LumenCache

LumenCache implements a RAM-first full-page cache with a WordPress

php drop-in. On a cache HIT, the drop-in serves complete HTML

before the normal WordPress bootstrap and database queries. This early-response

path reduces application-layer work and keeps repeat page requests fast across

Nginx, Apache, and LiteSpeed.

The cache is designed to fail open when its storage layer is unavailable, so a

cache connection problem does not take the WordPress site offline.

Research Foundation

Academic Reference:

“Dynamic Resource Mapping in Zero-Reload Server Architectures: Eliminating

Application-Layer Latency and Extension Dependency in High-Concurrency CMS

personalised requests continue through the full WordPress stack.

This architecture is intended to reduce repeated bootstrap work, database

queries, and extension overhead while preserving WordPress compatibility. It

also provides a practical bridge between academic performance research and

everyday publishing workloads, including content-heavy sites, WooCommerce

catalogues, and membership-driven pages.

Research author: Professor Nasrul Eam — Dean, Light & Composition University.

Ten-Subsystem Architecture

• RAM-First Full-Page Cache Engine — PHP stores complete HTML at

shutdown and resolves repeat requests from the in-memory cache layer.

• Nginx / Apache Proxy Bridge — Static or dynamic server config bypasses

PHP entirely for cache hits.

• Selective Bypass Cookie Router — sys_active_state cookie routes

logged-in users and cart-active visitors to live PHP.

• Application Driver Profile Engine — Auto-detects WooCommerce,

LearnDash, LifterLMS, MemberPress, BuddyBoss and registers tailored bypass

rules and invalidation hooks.

• Surgical Cache Invalidation — Post save / nav menu / widget / theme

switch events trigger precise per-URL or full purges.

• REST API State Endpoint — /wp-json/lumencache/v1/user-state serves

personalised fragments for skeleton-hydration clients.

• Skeleton Hydration DOM Worker — skeleton-hydration.js replaces cached

placeholders with live content on load.

• WP-CLI Management Interface — flush, flush-url, status commands.

Architectural Resilience Against Runtime Exploits (Case Study: php2shell / CVE-2026-109618 & CVE-2026-109619)

The recent critical vulnerabilities (such as the October 2026 php2shell flaws, CVE-2026-109618 and CVE-2026-109619) exploit internal memory management, request lifecycles, and Out-Of-Memory (OOM) error handling inside the C-level PHP engine itself. Whenever runtime vulnerabilities emerge, automated exploit scanners flood millions of WordPress websites searching for unauthenticated vulnerable endpoints.

LumenCache provides immediate defense-in-depth mitigation through its zero-worker server proxy architecture:

• Bypassing PHP Completely (Nginx / Apache / LiteSpeed Proxy Mode): When server-level proxy rules are enabled (Nginx FastCGI cache, redis_pass, or LiteSpeed.htaccess direct RAM rewrites), cache HIT requests never touch PHP-FPM or the PHP interpreter at all.

• Automated Exploit & Scanner Deflection: Malicious crawlers or automated exploit scanners scanning public cached URLs are intercepted at the web server layer and served raw static HTML directly from RAM. Because PHP is never invoked, the vulnerability cannot be triggered on those requests.

• Worker & Memory Starvation Defense: Protects against Out-Of-Memory (OOM) denial-of-service by keeping PHP-FPM worker pools 100% isolated for authentic logged-in users and checkout actions.

(Note: A caching plugin does not replace updating your server binaries; hosting administrators must still update PHP to patched point releases. LumenCache acts as an architectural first-line attack surface reducer).

Configuration (optional)

All settings are configurable from LumenCache → Settings in the WordPress

admin. php — constants always win:

0 ); define( 'LUMENCACHE_REDIS_PREFIX', 'cache:' ); define( 'LUMENCACHE_CACHE_TTL', 86400 ); define( 'LUMENCACHE_CACHE_SALT', '' ); define( 'LUMENCACHE_CACHE_QUERY_STRINGS', false ); define( 'LUMENCACHE_PROXY_PASSWORD', '' );

WP-CLI

com/page/ wp lumencache status<h3>Privacy</h3>

LumenCache stores rendered page HTML and cache metadata in the in-memory cache

service configured by the site administrator. It does not send cache contents,

visitor data, or analytics data to a third-party LumenCache service. The

optional user-state endpoint returns only the requested dynamic values to the

requesting browser; sites should review those values and their own privacy

policy before enabling personalized hydration.