What WP Fastest Cache does on your site
WP Fastest Cache has been developed by Emre Vona since 2013. It saves every visited page as a static HTML file in wp-content/cache/all/. On Apache, rewrite rules added to your .htaccess file then hand that file straight to the visitor, without running WordPress or querying the database. The cache is cleared when you publish or update content, and a preload feature can build pages ahead of time.
The free version adds a handful of optimizations: HTML and CSS minification, CSS and JavaScript combining, Gzip compression, browser caching and removal of the emoji script. It also handles exclusion rules (pages, cookies, user agents), scheduled cache expiry, URL rewriting for a CDN, Cloudflare and Varnish purging, and cache clearing through WP-CLI.
Everything else belongs to Premium, an add-on plugin sold for a one-time fee: a separate mobile cache, JavaScript minification, deferred or delayed JavaScript, image lazy loading, image optimization and WebP conversion, database cleanup and cache statistics.
Which sites WP Fastest Cache is a good fit for
- Blogs and brochure sites on Apache hosting: a few checkboxes are enough to have the web server deliver static pages.
- Simple WooCommerce stores: the cart, checkout and customer account pages are excluded from the cache automatically.
- Sites behind Cloudflare or a CDN that want a coordinated purge whenever the local cache is cleared.
- Site owners who would rather pay once than subscribe every year for advanced optimizations.
It is a weaker fit on a LiteSpeed server, where the server's own plugin caches at a lower level, or for a site that expects JavaScript and image optimizations without paying anything. On Nginx, page caching works, but compression and browser caching are set up in the server itself: check what your host already does (see our page on hosting and cache compatibility). If you want a free cache with no paid edition at all, compare it with WP Super Cache.
WP Fastest Cache strengths and limitations
Strengths
- Quick to set up. One screen of checkboxes, no wizard and no account to create.
- Pages served by Apache. Thanks to
mod_rewriterules, a cached page does not load PHP. - Well-designed purging and exclusions. Targeted purge on publish, expiry rules, exclusions by page, cookie or user agent, and a
[wpfcNOT]shortcode to keep a piece of content out of the cache. - Premium without a subscription. One-time payment with updates and support for an unlimited period.
Limitations
- Modern optimizations cost extra. JavaScript minification, deferred JavaScript, image lazy loading and WebP are Premium only.
- No separate mobile cache in the free version. If your theme outputs different HTML on mobile, those visitors miss out on the cache.
- Manual setup on Nginx. Gzip and browser caching rely on
.htaccess, which Nginx ignores. - Recent unauthenticated flaws. An SQL injection in 2023 and cache poisoning in 2026 could be exploited without an account.
The WP Fastest Cache settings we recommend
Everything lives in the WP Fastest Cache menu, on the Settings tab, with the save button at the bottom of the page. Turn on one optimization at a time, clear the cache, then test in a private window. Judge the result on the Core Web Vitals measured for your real visitors, not on a single test run.
| Setting | Recommended value | Why |
|---|---|---|
| Cache System WP Fastest Cache > Settings | Enabled | This is the page cache itself. Deactivate any other page caching plugin first. |
| Preload WP Fastest Cache > Settings | Enabled, with a low "pages per minute" rate on shared hosting | Early visitors get a page that is already built; too high a rate puts needless load on the server. |
| Logged-in Users WP Fastest Cache > Settings | Checked | Admins and members see the live version, and no page showing a name or the admin bar ends up in the cache. |
| Mobile WP Fastest Cache > Settings | Unchecked with a responsive theme; checked if the theme serves mobile-specific HTML | With a responsive theme, everyone gets the same HTML. Otherwise, without the Premium mobile cache, it is safer not to serve the desktop version to phones. |
| New Post and Update Post WP Fastest Cache > Settings | Checked; targeted purge (post, home page, categories) on a large site | "Clear All Cache" on every edit forces the whole site to be rebuilt. |
| Minify HTML and Minify Css WP Fastest Cache > Settings | Checked, after checking the layout | Modest gain, low risk. |
| Combine Css and Combine Js WP Fastest Cache > Settings | Unchecked unless you measure a gain | With HTTP/2 the gain is often small, and JavaScript combining can break menus, forms or the cookie banner. |
| Gzip and Browser Caching WP Fastest Cache > Settings | Checked on Apache; on Nginx, configure them in the server | Both options write rules to .htaccess; many hosts already apply them. |
| Disable Emojis WP Fastest Cache > Settings | Checked | Removes a script and a style loaded on every page; current browsers render emoji on their own. |
- Open a page twice in a private window: the second response should be noticeably faster, and a folder should appear in
wp-content/cache/all/. - If the ".htaccess was not found" message shows up, make sure the file exists and its permissions are set to 644.
- On a store, add a product to the cart, then check that the cart and checkout stay up to date.
- After any combining or minification, test a form, the mobile menu and the cookie banner.
WP Fastest Cache vulnerabilities and the version to run
- CVE-2023-6063, fixed in 1.2.2: an unauthenticated SQL injection that exposed the contents of the database.
- CVE-2024-4347, versions up to 1.2.6: an administrator could delete any file on the server,
wp-config.phpincluded, through directory traversal. - CVE-2025-10476, versions up to 1.4.0: a mere subscriber could trigger database cleanup actions on sites running Premium.
- CVE-2026-74932, CVE-2026-74916 and CVE-2026-19760, versions up to 1.5.0: a
Hostheader or tracking parameters left out of the cache key made it possible to store a booby-trapped page that was then served to every visitor.
Run at least 1.5.1, which fixes the cache poisoning, and turn on automatic updates for the plugin on the Plugins screen. WP Masquerade removes the HTML comment the plugin adds at the bottom of cached pages (see removing the HTML comments that give WordPress away), which makes the plugin harder to spot for bots targeting these flaws, but it does not replace updating.
What WP Masquerade hides for WP Fastest Cache
Free version Handled by the free version of WP Masquerade
WP Fastest Cache is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- signed HTML comments
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- JavaScript variables
Wpfcll
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
WP Fastest Cache FAQ
How can I tell that a page is served from the cache?
Reload the page twice in a private window while logged out. The documentation says a cached page ends with an HTML comment reading "WP Fastest Cache file was created in…"; if that comment is hidden, look for the file in wp-content/cache/all/ instead.
Does WP Fastest Cache work on Nginx?
Yes for page caching. Since Nginx does not read the .htaccess file, Gzip compression and browser caching have to be turned on in the server configuration, which the developer documents.
How do I stop a specific page from being cached?
Add a rule on the Exclude tab ("Exclude Pages"), or put the [wpfcNOT] shortcode in that content. WooCommerce cart, checkout and account pages are already excluded.
Can one Premium license be used on several sites?
No: one license covers one site. The developer sells bundles of 3, 5 or 10 licenses, each for a one-time fee, with a 30-day money-back guarantee.