Changelog#

Versions and their contents are taken from the version markers in the code comments and from the project's notes. Dates are given by month.

Unreleased#

Responsive images on sites behind a TLS proxy. The uploads-URL test in BB_Cache_Boost::attachment_id() compared URLs including their scheme. Where WP_HOME is http:// but attachment URLs print as https:// (a proxy in front, is_ssl() true), no image matched, so pages kept full-size originals with no srcset. Both sides are now compared without the scheme.
Lookup misses are no longer cached for a day. The bb_cache_att_map transient keeps hits only; a miss is remembered for the current request and retried on the next render, and a 0 stored by an earlier version is looked up again.

Cloudflare integration.

Purge mirror. New inc/class-cloudflare.php. Every page-cache purge is repeated at the Cloudflare zone: the purged URLs (30 per API call) or one purge-everything, queued during the request and sent at shutdown. Settings cf_purge, cf_zone, cf_token, cf_purge_mode.
Credentials from constants. BB_CACHE_CF_ZONE and BB_CACHE_CF_TOKEN in wp-config.php take precedence over the settings, so the token need not be stored in the database.
Edge headers. New setting cf_edge_ttl. Responses the page cache serves or stores carry Cache-Control: public, max-age=0, s-maxage=<ttl>; every other front-end HTML response is marked private. The value is mirrored into config.php for the drop-in and into the .htaccess block.
Cloudflare tab. Status line, Verify token, Check the edge, Purge everything at Cloudflare, the purge log (last 20 calls, option bb_cache_cf_log), warnings for the mobile and WebP variants, and the Cache Rule to create on the zone.
WP-CLI. New wp bb-cache cloudflare <verify|purge|check|log>. wp bb-cache purge reports the outcome of the edge purges it caused.
Purge event for uncached URLs. bb_cache_purged now fires for a URL even when nothing was stored for it, so Varnish and Cloudflare are purged for URLs that had already expired or been purged locally.
Uninstall also deletes the bb_cache_cf_log option.

Fixes in the same release:

Varnish. A post save no longer ends with a full regex purge: the post summary event is ignored and only the per-URL PURGE requests are sent.
wp bb-cache purge --minified also purges the cached pages, which reference the files it deletes.
Missing-fragment marker. The <meta name="bb-critical"> tag is followed by a real line break instead of the characters \n.
Drop-in. Two debug query flags of the originating theme were removed from inc/serve.php; any parameter that is not on the allow list already bypasses the cache.

Security hardening before the first production install, plus fixes to the critical CSS composer.

Host allow-list. The drop-in serves and stores only for the site's own host name, with and without www. (hosts in config.php, filter bb_cache_hosts). A stray Host header gets MISS (host) and creates no cache folder. The list is derived only in trusted contexts, never on a front-end request.
Purge path guard. Purging a URL resolves the target with realpath and refuses anything outside the page cache folder.
CSS and JS only. Combining and inlining are limited to stylesheet and script files. In the 0.3.0 code the .css extension is enforced for stylesheets; scripts are selected by tag and type without an extension check.
</style escape. An inlined stylesheet has any </style text escaped so it cannot end the element.
.htaccess token filter. Only plain cookie-name tokens from reject_cookies are written into the rewrite block.
Config self-heal. A config.php written by another plugin version is rewritten on the next request, keeping its host list, so new config keys are live after an update without a settings save.
Critical CSS composer. Layout names are read from markup only, never from the selectors of an inlined stylesheet; a name stops at a -- modifier; a layout without a fragment counts as covered when the same section also carries a layout that has one; the missing-fragment marker is a <meta name="bb-critical"> tag, because HTML minify removes comments.

Render-path work for mobile performance.

Per-page composed critical CSS. The inline CSS is composed from base.css, one section-<layout>.css fragment per section layout found in the page's HTML, masthead.css and an optional post-<ID>.css, with duplicate rules removed. A layout without a fragment leaves the page's stylesheets render-blocking. The earlier per-template files are still honoured while the folder has no base.css.
Page sheets inlined whole. New setting critical_inline: page-scoped stylesheets are inlined (up to 24 KB each) instead of loaded asynchronously.
LCP preload with srcset and a phone candidate. The preload for the first large image carries its srcset and sizes. A hero's inline background image is preloaded, with a --bg-m phone-sized candidate under its media query and the full size under the complement. A first-screen <video poster> is preloaded. An image that follows a raster hero background no longer gets fetchpriority="high", and images the theme already preloads are not preloaded twice.

Initial versions.

Page cache: advanced-cache.php drop-in, WP_CACHE setup, variants for HTTPS, mobile and allow-listed query strings, purge on content changes, hourly lifespan sweep, optional Apache rewrite block, Varnish PURGE.
File optimisation: conservative CSS and JS minify, combining of consecutive same-origin files, Google Fonts request combining.
JavaScript: defer, and delayed execution until the first interaction with a timeout fallback, in third-party-only or everything mode.
Media: native lazy loading for images and iframes, YouTube click-to-play preview, optional image dimensions.
Preload: dns-prefetch, preconnect and font preload tags, hover prefetch, sitemap-driven cache warming.
Heartbeat control per context and emoji script removal.
Critical CSS in its first form: one <key>.css file per template, with post-<ID>.css overriding it.
The other Boost features, which carry no later version marker in the code: locally hosted Google Fonts, WebP swap, LCP image preload in its first form, preconnect hints, HTML minify, responsive images, lazy videos and content-visibility.
Settings screen, admin-bar purge menu, health notices, conflict detection and the wp bb-cache commands.