A WordPress cache plugin that sends no data to third parties.
CachePilot talks to your Redis server and to your own site. It loads nothing on the front end except the minified copies of your own files, bundles its fonts and icons, and checks for updates only at update.cms-admins.de.
What holds on every site
Six properties of CachePilot 1.4.2 that do not depend on settings.
Which connections CachePilot opens, and why
Redis. The drop-in connects to the server you set, over TCP, TLS or a Unix socket. The password stays in your configuration.
Your own site. The page cache preload and the safety check request pages of your site. The safety check sends the User-Agent CachePilot SafetyCheck and no cookies, the preload the User-Agent CachePilot/PreloadManager.
Updates. CachePilot checks for new versions at update.cms-admins.de, a server of CMS ADMINS, only in the admin, in cron and in WP-CLI. The request carries the site URL and the installed version; the server sees the IP address.
E-mail. The weekly report goes through wp_mail() of your site to the admin address. There is no tracking of opens or clicks.
Licences
CachePilot and the code it bundles, with their licence texts.
- GNU General Public License, version 2 (TXT, 18 KB) The licence of the CachePilot plugin, GPL v2 or later.
- Apache License 2.0 of wikimedia/minify (TXT, 11 KB) wikimedia/minify 2.12.0, bundled under src/Vendor/Minify.
- SIL Open Font License 1.1 of Open Sans (TXT, 4 KB) Open Sans, bundled under assets/fonts.
Questions about security and privacy
Short answers for data protection officers and administrators.
Does CachePilot set cookies?
No. The page cache reads cookies to decide whether a page may come from the cache, for example the login cookie of WordPress or the currency cookie of WCML.
Where is the Redis password stored?
In the settings of CachePilot or in wp-config.php, and in the configuration file of the drop-in under wp-content/cache/cachepilot/. On Apache a .htaccess file blocks direct access to that folder.
Does the page cache store personal data?
It stores pages for visitors who are not logged in. Pages rendered with a WooCommerce session, cart notices or location-based prices are never stored.
Who can change the settings?
Users with the right to manage options, in a Multisite network only super admins.
Can I switch off the update check?
Yes. Define the constant CACHEPILOT_DISABLE_UPDATE_CHECK in wp-config.php. CachePilot then no longer asks update.cms-admins.de, and you install new versions by hand.
Beta
Test it under your own privacy rules.
Join the beta and check the network tab of your browser: nothing loads from other hosts. More in the FAQ and the benchmarks.