Is there any way to automatically update our version of W3TC to the fix-W3TC version that and admin commented below will be deployed? I have a lot of sites to apply it to, FTPing the files will take ages.

Good news, the plugin was updated 3 hours ago and fixes XSS vulnerability.

We are following this closely and discussing options.

Cloudways Team

Could you please investigate the security issue with W3 Total Cache plugin. The vulnerable version is preinstalled and activated by default on every Cloudways WordPress installation.

Here few sources describing the high risk XSS vulnerability issue:

https://wptavern.com/high-risk-xss-vulnerability-discovered-in-w3-total-cache-plugin

https://wordpress.org/support/topic/vulnerability-version-0941-allows-an-attacker-upload-of-malicious-files/

https://yoast.com/w3-total-cache/

https://wptavern.com/high-risk-xss-vulnerability-discovered-in-w3-total-cache-plugin

By now we are keeping W3 Total Cache and deploying on top of it https://github.com/szepeviktor/fix-w3tc to keep it updated and supporting latest features.

None of the other free plugins we have tried has given us the level of flexibility W3 Total Cache does.

Of course, the best alternative we have found is paid WP Rocket https://support.cloudways.com/how-to-configure-wp-rocket-plugin-wordpress/ that integrates pretty well with our platform.

We continue to scan what is available and listen to your suggestions for improvements.

W3TC + https://github.com/szepeviktor/fix-w3tc will be deployed in next few weeks.

Cloudways Team

I agree that W3TotalCache should not be installed. It will cost me time to remove it. It is effectively abandoned, which means that whilst it may work, it may also pose a security risk. I do not agree about installing any plugins. This is what GoDaddy do and it is annoying. If I HAD to vote for one, it would be CometCache simply because they are proactive and constantly develop the plugin. I know they are working on nginx AND Redis support (it works with them, but they want to fully take advantage of them).

Another vote for https://github.com/szepeviktor/fix-w3tc

It is fine to use w3 but full tutorial to set it along with your services like redis, varnish, etc. how?

I've tested this on a wordpress 4.6 site with ssl enabled and works great https://wordpress.org/plugins/simple-cache/
I can load the homepage in 0.6 seconds.
Looking forward.

have a look, customized W3 Total Cache:

https://github.com/szepeviktor/fix-w3tc

support all features of wp-rocket!

I am currently using the below and everything works great. I haven't seen any errors or compatibility issues with W3TC. With that said I am interested in what Cloudways is working on.

-WordPress Multisite 4.6
-PHP7
-MariaDB 10
-W3TC with object cache disabled.
-Redis Object Cache
-Varnish enabled
-Cloudflare CDN

I had a tech support agent disable W3TC on all of my applications last week. I was having troubles with sites not loading properly, white screens, etc.

His response? All issues were caused by W3TC, and he thinks it's because I was on PHP7, which is incompatible without a half dozen file edits of plugin code. (I was one PHP7 for weeks prior to the errors, however).

But once he disabled it, all sites went back to normal.

How is it that a preinstalled plugin that's deemed crucial for varnish to work doesn't even function with PHP7, which is becoming standard?

+3 votes to drop W3TC.

Hi Cloudways Team, any news on this?

"new tool to detect apps not optimally configured"

+3 for Comet Cache

Why?
Because they are one of the few who are updating the plugin regularly. They are even open to add new features on demand and I'm pretty sure they would work together with a cloud hosting platform like Cloudways.

They have a github page where team members and others can discuss new features and optimizations. I think the only thing that must be worked on would be varnish integration.

Spoke with tech support and asked why this thread is not being responded to... The reply:

"Yes, we are moving away from pre-installed plugin on new installations. We have already removed Wordfence installation which is no longer added."

"Yes, we plan to remove the pre-installation of W3TC as well."

Please, use eAccelerator instead.

The guys from the rtCamp (EasyEngine) believe that the best option for caching WordPress is Redis. They recommend using it for page caching and object caching instead fastcgi(!) and other options:

"...Sure you can use fastcgi for full page cache and Redis for object cache.
But doing so, you will observe fastcgi cache is slower than redis for full page cache.
So why use fastcgi if we are getting performance upgrade with redis?"
http://community.rtcamp.com/t/does-redis-still-require-w3tc/4824

Maybe we should use the following scheme instead W3TC:
1. Redis for full page caching with Nginx Helper Plugin https://wordpress.org/plugins/nginx-helper/
2. Redis for object caching with Redis Object Cache plugin https://wordpress.org/plugins/redis-cache/
3. Database Cache - not required https://github.com/EasyEngine/easyengine/issues/509
4. Varnish cache with Varnish HTTP Purge Plugin https://wordpress.org/plugins/varnish-http-purge/
5. Autoptimize Plugin for aggregating and minimizing JS, CSS and HTML https://wordpress.org/plugins/autoptimize/
6. Plugin for connecting to CDN e.g. https://wordpress.org/plugins/cdn-enabler/

+1 for KeyCDN (Max CDN has no servers in my region)

WP Rocket, but with Varnish, is not compatible with WPtouch Pro. :(