LumenCache

LumenCache implements a RAM-first full-page cache with a WordPress
advanced-cache.php drop-in. On a cache HIT, the drop-in serves complete HTML
before the normal WordPress bootstrap and database queries. This early-response
path reduces application-layer work and keeps repeat page requests fast across
Nginx, Apache, and LiteSpeed.

The cache is designed to fail open when its storage layer is unavailable, so a
cache connection problem does not take the WordPress site offline.

Research Foundation

Academic Reference:
“Dynamic Resource Mapping in Zero-Reload Server Architectures: Eliminating
Application-Layer Latency and Extension Dependency in High-Concurrency CMS
personalised requests continue through the full WordPress stack.

This architecture is intended to reduce repeated bootstrap work, database
queries, and extension overhead while preserving WordPress compatibility. It
also provides a practical bridge between academic performance research and
everyday publishing workloads, including content-heavy sites, WooCommerce
catalogues, and membership-driven pages.

Research author: Professor Nasrul Eam — Dean, Light & Composition University.

Ten-Subsystem Architecture

1. RAM-First Full-Page Cache Engine — PHP stores complete HTML at
   shutdown and resolves repeat requests from the in-memory cache layer.
2. Nginx / Apache Proxy Bridge — Static or dynamic server config bypasses
   PHP entirely for cache hits.
3. Selective Bypass Cookie Router — sys_active_state cookie routes
   logged-in users and cart-active visitors to live PHP.
4. Application Driver Profile Engine — Auto-detects WooCommerce,
   LearnDash, LifterLMS, MemberPress, BuddyBoss and registers tailored bypass
   rules and invalidation hooks.
5. Surgical Cache Invalidation — Post save / nav menu / widget / theme
   switch events trigger precise per-URL or full purges.
6. REST API State Endpoint — /wp-json/lumencache/v1/user-state serves
   personalised fragments for skeleton-hydration clients.
7. Skeleton Hydration DOM Worker — skeleton-hydration.js replaces cached
   placeholders with live content on load.
8. WP-CLI Management Interface — flush, flush-url, status commands.

Architectural Resilience Against Runtime Exploits (Case Study: php2shell / CVE-2026-109618 & CVE-2026-109619)

The recent critical vulnerabilities (such as the October 2026 php2shell flaws, CVE-2026-109618 and CVE-2026-109619) exploit internal memory management, request lifecycles, and Out-Of-Memory (OOM) error handling inside the C-level PHP engine itself. Whenever runtime vulnerabilities emerge, automated exploit scanners flood millions of WordPress websites searching for unauthenticated vulnerable endpoints.

LumenCache provides immediate defense-in-depth mitigation through its zero-worker server proxy architecture:

• Bypassing PHP Completely (Nginx / Apache / LiteSpeed Proxy Mode): When server-level proxy rules are enabled (Nginx FastCGI cache, redis_pass, or LiteSpeed .htaccess direct RAM rewrites), cache HIT requests never touch PHP-FPM or the PHP interpreter at all.
• Automated Exploit & Scanner Deflection: Malicious crawlers or automated exploit scanners scanning public cached URLs are intercepted at the web server layer and served raw static HTML directly from RAM. Because PHP is never invoked, the vulnerability cannot be triggered on those requests.
• Worker & Memory Starvation Defense: Protects against Out-Of-Memory (OOM) denial-of-service by keeping PHP-FPM worker pools 100% isolated for authentic logged-in users and checkout actions.

(Note: A caching plugin does not replace updating your server binaries; hosting administrators must still update PHP to patched point releases. LumenCache acts as an architectural first-line attack surface reducer).

Configuration (optional)

All settings are configurable from LumenCache → Settings in the WordPress
admin. Optionally override any setting via wp-config.php — constants always win:

define( 'LUMENCACHE_REDIS_HOST',          '127.0.0.1' );
define( 'LUMENCACHE_REDIS_PORT',          6379 );
define( 'LUMENCACHE_REDIS_SOCKET',        '' );
define( 'LUMENCACHE_REDIS_PASSWORD',      '' );
define( 'LUMENCACHE_REDIS_DATABASE',      0 );
define( 'LUMENCACHE_REDIS_TIMEOUT',       1.0 );
define( 'LUMENCACHE_REDIS_PREFIX',        'cache:' );
define( 'LUMENCACHE_CACHE_TTL',           86400 );
define( 'LUMENCACHE_CACHE_SALT',          '' );
define( 'LUMENCACHE_CACHE_QUERY_STRINGS', false );
define( 'LUMENCACHE_PROXY_PASSWORD',      '' );

WP-CLI

wp lumencache flush
wp lumencache flush-url https://example.com/page/
wp lumencache status<h3>Privacy</h3>

LumenCache stores rendered page HTML and cache metadata in the in-memory cache
service configured by the site administrator. It does not send cache contents,
visitor data, or analytics data to a third-party LumenCache service. The
optional user-state endpoint returns only the requested dynamic values to the
requesting browser; sites should review those values and their own privacy
policy before enabling personalized hydration.