WP Manifestindependent plugin directory
manifest / performance / opcache-preload-generator

OPcache Preload Generator WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin that generates OPcache preload files based on runtime statistics

★ 1stars
12release downloads
≈10active sites
v1.1.1latest · 2mo ago

Install

Download opcache-preload-generator.zip From the v1.1.1 release on GitHub, Aug 20, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ultimate-multisite/opcache-preload-generator/releases/download/v1.1.1/opcache-preload-generator.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Download Plugin Now   Upload the zip to WordPress like any other plugin

⚠️ Advanced Users Only - This plugin is intended for system administrators and developers. It requires server-level access to modify php.ini and restart PHP processes.

🚫 Not for Shared Hosting - OPcache preloading requires dedicated server access. This will NOT work on shared hosting environments where you don't have control over the PHP configuration.

A WordPress plugin that generates OPcache preload files based on runtime statistics with safety analysis.

Description

OPcache Preload Generator analyzes your WordPress site's OPcache usage patterns and creates optimized preload files for PHP's OPcache preloading feature (PHP 7.4+).

The plugin automatically identifies which PHP files are most frequently accessed and would benefit most from preloading, while filtering out files that could cause issues.

You should use this plugin if:

  • You manage your own server (VPS, dedicated, or cloud instance)
  • You have SSH/root access to modify php.ini
  • You can restart PHP-FPM or your web server
  • You understand the implications of PHP preloading

Do NOT use this plugin if:

  • You're on shared hosting (SiteGround, Bluehost, GoDaddy, etc.)
  • You cannot access or modify php.ini
  • You cannot restart your web server
  • You're not comfortable with server administration

Features

  • Automatic File Detection - Uses OPcache statistics to identify hot files
  • Smart Reference Algorithm - Uses WordPress core files as reference points for threshold calculation
  • Safety Analysis - Filters files with side effects, dependency issues, or conflicts
  • Interactive Threshold Slider - Visual control over how many files to include
  • Context-Aware UI - Different workflows for new users, file generated, and active states
  • File Preview - See which files will be included before generating

Requirements

  • PHP 7.4 or higher
  • WordPress 5.3 or higher
  • OPcache extension enabled
  • Server access to configure php.ini

Installation

  1. Upload the plugin files to /wp-content/plugins/opcache-preload-generator/
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Go to Settings → OPcache Preload (Network Admin for multisite)

Usage

For New Users (No Preload File)

  1. Click "Advanced Options" to expand settings
  2. Adjust the Hit Threshold slider:
    • Lower % = more files, higher cutoff
    • Higher % = fewer files, lower cutoff
  3. Review the Candidate Files Preview
  4. Click "Generate Preload File"

After Generating

  1. Copy the PHP configuration shown
  2. Add to your php.ini:
    opcache.preload=/path/to/wordpress/preload.php
    opcache.preload_user=www-data
  3. Restart PHP-FPM or your web server

Regenerating

Use "Regenerate Preload File" to update the preload file with current OPcache statistics. Recommended periodically or after major updates.

How It Works

  1. Reference File Detection: Finds a WordPress core file (l10n.php, option.php, etc.) that's loaded on every request
  2. Threshold Calculation: reference_hits × threshold_percentage = cutoff_hits
  3. File Selection: Includes all files with hits >= cutoff_hits
  4. Safety Filtering: Excludes files with side effects or dependency issues
  5. Preload Generation: Creates a preload.php file with opcache_compile_file() calls

Project Structure

opcache-preload-generator/
├── opcache-preload-generator.php    # Plugin entry point
├── inc/
│   ├── class-plugin.php           # Main plugin class
│   ├── class-opcache-analyzer.php # OPcache statistics analysis
│   ├── class-preload-generator.php # Preload file generation
│   ├── class-file-safety-analyzer.php  # Safety checks
│   ├── class-admin-page.php       # Admin UI
│   ├── class-ajax-handler.php     # AJAX endpoints
│   └── ...
├── views/                         # Admin templates
├── assets/                        # CSS and JS
└── tests/                         # PHPUnit tests

Development

Setup

composer install
npm install

Running Tests

vendor/bin/phpunit

Code Standards

vendor/bin/phpcs
vendor/bin/phpcbf  # Auto-fix

Safety Analysis

The plugin checks files for:

  • Side Effects - Code that executes on include (echo, direct calls)
  • Dependency Issues - Classes extending unavailable classes
  • Define Conflicts - Multiple define() calls
  • Path Constants - DIR/FILE usage in class properties
  • Blacklisted Files - Known problematic WordPress core files

FAQ

Why don't I see more files when lowering the threshold?

If all your cached files have high hit counts, lowering the threshold won't show more files. The cutoff is relative to the reference file's hit count.

Why does the reference file hit count keep increasing?

The reference file's hit count grows as the OPcache warms up. This is normal and expected.

Is preloading right for my site?

Best for production sites with stable code. Changes to preloaded files require a PHP-FPM restart.

License

GPLv3 or later. See LICENSE.

Credits

Created by David Stone - Multisite Ultimate

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.1 latest
Aug 20, 2026 2mo ago
opcache-preload-generator.zip
3
Mar 27, 2026 7mo ago
opcache-preload-generator.zip
9

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

OPcache Preload Generator 1.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.1
Findings
1
Worst severity
high
Content hash
37b6ef22fc7c108ade25ae27…

Findings

  • high CLI bearer token stored at a hardcoded web-accessible path bypasses REST manage_options

    auth_bypass

    WP-CLI talks to the web SAPI via GET /wp-json/opcache-preload/v1/{opcache-status,candidates}. Cookie+nonce cannot cross the CLI/FPM process boundary, so CLI_Command::get_or_create_auth_token() writes a 64-character wp_generate_password token as JSON to Rest_API::AUTH_TOKEN_FILE, which is the constant path WP_CONTENT_DIR/.opcache_preload_auth_token (typically https://site/wp-content/.opcache_preload_auth_token). Rest_API::check_permissions() treats a matching X-OPcache-Preload-Token header as full authorization and never consults current_user_can. chmod 0600 after the write only hides the file from other OS users; the web server uid that created it will still serve it. WordPress does not deny dotfiles under wp-content, and delete_auth_token() is defined but never invoked, so the token remains valid for the full 5-minute TTL after every `wp opcache-preload generate|status|candidates` run. An unauthenticated client that fetches the JSON during that window can call get_opcache_status (opcache_get_status(true) plus configuration, memory, preload_user) and get_candidates (absolute PHP paths, optional skip_safety). These routes are otherwise limited to manage_options / manage_network_options. The REST surface is read-only (no generate/delete), but the leak is a complete map of the PHP application and hosting homedir.

    inc/class-rest-api.php:40,121-190

    Recommendation

    Do not store the bearer token under a web-reachable directory with a stable name. Write it outside the docroot (e.g. sys_get_temp_dir() or a randomized filename under a directory with a Deny from all / location ~ /\. htaccess), or share the secret via the options table with a CLI-only name that object-cache plugins cannot split. Unlink the file immediately after the HTTP round-trip (call delete_auth_token()). Keep chmod 0600 but do not treat it as an HTTP control. Optionally require the token file to be unreadable by the web vhost user, or send the token over a loopback-only bind.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.