wp-query-cache — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wp-query-cache (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
WordPress 6.9 changed how query cache groups store invalidation state. Core now uses stable cache keys with stored salts instead of baking changing last_changed values into every key. This reduces unreachable cache keys on high-update sites.
This skill is for plugin code that directly reads/writes object-cache entries for query results. Most plugins should not do that.
Trigger when ANY of the following is true:
wp_cache_get() / wp_cache_set() in query groups such as post-queries, term-queries, user-queries, comment-queries, site-queries, or network-queries.wp_cache_get_last_changed().WP_Query, WP_User_Query, WP_Term_Query, or WP_Comment_Query cache behavior.Before writing custom cache logic, ask whether the normal query API already caches the result:
WP_Query and helpers for posts.WP_Term_Query / taxonomy helpers for terms.WP_User_Query / user helpers for users.WP_Comment_Query / comment helpers for comments.Direct query-cache writes are a maintenance liability. They couple plugin code to internal cache key formats that changed in WP 6.9.
Use these only when you deliberately maintain a cache entry whose validity depends on one or more core last_changed salts:
$last_changed = wp_cache_get_last_changed( 'posts' );
$cache_key = 'myplugin:featured_ids:' . md5( wp_json_encode( $args ) );
$ids = wp_cache_get_salted( $cache_key, 'post-queries', $last_changed );
if ( false === $ids ) {
$ids = myplugin_expensive_featured_post_ids_query( $args );
wp_cache_set_salted( $cache_key, $ids, 'post-queries', $last_changed, HOUR_IN_SECONDS );
}For data depending on multiple groups, pass an array of salts:
$salt = array(
wp_cache_get_last_changed( 'posts' ),
wp_cache_get_last_changed( 'terms' ),
);
$result = wp_cache_get_salted( $cache_key, 'post-queries', $salt );The helper stores an array containing data and salt. Do not assume the raw cached value is your data when reading entries written by wp_cache_set_salted().
Core WP 6.9 uses salted query cache helpers in groups including:
post-queriesterm-queriescomment-queriesuser-queriessite-queriesnetwork-queriesIf old plugin code directly sets any of these groups with wp_cache_set(), it can bypass the new salt shape and produce stale reads or misses depending on how the value is later consumed.
Use WordPress mutation APIs whenever possible. They update the relevant last_changed salts through core hooks.
// Good: core updates post caches and last_changed state.
wp_update_post( array(
'ID' => $post_id,
'post_title' => $title,
) );
// Risky: direct SQL bypasses normal cache invalidation.
$wpdb->update( $wpdb->posts, array( 'post_title' => $title ), array( 'ID' => $post_id ) );If you deliberately perform direct SQL, call the correct cache clean function afterwards (clean_post_cache(), clean_term_cache(), clean_user_cache(), etc.) rather than manually setting query group salts.
After upgrading to WP 6.9, a temporary increase in cache misses is expected because affected query cache keys are different. Do not "fix" this by forcing old keys back. Let the cache warm naturally unless the object-cache backend needs a one-time eviction plan.
wp_cache_*_salted() helpers when direct query caching is justified.clean_*_cache() function after direct SQL.// WRONG - old pattern creates unreachable keys as last_changed changes.
$key = 'my_query:' . md5( $sql ) . ':' . wp_cache_get_last_changed( 'posts' );
$data = wp_cache_get( $key, 'post-queries' );
// RIGHT
$salt = wp_cache_get_last_changed( 'posts' );
$key = 'my_query:' . md5( $sql );
$data = wp_cache_get_salted( $key, 'post-queries', $salt );
// WRONG - direct set into a core query group with arbitrary shape.
wp_cache_set( $key, $data, 'post-queries' );
// RIGHT - if direct caching is truly needed.
wp_cache_set_salted( $key, $data, 'post-queries', $salt );~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.