed score no longer answers with the cache benchmark. The two measure different things — a real Lighthouse score versus xSpeed's own cached-vs-uncached TTFB — and nothing in the guidance said so, so the wrong tool looked like a reasonable answer. The connection instructions now contrast them by name and tell the assistant to read existing history before spending a new run.

Connection instructions

Improved The read/write tool lists in the MCP connection instructions are now derived from the catalog rather than typed out by hand. Every hand-written list had already gone stale — none mentioned the Cloudflare, object-cache or score tools — and a tool missing from the instructions is effectively invisible, because the model reads them before it reads the catalog.

v1.0.10

2026-08-11

Run a PageSpeed audit from the Hub on the device you choose, let your AI purge Cloudflare and diagnose the object cache, and find any setting in a grouped, searchable Settings tab.

Reports

New Run a PageSpeed audit from the Hub, on the device you choose. The Analyze button on a site's Reports tab now runs PageSpeed Insights against the site and stores the result beside its history — desktop by default, mobile a click away, and each kept as its own run so the two can be compared. Previously the Reports tab could display a PageSpeed run but had no way to start one. Which providers the tab offers is now a server setting, so a Hub can present PageSpeed alone, GTmetrix alone, or both; with one provider the chooser disappears rather than becoming a control with a single option, and the remaining monthly count is shown only for GTmetrix, which is the one that has a limit.

AI actions

New Your AI can now check and fix a site's Cloudflare cache. Purging a site's own cache while Cloudflare still serves the old page is a confidently wrong answer, and it was the only thing an assistant could do. It can now purge the edge, check that the stored credentials still work, and turn development mode on or off — with the caveat that development mode slows the site for real visitors while it is on, so the assistant is told to turn it back off.

New Your AI can now diagnose the object cache. An object-cache drop-in left pointing at a backend that is gone adds seconds to every request: the site stays up, the page cache looks healthy, and nothing else explains it. An assistant can now open a live connection to Redis or Memcached and report what came back, alongside reading the cache's state, flushing it, and turning it on or off. Asked why a site is slow, it can now answer that question instead of ruling out everything else.

Settings

New The site Settings tab is grouped and searchable. It listed every module a site reports as one flat alphabetical accordion — around 46 rows on a site running Pro. Settings now sit in the same seven groups the plugin's own dashboard uses, with a jump list and a search that matches a module's name or any individual setting's label, description or options: typing ttl finds the four modules that have one, webp finds the image-format settings.

Connections

Improved The connect config now names the server xspeedcache-hub instead of xspeed, so you can tell which xSpeed it is. The plugin exposes an MCP server on every site it runs on, so a config often holds several at once — and when they were all called xspeed, neither you nor the AI could tell from a tool call whether it reached the Hub or one particular site. That ambiguity mattered most for the calls that change something, like purging a cache or updating settings. Tools now appear as mcp__xspeedcache-hub__*. Existing connections keep working under the old name and pick up the new one the next time a fresh config is pasted, such as after rotating a token; the name is client-side only, so renaming it yourself is safe.

Boost opportunities

Fixed A boost opportunity for a feature you already run no longer shows an "Enable" button that does nothing. The button was drawn from whether the module could be switched, never whether it already was — so a suggestion naming a running feature offered to enable it, saved successfully, and changed nothing visible. Such a suggestion now reads as advice. The matching plugin-side fix stops the audit raising those suggestions in the first place.

v1.0.9

2026-08-11

One AI request now reaches the whole fleet, each site page carries its own Pro audit with one-click fixes, modules toggle straight from the site overview, and the Hub picks up the finalised xSpeed mark.

Fleet actions

New One AI request now reaches every site — "purge all my sites" is a single call. The site argument on purge_cache, toggle_cache, update_settings, run_benchmark and the preloader tools accepts "all" or a list of handles, and the result comes back per site — four sites where one is unreachable is reported as exactly that, never a blanket "done" or "failed". Sites run one at a time with the same courtesy pause the daily pass uses, a restricted connection asking for "all" quietly gets only the sites it's allowed to touch, and every site's action lands in the activity log as its own row — a four-site purge reads as four purges. The connection instructions teach the AI the new form, including confirming once before a fleet-wide write.

Site pages

New A site's page now shows its own Pro audit, merged with the Hub's advice. The plugin has always computed a personalized list of Pro features that would benefit each site (the same one its own dashboard shows); the Hub proxied it for AI clients but never displayed it, so the two surfaces gave one site different advice. A Boost opportunities panel on the site page now shows both in one list — deduplicated, with the site's items tagged "from this site". Suggestions that map to a switchable module get a one-click Enable; ones that need a Pro plugin the site demonstrably does not have get an honest Included in Pro link instead of a dead button. When the Hub cannot yet tell whether Pro is installed — the state every site is in until its first daily pass — the suggestion stays as plain advice rather than guessing, so a site that already runs Pro is never pitched an upgrade. Fetched only when the panel is opened, so the fleet Overview still costs zero live calls.

New Flip a module on or off from the site overview. The Modules card's chips are now switches: click one to enable or disable that module on the live site, with no settings form in between. Only modules whose own schema says they can be toggled get a switch — everything else (and everything, for viewers) stays a read-only chip — and the write goes through the same validated settings path the Settings tab uses. The chip flips immediately and flips back with the site's own explanation if the site refuses.

Branding

Improved The Hub now carries the new xSpeed Cache mark. The sidebar rail, the sign-in screen, the workspace switcher and the email logo all pick up the finalised branding. The artwork is the same two-path icon the plugin ships, so the Hub and the plugin stay pixel-identical rather than drifting apart.

v1.0.8

2026-08-09

The Overview becomes a fleet command center — a fleet-average score hero, an Apply-all button, and a worst-first site leaderboard.

Overview

Improved The Overview is now a fleet command center. A hero card leads with the fleet's average mobile score, a gauge showing the climb to the 90+ "good" band, and one Apply all button that runs every one-click fix in the queue — sequentially, with whatever's left after a failure still listed below. The site cards underneath became a worst-first leaderboard — one ranked row per site, each carrying that site's own top fix — so ten sites read as a list you scan, not a wall you hunt through. Single-site accounts keep their site hero unchanged.

v1.0.7

2026-08-09

Run a GTmetrix test on any site straight from the Hub, and every site now opens as its own linkable page.

Reports

New Run a GTmetrix test on any site straight from the Hub. A Test button on a site's Reports tab measures it there and then, instead of asking you to go and run one from that site's own dashboard. Results land in the same history as everything else, so a fresh test can be compared against any earlier run. Free accounts get 5 tests a month, Pro 50 — the count is shown next to the button.

New The test works on every attached site, including ones whose owner has never configured GTmetrix, because it runs on the Hub's own account. The daily pass still only ever copies what a site already measured — nothing on a schedule spends anyone's credits.

Site pages

Improved Each site now opens as its own page at /sites/<handle>, instead of expanding an accordion inside the list. That address is linkable, bookmarkable and survives a reload, and browser back/forward moves between the list and a site the way you'd expect. The page carries four tabs — Overview, Settings, Reports and Access — each with its own address (/sites/acme/settings), so a tab can be shared too. The list row keeps what you scan a list for: name, URL, status and latency.

Improved Only the site you're looking at talks to your WordPress install. Several rows could previously be expanded at once, each proxying calls to a different customer site; one site at a time is now structural rather than a convention.

v1.0.6

2026-08-09

Overview reads clearly before your sites have any speed tests, and a connected AI client no longer fills the page with setup instructions you've already used.

Overview

Improved A site with no speed tests still looks designed. The mobile and desktop rings stay in place — muted, with an em dash — so the card keeps its shape, with one line underneath: "No speed tests yet · set up in site settings".

Improved The badge on each site card now means one thing: the connection. It appears for sites that are pending, unreachable, or revoked. Performance is already shown by the ring colours, the "N to fix" chip, and worst-first order.

Improved A connected AI client collapses to a single status line — "AI connected · claude-code · last call 19m ago". The connection snippets are one click away under Add a client / manage; before you've connected, that panel leads the page.

Improved Fleet score, Needs attention, and Open fixes share one compact strip instead of four large cards, and it's hidden entirely when you have one site. Boost opportunities are one line each, with the full explanation on hover. The hero drops its duplicate hit-ratio bar — the hit-ratio stat now shows the trend arrow inline.

Cache & health

New Purge a cache from the dashboard — one site, or the whole fleet. Until now purging was reachable only by an AI through MCP. A Purge all button sits in the top bar and each site row gets a Purge. The fleet purge confirms first, runs at most four sites at a time so it never becomes a thundering herd at customer origins, and reports per site — a fleet where one site is unreachable is a partial success, not a single "done" or "failed". Every purge is recorded in the activity log as its own row.

New Health diagnostics per site, and a config-issue signal on the fleet. The site drill-down now has a Health panel listing every check worst-first with the site's own explanation, plus its 30-day hit-ratio line against the 80% target. It is fetched only when opened, because it is a live call to the customer's server. The daily pass now records how many checks fail or warn, so a site with a broken environment carries a "config issues" chip on the Overview. A site the pass could not reach stores null, never 0 — "we could not ask" must never read as a clean bill of health.

Preload & benchmarks

New Preload and warm a site from the Hub. The site drill-down now has a Preloader panel: start a crawl, watch it progress, stop it mid-run. It polls only while a crawl is actually running, so an idle preloader costs the customer's server nothing. When the site refuses because its preloader module is disabled, its own sentence is shown as a 409 rather than a generic failure.

New Three preloader tools on the MCP catalog — get_preloader_status (read), start_preloader and stop_preloader (write) — so an AI can warm a cache after a purge. The Hub parses the plugin's CLI-transcript output defensively: every field degrades to null on its own, and an unknown running state renders as "unknown" rather than "idle".

New Benchmarks you can run from the Hub — and that stick around. The site drill-down now has a Benchmark panel; each result is kept in a new history alongside every previous run, so you can see whether a change actually helped. The headline is the time saved per request, with uncached and cached shown side by side so the number is checkable. A run taken with caching off has no saving (null, never 0), and a negative saving is kept and labelled "cached was slower" rather than clamped away.

v1.0.5

2026-08-06

The account app now looks like the plugin, and the Overview answers the question people open it for: how fast are my sites? Scores, hit ratio, and traffic lead the page.

Design

Improved The account app wears the plugin's redesign-v2 skin — the muted-teal accent, the deep-sea sidebar rail (dark in both themes), paper/panel/line surface tokens, self-hosted Inter + Space Grotesk + JetBrains Mono, 12px cards and pill badges. Every colour rides a CSS variable, so light and dark stay correct without per-class dark variants.

Overview

Improved Overview is now a fleet performance dashboard. One site gets a hero — big PageSpeed-style mobile + desktop score rings (Lighthouse's 0–49 / 50–89 / 90–100 bands), hit ratio, 24h requests, cache size, Free/Pro tier badge. Two or more sites get worst-first site cards plus a fleet stat strip (average mobile score, sites needing attention, open fixes). Scores come from each site's own stored PSI/GTmetrix runs — the Hub still never spends anyone's audit quota. Recommendations are reframed as "Boost opportunities", driving "N to fix" chips on the site cards.

AI & data

New Sites now report whether xSpeed Pro is active (inferred from the module list the daily pass already fetches) plus 24h hit/miss counts on each snapshot; the fleet endpoint carries them along with the latest stored mobile/desktop scores per site.

New Three read tools on the MCP catalog — get_health (env checks, hourly buckets, 30-day hit-ratio series), get_benchmark_history, and get_score_history — proxied 1:1 to the plugin tools that already exist, so an AI client can answer "how is my site doing" from one call.

Fixed Every module showed "Inactive" in the site detail view. Enabled state lives inside each module's own settings (settings.enabled); the Hub read a top-level enabled key the plugin never sends.

v1.0.4

2026-08-04

Team invitations now work end to end — the accept link, the email, and the invitation message are all fixed.

Teams

Fixed The emailed invitation link now lands on the accept screen instead of dropping the invitee on their own dashboard with the invitation still pending.

Fixed The invited email address now prefills on the sign-in screen.

Fixed Invitations now name the workspace you are being invited to, instead of repeating the owner's email address.

Fixed The logo in every email now renders instead of showing a broken image.

v1.0.3

2026-08-02

Scoped connections — one AI credential no longer means full control of everything — plus a speed-test history per site.

Access Control

New Scoped connection tokens — a connection can be read-only, limited to selected sites, and refused individual tools.

New Per-site access levels — each site is Full access, Read-only, or No access, set as a default plus exceptions so a hundred sites is one decision.

New Edit a live connection's scope without reconnecting — tighten a credential without re-pasting config into every AI client.

Improved Restrictions only ever narrow access: reach is the intersection of the credential's limits and the member's role, and rotating a token preserves its scope.

Fixed A read-only connection is no longer described as full access on the Connect panel.

Reports

New Per-site report history — PageSpeed Insights and GTmetrix runs listed on the site drill-down, with any two comparable side by side across score, LCP, TTFB, FCP, TBT, Speed Index, and CLS.

Fixed A failed audit no longer stores a zero — missing metrics now read as unknown instead of claiming a perfect or catastrophic result.

v1.0.2

2026-07-31

Teams — one account becomes many people with different powers, and the account itself becomes a workspace you can name, create, and delete.

Teams & Workspaces

New Team & multi-user access — invite people as Owner, Admin, or Viewer, at account level and per site, with a Members section for people, roles, and pending invites.

New Roles are enforced everywhere, including the AI surface — a Viewer can read the fleet but cannot change settings, mint tokens, or write through an AI client.

New Workspaces — name, create, switch, and delete accounts, with a switcher in the sidebar.

New Per-site access — restrict a site to specific members for the "this contractor only touches one client" case.

New Profile page and confirmation prompts on every destructive action.

Fixed Loading the Connect page no longer auto-mints an account-wide read+write token — minting is an explicit owner-only action.

Fixed Every AI tool now declares read or write access at registration, so a new write tool can no longer silently inherit write access.

v1.0.1

2026-07-30

Security hardening, a server-authoritative site cap, and a rebuilt deploy pipeline with automatic rollback.

Security & Reliability

Fixed Site tokens are now compared in constant time, closing a timing side-channel.

Fixed The site limit is now server-authoritative, so the add-site form no longer stops at a stale client-side cap.

Improved Releases now ship on a version tag, build in CI rather than on the server, and roll back automatically if the health check fails.

v1.0.0

2026-07-28

Initial release — connect all your WordPress sites running xSpeed Cache and let one AI connection manage caching across the whole fleet.

Fleet Management

New Fleet overview ranking every site worst-first, with health chips and a site drill-down showing live cache status, modules, and trends.

New Remote settings editing, validated against each site's live schema.

New Fleet-wide recommendations center — a ranked next-best-action queue with one-click remote fixes.

AI & Monitoring

New MCP broker — one endpoint, one credential, every connected site reachable from Claude or any MCP-compatible AI client.

New OAuth 2.1 authorization server with per-site token scoping.

New Daily monitoring snapshots with Slack and email alerts, plus an activity audit log across account tool calls.

Hosted service

What is xSpeed Hub?

xSpeed Hub is the hosted companion to the plugin: connect every WordPress site running xSpeed Cache to one free account, monitor the whole fleet from one dashboard, and give your AI assistant a single MCP connection that reaches all of them.

The Hub ships by deploying — versions here record what is live on app.xspeedcache.com, updated for everyone at once.

Open xSpeed Hub

Make your site load in milliseconds.

One switch. Zero bloat. Always free to start.

Try xSpeed Cache ⚡ View pricing