Marko Vasiljevic

Hey Mel,

Thank you for reaching out and I am happy to answer.
As I’ve mentioned in the previous topic regarding this, security headers are an option in the W3 Total Cache, however, how and if you are going to use it, it depends on you, your website, and what you are trying to achieve so there is no single answer for this.
In W3 Total Cache Browser Cache settings there is a description for each option. Again, it’s up to you on what you are trying to achieve and how the website should behave, and this is why there are a lot of articles explaining the Security headers, however, there are no recommended settings, since every website’s traffic, purpose and content is different.

I hope this answers your question

Thanks!

Hello Mel,

Thank you for your feedback.
This is a public forum and any replies or topics must be approved by the Administrator to avoid potential spam or sharing of sensitive information.
The Security headers do not have any impact or conflict with Minify so you should not worry about this.
The security headers are an option in the W3 Total Cache, however, how and if you are going to use it, it depends on you, your website, and what you are trying to achieve so there is no single answer for this.

X-Frame-Options directives#
The X-Frame-Options header has three different directives in which you can choose from. These must be sent as an HTTP header, as the browser will ignore if found in a META tag. It is also important to note that certain directives are only supported in certain browsers. See browser support further below in this post. While it is not required to send this response header across your entire site, it is best practice to at least enable it on pages that need it.

1. deny directive#
The deny directive completely disables the loading of the page in a frame, regardless of what site is trying. Below is what the header request will look like if this is enabled.

X-Frame-Options: deny
This might be a great way to lock down your site, but it will also break a lot of functionality. The following two directives below are more common use cases for a typical website.

Examples of sites currently using the deny directive:

Facebook
GitHub

2. sameorigin directive#
The sameorigin directive allows the page to be loaded in a frame on the same origin as the page itself. Below is what the header request will look like if this is enabled.

X-Frame-Options: sameorigin
We have the sameorigin directive enabled on this website. With this directive enabled, only our website is allowed to embed an iframe of one of our pages. This is probably the most commonly used directive out of the three. It is a good balance between functionality and security.

It is also important to note that if a browser or plugin can not reliably determine whether the origin of the content and the frame have the same origin, this must be treated as deny.

Examples of sites currently using the sameorigin directive:

Twitter
Amazon
eBay
LinkedIn

3. allow-from uri directive#
The allow-from uri directive allows the page to only be loaded in a frame on the specified origin and or domain. Below is what the header request will look like if this is enabled.

X-Frame-Options: allow-from https://www.example.com/
This allows you to lock down your site to only trusted origins. But be careful with this directive. If you apply it and the browser does not support it, then you will have NO clickjacking defense in place.

As for the CSP (Content security policy) and GTM, please check the article below for more assistance with the setup:
https://developers.google.com/tag-platform/tag-manager/web/csp

I hope this helps!

Thanks!

Hello Mel,

Thank you for your feedback.
When implementing a Google tag manager script, The function then creates a new script element, sets its src attribute to the URL of the GTM JavaScript file, and appends it to the element of the HTML document. The id parameter passed to the GTM JavaScript file is the GTM container ID that identifies the specific GTM container that the website owner has set up in the GTM interface.
So you should not worry about any conflict with W3 Total Cache in this case.

As for the X-Frame-Options, you can enable this and set a Directive in Performance>Browser Cache>Security headers section
This tells the browser if it is permitted to render a page within a frame-like tag (i.e., <frame>, <iframe> or <object>). This is useful for preventing clickjacking attacks.

Thanks!

Hello Petus,

Thank you for reaching out and I am happy to assist you with this.
W3 Total Cache Pro licenses are valid on a per-install basis, meaning you need one for every WordPress instance you run. If you have three separate websites, you will need three licenses in total—one for each site. If you have five sites in a WordPress multisite instance, you need just one license for all five sites. If you are interested in bulk licensing, please email us for more information.

Hey Mel,

You are most welcome!

Thanks!

Hello Ryan,

Thank you for reaching out and I am happy to assist you with this.
The fact that the issue occurs sporadically and not to all users suggests that the problem is not specifically related to the W3 Total Cache. I’ve tested this on your website and I have not experienced an issue as you described.
Can you please temporarily disable W3 Total Cache and let me know if the problem keeps persisting?
Thanks!

Hello Mel,

Thank you for reaching out.
The optimal W3 Total Cache configuration takes into account several factors: your theme, your plugins, and the technologies available on the server. Since everyone’s site and traffic and theme are different, there is no one size fits all solution.
The mentioned guide is good, however, it all depends on your website.
All the settings related to the performance of your website are good. I’ve made the tests (check the screenshots) and in the report, there are no render-blocking files (total blocking time is 0ms), and the score is PERFECT! There are no console errors and there are no problems in the functionality of your website.
The Minify settings are spot on for your website.
Since the other topic is duplicate, I’ll remove it and you can ask any additional questions in this thread if you have any.

Thanks!

Hello Mel,

You are most welcome and thank you for your awesome review!

Thanks!

Hello Mel,

Thank you for your feedback.
I’ve checked the screenshot you shared and you added the path to the file to “Never minify the following pages:” instead of “Never minify the following JS files:”.
You should add it to the field below, save all settings and purge the cache.
Please check the screenshot below:

Thanks!

Hello Mel,

Thank you for your feedback.
First of all, this is just a warning and it does not impact the performance of your website. Nothing to worry about. Next, I do see the warning in the console, so there is a chance that either you did not the proper path to the file: /wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js or you have not added it to the correct place so please share the Performance>Minify>Advanced>” Never minify the following JS files:”
Please make sure that you saved all settings and purged the cache once the path was added and please share the screenshot of the Performance>Minify page.
I am not sure where you are performing the tests, however, in Google Page speed the score is amazing
https://pagespeed.web.dev/analysis/https-www-hundetraining-mit-roya-at/yo7y7ut19g?hl=en&form_factor=desktop

I am also seeing no report related to the image you are mentioning impacting the performance.
Thanks!

Hello,

I am sorry about the issue you are experiencing and I am happy to assist you with this.
Can you please try to disable the settings one by one in W3 Total Cache Performance>general settings, save the settings and purge the cache after each setting is disabled and see which one might be causing the issue?
Please start with the Lazyloading option, save all settings, and purge the cache.
Thanks!

Hello Mel,

I’ve checked your website and the Lazyload is working just fine. If you check the images they have class=”gb-image gb-image-9c061411 lazy loaded” so Lazyload is working as it should. This warning is triggered due to the fact that the file was also minified.
I can see that you also have the minify enabled.
Can you please try adding the following to W3 Total Cache Performance>Minify>Advanced>”Never minify the following JS files:”
/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js
Save all settings and purge the cache and see if the problem persists.
Thanks!

Hello Mel,

Thank you for reaching out. I’ve replied to your question related to the W3 Total Cache compatibility check in the wp.org forums. Check: https://wordpress.org/support/topic/compatibility-check-12/

Please continue any further correspondence there so we can avoid duplicating the answers.
Thanks!

Hello,

Thank you for your feedback and for providing the details on this.
Let me check and make some tests on this and I’ll get back to you with more details.
Thanks!

Hello,

Thank you for reaching out and I am happy to assist you with this.
Can you please share if you are using any security plugin or any plugin that may alter the naming of the folder structure?
This may prevent W3 Total Cache from getting the correct path.
Thanks!

Hello Fernando,

Thank you for reaching out and I am happy to assist you with this.
If you are referring to the W3 Total Cache Pro license, it’s a yearly subscription and it’s not being charged monthly.
Please reach out directly to us via the website contact form and provide the information about your subscription so I can check this for you.
Thanks!

Hello,

Still testing the behavior, I’ll get bac to you once I have more information.
Thanks!

Hello,

Thank you for your feedback.
Let me check this and I’ll get back to you.
Thanks!

Hello Jonathan,

Thank you for reaching out.
We are aware of this and we have tickets opened for these in our GH repo as you already know.

https://github.com/BoldGrid/w3-total-cache/issues/583
https://github.com/BoldGrid/w3-total-cache/issues/513

I’ve added your comments there and also notified the team, and this will hopefully be added in the May/June release.
PLease make sure to add any commends or suggestions in the tickets mentioned, which I can see you already did.
Thank you again for reaching out and for bringing this to our attention, and thank you for your patience!

Hello,

Thank you for your feedback.

Please use the link provided and email us for more details.
You can email us using this link and make sure to add the link to this topic
Thanks!