What LiteSpeed Cache does on your site
LiteSpeed Cache is published by LiteSpeed Technologies, the company behind the LiteSpeed web server, OpenLiteSpeed and the QUIC.cloud CDN. It combines two very different sets of features: a page cache handled by the server itself, which automatically purges related pages when you publish or edit content, and a set of optimizations (CSS and JavaScript minification and combining, image lazy loading, WebP and AVIF, database cleanup, Redis or Memcached object caching).
Here is what decides everything: the page cache requires a LiteSpeed server (LiteSpeed Enterprise or OpenLiteSpeed) or the QUIC.cloud CDN. On Apache or Nginx without QUIC.cloud, the official documentation is clear: none of the caching features are available, only the optimizations. And OpenLiteSpeed does not support ESI (personalized fragments inside a cached page), which is reserved for commercial LiteSpeed products and QUIC.cloud.
The plugin is free and open source, with no paid edition. What can cost money are QUIC.cloud services beyond their quota: Critical CSS, Unique CSS (UCSS), viewport images, LQIP, the advanced image optimization queue and Standard CDN bandwidth. QUIC.cloud has announced simplified billing starting November 10, 2026, so check the prices in your QUIC.cloud dashboard before turning on a service.
Which sites LiteSpeed Cache is the right choice for
- Sites hosted on a LiteSpeed server, common on shared hosting: the plugin then drives the server cache directly.
- Stores and membership sites on LiteSpeed Enterprise: private caching for logged-in users and ESI let you cache pages that show a cart or a user name.
- Sites on Apache or Nginx willing to go through QUIC.cloud, which then get page caching at the CDN level.
On Apache or Nginx without QUIC.cloud, you would only use the optimizations: a plugin that builds its own page cache, such as WP Rocket, is a better fit. Never run two page caches at once. And having the plugin installed does not prove the server runs LiteSpeed: ask your host (see our page on hosting and cache compatibility).
LiteSpeed Cache strengths and limitations
Strengths
- Server-level caching. On a LiteSpeed server, cached pages are served without running PHP, with targeted purging of related pages.
- Free all-in-one. Caching, CSS, JavaScript and HTML optimization, images, database and object cache, with no license to buy.
- Private cache and ESI. Pages for logged-in users and personalized fragments can be cached.
- Reversible presets. Applying a preset first backs up your settings, which you can restore from the history.
Limitations
- No caching outside the LiteSpeed ecosystem. On Apache or Nginx, the page cache requires QUIC.cloud.
- Reliance on QUIC.cloud. Critical CSS, UCSS, viewport images, LQIP and image optimization all run on this third-party service, with quotas.
- Crowded interface. Ten menus and dozens of options: it is easy to turn on an optimization without measuring its effect.
- Heavy vulnerability history. Several flaws exploitable without an account, three of them exploited at scale.
The LiteSpeed Cache settings we recommend
Change one setting at a time, click "Purge All", then test in a private window. Measure the effect on Core Web Vitals, not on a single score.
| Setting | Recommended value | Why |
|---|---|---|
| Enable Cache LiteSpeed Cache > Cache > Cache | On with a LiteSpeed server or QUIC.cloud | Anywhere else it has no effect: keep your current cache. |
| "Basic" preset LiteSpeed Cache > Presets > Standard Presets | Starting point; "Advanced (Recommended)" only after testing | "Basic" adds image optimization and mobile caching; "Advanced" already turns on Guest Mode and deferred JavaScript. |
| CSS Minify and JS Minify LiteSpeed Cache > Page Optimization > CSS Settings and JS Settings | On, after checking | Real gain, low risk. |
| CSS Combine and JS Combine Same tabs | Off, unless you measure a gain | The documentation warns they can cause CSS or JavaScript conflicts, especially with a complex theme. |
| Load JS Deferred LiteSpeed Cache > Page Optimization > JS Settings | "Deferred" after testing; "Delayed" only after testing every page type | Delayed mode waits for visitor interaction: forms, menus, cart and cookie banner may stop responding. Exclusions go in the Tuning tab. |
| Lazy Load Images LiteSpeed Cache > Page Optimization > Media Settings | On, with the above-the-fold image excluded | Exclude the main image in the Media Excludes tab so it is not displayed late. |
| Guest Mode LiteSpeed Cache > General > General Settings | Off, unless you have a tested need | Extra cache varies, default content shown briefly (language, prices), QUIC.cloud quota used. |
| Crawler LiteSpeed Cache > Crawler > Settings | Off (the default) on shared hosting | It must be allowed at the server level and loads the machine; if it runs, set the "Server Load Limit". |
| Debug Log LiteSpeed Cache > Toolbox > Debug Settings | Off in production; "Admin IP Only" during a diagnosis | An exposed log let attackers steal sessions (CVE-2024-44000), and it fills the disk quickly. |
- Reload a page in a private window: the
x-litespeed-cache: hitresponse header should appear on the second visit. - After each optimization, test a form, the mobile menu, the cart and the cookie banner.
- Check that no other page cache plugin is active.
- Turn on automatic updates for the plugin, in Plugins or with "Automatically Upgrade" (General > General Settings, which relies on WP-Cron).
LiteSpeed Cache vulnerabilities and the version to run
- CVE-2023-40000, fixed in 5.7.0.1: unauthenticated stored XSS, exploited in spring 2024 to create administrators named
wpsupp-userorwp-configuseron outdated sites. - CVE-2024-28000, fixed in 6.4 (CVSS 9.8): the user simulation hash could be brute-forced to create an administrator without an account; attacks began as soon as it was disclosed in August 2024.
- CVE-2024-44000, fixed in 6.5.0.1 (CVSS 9.8): the publicly readable debug log contained users’ session cookies.
- CVE-2026-113499 and CVE-2026-113500, fixed in 7.9.2: a single published comment could inject script when CDN rewriting or Font Display Optimization was on (see the two XSS flaws fixed in 7.9.2).
Run at least 7.9.2 and turn on automatic updates. The full timeline is in our history of LiteSpeed Cache vulnerabilities. WP Masquerade removes the HTML comment the plugin adds to your pages, which makes it harder for bots targeting these flaws to spot it, but never replaces updating.
What WP Masquerade hides for LiteSpeed Cache
Free version Handled by the free version of WP Masquerade
LiteSpeed Cache is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- signed HTML comments
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- server or cache headers
X-LiteSpeed-Cache
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
LiteSpeed Cache frequently asked questions
Does LiteSpeed Cache work on Apache or Nginx hosting?
Yes for the optimizations (CSS, JavaScript, images, database), no for the page cache. Without a LiteSpeed server, the site has to go through the QUIC.cloud CDN.
Do I need a QUIC.cloud account?
Not for caching on a LiteSpeed server. Services are turned on in General > Online Services; the standard image optimization queue is free without an account, but you need one to buy more quota.
Can I keep WP Rocket or another cache plugin?
Not for page caching: only one should be active. An object cache or browser cache can coexist; for optimizations, turn each feature on in only one of the two plugins.
My site looks broken after an optimization. What should I do?
Compare with "View Site Before Optimization" (Toolbox > Debug Settings), turn off the last setting you changed, then click "Purge All". If a single file is the problem, exclude it in the Tuning tab.