FlyWP Cache
Changelog

1.3.4

• Fixed Smart Auto-Preload preloading a font the page no longer uses. The list of files to preload was stored for 24 hours per URL and survived purges, regenerated used CSS and font changes, so after switching a site from Google Fonts to a self-hosted font the old file was still preloaded with high priority and the new one was not. Nothing is stored anymore: the list is built each time the page is cached, so it always matches the fonts the page delivers.
• Smart Auto-Preload now preloads the fonts the page’s text actually uses, not the first font faces it finds. It reads the font faces the page delivers (used CSS, inline styles including builder custom fonts such as Bricks or Elementor, the page’s own stylesheets and Google Fonts) and picks the families that its CSS rules render, with html/body rules first. Per family it takes the normal Latin file that covers regular text; a variable font needs one file, a static family can add its bold file. At most two files; italic, other character sets, icon fonts and families that are only declared are never preloaded. A font that already has a preload tag from the theme or builder is not added a second time.

1.3.3

• @layer cleanup moved to the RUCSS service. The used CSS service now filters rules inside cascade layers (@layer) itself, with the same conservative rules as FlyWP Cache 1.3.2, and keeps layer order statements. FlyWP Cache no longer changes the used CSS on each page view; it inserts it as the service delivered it. Regenerate Used CSS after updating.

1.3.2

• Remove Unused CSS now also cleans rules inside cascade layers (@layer). The CSS service kept these blocks whole, so page builders that ship their framework stylesheet in a layer — Bricks 2.x puts about 148 KB into @layer bricks — ended up almost completely in the inline used CSS of every page. A rule inside a layer is removed only when each of its selectors names a class or id that is neither in the page, nor set by the page's own JavaScript files, nor in the CSS Safelist. Nested layers and layers combined with @media, @supports and @container are handled; rules without a class or id, :is()/:where()/:not()/:has() arguments, attribute selectors, @keyframes, @font-face and @property always stay, and the layer order is kept. Pages that load markup over AJAX are left as they were. Regenerate Used CSS after updating to apply it.
• Fixed lazy loading adding high fetch priority to more images than intended. Exclude Leading Images skipped images that already had a loading attribute without counting them, so with the defaults five instead of two images were fetched with fetchpriority="high". The setting now counts every image from the top of the page, including the ones LCP Image Optimization marked, and high priority has one page-wide limit: the Number of LCP Images, or the Exclude Leading Images count when LCP Image Optimization is off.
• AVIF/WebP <source> elements now offer the same sizes as the image's srcset and use its sizes, instead of pointing at the full-size original when the image had no computable srcset — for example behind a lazy-load placeholder. Images without a usable srcset get the variant of the size that is actually shown.
• A script removed by a Script Manager rule now also removes its inline parts: the wp_localize_script data and inline code added before or after it. The data stays when a script that is still loaded depends on the removed one. get-assets reports this per script, and verify-script-rules checks that the data is gone.

1.3.1

• Added the ability group Script Manager under Settings > AI / MCP. It is off by default, also on sites that already use the AI integration, and adds six abilities: get-assets lists every script and style a page loads — rendered on the server as an anonymous visitor without touching the cache — with source plugin or theme, size, dependencies, position, inline parts and rule state; analyze-assets finds plugin assets that load on pages where the plugin is not used, with confidence, reasons, savings and ready-to-use rule suggestions; get-script-rules, update-script-rules, verify-script-rules and rollback-script-rules read, change, check and undo Script Manager rules.
• Rule changes through abilities are checked before anything is written. WordPress core, theme and page builder files, cookie banners and analytics are never removed. Shop, checkout, login and form files stay on every page that needs them — the shop's checkout, cart, account and receipt pages, pages whose content uses the plugin and pages that render its markup. A file is not removed where another file that stays loaded depends on it. Writes need a dry run decision and an explicit risk level, store a snapshot of the previous rules first and can be verified and rolled back.
• Snapshots now have a type, settings or Script Manager rules; each keeps its latest 20.
• Fixed Save Settings resetting values that have no field on the settings screen: the Script Manager options for inline handling, file sizes and grouping were switched off, the Script Manager accessibility mode was dropped, and the JavaScript delay timeout and Cloudflare edge TTL returned to their defaults on every save. Values the form does not contain are now kept; an emptied checkbox group is still saved as empty.
• A settings rollback through abilities no longer changes Script Manager options such as MU or testing mode. Before, restoring an older snapshot could switch Script Manager rules on or off.
• The Script Manager export no longer contains the stored Cloudflare token and SaaS key, and its import keeps the target site's own values.
• Optimization recommendations now also report inline or used CSS above 100 KB with likely causes, plugin assets worth an analysis, too many images with high fetch priority or eager loading, and Google Fonts with many variants or many @font-face rules. When a FlyWP Cache setting causes too many high-priority or eager images, a recommendation to lower it replaces the observation.

1.3.0

• Added AI / MCP under Settings: FlyWP Cache now registers 18 abilities with the WordPress Abilities API, so an AI assistant connected through an MCP server (for example the WordPress MCP Adapter) can read the status, measure the site, recommend and apply optimizations, purge and warm the cache, and roll changes back. The integration is off by default and can be limited to four groups: read, cache actions, change settings, measure and optimize. Only administrators can run the abilities. Without the Abilities API (WordPress before 6.9 without the Abilities API plugin) nothing is registered and the tab says so.
• Every setting is now rated safe, moderate or risky. Assistants write only settings up to the requested risk level, which defaults to safe; moderate and risky changes require an explicit request. Returning a setting to its default always counts as safe, so an assistant can switch off an optimization that caused a problem. The ratings and descriptions live in one catalog that also validates every value, so an assistant can only store values the settings screen accepts.
• Settings changes made through abilities need an explicit dry-run decision, are all-or-nothing, and store a snapshot of the previous settings first. Any of the latest 20 snapshots can be restored; a rollback snapshots the state it replaces.
• Secrets stay on the site: the Cloudflare API token and the SaaS key are never returned or changed through abilities, the license key appears only as its last four characters, snapshots do not contain them, and every ability output is filtered for stored secrets. The Cloudflare zone ID, the FastCGI cache path and the Script Manager remain settings-screen only.
• Added a server-side performance measurement: the site requests its own pages as an anonymous visitor and records response times (cold and warm), cache HIT/MISS, CDN status, compression, render-blocking CSS and JavaScript, asset sizes and image lazy loading. Measurements are stored and can be compared before and after a change; measurements taken with different parameters are reported as not comparable. Only URLs of the site itself can be measured.
• Added optimization recommendations that combine the settings, the server environment, conflicting cache plugins and a measurement, and a matching apply safe optimizations action. Recommendations that cannot be applied — another page cache plugin active, Remove Unused CSS without a license — say why.
• An assistant can hand out a FlyWP Speedtest link with the site address prefilled; the test itself is started by a person.

1.2.0

• Added Sitemap Source under Settings > Preload. The sitemap the preload crawls is now shown instead of being decided invisibly. The setting defaults to automatic, which is the behaviour every existing install already had.
• In automatic mode the settings screen lists every checked candidate with its result — the SEO plugin filter, sitemap_index.xml, sitemap.xml and wp-sitemap.xml — not only the one that won. Two sitemap systems running side by side are therefore visible as such. The selection rule is unchanged: the first reachable candidate is used.
• Added a manual mode with a sitemap URL field, for sites whose sitemap does not sit on one of the standard paths. Only http and https URLs on the site's own host are accepted, so the preload cannot be pointed at a foreign server. Manual mode without a usable URL preloads nothing rather than falling back to a sitemap that was not chosen.
• Added a Test Sitemap button that resolves, fetches and parses the sitemap currently selected in the form and reports the number of URLs found, or the reason it failed.
• Detection results are cached for twelve hours, and the settings screen reads only that cache, so opening the settings page performs no HTTP requests. Test Sitemap forces a fresh check.

1.1.1

• Fixed used CSS on pages that are addressed through a query parameter. Pagination, search results and filtered views such as ?page=2, ?s=... or ?orderby=... render different markup than the bare URL, but the used CSS lookup discarded the query string entirely and returned the bare URL's entry. Such a page could therefore be delivered with styles missing. These views are now looked up, generated and stored under their own entry.
• Tracking parameters continue to share the bare URL's used CSS. utm_source, fbclid, gclid and the other tracking parameters do not change the page, so a visitor arriving from a newsletter, an ad or a social post is served the same optimized CSS and no second generation is queued. This behaviour is unchanged; it is now explicit rather than a side effect of discarding the whole query string.
• The distinction reuses the page cache's ignore list, including the entries added under Settings > Cache > Ignored query strings. There is no second list to maintain.

1.1.0

Upgrade note — re-enter your Cloudflare API token and SaaS API key. Secrets stored under the pre-rename encryption format ($fc0$ / $fc1$) can no longer be read after this update. This affects cloudflare_api_token and saas_api_key in the flywpcache_settings option. Such a value is treated as empty, and the only trace is a line in the PHP error log — there is no admin notice, and the field simply appears blank. Open FlyWP Cache > Settings, check both fields, and enter the values again where they are empty.

• Fixed a security issue in stored-secret decryption: a value that carries a storage marker but is in an unrecognised format is no longer passed through as plaintext. Previously such a value could have been sent to an external API as if it were the token. Only a positively recognised format now returns a value; anything else returns empty and is logged without the value itself.
• Removed the legacy encryption read path, including the pre-rename key domain and the one-time migration of values stored under it.
• Changed the default SaaS host to https://cache.flywpcode.com. Installs that set FLYWPCACHE_SAAS_API_URL in wp-config.php are unaffected.
• Completed the rename cleanup: the plugin no longer sends or accepts the former flycache spellings, including the flycache-nocache cache bypass parameter and the flycache_rucss_allowed license field.

Values stored as plaintext without any marker keep working and are encrypted on the next admin request.

1.0.5

• The plugin now reports the WordPress version it is tested against, so Dashboard > Updates shows “Compatibility with WordPress 7.1.1: Yes (according to its author)” instead of “Not tested”, and the plugin details screen no longer warns that the plugin has not been tested with your version of WordPress.

1.0.4

• Restored the RUCSS cache bypass: the generator’s request is recognised again under both the current and the previous query-parameter spelling, so generation analyses a live page instead of a cached one.
• License requests now carry the current credential headers alongside the previous spelling, so the plugin works against either SaaS release.
• The RUCSS entitlement is read from the current field name and falls back to the previous one, so an install keeps its entitlement until its next license refresh.
• Stored secrets are re-encrypted under the current key domain on the next admin request; values written before the rename are still decrypted and are migrated transparently.

1.0.3

• Corrected FlyWP Code website links in the Script Manager and multisite interface.
• Standardized the visible Script Manager product name to FlyWP Cache.
• Updated translation metadata and documentation links to the current FlyWP Code website.

1.0.2

• Removed redundant local Google Fonts stylesheets when all equivalent font rules are already present in generated RUCSS.
• Preserved the original font stylesheet when RUCSS is missing, incomplete or conditional.
• Limited automatic font preloads to two normal Latin font files, avoiding speculative language, italic and icon font downloads. Other variants remain available through CSS when needed.
• Improved recognition of minified Unicode ranges and variable font weights.

1.0.1

• Fixed relative font URLs in automatic preloads and prevented malformed preload addresses.
• Fixed Google Fonts self-hosting for font faces embedded in Remove Unused CSS output and other inline styles.
• Matched font preloads to locally hosted files and removed unnecessary Google connection hints.
• Validated newly downloaded font files before using them for inline self-hosting.
• Refreshed cached font discovery so corrected preload URLs take effect.

For sites affected by incorrect font paths, regenerate Remove Unused CSS and clear the page cache after updating. The RUCSS service includes the companion resource-path fix.

1.0.0

Initial release of FlyWP Cache by FlyWP Code.