What NitroPack does on your site
NitroPack, published by NitroPack Inc., is not a classic caching plugin: it is the WordPress connector for an online service. After installing it, you create an account on nitropack.io and paste the site’s API key and API secret key into the NitroPack menu. The heavy lifting (building optimized pages, critical CSS, image compression, WebP conversion, minification) happens on NitroPack’s servers, not on your hosting, and your original files stay untouched.
Optimized pages are served by the plugin’s cache, installed as the wp-content/advanced-cache.php file, while images, stylesheets, scripts and fonts go through a built-in CDN that the vendor says is powered by Cloudflare. Inside WordPress, you mostly pick a predefined optimization mode, automatic purging, cache warmup and a few exclusions; most fine-tuning (excluded resources and URLs, custom CSS, delayed scripts) happens in NitroPack’s online dashboard.
The business model is a monthly or annual subscription, priced by site, pageviews and CDN bandwidth. The free plan covers one site with 1,000 pageviews and 1 GB of CDN bandwidth per month, and shows a small NitroPack badge in the footer. According to the pricing page, once the pageview quota is reached, optimizations stop; paid plans allow overages billed at an extra cost.
Which sites NitroPack is a good fit for
- Business sites and blogs whose owners don’t want to tweak anything: one optimization mode is enough to get caching, critical CSS, WebP images and a CDN.
- Sites on modest hosting, since page and image optimization doesn’t use the server’s CPU.
- WooCommerce stores: the account, cart and checkout pages are excluded automatically, and caching for pages with a filled cart (“Cart cache”) is available from the Plus plan up.
NitroPack is a weaker fit for a high-traffic site on a tight budget, because the price follows pageviews, and for anyone who wants all optimization to stay on their own server without an outside account. On a LiteSpeed server, LiteSpeed Cache handles page caching for free; elsewhere, a license such as WP Rocket isn’t tied to a traffic quota. Before choosing, check what caching your host already enforces (see our host and cache compatibility page).
NitroPack strengths and limitations
Strengths
- Processing off your server. Page optimization, critical CSS and image compression are computed by NitroPack, on copies of your files.
- All-in-one with a CDN. Caching, WebP images, lazy loading, minification and a CDN come together, with no extra optimization plugin needed.
- Predefined modes. Standard, Medium, Strong and Ludicrous range from most stable to most aggressive, with no dozens of options to set.
- Test mode. “Test Mode” serves the original site to visitors while you check the optimized version by adding
?testnitro=1to the URL.
Limitations
- Price tied to traffic. Every plan sets a pageview and bandwidth quota; as the site grows, so does the subscription.
- Very limited free plan. 1,000 pageviews per month, a footer badge, no Ludicrous mode and no delayed scripts.
- Depends on an outside service. Without a connected account nothing gets optimized, and fine-tuning happens outside WordPress.
- No object cache. The vendor itself says NitroPack doesn’t replace an object cache such as Redis or Memcached.
- Recurring access control flaws. Several vulnerabilities fixed since 2023 let a mere subscriber change settings.
The NitroPack settings we recommend
All settings below live in the NitroPack menu of your dashboard. Change one setting at a time, purge the cache, then measure the effect on Core Web Vitals rather than on a single score.
| Setting | Recommended value | Why |
|---|---|---|
| Optimization mode NitroPack > Dashboard | “Strong” to start; “Ludicrous” only after testing | Strong balances speed and stability; Ludicrous defers JavaScript and can break menus or forms. It requires at least the Starter plan. |
| Test Mode NitroPack > Dashboard > Basic Settings | On during testing, then off | Visitors see the original site while you test with ?testnitro=1. Purge the cache when you turn it off. |
| Cache warmup NitroPack > Dashboard > Basic Settings | On | Pages are prepared before the first visit instead of waiting for traffic. |
| Purge affected cache when content is updated or published NitroPack > Dashboard > Automated Behavior | On (default) | Without it, an edited page keeps being served in its old version. |
| Page optimization NitroPack > Dashboard > Automated Behavior | The public content types that actually get visits | There’s no point optimizing content nobody views. |
| Shortcodes exclusions NitroPack > Dashboard > Exclusions | Shortcodes with changing content (stock, counters, feeds) | They are then loaded via AJAX and always show current data. |
| HTML Compression NitroPack > Dashboard > Basic Settings | Based on the “Run compression test” result | Most servers already compress with gzip or Brotli; turn it on only if the test finds none. |
| Allow Editors to purge cache NitroPack > Dashboard > Basic Settings | On only if editors publish content | Editors can then clear the cache without an administrator account. |
| Generate Log File NitroPack > System Report | Off; “Minimal (Errors Only)” for the length of a diagnosis | Logs are written to wp-content/uploads/nitropack-logs/; the detailed level fills up fast. |
- Open a page in a private window and check that the response includes the
X-Nitro-Cacheheader. - With
?testnitro=1, test a form, the mobile menu, the cart and the cookie banner before leaving test mode. - Deactivate any other page caching plugin: NitroPack warns you when its
advanced-cache.phpfile has been replaced. - Keep an eye on the pageview counter in the “Subscription” block: NitroPack emails you when a limit is reached.
- Turn on automatic updates for the plugin under Plugins.
NitroPack vulnerabilities and the versions to avoid
- CVE-2024-43922, versions up to 1.16.7: an unauthenticated visitor could trigger arbitrary shortcodes.
- CVE-2024-11848 and CVE-2024-11851, versions up to 1.17.0: due to a missing capability check, a subscriber could change certain options or transients.
- CVE-2025-8778, versions up to 1.18.4: a subscriber could change the compression setting through the
nitropack_set_compression_ajaxfunction. - CVE-2026-39669, versions up to 1.19.3: broken access control of the same kind.
These flaws are fixed in later versions: install the latest one and turn on automatic updates. The ones that need a subscriber account mainly affect sites with open registration (stores, membership areas). WP Masquerade Pro removes the plugin folder from its file URLs and its script IDs, which makes it harder for bots to spot, without replacing the update; the generator tag (see wiping WordPress traces), the X-Nitro-Cache header and the nitrocdn.com URLs, produced by the NitroPack service, stay visible.
What WP Masquerade hides for NitroPack
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to NitroPack: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- text in the cache file
<meta name="generator" content="NitroPack"> - server or cache headers
X-Nitro-Cache - files served by the vendor
*.nitrocdn.com
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
NitroPack frequently asked questions
Is NitroPack free?
There is a free plan with no credit card required, for one site, with 1,000 pageviews and 1 GB of CDN bandwidth per month and a footer badge. Paid plans start with Starter, at $8 per month or $7 per month billed annually.
What happens when the pageview quota runs out?
According to the pricing page, optimizations stop on the free plan. Paid plans include overages billed at an extra cost, which keep the site optimized.
Can I keep WP Rocket or LiteSpeed Cache alongside NitroPack?
Not for page caching: NitroPack asks you to deactivate other page caching plugins. A Redis or Memcached object cache can stay active, though.
My site looks broken after activation. What should I do?
Turn on “Test Mode” to serve the original site, then pick a less aggressive mode (Strong or Medium). If a single resource causes the problem, exclude it from optimization in NitroPack’s online dashboard.
Does NitroPack work with WooCommerce?
Yes. The account, cart and checkout pages are excluded automatically; caching for pages with a filled cart and real-time stock refresh are turned on in Basic Settings, the former from the Plus plan up.