=== LumenCache ===
Contributors:      nasruleam, celsiusanderson
Tags:              cache, full-page-cache, performance, woocommerce, page-speed
Requires at least: 6.0
Tested up to:      7.1
Requires PHP:      8.1
Stable tag:        1.6.34
License:           GPL-2.0-or-later
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

RAM-first full-page caching that serves pages before WordPress loads, with automatic WooCommerce and LMS integration.

== Description ==

LumenCache implements a RAM-first full-page cache with a WordPress
`advanced-cache.php` drop-in. On a cache HIT, the drop-in serves complete HTML
before the normal WordPress bootstrap and database queries. This early-response
path reduces application-layer work and keeps repeat page requests fast across
Nginx, Apache, and LiteSpeed.

The cache is designed to fail open when its storage layer is unavailable, so a
cache connection problem does not take the WordPress site offline.

== Research Foundation ==

Academic Reference:
"Dynamic Resource Mapping in Zero-Reload Server Architectures: Eliminating
Application-Layer Latency and Extension Dependency in High-Concurrency CMS
personalised requests continue through the full WordPress stack.

This architecture is intended to reduce repeated bootstrap work, database
queries, and extension overhead while preserving WordPress compatibility. It
also provides a practical bridge between academic performance research and
everyday publishing workloads, including content-heavy sites, WooCommerce
catalogues, and membership-driven pages.

Research author: **Dean Nasrul Eam — Light & Composition University**.

= Eight-Subsystem Architecture =

1. **RAM-First Full-Page Cache Engine** — PHP stores complete HTML at
   `shutdown` and resolves repeat requests from the in-memory cache layer.
2. **Nginx / Apache Proxy Bridge** — Static or dynamic server config bypasses
   PHP entirely for cache hits.
3. **Selective Bypass Cookie Router** — `sys_active_state` cookie routes
   logged-in users and cart-active visitors to live PHP.
4. **Application Driver Profile Engine** — Auto-detects WooCommerce,
   LearnDash, LifterLMS, MemberPress, BuddyBoss and registers tailored bypass
   rules and invalidation hooks.
5. **Surgical Cache Invalidation** — Post save / nav menu / widget / theme
   switch events trigger precise per-URL or full purges.
6. **REST API State Endpoint** — `/wp-json/lumencache/v1/user-state` serves
   personalised fragments for skeleton-hydration clients.
7. **Skeleton Hydration DOM Worker** — `skeleton-hydration.js` replaces cached
   placeholders with live content on load.
8. **WP-CLI Management Interface** — `flush`, `flush-url`, `status` commands.

= Configuration (optional) =

All settings are configurable from **LumenCache → Settings** in the WordPress
admin. Optionally override any setting via wp-config.php — constants always win:

    define( 'LUMENCACHE_REDIS_HOST',          '127.0.0.1' );
    define( 'LUMENCACHE_REDIS_PORT',          6379 );
    define( 'LUMENCACHE_REDIS_SOCKET',        '' );
    define( 'LUMENCACHE_REDIS_PASSWORD',      '' );
    define( 'LUMENCACHE_REDIS_DATABASE',      0 );
    define( 'LUMENCACHE_REDIS_TIMEOUT',       1.0 );
    define( 'LUMENCACHE_REDIS_PREFIX',        'cache:' );
    define( 'LUMENCACHE_CACHE_TTL',           86400 );
    define( 'LUMENCACHE_CACHE_SALT',          '' );
    define( 'LUMENCACHE_CACHE_QUERY_STRINGS', false );
    define( 'LUMENCACHE_PROXY_PASSWORD',      '' );

= WP-CLI =

    wp lumencache flush
    wp lumencache flush-url https://example.com/page/
    wp lumencache status

== Installation ==

== Privacy ==

LumenCache stores rendered page HTML and cache metadata in the in-memory cache
service configured by the site administrator. It does not send cache contents,
visitor data, or analytics data to a third-party LumenCache service. The
optional user-state endpoint returns only the requested dynamic values to the
requesting browser; sites should review those values and their own privacy
policy before enabling personalized hydration.

== Frequently Asked Questions ==

= Getting a 502 Bad Gateway on Nginx after activating or during WooCommerce use? =

Nginx has a default `fastcgi_buffer_size` of only 4KB–8KB. When combining rich caching headers with WooCommerce session cookies, the upstream response header exceeds this limit. Nginx immediately terminates the connection with:
`upstream sent too big header while reading response header from upstream`, resulting in an instant 502 Bad Gateway error.

To resolve this, add the following FastCGI and proxy buffer directives to your Nginx configuration (within the `http {}`, `server {}`, or PHP `location` block):

    fastcgi_buffer_size 32k;
    fastcgi_buffers 16 16k;
    fastcgi_busy_buffers_size 32k;
    proxy_buffer_size 32k;
    proxy_buffers 16 16k;
    proxy_busy_buffers_size 32k;

After adding these directives, test and reload Nginx:
    nginx -t && systemctl reload nginx

= Why are 0 pages cached? =

Two common causes:
1. **Nginx config not applied** — visit Server Setup and paste the config blocks.
2. **WooCommerce session cookie** — fixed in v1.1.0. Previous versions bypassed
   the cache for *all* visitors on WooCommerce sites due to the always-present
   `wp_woocommerce_session_*` cookie.

= Why can key salting affect server-level caching? =

When `LUMENCACHE_CACHE_SALT` is set, PHP stores keys as SHA-256 hashes. A
server-level configuration must use the same key strategy or it will produce
cache misses. Disable the salt for a plain-key configuration, or use the
compatible hashed-key server template.

= Does LumenCache work with LiteSpeed? =

Yes. LiteSpeed supports Apache-compatible `.htaccess` rewrites. LumenCache uses
the Apache proxy mode on LiteSpeed. For better performance, ask your host
which in-memory cache acceleration options are available.

= Can I still use wp-config.php constants? =

Yes — constants always take precedence over admin settings. If you define a
constant, the corresponding field in the Settings tab is shown locked (read-only).

== Changelog ==

= 1.6.34 (September 15, 2026) =
* PRO COMPATIBILITY: Hardened `lumencache_is_pro_active()` to verify `defined( 'LUMENCACHE_PRO_VERSION' ) && get_option( 'lumencache_pro_status' ) === 'active'`, preventing false positive status if the Pro add-on is deactivated or uninstalled.
* CLOUDFLARE EDGE SYNC: Hooked `lumencache_purge_urls` into single-URL purge operations (`purge_url`), ensuring Admin Bar "Purge This URL" and WP-CLI `flush-url` actions automatically purge Cloudflare edge cache alongside local Redis.
* APACHE & LITESPEED TELEMETRY: Added Pro hit-counter telemetry parity to the pre-bootstrap proxy (`server/lumen-cache-proxy.php`) on cache HITs, and updated `Drop_In::write_config()` to synchronize compiled `pro_active` state to deployed proxy files.
* ADMIN ACTIONS CONTEXT: Injected `from_tab` retention to the Cloudflare purge form on the Cache Controls page, keeping administrators on their current tab after purging.

= 1.6.33 (September 15, 2026) =
* ADMIN BAR: Added contextual "Purge This URL" sub-node when viewing frontend content, enabling instant single-URL cache invalidation directly from the toolbar without flushing the entire site.
* DASHBOARD WIDGET: Retained administrator on `wp-admin/index.php` after flushing cache via `redirect_to` handling, complete with dismissible success notice and refined button hover styling.
* WP-CLI: Enhanced `wp lumencache status` with `--format` support (table, json, yaml, csv) and drop-in / `WP_CACHE` status visibility; aligned `flush-url` output with semantic WP-CLI warning conventions.
* REST API & HOLE-PUNCHING: Automated WooCommerce cart and session initialization (`wc_load_cart`) during REST API user-state hydration requests; added LifterLMS course-progress resolution support.
* REST API EXTENSIBILITY: Introduced `lumencache_user_state_keys` and `lumencache_resolve_user_state_{$key}` filters for developer extensibility.
* NONCE HARDENING: Supported both query parameter and `X-WP-Nonce` header authentication across REST user-state hydration and Admin Bar AJAX flush handlers.

= 1.6.32 (September 15, 2026) =
* SETTINGS & CONNECTION TEST: Added native AJAX Redis connection testing (`lumencache_test_redis`) supporting both phpredis and Predis drivers, Unix sockets, host/port, database indexes, connection timeouts, and authentication passwords.
* UI & TAB NAVIGATION: Implemented seamless browser URL synchronization (`history.replaceState`) on sidebar tab switches, preventing stale tab states across page reloads.
* QUICK SETUP TRACKER: Enabled 1-click execution for Apache / LiteSpeed rewrite rule generation directly from the Quick Setup Tracker on the Overview tab, eliminating unnecessary navigation steps.
* ADMIN ACTION REDIRECTS: Added contextual `tab` and `from_tab` state retention across all admin actions (cache flushes, drop-in deployment, settings save, salt save, and rewrite operations), preserving the user's active view after every submission.
* SETTINGS HARDENING: Enhanced password field handling to preserve special characters and ensured default namespace fallback (`cache:`) when clearing key prefix.
* SETTINGS CACHE: Added `Settings::reset_cache()` method to reset in-process configuration memory.

= 1.6.31 (September 15, 2026) =
* NGINX: Synchronized `nginx_map_block()` and sample Nginx configurations with `wp-postpass_` and `comment_author_` cookie bypass rules, preventing cached responses for unlocked password-protected posts and returning commenters.
* APACHE & LITESPEED: Enhanced `.htaccess` rewrite rules to directly exclude `/feed/` requests and XML sitemaps before proxy evaluation, avoiding unnecessary PHP execution overhead.
* APACHE & LITESPEED: Added explicit `wp-postpass_` and `comment_author_` cookie rewrite conditions to `.htaccess` configuration.
* PROXY DEPLOYMENT: Hardened `Htaccess::deploy_proxy()` to verify and ensure target upload directory existence with `wp_mkdir_p()`.
* PRE-BOOTSTRAP PROXY & DROP-IN: Aligned socket connection timeouts, `\Redis::OPT_READ_TIMEOUT`, Predis `read_write_timeout`, and `comment_author_` cookie bypass across both `server/lumen-cache-proxy.php` and `server/advanced-cache.php`.

= 1.6.30 (September 15, 2026) =
* TIMEOUT: Added explicit connection and read timeouts for phpredis (`\Redis::OPT_READ_TIMEOUT`) and Predis (`read_write_timeout`) to protect PHP worker processes from hanging on stalled Redis operations.
* SOCKETS: Added explicit timeout to phpredis Unix socket connections and cleaned up TCP host/port parameters on Predis socket connections.
* LATENCY & QUERY OPTIMIZATION: Implemented in-memory memoization and transient caching for `key_count()` to eliminate redundant full-keyspace SCAN operations across admin page views.
* ARRAY SAFETY: Hardened `delete()` and `delete_pattern()` against PHP 8.1+ argument unpacking errors by guaranteeing integer-indexed array keys with `array_values()`.
* TELEMETRY: Standardized memory extraction in `memory_used()` across both phpredis and Predis drivers for accurate RAM usage reporting.
* RECONNECT: Added `reconnect()` and `get_prefix()` helper methods to `Redis_Connector`.

= 1.6.29 (September 15, 2026) =
* FIX: Protected logged-in sessions in Cookie Router (`clear_active_cookie()`) when WooCommerce cart is emptied or subscriptions stop, ensuring `sys_active_state` cookie is preserved while user remains logged in.
* FIX: Expanded WooCommerce bypass routes across early drop-in, proxy, and application drivers to include `/wc-api/` to safeguard payment gateway callbacks and webhooks from being cached.
* FIX: Hooked `woocommerce_variation_set_stock` to immediately purge stale caches when variable product inventory levels are updated.
* HARDENING: Dynamic cookie path and domain resolution in `send_cookie()` with reverse proxy HTTPS detection via `HTTP_X_FORWARDED_PROTO`.

= 1.6.28 (September 15, 2026) =
* FIX: Added universal WordPress DONOTCACHEPAGE constant compliance in both bypass decision and shutdown write checks.
* FIX: Added contextual bypass checks in Cache_Engine for 404 pages, post draft previews, customizer previews, robots.txt, trackbacks, XML-RPC, and password-protected posts (`wp-postpass_` cookie).
* HARDENING: Added PHP fatal error detection (`error_get_last()`) during output buffer capture to guarantee broken pages or fatal errors are never written to cache.
* INVALIDATION: Added surgical invalidation for post status transitions (`transition_post_status`) so unpublishing or trashing a post immediately clears its cached HTML from Redis.
* INVALIDATION: Added post comment and review invalidation hooks (`comment_post`, `edit_comment`, `wp_set_comment_status`, `delete_comment`, `trashed_comment`, `spammed_comment`) and `created_term`.
* PERFORMANCE: Optimized post purging with batched multi-key Redis DEL execution and automated invalidation of all taxonomy archive URLs (categories, tags) associated with the updated post.
* REVERSE PROXY: Aligned HTTPS scheme detection across Cache_Engine, advanced-cache.php, and lumen-cache-proxy.php behind SSL-terminating reverse proxies.

= 1.6.27 (September 15, 2026) =
* FIX: Synchronized pre-bootstrap Apache/LiteSpeed proxy (`lumen-cache-proxy.php`) with complete feed bypass rules (`/feed/` and `?feed=`) to prevent XML feeds from caching as HTML.
* FIX: Expanded XML sitemap bypass in both `advanced-cache.php` and `lumen-cache-proxy.php` to cover core WordPress (`wp-sitemap`), standard sitemaps (`sitemap_index`), and paginated variants.
* FIX: Automated compiled configuration snapshot synchronization into deployed `wp-content/uploads/lumen-cache-proxy.php` on file deployment and settings save.

= 1.6.26 (September 15, 2026) =
* DOCS: Added Nginx 502 Bad Gateway troubleshooting FAQ and recommended 32KB FastCGI/Proxy buffer configuration directives.
* SERVER CONFIG: Updated Nginx global and per-site templates with 32k FastCGI and Proxy buffer directives to eliminate "upstream sent too big header" errors.
* UI: Added high-performance buffer configuration callout in Server Setup and Hosting Guide for Plesk and Nginx + PHP-FPM environments.
* PRO: Added Nginx FastCGI buffer size recommendation to Config Consistency Checker.

= 1.6.25 (September 4, 2026) =
* FEATURE: Added mobile admin bar quick-action button adjacent to native new-content icon (hook priority 71) with responsive display on viewports <= 782px.
* UI: Integrated dashicons-performance tachometer icon inside a touch-friendly 46px target with live Redis connection indicator dot.
* UX: Implemented high-contrast, Apple-grade backdrop-blurred confirmation modal ("Clear All Cache?") to prevent accidental cache purges on touch devices.
* PERFORMANCE: Asynchronous non-blocking AJAX cache purge with spinning telemetry feedback, dynamic page count reset, and floating feedback toast notification.

= 1.6.24 (August 23, 2026) =
* COMPATIBILITY: Tested and verified full compatibility with WordPress 7.1.
* PERFORMANCE: Verified pre-bootstrap drop-in execution, cache purging hooks, and REST API user-state endpoints on WordPress 7.1.

= 1.6.23 (August 15, 2026) =
* SECURITY: Added explicit ABSPATH direct access guard to `server/lumen-cache-proxy.php`.
* IMPROVEMENT: Updated `Htaccess::deploy_proxy()` to automatically configure localized ABSPATH definitions upon file deployment.

= 1.6.22 (August 15, 2026) =
* COMPLIANCE: Full compliance with WordPress.org Guideline 5; streamlined UI with clean external Pro link.
* DROP-IN: `advanced-cache.php` is now completely self-contained with compiled configuration snapshot data.
* SANITIZATION: Strict input and header sanitization against CRLF injection across all pre-bootstrap request paths.

= 1.6.21 (August 14, 2026) =
* HOUSEKEEPING: Updated Plugin URI to point to the official Dev Lab page.

= 1.6.20 (August 11, 2026) =
* FIX: Adjusted Quick Setup step flex rules in `assets/css/admin.css` to prevent connector lines from overlapping labels.

= 1.6.19 (August 11, 2026) =
* FIX: Replaced WordPress functions in `lumen-cache-proxy.php` with native PHP casts since the proxy runs pre-bootstrap.
* FIX: Corrected root path calculation (`LUMENCACHE_PROXY_ABSPATH`) for WordPress `index.php` and `wp-config.php` inclusion.

= 1.6.18 (August 11, 2026) =
* FIX: Added return value check on `$redis->auth()` and `$redis->select()` in `connect_phpredis()`.

= 1.6.17 (August 11, 2026) =
* PERF: Guarded debug string concatenation behind an explicit `LUMENCACHE_DEBUG` check for zero production overhead.

= 1.6.16 (August 11, 2026) =
* FIX: Replaced non-existent WordPress helper calls in `advanced-cache.php` with native PHP casts and isset checks.
* FIX: Corrected `enable_wp_cache()` string replacement logic for reliable `WP_CACHE` insertion into `wp-config.php`.

= 1.6.15 (August 11, 2026) =
* FIX: `Lifecycle::uninstall()` now flushes all Redis keys before removing plugin files.
* FIX: Corrected connection source label in Settings for manually-entered host/port settings.

= 1.6.14 (August 11, 2026) =
* SECURITY: Added direct file access protection via `ABSPATH` check to all server drop-ins.
* SANITIZATION: Sanitized all `$_SERVER` inputs across pre-bootstrap request paths.

= 1.6.13 (August 11, 2026) =
* FIX: Prevented RSS/Atom feeds from caching to avoid incorrect `Content-Type: text/html` response headers.
* FIX: Hardened URL sanitization in manual cache purge handler using `esc_url_raw()`.

= 1.6.12 (August 10, 2026) =
* NEW: Built-in WooCommerce cart-fragments guard against crawler-triggered fragment storms.

= 1.6.11 (August 9, 2026) =
* COMPLIANCE: Standardized update delivery on the official WordPress.org channel.
* DOCS: Added direct SSH installation instructions for Plesk in the Hosting Guide.

= 1.6.10 (August 9, 2026) =
* NEW: Added RAM Cache Engine connectivity check to Quick Setup and introduced the Hosting Guide tab.

= 1.6.9 (August 9, 2026) =
* IMPROVED: Quick Setup tracker review drawer for active, fully-configured sites.

= 1.6.8 (August 9, 2026) =
* NEW: Added interactive 4-step Quick Setup progress tracker on the Overview tab.

= 1.6.7 (August 9, 2026) =
* FIX: Aligned admin card headers and status badges across dashboard screens.

= 1.6.6 (August 8, 2026) =
* SECURITY: Synchronized MemberPress session cookie matching across Nginx, Apache, and PHP drivers.

= 1.6.5 (August 8, 2026) =
* FIX: Updated navigation references and doc comments for modular settings architecture.

= 1.6.4 (August 8, 2026) =
* UX: Refined dashboard sidebar layout with dedicated feature navigation panels.

= 1.6.3 (August 8, 2026) =
* CRITICAL: Added foreign drop-in protection to prevent overwriting existing third-party cache drop-ins.
* FIX: Aligned Redis timeout defaults and safety bypasses for dynamic/personal routes across all readers.
* FIX: Added non-HTML response rejection to prevent caching API/JSON payloads as HTML.

= 1.6.2 =
* IMPROVED: Refined update channel integration for WordPress.org directory hosting.

= 1.6.1 =
* UX: Instant click-to-show tabs across dashboard navigation.
* FIX: Fixed Admin Bar quick link URL routing.

= 1.6.0 =
* ARCHITECTURE: Split into clean Standard core with modular action/filter extensibility.
* UX: Single-page admin navigation shell with collapsible sidebar.

= 1.5.1 =
* FIX: Corrected LiteSpeed / OpenLiteSpeed server detection order.
* FIX: Added safe commented placeholders for salted Nginx configurations.

= 1.5.0 =
* NEW: Added Cloudflare edge cache purge integration support.

= 1.4.0 =
* NEW: Added cache telemetry diagnostics, bypass-reason counters, and connection test tooling.

= 1.3.0 =
* NEW: Automatic detection and bypass integration for XML sitemaps.

= 1.2.9 =
* NEW: Automatic application driver integration for educational courses and custom post types.

= 1.2.8 =
* COMPATIBILITY: Verified compatibility with WordPress 7.0 and PHP 8.5.

= 1.2.7 =
* FIX: Intelligent handling of all three `WP_CACHE` states in `wp-config.php` and automated cleanup on deactivation.

= 1.2.6 =
* UX: Added context-aware validation for Nginx key salting configurations.

= 1.2.5 =
* UX: Context-aware badges in Security Hardening Matrix and direct key salt generator.

= 1.2.4 =
* FIX: Added tracking-parameter stripping to Apache proxy to maintain parity with PHP cache keys.

= 1.2.3 =
* CRITICAL: Fixed phpredis `SCAN` cursor handling in `key_count()` and `delete_pattern()`.

= 1.2.2 =
* FIX: Automated stripping of 14 marketing tracking query parameters (Google Shopping, Meta Ads, etc.).

= 1.2.1 =
* FIX: Added connection return validation in `connect_phpredis()` and refined Unix socket handling.

= 1.2.0 =
* FIX: Output buffering rebuild for PHP-FPM and Nginx FastCGI environments.

= 1.1.1 =
* NEW: Standalone `advanced-cache.php` drop-in deployment with zero server configuration requirements.

= 1.1.0 =
* NEW: Admin settings interface, Admin Bar menu, and WP Dashboard widget.
* FIX: Resolved WooCommerce session cookie over-bypass for dramatic cache hit rate improvements.

= 1.0.3 =
* Initial public release.

== Upgrade Notice ==

= 1.6.34 =
Comprehensive audit and hardening release across all 8 core caching pipelines, including early drop-in execution, selective bypass cookie router, Redis multi-driver resilience, contextual Admin Bar & WP-CLI invalidation, and Cloudflare edge synchronization.

= 1.6.27 =
Hardened early drop-in and Apache/LiteSpeed proxy feed/sitemap bypass parity and automated config snapshot compilation.

= 1.6.26 =
Recommended update for all Nginx, Plesk, and WooCommerce environments with official 502 Bad Gateway buffer resolution.

= 1.6.24 =
WordPress 7.1 compatibility release. Recommended update for all users.
