What WP Rocket does on your site
WP Rocket is a commercial performance plugin from WP Media, sold on its official website and not listed in the wordpress.org directory. As soon as you activate it, it saves each page as a static HTML file in wp-content/cache/wp-rocket/, which the server’s rewrite rules (.htaccess or Nginx configuration) then serve without a database query. Preloading rebuilds that cache on its own: it reads your sitemaps and revisits the URLs after every purge.
Around the cache, it bundles the usual optimizations: CSS and JavaScript minification, unused CSS removal, JavaScript deferred or delayed until the first interaction, lazy loading for images, iframes and videos, missing image dimensions, self-hosted Google Fonts, database cleanup, Heartbeat API control, and Cloudflare, Varnish and Sucuri integrations. On a fresh install, caching, preloading, CSS and JS minification and reduced Heartbeat activity are already on; lazy loading, unused CSS removal and delayed JavaScript are opt-in.
There is no free version. The yearly license covers updates, support and the "cloud" features that run on WP Media’s servers: Remove Unused CSS, Load CSS asynchronously and Rocket Insights, the built-in performance tracking dashboard. Requirements according to the vendor: PHP 7.4 and WordPress 5.8 or later, "pretty" permalinks, and an Apache, Nginx, LiteSpeed or Windows server.
Which sites WP Rocket suits best
- Sites on Apache or Nginx with no server-level cache: WP Rocket builds its own page cache, whatever the host.
- Owners who want results without tuning everything: the default setup already covers the essentials, and the interface fits in a handful of tabs.
- WooCommerce stores: the cart, checkout and my account pages set in WooCommerce are detected and never cached by default.
- Agencies: the Multi license covers 50, 100 or 500 client sites.
It is not the best buy on a LiteSpeed server, where LiteSpeed Cache drives the server cache for free, nor on a managed host that runs its own cache: WP Rocket’s documentation says its page caching is then turned off, leaving only the optimizations. Check this before you buy (see our host and cache compatibility page).
WP Rocket strengths and limits
Strengths
- Effective out of the box. Page caching, preloading and minification work without any setup.
- Server-independent. The cache runs on Apache, Nginx, LiteSpeed or Windows, with no mandatory third-party service.
- Guardrails against breakage. "One-click exclusions" for delayed JavaScript, plus exclusion lists kept up to date by the vendor.
- Clear interface. Few options, grouped by topic, with a warning on the ones that can break your layout.
Limits
- No free version. The only way to try it is a 14-day trial, with a payment method on file.
- Subscription to renew. Once the license expires: no more updates or support, and cloud features stop 15 days later.
- Unused CSS relies on the cloud. It needs a public site that WP Rocket’s bots can reach, which a firewall may block.
- Cache disabled on some hosts. On a managed host with its own cache, you are mostly paying for the optimizations.
The WP Rocket settings we recommend
Everything lives under Settings > WP Rocket. Turn on one option at a time, use "Clear and Preload Cache" in the admin bar, then test in a private window. Judge by measured Core Web Vitals, not by a single score.
| Setting | Recommended value | Why |
|---|---|---|
| Activate Preloading Cache > Preload | On (default) | The cache rebuilds after every purge without waiting for visitors. |
| Cache Lifespan Cache > Cache Rules | 10 hours (default) | The plugin advises staying at 10 hours or less if errors keep coming back periodically (expired form tokens). |
| Never Cache URL(s) Cache > Cache Rules | Your custom login URL and any page specific to each visitor | The plugin asks for this on sensitive pages; WooCommerce cart and checkout are excluded automatically. |
| Minify CSS files and Minify JavaScript files Page Optimization > JavaScript & CSS | On, after checking | Real gain, low risk; exclude the offending file if a layout breaks. |
| Optimize CSS delivery Page Optimization > JavaScript & CSS | "Remove Unused CSS" after testing; otherwise "Load CSS asynchronously" | The vendor’s recommended method, but flagged as able to break your layout; it requires a valid license. |
| Delay JavaScript execution Page Optimization > JavaScript & CSS | On after testing each page type, with "One-click exclusions" | Menus, forms and the cookie banner may wait for a visitor action. Safe Mode is only a temporary fix. |
| Enable for images and Add missing image dimensions Page Optimization > Image & Media | On, with the above-the-fold image excluded | Add the main image to "Excluded images or iframes" so it is not displayed late. |
| Control Heartbeat Backend > Heartbeat | "Reduce activity" (default), never "Disable" without testing | The plugin warns that disabling it entirely may break plugins and themes. |
| Schedule Automatic Cleanup Backend > Database | Off until backups are scheduled | Revisions, drafts and comments it removes are deleted permanently. |
- Logged out, view a page’s source: WP Rocket’s closing comment should end with
Debug: cached@followed by a timestamp. - After each optimization, test a form, the mobile menu, the cart and the cookie banner.
- Make sure no other page caching plugin is active.
- If your site runs behind the Cloudflare CDN, turn on the Cloudflare add-on (Tools > Add-ons) so clearing WP Rocket’s cache also clears Cloudflare’s.
WP Rocket vulnerabilities and the version to run
WP Rocket has a short vulnerability record, but several flaws have been published since 2025:
- CVE-2026-28044, fixed in 3.20.0.2: stored XSS exploitable by an Author-level account or higher.
- CVE-2026-5934, fixed in 3.21.1: unauthenticated stored XSS through the
rocket_beaconAJAX endpoint andpicturetag attributes. - Unauthenticated information exposure, fixed in 3.23.3.3: it only affected versions 3.23.1 to 3.23.3.2.
- CVE-2026-97075 and CVE-2026-97076, fixed in 3.23.5: missing authorization and a regular expression denial of service.
Run at least 3.23.5 and keep your license active: without it, fixes stop arriving. WP Masquerade Pro removes the plugin folder URLs and the IDs of its scripts and styles from your pages, which makes the plugin harder for bots to spot without replacing updates; the comment in cached pages, its lazy loading scripts and the X-Rocket-Nginx-Bypass header stay visible (see also HTML comments and the generator tag).
What WP Masquerade hides for WP Rocket
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WP Rocket: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- text in the cache file
Cached for great performance - JavaScript variables
RocketLazyLoadScripts, rocket_lazy - tag IDs
wpr-usedcss - server or cache headers
X-Rocket-Nginx-Bypass
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
WP Rocket FAQ
Does WP Rocket keep working if I don’t renew the license?
Yes, caching and local optimizations keep running. You lose updates, support and exclusion list refreshes, and 15 days after expiry, Remove Unused CSS, Load CSS asynchronously and Rocket Insights.
Can I use WP Rocket alongside LiteSpeed Cache?
Not for page caching: only one should be active. On a LiteSpeed server, keep LiteSpeed Cache instead, or turn on each optimization in only one of the two plugins.
How much does WP Rocket cost for several sites?
Billed yearly, licenses cost €49.95 for one site (Single), €99.95 for three (Plus) and €249.95 for 50 (Multi), with 100-site and 500-site tiers. Paying three years upfront gets a 30% discount, and taxes may apply depending on your country.
My site looks broken after an optimization: what should I do?
Turn off the last setting you changed, clear the cache and test again. If delayed JavaScript is the cause, add the script to "Excluded JavaScript Files" rather than turning everything off.