WP Manifestindependent plugin directory
manifest / performance / cache-refresher

Cache Refresher WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

A WordPress plugin to refresh your cache periodically or on-demand

★ 0stars
16release downloads
≈10active sites
v0.0.3latest · 4 years ago

Install

Download cache-refresher.zip From the v0.0.3 release on GitHub, Jan 27, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/joppuyo/cache-refresher/releases/download/v0.0.3/cache-refresher.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This is a WordPress plugin that allows you to refresh your cache periodically or on-demand.

And by refreshing, I mean it will ping your page using a HTTP GET request.

It's mostly useful when used in conjunction with microcaching or for warming your cache after a deployment.

The plugin works in the background using a queue so it will refresh one page at the time and thus will hopefully avoid overloading your server.

On demand

This allows you to refresh every page on your site. There are two methods you can use

HTTP request

You can refresh every page on your site by sending a GET request to an URL. You can find this URL under Options and Cache Refresher. It looks something like this:

https://example.com/wp-json/cache-refresher/v1/refresh-all?token=gnjvb5th13ken07nmwov9gqnt

You can ping it using your CI pipeline or something. I may add a button to the UI to do this also.

WP CLI

Run the following command

wp cache-refresher refresh-all

Scheduled refreshing

This plugin will refresh all pages on your site every day at 00:01 in the site time zone. I will maybe add some option to disable or customize this in the future.

Refresh on save

When you save or delete a post, the plugin will ping the permalink of that post. I will maybe add some option to disable or customize this in the future.

⚠️ Refresh on save doesn't use a queue. Instead it's done immediately after the save using an asynchronous request

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.0.3 latest
Jan 27, 2022 4 years ago
cache-refresher.zip
9
Jan 21, 2022 4 years ago
cache-refresher.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

A- grade

Security

Cache Refresher 0.0.3 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
0.0.3
Findings
1
Worst severity
low
Content hash
9f377c57fec804ed8aba2b0e…

Findings

  • low REST route admits everyone then relies on shared secret

    missing_permission_callback

    register_rest_route for /cache-refresher/v1/refresh-all sets permission_callback to a function that always returns true. Authorization is deferred to a query token compared with option cache_refresher_key. The token is strong (random_int) and only shown to manage_options, but the open permission_callback is unnecessary attack surface and breaks standard REST capability reporting.

    lib/Rest.php:36-77

    Recommendation

    Use a proper permission_callback (e.g. manage_options or a dedicated capability) or document the token as an application password-style secret and rate-limit failures.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.