What Breeze does on your site
Breeze is the caching plugin built by Cloudways, the managed WordPress host, and listed on wordpress.org as Breeze Cache. At its core is a file-based page cache: on the first visit, the plugin saves the HTML WordPress generates, then serves it to the next visitors through the advanced-cache.php drop-in, which loads before the rest of WordPress. By default the cache is cleared every 1,440 minutes (one day) and whenever you publish or edit content.
On top of that cache, Breeze adds Gzip compression and browser caching (written to the .htaccess file), HTML, CSS and JavaScript minification, lazy loading for images, iframes and videos, delayed JavaScript, font and link preloading, database cleanup, Heartbeat API control, CDN URL rewriting and local hosting of Google Fonts. On a Cloudways server, it also purges Varnish every time you publish.
The plugin is free, with no paid tier or billed add-on, and its code is released under the GPL. Settings live under Settings > Breeze, split across about ten tabs, and a Breeze menu in the admin bar lets you clear the cache.
Which sites Breeze is a good fit for
- Sites hosted on Cloudways: Breeze drives Varnish, which comes preinstalled on those servers, with no setup at all, and the Cloudways community forum answers questions.
- Blogs and brochure sites on Apache that want a free page cache and cautious defaults, without signing up for a third-party service.
- Multisite networks: settings are managed at the network level, and each site can inherit them or use its own.
It is not the best pick on a LiteSpeed server, where the server vendor’s own plugin handles a more efficient cache, or if you want advanced optimizations and dedicated support: a paid plugin such as WP Rocket goes further there. On Nginx, Gzip and browser caching depend on the server configuration, not on Breeze (see our host and cache compatibility page). As with any caching plugin, keep only one active.
Breeze strengths and limitations
Strengths
- Completely free. No feature locked behind a paid version, no external service quota.
- Cautious defaults. On install, caching, Gzip and browser caching are on, while all minification and delayed JavaScript stay off.
- Reversible one-click optimization. Three levels (Standard, Advanced, Expert) apply with one button, and "Restore Previous Settings" brings back what you had.
- Varnish and Cloudflare integration on Cloudways. Automatic Varnish purging and purge menus in the admin bar.
- Settings import and export. A JSON file lets you copy the configuration to another site.
Limitations
- Built for Cloudways first. On other hosts, Varnish and the built-in Cloudflare purge do nothing, and Gzip and browser caching rely on Apache.
- Fewer optimizations than paid plugins. No critical CSS and no unused CSS removal, unlike WP Rocket.
- A run of flaws fixed in 2026. Several were exploitable without an account, including an arbitrary file upload rated 10 out of 10.
- Limited support for non-customers. The wordpress.org forum for everyone, the Cloudways community for its customers.
The Breeze settings we recommend
Change one setting at a time, clear the cache with "Purge All Cache" in the admin bar, then test in a private window. The plugin itself recommends testing any minification on a staging copy before going live. Measure the effect on Core Web Vitals, not on a single score.
| Setting | Recommended value | Why |
|---|---|---|
| Cache System Settings > Breeze > Basic Options | On (default) | This is the page cache itself; deactivate any other caching plugin first. |
| Cache Logged-in Users Settings > Breeze > Basic Options | No role checked (default) | Pages for logged-in users are personalized; this setting was the precondition for CVE-2026-2128. |
| Mobile Cache Settings > Breeze > Basic Options | Off with a responsive theme | The plugin advises turning it on only with a dedicated mobile theme or plugin. |
| Gzip Compression and Browser Cache Settings > Breeze > Basic Options | On, on Apache | They write rules to .htaccess; on Nginx, ask your host whether compression is enabled. |
| HTML Minify, CSS Minify, JS Minify Settings > Breeze > File Optimization | On, one at a time, after testing | The plugin warns that minification can break the front end; JavaScript is the riskiest. |
| Combine CSS and Combine JS Settings > Breeze > File Optimization | Off unless you measure a gain | Merging files multiplies conflicts for a gain that is often small. |
| Delay All JavaScript Settings > Breeze > File Optimization | Off (default); if tested, add exclusions to "List of scripts not to delay" | Menus, forms and the cookie banner may wait for a visitor action; do not combine it with "Delay JS Inline Scripts". |
| Host Files Locally > Gravatars Settings > Breeze > Advanced Options | Off (default) unless needed | This option was the precondition for CVE-2026-3844; Google Fonts alone is usually enough. |
| Never Cache URL(s) Settings > Breeze > Advanced Options | Personalized pages Breeze does not detect (member area, token pages) | A page unique to each visitor should never be served from cache. |
- Open a page in a private window and reload it: the page source should end with the
Cache served by breeze CACHEcomment. - After each optimization, test a form, the mobile menu, the cart and the cookie banner.
- Export your settings (Tools tab, "Download Settings") before trying a one-click optimization level.
- Turn on automatic updates for Breeze on the Plugins screen.
Breeze vulnerabilities and the version to run
- CVE-2026-3844, fixed in 2.4.5 (CVSS 10 according to Patchstack): unauthenticated arbitrary file upload that could lead to code execution, when the Gravatars option of Host Files Locally was enabled.
- CVE-2026-2128, fixed in 2.5.3: with Cache Logged-in Users enabled, a forged login cookie could read another user’s cached page.
- CVE-2026-73356, fixed in 2.5.13: unauthenticated arbitrary content deletion, fixed in the same release as CVE-2026-79706 (file creation outside the cache folder).
- CVE-2026-79713, fixed in 2.5.15: cache poisoning through tracking parameters left out of the cache key; a page crafted by an attacker could be served to every visitor.
Run at least 2.5.15, ideally the latest version, and turn on automatic updates (our guide to automatic plugin updates explains how to do it without breaking things). WP Masquerade Pro renames the plugin folder and its file identifiers in your page code, which makes the plugin harder to spot for bots targeting its flaws, without replacing the update; the HTML comment on cached pages and the X-Breeze-Cache-Write header stay visible.
What WP Masquerade hides for Breeze
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Breeze: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- text in the cache file
Cache served by breeze CACHE - server or cache headers
X-Breeze-Cache-Write
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Breeze frequently asked questions
Does Breeze work outside Cloudways?
Yes. The page cache, minification, lazy loading and database cleanup work with any host. Only the Varnish integration and the built-in Cloudflare purge depend on Cloudways infrastructure.
Is Breeze compatible with WooCommerce?
Yes, the vendor describes it as compatible with no special configuration. Still test the cart and checkout after each optimization, and leave every role unchecked in Cache Logged-in Users.
Can I keep another caching plugin alongside Breeze?
Not for page caching: the vendor strongly advises against running two caching plugins at once. Deactivate the old one before activating Breeze.
My site looks broken after a one-click optimization. What now?
Open the One-Click Optimization tab, click "Restore Previous Settings", then clear the cache. Turn options back on one at a time to find the one that breaks the layout.