Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
LiteSpeed Cache for WordPress (LSCWP) is a popular free performance plugin developed by LiteSpeed Technologies. It works in tandem with LiteSpeed/OpenLiteSpeed web servers to deliver server-level full-page caching, browser cache headers, database cleanup, lazy loading, and front-end optimisation (CSS/JS minification, critical CSS). LiteSpeed Cache itself does not transfer visitor data; optional QUIC.cloud services for CDN, image optimisation, and critical CSS introduce remote processing on US infrastructure.
LiteSpeed Cache for WordPress (LSCWP) is a free performance plugin developed by LiteSpeed Technologies Inc. (Houston, Texas). When paired with a LiteSpeed Web Server or OpenLiteSpeed, the plugin enables server-level full-page caching, ESI block caching, browser cache headers, database optimisation, lazy loading, and front-end asset optimisation. It is the most widely used cache plugin in the WordPress ecosystem after WP Rocket.
On the server: cached HTML pages, ESI fragments, and the cache vary keys (typically based on cookies for logged-in users). On the client: a small functional cookie or absence-of-cookie marker used by the cache to differentiate logged-in users from anonymous visitors. The optional QUIC.cloud services receive asset URLs and (for some features) page HTML content; opt-in usage analytics for the plugin itself report aggregated WordPress and plugin version stats.
The cache logic itself is a technical necessity and qualifies as legitimate interest under Art. 6(1)(f). The cache-bypass cookies are functional and exempt from consent. The QUIC.cloud optional services are subprocessor relationships: the publisher (controller) must document them in the RoPA and ensure the asset URLs do not leak personal data via path or query parameters.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
None for the core plugin (runs on the WordPress host). QUIC.cloud services are operated by LiteSpeed Technologies from the US with global edge presence; transfers from the EU rely on the QUIC.cloud DPA and Standard Contractual Clauses. The image optimisation feature also sends original images to QUIC.cloud for processing, which can be a transfer trigger if the images contain personal data.
Run LiteSpeed Cache locally without QUIC.cloud if you want zero third-country transfer; if you do enable QUIC.cloud, sign the DPA and document the SCCs, configure image optimisation to skip user-uploaded sensitive images, document LiteSpeed Cache in your RoPA as both a legitimate-interest processor (core) and a US subprocessor (QUIC.cloud), and exclude personal-data-rich pages from caching.
Websites using LiteSpeed Cache must obtain user consent under GDPR regulations.
DPIA considerations
LiteSpeed Cache mainly operates on the cached HTML response and on backend cache invalidation. Key DPIA considerations: (1) cache bypass cookies (e.g., for logged-in users) are functional and tied to the cache logic; (2) caching authenticated pages with personal data must be carefully configured to avoid cross-user leaks (the plugin handles this through cache vary rules); (3) the optional QUIC.cloud services for CDN, image optimisation, low-quality image placeholder, and critical CSS generation send asset URLs (and sometimes HTML) to US infrastructure; (4) the bundled Cloudflare API integration manages purges via Cloudflare account credentials; (5) usage analytics for the plugin itself (opt-in) report aggregated statistics back to LiteSpeed.
Sample consent text
Our WordPress site uses LiteSpeed Cache to deliver faster pages. The plugin runs on our server and caches full HTML pages, with cache-bypass logic for logged-in users. Some optional features (QUIC.cloud CDN, image optimisation, critical CSS generation) transfer asset URLs to LiteSpeed Technologies infrastructure in the United States; transfers rely on Standard Contractual Clauses. No marketing or analytics cookies are set by LiteSpeed Cache.
Third-party domains contacted
litespeedtech.comwww.litespeedtech.comquic.cloudapi.quic.cloudcdn.quic.cloudCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _lscache_vary | Functional / Cache | Session | Used by the LiteSpeed Cache layer to compute the cache vary key for the current visitor (e.g., logged-in vs anonymous) so the correct cached page is served. |
| litespeed_role | Functional / Cache | Session | Differentiates cache versions based on the WordPress user role, ensuring administrators and editors get the appropriate uncached experience. |
| litespeed_url_vary | Functional / Cache | Session | Stores additional cache key data when the publisher has configured custom cache vary rules (currency, language, region). |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
LiteSpeed Cache may set a functional cookie used by the cache layer to determine whether the visitor should bypass the cache (typically because they are logged in or have a non-empty cart). The cookie name and behaviour depend on the cache vary configuration. No marketing or analytics cookies are set by the plugin itself.
No. The cache logic and cache-bypass cookies are functional and exempt under the strict service-delivery exemption of Art. 5(3) ePrivacy. The optional QUIC.cloud services are server-to-server and do not require user consent in themselves, but should be documented in the privacy notice as subprocessors.
Legitimate interest (Art. 6(1)(f) GDPR) for the caching and optimisation activity as a necessary technical performance measure.
Not for the core plugin. The optional QUIC.cloud services (CDN, image optimisation, low-quality placeholder, critical CSS generation) are operated from the US and trigger transfers; signed DPA and SCCs apply.
No for the core plugin. If you enable QUIC.cloud image optimisation on user-uploaded media that may contain personal data (member photos, medical imagery), document a short DPIA covering the subprocessor relationship and the safeguards.
Run LiteSpeed Cache locally without QUIC.cloud for zero third-country transfer; or sign the QUIC.cloud DPA and document SCCs; configure cache vary correctly to avoid leaking personal data across users; exclude authenticated and personal-data routes from caching; document LiteSpeed Cache in your RoPA.
Alternative WordPress cache and performance plugins include WP Rocket (France), W3 Total Cache (US, open source), Cache Enabler (Germany, free), Hyper Cache, WP Super Cache, NitroPack (Bulgaria), Borlabs Cache (Germany), and Autoptimize (Netherlands) for asset optimisation.
Mention LiteSpeed Cache in the technical stack section of the privacy notice as a legitimate-interest caching processor. Add the cache-bypass cookie (if any) to the strictly-necessary section of the cookie policy. If QUIC.cloud is enabled, list it as a US subprocessor with SCCs.