Self‑Hosting External Resources
ZiziCache can download external CSS and JavaScript files and serve them locally when self_host_third_party_css_js is enabled. This is implemented in SysTool::download_external_file() and the CSS/JS optimization modules.
What Gets Self‑Hosted
- External
files (CSS). - External
files (JavaScript).
Local resources are not modified. Only URLs that are external to home_url() are processed.
Allowed Domains
Downloads are restricted to an allowlist. The default list includes common CDNs such as:
cdn.jsdelivr.net,cdnjs.cloudflare.com,unpkg.comcode.jquery.com,ajax.googleapis.comfonts.googleapis.com,fonts.gstatic.com
You can extend or override the list via the zizi_cache_selfhost_external_domains filter.
Download Location
Files are saved to:
wp-content/cache/zizi-cache/3rd-css-js/
Cached file names are sanitized and, when necessary, replaced with a hash‑based filename.
HTML Rewrites
- CSS: the original
hrefis replaced with the local cache URL and stored indata-original-href. - JS: the original
srcis replaced and stored indata-origin-src. integrityandcrossoriginattributes are removed for locally hosted files.- Resource hints (
preload,prefetch,preconnect) for the original host are removed.
Font Files Inside CSS
Downloaded CSS is filtered before saving. If it contains font URLs, ZiziCache downloads those font files and rewrites @font-face URLs to local cached files.
Security Checks
- SSRF protection: blocks private/reserved IP ranges.
- Content size limits (rejects extremely large responses).
- Content validation: blocks PHP injection patterns and suspicious JavaScript in CSS files.
- Filename sanitization to prevent path traversal.
Cache Lifespan
External file expiration uses cache_lifespan when available, otherwise falls back to .htaccess settings or a default 30‑day cache window. A metadata comment is written into cached CSS/JS files with download and expiration timestamps.
Cleanup
When the feature is disabled (or on plugin deactivation), ZiziCache can remove cached third‑party files via SysTool::cleanup_third_party_files().
Troubleshooting
- File not downloaded: confirm the domain is in the allowlist.
- Missing fonts after self‑hosting CSS: verify the cached font files exist under
wp-content/cache/zizi-cache/. - Unexpected behavior: clear the third‑party cache directory and re‑enable the feature.