---
title: "Autoptimize"
description: "Autoptimize: what it optimizes (CSS, JS, HTML, images), why you still need a page cache, safe settings, Pro pricing and patched vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/autoptimize/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T20:59:05+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/autoptimize/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/autoptimize/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/autoptimize/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/autoptimize/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/autoptimize/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/autoptimize/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/autoptimize/index.md"
---

# Autoptimize

Autoptimize minifies and defers WordPress CSS, JavaScript and HTML, but it does not cache pages. Our take, what the Pro version adds, the safe settings that keep your site from breaking and the patched vulnerabilities you should know about.

## The essentials

- Best for trimming CSS, JavaScript and HTML on a site that already has a page cache.
- Main caveat: the free version has no page caching, so you need your host’s cache or another plugin.
- Free; Pro costs €/$89 a year for one site and adds page caching, images, CDN and automatic critical CSS.

## What Autoptimize does on your site

Autoptimize is a front-end code optimization plugin published by Optimizing Matters. It intercepts each page’s HTML before it is sent, minifies the CSS, JavaScript and HTML, can combine files, and by default defers JavaScript so it no longer blocks rendering. The optimized files are stored in `/wp-content/cache/autoptimize/` and served as static files.

Around that core sit four settings tabs: “JS, CSS & HTML”, “Images” (lazy loading, on-the-fly optimization through ShortPixel’s CDN, WebP and AVIF), “Critical CSS” and “Extra” (Google Fonts, emojis, block CSS, preconnect, preload). The key point: **Autoptimize does not do page caching**. Its own FAQ recommends pairing it with a caching plugin or your host’s cache.

The plugin is free. Autoptimize Pro, a subscription sold on the vendor’s site, adds page caching, near-unlimited image optimization and CDN delivery through ShortPixel, automatically generated critical CSS rules, “Boosters” (delaying JavaScript, iframes or parts of the HTML until the visitor interacts) and a setup wizard.

![Diagram: Autoptimize works on visitors and bots, web server, wordpress. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); file names (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/autoptimize/diagram-en.svg?v=9385aece)

## Which sites Autoptimize suits best

- **Sites that already have a page cache** (from the host, WP Super Cache or Cloudflare) and want leaner CSS and JavaScript without switching tools.
- **Blogs and brochure sites** whose theme loads lots of scripts: deferring JavaScript by default often speeds up the first render.
- **Developers comfortable with code**, who get exclusions, `noptimize` tags and plenty of filters to tune optimization per site.

It is the wrong pick if you want an all-in-one fix for a site with no cache at all: a plugin like [WP Rocket](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-rocket/) bundles caching and optimization. On a LiteSpeed server, [LiteSpeed Cache](https://www.wp-masquerade.com/features/camouflaged-plugins/litespeed-cache/) already handles minification. Turn each optimization on in one plugin only, or you risk broken pages and server errors, as Autoptimize’s FAQ warns.

## Autoptimize strengths and limits

### Strengths

- **Cautious defaults.** JavaScript is minified and deferred without combining, CSS is minified, and cart and checkout pages are left alone.
- **Plays well with most caches.** It only rewrites code, and it clears its own cache when some caching plugins purge theirs.
- **Highly configurable.** Exclusions by file or code snippet, per-post and per-page settings, and hooks for developers.
- **404 fallbacks.** If a cached page requests an optimized file that was deleted, backup CSS or JS limits the damage.

### Limits

- **No page caching in the free version.** You need another plugin, your host’s cache, or Pro.
- **External services for images and critical CSS.** Image optimization runs through ShortPixel with a quota, and automatic critical CSS needs a paid key or Pro.
- **A cache that can balloon.** The plugin never purges its cache on its own, and aggregating inline JS or CSS makes it grow fast.
- **Things can break.** Combining, deferring and exclusions need testing, especially with page builders or jQuery-heavy themes.

## The Autoptimize settings we recommend

You will find everything under Settings > Autoptimize. Change one setting at a time, click “Save Changes and Empty Cache”, clear your page cache too, then test in a private window. Judge the result on [Core Web Vitals](https://www.wp-masquerade.com/glossary/core-web-vitals/), not on a single score.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Optimize JavaScript Code?**  Settings > Autoptimize > JS, CSS & HTML | On, with “Do not aggregate but defer?” | That is the default on new installs: minified, non-blocking JS without one giant file. |
| **Aggregate JS-files?** and **Aggregate CSS-files?**  Same tab | Off unless you measure a gain | With HTTP/2 the vendor no longer turns them on by default, and combining breaks scripts more often. |
| **Also aggregate inline JS?**  Same tab | Off | The FAQ advises against it because it makes the cache grow very quickly. |
| **Optimize CSS Code?** and **Optimize HTML Code?**  Same tab | On | Real gain, low risk; check the layout after enabling them. |
| **Eliminate render-blocking CSS?**  Same tab | Only with reliable critical CSS | Without matching critical CSS, the page flashes unstyled for a moment. |
| **Also optimize shop cart/ checkout?**  Same tab, Misc Options | Off (default) | The FAQ says to turn it off if checkout or payment stops working. |
| **Also optimize for logged in editors/ administrators?**  Same tab, Misc Options | Off if you use a page builder | The FAQ recommends this for Visual Composer, Beaver Builder and similar builders. |
| **Enable 404 fallbacks?**  Same tab, Misc Options | On (default) | Prevents an unstyled page when a page cache requests a deleted file. |
| **Lazy-load images?**  Settings > Autoptimize > Images | On, sparing the first images | Set “Lazy-load from nth image” so the hero image is not delayed, and do not enable lazy loading in another plugin as well. |

- Compare a page with and without `?ao_noptimize=1` appended to the URL: the difference shows what Autoptimize changes.
- Test a form, the mobile menu, the cart and the cookie banner after every change.
- Make sure no other plugin already minifies CSS, JavaScript or HTML.
- Keep an eye on the cache size shown in the “JS, CSS & HTML” tab: steady growth points to code that changes on every page.

## Autoptimize vulnerabilities and the version to run

Autoptimize rewrites the HTML of every page, so an escaping mistake can turn into an [XSS vulnerability](https://www.wp-masquerade.com/glossary/xss/). The recent fixes worth knowing:

- **CVE-2026-3220, fixed in 3.1.15**: unauthenticated stored XSS caused by the predictable placeholder used during HTML minification; other plugins shipping the same library were affected too.
- **CVE-2026-2430, fixed in 3.1.15**: a Contributor could inject script through the attributes of lazy-loaded images.
- **CVE-2026-14995 and CVE-2026-78471, fixed in 3.1.16**: unauthenticated XSS, the first when critical CSS is active with an API key, the second under rarer conditions tied to image lazy loading.
- **CVE-2021-24377, fixed in 2.7.8**: a race condition in the settings import allowed code execution from an administrator account.

Run the latest version (3.1.17 also hardens Google Fonts optimization) and turn on automatic updates, following our guide to automatic plugin updates. WP Masquerade Pro strips the HTML comments Autoptimize can leave in your pages (see [removing the HTML comments that give WordPress away](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)), which makes the plugin harder for bots to spot, without replacing updates; Pro also renames the `/wp-content/cache/autoptimize/` folder, but the `autoptimize_*` file names stay visible.

## Autoptimize FAQ

**Does Autoptimize replace a caching plugin?**

No, the free version does not cache pages. Pair it with your host’s cache or a caching plugin whose minification you switch off. Autoptimize Pro adds page caching.

**My site looks broken after activation. What now?**

Turn off JavaScript optimization alone, then CSS optimization, to find the culprit. Then exclude the offending file under “Exclude scripts from Autoptimize:” and clear both the Autoptimize cache and your page cache.

**Why does the Autoptimize cache keep growing?**

The plugin does not purge its cache by itself, so it won’t break pages still cached elsewhere. Fast growth almost always comes from aggregated inline code: turn off aggregation of inline JS and CSS.

**Does image optimization work on a protected site?**

No. ShortPixel’s service must be able to download your images, so a local site, password protection, a firewall or hotlink protection will block it.

## Key facts

- Category: Cache and performance
- Vendor: Optimizing Matters
- Price: Free; Autoptimize Pro costs €/$89 per year or €/$12.99 per month for one site, €/$379 per year for 5 sites
- Active installations (wordpress.org): 800 000+
- Version: 3.1.17
- Official page: https://wordpress.org/plugins/autoptimize/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: signed HTML comments, folder name, tag IDs, generated-file folders
- Still visible: file names