What's new in xSpeed Cache

Combine CSS now works on Flywheel and Bedrock installs, Elementor Pro sticky headers stick under Delay JS, and a failed pass on the finished page can no longer cache an empty page.

Cloudflare Enterprise setup now runs in four short steps, and the add-on's offer opens its page in the dashboard, shows with any version of Pro, and goes away once the add-on is bought.

Saving a post now clears only the pages it changes instead of the whole cache, sites on xCloud's Cloudflare Enterprise get every purge passed to the edge, and pages whose address uses non-Latin characters are cached and purged correctly.

Pages with a background-video hero now paint the hero text first, Load CSS Asynchronously no longer makes pages flash unstyled, sites in a multisite network stop sharing cached REST responses, and a site whose token changed can reconnect to xSpeed Hub.

Smart Delay postpones the scripts other delay modes had to leave running, LCP background images and video posters are preloaded, LiteSpeed servers get the same static fast path nginx and Apache already had, lightbox videos open with their player instead of a blank window, and Turbo Render no longer clips designs that overlap their neighbours. Emojis can be switched off, post revisions capped, and inline background images held back until they scroll into view.

Consent banners now survive Delay JS on every site that ships one, Turbo Render works on any theme rather than only Elementor, JS-injected YouTube/Vimeo embeds load only on click, and nginx sites are no longer told to fix a configuration that was already correct.

Consent-manager scripts marked late are now always left alone, below-fold sections skip rendering work until they are needed, and xSpeed's MCP server shares a site cleanly with other MCP plugins.

Consent gets a dashboard home, the cache engine learns to leave non-HTML alone, and uncacheable pages now tell the CDN so.

Purging is now a contract other caches can join: clearing xSpeed's page cache also invalidates LiteSpeed Cache and the host's nginx FastCGI cache, and every purge is scoped to exactly the site and pages it was asked for — including on multisite.

Purge all now says what it actually cleared, on the button and in the toast, instead of claiming success when a store refused. Pro features are marked with one lock everywhere rather than amber squares and crowns, which also lifts the dimmed labels back to readable contrast. The Cloudflare panel is staged by connection state, so setup comes before the actions that depend on it — and the auto-purge switch is visible while disconnected instead of hidden.

A single page can now be purged straight from the admin bar, the post list or the editor, and known third-party scripts — analytics, chat widgets, tracking pixels — are delayed automatically without asking you to list them. A host or agency can pin any setting from wp-config.php with a constant: the dashboard shows the pin, names the constant, and lets an admin take the setting back. xSpeed can also take over an abandoned page-cache drop-in, with your consent, instead of being blocked by it forever.

The Overview now reports what is actually switched on, counted from the server rather than guessed from the payload, and a new xSpeed Scan grades the site from inside the plugin. Pages carrying a security token can use the fast static path again instead of silently falling back, and nginx users can now fetch their server config from the command line.

xSpeed now recognises which plugin owns the page cache and refuses to take it, so installing beside WP Rocket, WP Super Cache or LiteSpeed no longer switches thirteen features on behind you or leaves two page caches competing. Switching caching on is now all-or-nothing, so a half-finished attempt can no longer leave a site with a broken wp-config.php. Combining CSS no longer strips a site's styles when Critical CSS is on, and page builders can be edited again.

Forms on cached pages stop being rejected, because a page is no longer served for longer than the security token it carries. Stores keep their cache through orders and reviews while price and stock changes actually clear it, the cache lifetime you configure is finally the one enforced, and the AI tools can no longer delete content without showing you what they found first.

Self-hosted videos no longer download in full before anyone presses play, the autopilot now undoes a change that makes the site slower instead of calling it verified, and the diagnosis finally reports the content problems it was measuring all along.

One command now measures your site, applies the settings that help, and undoes anything that breaks. Four cache-poisoning routes are closed, importing from W3 Total Cache carries settings across faithfully instead of a handful, and combined JavaScript keeps running in the order the page expects.

Importing settings from another caching plugin no longer switches that plugin off without asking. Purging CSS or JavaScript now also clears the pages that link them, a failed save no longer reports success, and another MCP plugin's AI connections keep working alongside xSpeed.

On a multisite network, a change to one site no longer wipes every other site's cache. Cache cleanup no longer deletes stylesheets a live page is still using, and a consent banner styled by another plugin stays styled.

A search-results page could be cached and served as your home page. Combining CSS no longer strips a site's styling, Pro settings can no longer be changed without an active licence, and an AI assistant now reports this site's tier and audits the page you actually asked for.

AI assistants can change your settings again, and the cache preloader works on sites without a readable sitemap.

Stored credentials are now encrypted, exclusions are enforced by the server itself, and the cache cleans up after itself.

A redesigned dashboard, a homepage cache-poisoning fix, and caching that survives a plugin update.

A new Overview dashboard, click-to-play video embeds, and a full audit trail for AI actions.

Actionable dashboard insights, richer AI tooling, and smarter health detection.

New xSpeed Hub. Connect one AI assistant to manage caching across all your sites.

Redesigned dashboard navigation, improved settings experience, and caching reliability fixes.

MCP support for AI assistants, LCP optimization, and admin experience improvements.

Improved reliability, granular cache management, Redis compatibility, and asset optimization fixes.

New caching surfaces, conditional settings, Pro warming features, and a large round of QA fixes.

Migration into Free, white-label onboarding, LiteSpeed cache ownership & accurate hit counting.

One-click object cache, parity exclusions & admin polish.

Topology-aware UX, nginx HIT counting, admin polish.

Static-rewrite cache, Site Health & Fonts.

Foundation release, full feature set + Pro hooks.

Initial release.

A failed image pass no longer serves an empty page, and each cache miss reads far less stored page data.

Cloudflare Enterprise setup is now four short steps with a card for each DNS record, opens right after activation, and waits for an active Pro licence.

Cloudflare Enterprise arrives as an add-on: the site's pages are served and purged from Cloudflare's enterprise edge, set up from one panel in wp-admin. Measured hero images are preloaded per device, and a phone copy counts as warm only once it is cached.

Critical CSS is smaller and says when it is still large, collapsed elements in the first screen stay in the fold, and deactivating Pro no longer switches off Free's features.

Critical CSS now takes effect the day it is measured instead of waiting for visitor confirmation, fold blobs carry only the font variants the fold uses, and Unused CSS can no longer be poisoned by a cache answering the generator with an already-optimized page. SmartPredict now sets how WordPress prefetches or prerenders the next page.

The AI Provider card now says what the API key is actually for, and that connecting Claude does not need one.

Critical CSS is built per template from validated requests only, licensing reads the right key, and Cloudflare APO tells "not connected" apart from "refused".

The CSS pipeline stops wasting renders — and the edge waits until a page is actually finished being optimized.

Critical CSS generation heals itself when a run's files go missing, and small stylesheets are no longer held back while the fold is unconfirmed.

The front-end beacons are minified at build time instead of shipping as source, cutting what every visitor downloads on an uncached page view from 29.9 KB to 8.7 KB. A Cloudflare APO panel that has not been set up yet reads as a setup step rather than an error, and Pro panels render correctly in dark mode again.

Critical CSS now builds itself, the way Unused CSS already does, and both use the fold a real browser measured instead of counting opening tags. Licensed installs generate in the cloud first and say so when the cloud fails, rather than silently falling back to a local build. Converted images that came out larger than the original are no longer kept or served.

Unused CSS no longer waits on Critical CSS to defer, so the two features stop blocking each other, and Critical CSS now fits the fold to its budget instead of refusing outright. The AI provider catalogue covers current model generations.

Every Pro AI feature works again. The API key was being sent to the provider still encrypted, so all four providers rejected it. Critical CSS and Unused CSS now take effect the moment you clear them, keep the files you uploaded through automatic rebuilds, and can no longer be generated or stored on a site without a licence.

Brotli-compressed pages are now written for both cache paths and published atomically, so a compressed page can no longer arrive half-written, and cached pages carry the Pro version alongside Free's.

Unused CSS is now measured in a real browser instead of inferred, the external generator endpoint is gone, and an incomplete Pro folder no longer takes every request down with it.

Requires xSpeed 1.2.0 or later. A security fix for stored CSS that could break out of the block it is inlined into, and the Apply button on a Pro recommendation now works. Unused CSS no longer strips stylesheets it should have left alone, and CSS entries are keyed per page rather than shared across pages that only differ by query string.

A security release. The Real User Monitoring endpoint and the predictive tracker were both open to anonymous callers with no bound on what they could store, network-wide multisite settings could be changed by a single site's administrator, and the licensing library carried an update-channel exposure.

Predictive warming now recognises pages that are already cached, instead of re-warming the same ones on every run.

Pro settings are no longer writable on a site whose licence has lapsed, a PageSpeed run from an assistant is finally recorded, and Pro toggles are keyboard-navigable again.

Edits are no longer lost while a panel saves, failed image conversions are counted, and the Brotli snippet reaches the nginx users who need it.

Unused-CSS removal now works out of the box, and a fatal-error fix for sites running the latest Free release.

Image-wrapping and licensing fixes, plus more reliable real-user metrics.

License activation now connects to the production WPDeveloper store.

Maintenance release with build and release process improvements.

Bulk image optimization, AI integration, and licensing improvements.

Maintenance release with image delivery, cache purge, and migration improvements.

Initial release of xSpeed Cache Pro. Built as an add-on for xSpeed Cache Free, installs alongside Free and layers 25+ Pro modules into the same dashboard, gated by a single license.

Google One Tap on the website. xspeedcache.com can show Google's prompt to signed-out visitors and sign them in to their Hub account, through two new website-session endpoints with the same checks as the app's One Tap. The website's origin must be an authorized JavaScript origin on the Google client.

Google One Tap sign-in. A browser already signed in to Google sees Google's "Continue as …" prompt on the sign-in page, and one click signs in, or creates the account the first time. Two-factor still applies. The hub verifies the ID token's signature against Google's keys and binds it to a single-use nonce. `GOOGLE_ONE_TAP=off` hides the prompt.

Each DNS provider's own how-to link. `dns_provider` carries `help_url`, the provider's page on adding a DNS record, for the providers whose page we could open. The plugin and the Cloudflare Enterprise tab show it beside the DNS settings link, with the setup guide.

xCloud's visitor rate limit is switched off. xCloud enables it on every domain, and it challenged the Hub's own calls to a site's `/wp-json`. The Hub now writes `rate_limiting: false` on every domain it holds, in the same settings write as the cache lifetime mode. `XCLOUD_CFE_RATE_LIMITING_OFF=0` stops it.

The staff console has its own sign-in, and a second factor is required. Being signed in to the account app no longer opens the console. Staff ask for a sign-in link on the console (10 minutes, one use, and the same answer whether or not the address is staff), then confirm with a staff passkey, an authenticator app code or a recovery code; a staff passkey alone also signs in. Anyone without a factor, break-glass superadmins included, must add one before anything else and gets 10 recovery codes, shown once. The console session is its own cookie (`__Host-`, HttpOnly, SameSite=Strict), ends after 12 hours or 30 idle minutes, and gets a new id at every second factor. Wrong codes lock after five tries, for longer each time. Every state-changing console request must come from the console's origin. Adding or removing a factor needs a second factor from the last 10 minutes; deletions and impersonation from the last 30. Removing someone's staff access or changing their role ends their console sessions. Sign-ins, factor changes and used recovery codes are in the audit log, and factor changes and used recovery codes ring the bell for the person and for superadmins. The Profile page has a Security card for passkeys, the authenticator, recovery codes and console sessions. Set `XSPEED_HUB_ADMIN_URL` before deploying; a lost factor is reset on the box with `dist/ops/admin-auth-cli.js`. See [admin-auth](docs/architecture/admin-auth.md).

A smoke test runs after each release. When a push to `main` creates a new version, and after each dev deploy, a test account signs in, connects a test site, reads it, turns a setting on and off, approves an assistant and makes an MCP call, then removes the site and connects it again. The result goes to the run summary, and as a comment on the pull request merged into `main`, or, when there is none, on the most recent merged pull request that contains the commit. `npm run release:check` is the one local gate to run on `dev` before a release.

A site whose token changed reconnects by itself. Rotate, Disconnect then Connect, or a reinstall gave the site a new token the Hub never learned, so every check failed until the site was attached again. The site now sends its new token to the Hub, which checks it before keeping it. A live `.dev` site is no longer taken for a local one, and the daily check tries a failed site once more before calling it unreachable.

Render capacity is measured, not configured. The render box now reports, on every answer, how many more renders it can take from its load average and free memory, and the Hub sends that many and queues the rest. The fixed three-at-a-time worker, the 120-an-hour and 500-a-day per-site caps, one render per site at a time, and the 2–10 s pause between a site's renders are gone; the caps and the pause stay as settings, off. Nothing is refused for lack of room. See [ADR 1](docs/adr/0001-render-capacity-is-measured.md).

Sites that block anonymous REST can now attach and be controlled. Verify and the tool proxy reached sites only over `/wp-json/xspeed/v1/mcp`, which a security plugin's "restrict REST API" setting 401s for every anonymous request — so a valid token was reported as "rejected" and such sites could never attach. Verify now probes the plugin's own `/xspeed/mcp` endpoint first (REST stays the plain-permalink fallback), a REST-gate 401 is reported honestly with the setting to change, and proxied tool calls retry over JSON-RPC on the pretty endpoint. (#214)

Render history survives deploys. Every render the Hub asks for is now recorded in Postgres (`ucss_render_log`), and the admin console's Renderer tab reads from it: a deploy no longer wipes the recent-renders table, and a new "Load older renders" control pages back through the whole history, however old. A Hub without a database keeps the previous in-memory behaviour. (#205)

Renderer monitoring in the admin console. — a new System → Renderer tab shows the UCSS renderer's graded health, render counters (failure rate, in-flight depth, p50/p90/max durations) and its access-log traffic history, via `GET /admin/renderer`; the system-alert poll now also watches the renderer and posts edge-triggered up/down lines to the operator channel. The tab also lists the recent renders — which URLs were measured, with outcome and duration — so staff can verify the right pages are being rendered, not just that rendering works.

"Last seen" now reflects real activity, not just the nightly check. — every successful proxied call to a site (an MCP tool, a dashboard action, a report sync) touches the site's `last_seen_at`, debounced to at most one write per site per five minutes, and refreshes `plugin_version` when the site reports one. Previously both were only written by the daily re-verify, so an actively used site could show "Last seen 20h ago" and a freshly upgraded plugin kept its old version on the Overview card for up to a day.

The UCSS renderer no longer navigates away from the page it is measuring and

Staff can now sign in as a customer to debug a ticket — time-boxed, read-only

Password login joins Google and the magic link, the sign-in mail path stops

The UCSS/CCSS renderer can now run on our own server instead of only Cloud Run.

A structural release. Nothing about the Hub behaves differently for anyone using

Critical CSS can now be generated from the Hub. The new `generate_critical_css` tool builds a site's above-the-fold CSS and stores it, so the first screen paints without waiting for the full stylesheets — the fix for a site whose LCP is slow because its stylesheets are still render-blocking. Previously this was reachable only from the site's own MCP connection or WP-CLI. The site applies the blob on its next page build, so purge the cache afterwards.

The rendering service now measures the fold, so Critical CSS can use it too. `POST /site/ucss/measure` already answered which selectors a page uses; it now also returns `critical` — the selectors painting in the first screenful, unioned across a 390&times;844 phone and a 1280&times;900 desktop. Critical CSS had no browser to ask, so it approximated the viewport by taking the first N opening tags of `<body>`: an ordinal count standing in for a layout fact. Whether a rule paints above the fold is a layout fact, and now something measures it.

Unlisted scan reports are labelled in a site's report history. A site connected to the Hub asks the scan engine to keep its reports out of the public directory, and the Hub is the one place its owner still sees them — so the table says which rows are unlisted, and the note says what that does and does not promise: the report link still works for anyone it is shared with, so it is a secret link rather than a private page.

Unused CSS is now measured in a real browser, not guessed from HTML. Pruning read the served markup, which cannot show what a page uses *after* someone interacts with it: a class JavaScript adds on click is absent from the markup in exactly the way a class no element ever carries is absent. A live pricing toggle broke on that — the rules that slide its knob and hide its inactive pane were pruned, leaving both panes showing and a dead switch. Three static heuristics were measured against the real stylesheet before this: each either lost a state or put ~40 KB of genuinely dead CSS back, because a state class and an unused widget variant are the same shape in HTML. `POST /site/ucss/measure` loads the page in Chromium, drives its own controls, and returns every selector used in either state. On the page that surfaced this it recovers all three broken rules for seven extra selectors out of 1772.

The in-Hub scan report now matches the xSpeed Scan report exactly. It leads with the site — favicon, host and the full-size score ring — instead of a bare grade, shows the page as the scanner saw it in both desktop and mobile with click-to-zoom, and carries the report's own section bar, dimension panels (grade chip, checks-passed count, points earned) and scan history. The acquisition blocks the public page carries are deliberately left out: whoever is reading this already owns the site and already has their Hub connection.

A report opens over the reports list instead of replacing it. Reading one is a look, not a departure: the list stays behind the dialog, so closing a report returns you to it with its device filter and comparison selection intact rather than reloading the tab. The report keeps its own URL, so it is still reloadable, still linkable, and the back button still closes it rather than leaving the site.

Scan reports open inside the Hub. A scan result used to be a link that took you to xspeedcache.com; the grade, the four dimension scores, every check with its evidence and fix, and the screenshot now render on their own page in the Reports tab. The report keeps a shareable link and a Markdown twin for anyone who wants the public page, but reading your own site's report no longer means leaving the dashboard.

Full website reports, unified with xSpeed Scan. The Reports tab gains a "Full website report" card and the MCP catalog gains `run_speed_scan` / `get_speed_scan`: both queue the same graded scan engine that powers xspeedcache.com/scan (server probes + Lighthouse, four dimensions, every failing check ranked with its fix) and hand back the shareable report page. The website stays the single store of reports, so runs started from the Hub, the public /scan page, or a report's Re-scan button all land in one per-site history.

Autopilot now measures what it applied — and undoes a change that made the site slower. Each pass with something to apply takes a median-of-three uncached render-time baseline (the site measures itself, so Hub-side network variance never enters the number), re-measures after applying, and automatically replays the stored undo when the median regresses past both noise floors (30% and 150ms). Verdicts — better / unchanged / worse / unknown, with medians and spreads — land in the activity log, an unmeasured pass never triggers a blind revert, and a rule whose last application on a site was undone (by the measurement or by a person) is vetoed from re-applying automatically until someone applies it by hand.

One AI connection can span several workspaces. An MCP connection used to be welded to the workspace it was created in — a member of three workspaces needed three connections, and the AI could never see past the one it was born into. Every site-scoped tool now takes an optional `workspace` argument, and `list_workspaces` shows which workspaces you belong to and what you are in each. Say "switch to Acme" and the assistant keeps working there, the same way it already stays on one site across follow-up questions.

Owners can rename a workspace. Renaming was built everywhere except where anyone could reach it: the endpoint, the repo method and the client's `renameWorkspace` all shipped and worked, and nothing ever called the last one. So a workspace name was permanent once set, while the create dialog promised "You can rename it any time."

One press of Analyze now measures mobile and desktop in the background, and a notification bell, a snackbar and the browser tab itself tell you when the result lands. Newly attached sites are measured on arrival, and "Purge all" is on every screen.

The Hub now tells you when a site got slower, not just when a setting got turned off. Alerting watched three things — a site going unreachable, the cache being switched off, and the hit ratio falling through the floor — all of which describe configuration. A site could stay reachable, cached and healthy on every one of those and still have doubled its load time after a theme update, and nothing said a word. Performance regressions are now their own rules, over the report history already synced each day: the score, LCP, TBT, CLS and TTFB are each compared against a trailing median of recent runs, and a meaningful move in the wrong direction raises an alert down the existing Slack and email channels. Off until switched on per account.

"Make my site fast" is now a single call that measures, applies one change at a time, and puts back anything that broke the page. The Overview shows what each score could reach and what is already going well, and speed tests started from an assistant actually run.

Settings edits save themselves and survive a reload, each settings group is its own searchable page, and an AI assistant can finally run a speed test, not just read old ones.

Run a PageSpeed audit from the Hub on the device you choose, let your AI purge Cloudflare and diagnose the object cache, and find any setting in a grouped, searchable Settings tab.

One AI request now reaches the whole fleet, each site page carries its own Pro audit with one-click fixes, modules toggle straight from the site overview, and the Hub picks up the finalised xSpeed mark.

The Overview becomes a fleet command center, a fleet-average score hero, an Apply-all button, and a worst-first site leaderboard.

Run a GTmetrix test on any site straight from the Hub, and every site now opens as its own linkable page.

Overview reads clearly before your sites have any speed tests, and a connected AI client no longer fills the page with setup instructions you've already used.

The account app now looks like the plugin, and the Overview answers the question people open it for: how fast are my sites? Scores, hit ratio, and traffic lead the page.

Team invitations now work end to end, the accept link, the email, and the invitation message are all fixed.

Scoped connections, one AI credential no longer means full control of everything, plus a speed-test history per site.

Teams. One account becomes many people with different powers, and the account itself becomes a workspace you can name, create, and delete.

Security hardening, a server-authoritative site cap, and a rebuilt deploy pipeline with automatic rollback.

Initial release. Connect all your WordPress sites running xSpeed Cache and let one AI connection manage caching across the whole fleet.