---
title: "WP-Optimize"
description: "WP-Optimize: free caching, minification, images and database cleanup. Strengths, limits, Premium pricing, safe settings and fixed vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-optimize/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:32:35+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-optimize/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wp-optimize/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wp-optimize/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wp-optimize/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wp-optimize/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wp-optimize/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wp-optimize/index.md"
---

# WP-Optimize

WP-Optimize, from Team Updraft, combines page caching, minification, image compression and database cleanup, all free. Our take, what Premium adds, the safe settings to apply, especially for cleaning the database without risk, and the fixed vulnerabilities worth knowing.

## The essentials

- Best for blogs and brochure sites on Apache or Nginx that want free caching and database cleanup.
- Main caveat: image lazy loading and orphaned image cleanup are Premium-only.
- Free; Premium from €57.60 per year incl. VAT for 2 sites, or €229.20 for unlimited sites.

## What WP-Optimize does on your site

WP-Optimize is published by Team Updraft, David Anderson’s team, which also makes UpdraftPlus. It bundles four tools into one plugin: a page cache that stores a static HTML copy of each page, HTML, CSS and JavaScript minification, image compression (with WebP conversion) and database cleanup (revisions, auto-drafts, trash, spam comments, table optimization).

The page cache runs on Apache, Nginx and IIS, with no special server required. It needs to write to `wp-content/cache`, create `wp-content/advanced-cache.php` and add the `WP_CACHE` constant to `wp-config.php`. On Nginx and IIS, GZIP compression and browser caching are configured on the server, not in the plugin. Image compression goes through the free API of an outside service, reSmush.it, with a 5 MB limit per image; WebP conversion uses the tools available on your own server.

The model is freemium: caching, minification, compression and cleanup are all free. Premium adds, among other things, image lazy loading, removal of orphaned images and unused image sizes, precise cleanup schedules, per-role and per-user caching, multisite database optimization, WP-CLI support and priority support.

![Diagram: WP-Optimize works on visitors and bots, web server, wordpress. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro).](https://www.wp-masquerade.com/media/wpm-sheets/wp-optimize/diagram-en.svg?v=aaa50b40)

## Which sites WP-Optimize is a good fit for

- **Blogs and brochure sites on Apache or Nginx** that want a free page cache and regular database cleanup, managed from a single screen.
- **Older sites with a bloated database** full of thousands of revisions, spam comments and trashed data.
- **Sites already backed up with UpdraftPlus**, which can run an automatic backup before every scheduled optimization.

It is not the right pick if your host already provides a page cache (a LiteSpeed server, Varnish or a custom host cache): you would only use its cleanup and compression, and two page caches should never run at the same time. If you would rather pay for a plugin that turns on more optimizations out of the box, [WP Rocket](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-rocket/) is the most common alternative. If you are unsure what your host caches, see our [host and cache compatibility](https://www.wp-masquerade.com/features/hosting-and-cache-compatibility/) page.

## WP-Optimize strengths and limitations

### Strengths

- **Four free tools.** Page cache, minification, image compression and database cleanup, with no license to buy.
- **Controlled database cleanup.** You can keep the last few weeks of data and a fixed number of revisions, manually or on a schedule.
- **Built-in UpdraftPlus backup.** One checkbox takes a backup before optimizations, so a bad cleanup can be undone.
- **Reversible compression.** Originals can be kept and restored from the compression tab.
- **Safety nets.** The plugin warns you when another cache or minify plugin is active, and file merging is off by default.

### Limitations

- **Useful features locked behind Premium.** Image lazy loading, orphaned images, precise schedules and multisite are paid.
- **Outside compression service.** Images are sent to reSmush.it, and files over 5 MB are not compressed.
- **Frozen dynamic content.** Carts, widgets or ads do not change on a cached page unless they load through AJAX, as the vendor points out.
- **Recent vulnerabilities.** Three security fixes between May 2025 and April 2026, two of them for flaws reachable from a Subscriber or Author account.

## The WP-Optimize settings we recommend

Take a full backup before your first cleanup, then change one setting at a time and test in a private window. Judge optimizations by measured [Core Web Vitals](https://www.wp-masquerade.com/glossary/core-web-vitals/), not by a single score.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Enable page caching**  WP-Optimize > Cache > Page cache | On, unless your host or another plugin already provides a page cache | Two page caches at once lead to unpredictable results. |
| **Cache lifespan**  WP-Optimize > Cache > Page cache | 10 hours or less if your pages contain forms | The vendor explains that nonces printed in pages expire after 12 hours by default. |
| **Serve cached pages to logged in users**  Same tab | Off | Prevents serving a page that was built for another account. |
| **Generate separate files for mobile devices**  Same tab | Off, unless you use a mobile-specific theme or an AMP plugin | The vendor limits this setting to those two cases; a responsive theme does not need it. |
| **Enable merging of CSS files** and **Enable merging of JavaScript files**  WP-Optimize > Minify > CSS and JavaScript | Off (default), unless you measure a gain | Minification alone is often enough; if the layout breaks, the vendor recommends excluding the offending file. |
| **Defer all the JavaScript files** and **Delay JS**  WP-Optimize > Minify > JavaScript | Only after testing every page type | Some themes and plugins need render-blocking scripts: keep an eye on the browser console. |
| **Keep last X weeks data**  WP-Optimize > Database > Settings | On, 2 weeks | Content deleted by mistake can still be recovered during that period. |
| **Enable scheduled clean-up and optimization**  Same tab | Weekly, with the UpdraftPlus backup box checked | The database stays lean without manual work, and every run is preceded by a backup. |
| **Backup original images**  WP-Optimize > Images > Compress images | On | Lets you go back to the original if lossy compression degrades an image. |

- Open a page in a private window and look for the `Cached by WP-Optimize` comment at the bottom of the source code (Cloudflare can strip it even when caching works).
- After each optimization, test a form, the mobile menu, the cart and the cookie banner.
- Make sure a recent backup exists, for example with [UpdraftPlus](https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/), before any manual database cleanup.
- Turn on automatic updates for the plugin under Plugins.

## WP-Optimize vulnerabilities and the version to run

- **CVE-2026-7252, fixed in 4.5.3** (CVSS 8.1): an Author account could delete any file on the server, `wp-config.php` included, which can lead to a full takeover.
- **CVE-2026-2712, fixed in 4.5.1** (CVSS 5.4): with no capability check in the Heartbeat handler, a mere Subscriber could trigger image compression actions and change settings.
- **CVE-2025-3951, fixed in 4.2.0**: SQL injection by an administrator, on multisite only.
- **CVE-2023-1119, fixed in 3.2.13**: a third-party library removed the escaping on some characters, which opened an XSS flaw.

Run at least 4.5.3, keep automatic updates on and give Author accounts only to people you trust. WP Masquerade Pro removes the HTML comment the plugin adds to your pages (see our article on [HTML comments that give WordPress away](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)), which makes it harder for bots to spot, without replacing the update.

## WP-Optimize FAQ

**Is the WP-Optimize cache really free?**

Yes. The vendor commits to keeping the page cache free; Premium adds options such as per-role caching, caching selected URLs only and preloading the LCP element.

**Can I keep WP Rocket or my host’s cache?**

Not for page caching, since both plugins need the same `advanced-cache.php` file. Leave the WP-Optimize cache off and use only its database cleanup and image compression.

**Can database cleanup break my site?**

The vendor says it only uses standard MySQL commands, but it cannot restore anything without a backup. Back up before your first cleanup and keep a few weeks of data.

**Are my images sent to an outside service?**

Yes for compression, which relies on the free reSmush.it API. If you would rather avoid that, leave automatic compression off and use another tool; caching and cleanup work without this service.

## Key facts

- Category: Cache and performance
- Vendor: Team Updraft
- Price: Free; Premium from €57.60 per year incl. VAT for 2 sites
- Active installations (wordpress.org): 1 000 000+
- Version: 4.7.0
- Official page: https://wordpress.org/plugins/wp-optimize/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: signed HTML comments, folder name, tag IDs, generated-file folders