Download websites that use W3 Total Cache

About W3 Total Cache

W3 Total Cache is a WordPress plugin rather than a platform, and a detection of it carries two facts at once: the site runs WordPress, and somebody opened the admin panel and made a deliberate decision about performance. Released in 2009 and now maintained by BoldGrid under GPL v2, the plugin bolts page caching, object caching, database caching, browser cache headers and CDN integration onto a PHP application that would otherwise build every page on request.

Our catalogue files the plugin under Caching, which is a classification artefact rather than a claim about what it is. Caching plugins are grouped with the platform they extend because they have no meaning outside it, and a hit should be read as WordPress plus an optimisation choice, not as an independent content management system.

As of October 2026 the plugin appears on 146,238 sites. Presence is visible from outside because caching leaves traces, including generated HTML comments, rewritten asset URLs, cache related headers and the plugin's own directory paths in the markup. Absence proves much less, since the same job can be done by a competing plugin, by a host's built in page cache or by a CDN in front of the origin, so the list describes sites that chose this particular tool rather than sites that care about speed. A hit also tells you something about the page itself, because cached HTML can be served long after the source was edited, and the CDN integration means the plugin frequently appears next to a content delivery vendor in the same record.

Version spread is the part of the record worth studying. We have observed 105 distinct releases in the wild, with 2.9.4 the build we currently see most often, and a spread that wide on a plugin with automatic updates available says something uncomfortable about WordPress maintenance in general. Site owners hesitate to update a caching plugin, because an update can flush a working configuration or break a page that took an afternoon to tune, so installations freeze in place. The plugin also has a public record of serious vulnerabilities, including server side request forgery and remote code execution in older builds, which turns that frozen population into a genuine attack surface rather than a theoretical one.

49,773 of the sites we detect sit in United States and .com leads the domain mix, but the rest is spread widely across markets, which fits a free plugin installed from the WordPress repository by owners everywhere rather than a product pushed through regional resellers.

The useful question is almost never whether one domain runs the plugin. Security teams want the population still on outdated builds, which requires the release identifier joined to the domain across the whole set. Hosting and performance vendors want the population that has already paid attention to speed, because those owners have demonstrated intent and are the reachable market for a faster host or a paid optimisation service. Plugin authors want to know what else those sites run. A downloadable list answers all three at once by putting domain, version, country and co-installed technology in one file, which no per-domain lookup can assemble at scale.