=== Cartpace ===
Contributors: quellbox
Tags: performance, cache, page speed, optimization, core web vitals
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Speed optimization for WooCommerce that tells you what is actually slowing you down — without breaking your cart or checkout.

== Description ==

Cartpace starts by telling you what is wrong: whether your cache is genuinely working, which pages are quietly excluded and why, what is clearing your cache repeatedly through the day, and how much weight your store is carrying on every request. That diagnosis is free.

Then it fixes things, carefully. Nothing that can change how a page looks is switched on when you activate. Every risky option is grouped as risky, says what it can break, and loads four of your real pages to check them before the change goes live — undoing itself automatically if one comes back broken.

= What it does =

**It answers "why is my cache not working?"**
A live check that asks your own site for a page twice and reads the headers that come back. When a page is not cached it names the reason: a cookie, a query string, an exclusion rule, a logged-in visitor.

**It is built for stores.**
Cart, checkout and account pages are locked out of the cache and cannot be switched on. WooCommerce's cart-fragments script — an AJAX request on every page view, on most of which the cart is empty — can be made conditional instead of simply removed, so the live cart count keeps working. Product pages clear themselves when a price or stock status changes.

**It stands down when it should.**
On a managed host with server-level caching, or alongside another page cache plugin, Cartpace switches its own page cache off and tells you who owns the job. Everything else keeps running.

**Safety is free, always.**
Safe mode, an emergency bypass link that works without wp-admin, undo history, pre-flight page checks, and config export and import. None of it is behind a paywall.

= Free =

* Page caching with store-safe exclusions, mobile variants and gzip
* Browser caching and compression rules
* Cache warming with strict rate limiting
* CSS, JavaScript and HTML minification
* Lazy loading, with the main image always excluded
* Delay JavaScript with built-in exclusions
* CDN URL rewriting, and connection hints for your other domains
* Clearing your host's own cache when we clear ours — WP Engine, Kinsta, SiteGround, LiteSpeed, Nginx and Cloudflare
* Heartbeat control and fourteen WordPress cleanup toggles
* Manual database cleanup, including a listing of autoloaded options
* **The full diagnosis panel**
* **The conditional cart-script fix**
* Managed-host and page-builder detection
* The complete safety suite

= Paid =

* The maintained delay-exclusion list, kept current as plugins change
* Remove unused CSS, built in the background so nobody waits
* Defer JavaScript
* Per-page file control with store conditions — cart state, product type, template
* Advanced store rules and multi-currency cache handling
* Daily checks with alerts that name what changed
* Builder profiles for Elementor, Divi, Bricks and WooCommerce Blocks
* Local fonts, main-image priority, lazy render, link preloading
* Analytics scripts served from your own domain, refreshed daily
* Scheduled database cleanup
* Agency plan: your name instead of ours, and a client report you can download as a PDF

The paid features are a separate plugin, Cartpace Pro, which you receive when you buy a licence. It is not part of this download and this plugin does not need it — everything listed under Free above works on its own, forever, and nothing here nags you about the rest.

== Installation ==

1. Upload the plugin, or install it from the plugin directory.
2. Activate it. Only safe options are switched on — nothing that can change how a page looks.
3. Open **Cartpace**. The first-run scan is read-only and shows you exactly what it would change before it changes anything.

If you have bought a licence, install Cartpace Pro alongside this plugin and paste your key under **Cartpace → Your licence**.

== Frequently Asked Questions ==

= Will this break my checkout? =

Cart, checkout and account pages are excluded from the cache at the drop-in level and cannot be switched on. Files your checkout depends on cannot be disabled by the file manager. And every risky setting runs a page check before it takes effect.

= My host already caches pages. Should I still use this? =

Yes, and Cartpace will switch its own page cache off for you and say so. Asset control, store rules and the diagnosis are all still worth having.

= What if something breaks and I cannot reach wp-admin? =

Open your emergency link. It switches every optimisation off without a login. You will find it under Settings → Safety; save it somewhere now rather than when you need it.

= Does it compress images? =

No. Image compression is a separate job, best handled by a dedicated image plugin. Cartpace will tell you when an image is oversized, and runs happily alongside one.

= Does it need Redis? =

No, and it will not try to configure it. If Redis is available it will say so and point you at the Redis Object Cache plugin, which is built for that job.

= What does it change outside its own folder? =

Three things, all of them reversible, and all of them undone when you deactivate the plugin:

* `wp-content/advanced-cache.php` — the drop-in that answers a cached page before WordPress loads. Written when you switch page caching on. If the file already belongs to another plugin, Cartpace leaves it alone and tells you so.
* `WP_CACHE` in `wp-config.php` — one line, added beside the drop-in because WordPress will not load a drop-in without it. If the file is not writable, Cartpace says so and asks you to add the line yourself rather than failing silently.
* `.htaccess` — a browser-caching and compression block, only on Apache and LiteSpeed, and only when you switch those options on. It is written between marker comments and removed cleanly.

Deactivating the plugin removes all three. Nothing is left behind for you to find later.

== External services ==

Cartpace contacts two outside services, and neither of them on a normal page view. A site that never enters a licence key and never enters a Cloudflare token contacts nothing at all — the diagnosis, the cache checks and the pre-flight checks all ask *your own site* for pages, which is a request from your server to your server.

**The Cartpace licence server — cartpace-api.quellbox.com**

Used only if you have bought a licence and typed the key in. It is contacted when you activate a key, when you release it, and once a day after that to confirm the licence is still valid.

What is sent: the licence key you typed, your site address, and the plugin version. Nothing else — no post content, no visitor data, no email address, no statistics.

If it cannot be reached, nothing on your site changes. There is no request at all until you enter a key.

Terms: https://quellbox.com/terms/ — Privacy: https://quellbox.com/privacy/

**Cloudflare — api.cloudflare.com**

Used only if you switch Cloudflare purging on and enter your own zone ID and API token. It is contacted when Cartpace clears its cache, so that Cloudflare's copy is cleared too.

What is sent: your zone ID, your API token, and the addresses of the pages being cleared. This is Cloudflare's own API, used with your own credentials, and Cartpace stores the token on your site and nowhere else.

Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

== Screenshots ==

1. Overview — what is working, and the one thing worth doing next
2. Recommendations — ranked by what is worth doing, each saying how confident we are
3. Diagnosis — evidence-based checks, each with a plain-language explanation
4. Settings — grouped by risk, not by "basic" and "advanced"
5. Store rules — the cart-script fix and product cache invalidation
6. Safety — safe mode, the emergency link, undo history

== Changelog ==

= 1.0.1 =
* Every `$_SERVER` and `$_COOKIE` value is now sanitized where it is read.
* The WP-CLI export writes only inside a protected folder in `wp-content/uploads`, and through `WP_Filesystem`.
* The optimisation output buffer is now closed explicitly on shutdown instead of being left to PHP.
* The one-time setup notice is limited to the dashboard and plugins screens, and is dismissible.

= 1.0.0 =
* First release.
