W3 Total Cache Pro Changelog

Every recorded version, newest first, with what changed in each one.

Latest 2.10.713 versions

Undated · 13 versions

2.10.7
Latest
2 new3 improvements8 fixes
New
- Minify: Cache selected external scripts locally for auto minify
- Page Cache: Add a one-pass mode for sitemap cache preload
Improved
- Developers: Add a generated reference of supported actions and filters
- Remove leftover newsletter signup code
- Build: Omit development-only files from the release ZIP
Fixed
- Browser Cache: Constrain unquoted URL rewriting when removing query strings from static resources
- Page Cache: Remove the expired role-cookie compatibility path and skip caching for rejected roles
- Page Cache: Avoid Options API calls before WordPress has loaded them during early bootstrap
- Object Cache: Persist cache invalidation from wp-admin when admin object caching is disabled
- CDN: Preserve custom attachment directories when pushing media
- Google PageSpeed: Renew expired access tokens without discarding authorization
- Settings: Persist Purge via WP-Cron schedule settings
- Settings: Skip unchanged w3tc_state option writes
2.10.6
2 improvements19 fixes
Improved
- Page Cache: Add w3tc_pgcache_rules_required filter to skip writing rewrite rules
- Bunny CDN and Redis: Enable verified TLS by default
Fixed
- Database Cluster: Restore placeholder unescape so admin searches with wildcards match
- Settings: Restrict POST updates to keys owned by the active admin page
- Image Converter: Require administrator capability for convert and submit
- Config import: Validate structure before applying
- Role cookies: Stop honoring legacy names unless explicitly enabled
- Minify: Validate precache URLs before outbound fetch
- URL constants: Apply host allowlists to overrides
- Minify: Validate Java minifier JAR paths before invocation
- Diagnostics: Extend log redaction across remaining formats
- Reverse proxy: Apply forwarded client IP and scheme headers only from trusted proxies
- CDN: Limit Media Library import to static assets
- CDN: Render admin server responses as text
- CDN: Use saved settings for Test
- CDN: Scope CORS headers to font resources
- Browser Cache: Normalize rewrite rule rendering
- Support: Reduce client data sent from the Support page
- Forums: Normalize API client responses
- Lazy Load: Match background styles as top-level attributes only
- Admin: Align request validation across notice, extension, setup, CDN, and minify flows
2.10.5
1 fix
Fixed
- Page Cache: Keep Disk Enhanced cache file operations within the cache directory
2.10.4
2 fixes
Fixed
- Lazy Load: Match only quoted image attributes when rewriting src/srcset/sizes
- Cache purge: Restore filterable capabilities for purge-all and purge-post
2.10.3
3 fixes
Fixed
- Output buffering: Skip REST API requests unless page cache REST caching is enabled
- Minify: Keep cache file operations within the cache directory
- Defer Scripts: Restore timeout configuration placeholder replacement
2.10.2
3 fixes
Fixed
- Disk cache: Restore file-locking writes on PHP 8+
- Apache: Limit Options -MultiViews in page cache rules to compatibility mode
- Page Cache: Skip storing redirect responses
2.10.1
7 fixes
Fixed
- General Settings: "The link you followed has expired" when emptying all caches
- Redis/Memcached/CDN: Restore connection handling after 2.10.0 at-rest credential encryption
- At-rest credentials: Defer encryption until WordPress salts are available
- Always Cached: Queue regeneration on nginx with Disk: Enhanced page cache
- mfunc: Render unrecognized dynamic-fragment tags as empty output
- Apache: Remove Options -MultiViews from root .htaccess (HTTP 500 on restrictive AllowOverride)
- Multisite: Admin page links in network admin
2.10.0
8 security
Security
- Hardened authorization, capability, and request-verification (nonce/CSRF) checks across admin and AJAX endpoints
- Improved input validation and output escaping to prevent cross-site scripting (XSS)
- Strengthened protections against code, command, and file-inclusion injection
- Hardened processing of dynamic and cached content, including data serialization
- Restricted outbound server-side requests to mitigate server-side request forgery (SSRF)
- Restricted configuration changes to prevent unauthorized modification
- Improved handling of stored credentials, cookies, and generated server-configuration files
- Reduced potential information disclosure and improved security logging
2.9.4
3 fixes
Fixed
- Output buffering: Reverted to the previous output buffering from 2.9.1
- Cloudflare: Token/Key validation
- Prevent mfunc processing bypass by user-agent
2.9.3
4 fixes
Fixed
- Output buffering: Discard nested OB contents for non-HTML responses (JSON/AJAX) to prevent HTML prepended to JSON output
- Output buffering: Add wp_die_ajax_handler and wp_die_json_handler filters to properly handle AJAX die paths
- Page cache: REST API responses no longer cached due to output buffering pipeline being skipped for non-HTML responses
- Lazy load: Add debounced MutationObserver so images injected by AJAX plugins (e.g., FacetWP) are processed without requiring per-plugin integration; also fix async_head embed method not updating window.w3tc_lazyload to the live LazyLoad instance after initialization
2.9.2
3 fixes
Fixed
- Patch broken access control for Image Service AJAX operations
- mfunc dynamic output buffering fatal error causing blank pages
- Patch mfunc security vulnerability
2.9.1
4 fixes
Fixed
- Image Converter: Reset request when status is 404
- Image Converter: Better handling of separate format requests
- Image Converter: UI/JS changes
- Config caching/saving issue
2.9.0
2 new2 improvements3 fixes
New
- Next-Gen AVIF image conversion (Pro)
- Added notices for some billing issues
Improved
- Setup Guide Wizard and test improvements
- WebP Converter renamed to Image Converter
Fixed
- Bunny CDN purge section
- New Relic API
- Nginx + Memcached Unix socket compatability

Changelog published by the developer, in their original language.