What WP Super Cache does on your site
WP Super Cache is published by Automattic, the company behind WordPress.com and Jetpack. It does one job and does it well: it saves each page of your site as a static HTML file, then serves that file to the next visitors instead of running PHP and database queries all over again. Logged-in users, visitors who have left a comment and people who have viewed a password-protected post get pages tailored to their visit.
Two delivery modes set the speed. In Simple mode, PHP serves the cached file: it is the mode the developer recommends, nearly as fast, and it leaves your server configuration alone. In Expert mode, rewrite rules added to your .htaccess file serve cached pages without running PHP at all; the plugin itself warns that this change can take your site down if it goes wrong. A third engine, WP-Cache, caches pages for known users, URLs with query strings and feeds.
Around that cache, the plugin adds page compression, preloading that builds the cache for every post, garbage collection that clears out stale files, URL rewriting that points static files to a CDN, and a Lock Down mode for traffic spikes. It does not minify CSS or JavaScript and does not optimize images. The plugin is free, GPL-licensed and has no paid edition, although its settings page does suggest installing Jetpack Boost, another Automattic product.
Which sites WP Super Cache suits best
- Blogs and brochure sites where most visitors are not logged in: nearly every page can be served as a static file.
- Sites on Apache or Nginx without a LiteSpeed server that want a real, free page cache without relying on a third-party service.
- Owners who want few settings to manage: the Easy tab turns on the recommended setup in one click.
- Sites that face traffic spikes, thanks to Expert mode, cache rebuild and Lock Down.
It is the wrong pick on a LiteSpeed server, where LiteSpeed Cache drives the server's own cache. It is not a full optimization toolkit either: to minify CSS and JavaScript you need a second plugin such as Autoptimize, or an all-in-one plugin. And on a site where most visitors are logged in (membership area, forum), the gain is small with the recommended settings, which do not cache their pages. Before you install it, make sure your host is not already running a page cache (see our page on host and cache compatibility).
WP Super Cache strengths and limitations
Strengths
- Free, with no paid edition. Every feature is included, with no license or service to sign up for.
- One-click setup. The Easy tab enables Simple mode, cache rebuild and a 30-minute cache lifetime.
- No PHP in Expert mode. On Apache with mod_rewrite, the web server delivers static files directly.
- Protection against stampedes. Cache rebuild keeps serving the old page while a single visit regenerates the new one.
- No special server needed. Simple mode runs on any host where the wp-content folder is writable.
Limitations
- No asset optimization. No CSS or JavaScript minification and no image lazy loading: you need another plugin.
- Expert mode takes care. It edits .htaccess, and the Nginx rules it points to are not officially supported.
- Frozen dynamic content. Counters, polls or plugins that run PHP on every page view stop updating unless they use JavaScript.
- Technical interface. The Advanced tab lists dozens of options, some with cryptic labels (coarse file locking, late init).
The WP Super Cache settings we recommend
You will find everything under Settings > WP Super Cache. Change one option at a time, clear the cache, then test in a private window.
| Setting | Recommended value | Why |
|---|---|---|
| Caching Settings > WP Super Cache > Easy | Caching On | Applies the developer's recommended setup in one go. |
| Cache Delivery Method Settings > WP Super Cache > Advanced | Simple; Expert only on Apache, after backing up .htaccess | Expert is faster but rewrites a critical server file. |
| Disable caching for logged in visitors Advanced > Miscellaneous | On | Keeps a personalized page (admin bar, name) from being served to someone else. |
| Compress pages Advanced > Miscellaneous | On, unless the server already compresses | Off by default; if the browser shows garbled characters, turn it off. |
| Cache rebuild Advanced > Miscellaneous | On | Stops a comment or an edit from triggering dozens of simultaneous rebuilds. |
| 304 Browser caching Advanced > Miscellaneous | On, after testing | Off by default because some hosts have had trouble with the headers it uses. |
| Extra homepage checks Advanced > Advanced | On | Recommended by the developer, especially with a static front page. |
| Cache Timeout and Timer Advanced > Expiry Time & Garbage Collection | 1,800 s and 600 s if the site changes often; much longer for a static site | Clears out stale pages without emptying the cache too often. |
| Enable Logging Settings > WP Super Cache > Debug | Off in production | The log is password-protected, but it is only useful while you troubleshoot. |
- Make sure your permalinks are not set to "Plain": the plugin requires a custom structure.
- Click "Test Cache" on the Easy tab: both timestamps should match.
- In Simple mode, the
X-WP-Super-Cacheheader should show up in responses for a page viewed while logged out. - Check that no other page caching plugin is active.
- Turn on automatic updates for the plugin under Plugins.
WP Super Cache vulnerabilities and the version to run
The most serious published flaws date back to 2021, and all of them required an administrator account:
- CVE-2021-24209, fixed in 1.7.2: remote code execution through the Cache Location setting, caused by weak input validation.
- CVE-2021-24312, fixed in 1.7.3: an incomplete fix for the previous flaw; several settings still accepted characters that allowed code injection.
- CVE-2021-24329, fixed in 1.7.3: stored XSS through the cache location parameter.
Recent releases keep hardening the plugin: the 3.1.3 changelog, for example, fixes a cookie that could make a logged-in visitor look anonymous and expose their page to everyone, and 3.1.5 stops a malformed Host header from overwriting another page's cached copy. Stay on the latest version and turn on automatic updates. WP Masquerade removes the HTML comments the plugin adds at the bottom of your pages (see how to remove the HTML comments that give WordPress away), which makes the plugin harder to spot without replacing updates.
What WP Masquerade hides for WP Super Cache
Free version Handled by the free version of WP Masquerade
WP Super Cache is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- signed HTML comments
With Pro
Nothing more
Still visible
- server or cache headers
X-WP-Super-Cache
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
WP Super Cache FAQ
Does WP Super Cache work on an Nginx server?
Yes in Simple mode, since PHP serves the cached files. Expert mode relies on rewrite rules: the plugin points to Nginx rules but says they are not officially supported.
Can I use it alongside an optimization plugin?
Yes, and that is the usual setup: WP Super Cache handles page caching while a plugin like Autoptimize takes care of CSS and JavaScript. Just never run two page caches at once.
Why has a counter or widget stopped updating?
The page being served is a static file, so that widget's PHP code no longer runs. You need a widget that loads its data with JavaScript, or a shorter cache timeout.
How do I uninstall WP Super Cache cleanly?
Turn caching off, clear the cache, then deactivate the plugin. The .htaccess rules between # BEGIN WPSuperCache and # END WPSuperCache are not removed automatically, so delete them by hand.