Fix TTFB in WordPress

// wp-config.php -- enable the cache constant required by most plugins
define('WP_CACHE', true);

// Bypass paths that must always be dynamic
// (WP Rocket / W3TC settings panel exposes the same options)
// - /wp-admin/
// - /cart/, /checkout/, /my-account/   (WooCommerce)
// - /?add-to-cart=
// - any URL with a logged-in auth cookie

// .htaccess -- serve a cached static file when present, skip PHP entirely
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} !POST
  RewriteCond %{QUERY_STRING} ^$
  RewriteCond %{HTTP_COOKIE} !(wordpress_logged_in|comment_author|woocommerce_items_in_cart) [NC]
  RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/wp-rocket/%{HTTP_HOST}%{REQUEST_URI}/index.html -f
  RewriteRule .* /wp-content/cache/wp-rocket/%{HTTP_HOST}%{REQUEST_URI}/index.html [L]
</IfModule>

// Verify a cache hit on a logged-out request:
// $ curl -sI https://example.com/ | grep -iE 'x-cache|x-rocket'
// expected: x-cache: HIT  (or x-rocket: enabled)

// wp-config.php -- placed above the "stop editing" line

// Connection details
define('WP_REDIS_HOST', '127.0.0.1');
define('WP_REDIS_PORT', 6379);
// Optional auth + DB index
// define('WP_REDIS_PASSWORD', 'your-password');
define('WP_REDIS_DATABASE', 0);

// Use a unique salt per site so multisite installs do not collide
define('WP_CACHE_KEY_SALT', 'example_com_');

// Enable the persistent cache
define('WP_REDIS_DISABLED', false);

// Recommended for production
define('WP_REDIS_TIMEOUT', 1);
define('WP_REDIS_READ_TIMEOUT', 1);

// After activating Redis Object Cache plugin, click "Enable Object Cache"
// in Settings -> Redis. Confirm with:
// $ wp redis status
// Status:  Connected
// Client:  PhpRedis (5.x)
// Drop-in: Valid

; /etc/php/8.2/fpm/php.ini -- or your host's PHP-FPM config

[opcache]
opcache.enable=1
opcache.enable_cli=0

; Shared memory available to opcache. 256 MB fits most WordPress sites
; with 30+ plugins. Increase if "out of memory" appears in PHP logs.
opcache.memory_consumption=256

; Strings interned across requests. 16 MB is a safe default.
opcache.interned_strings_buffer=16

; Maximum files cached. Run `find . -name '*.php' | wc -l` in wp-content
; to size this -- include core (~2000) + plugins + themes.
opcache.max_accelerated_files=20000

; In production: do NOT recheck file timestamps on every request.
; Reset opcache manually on deploy with `opcache_reset()` or fpm reload.
opcache.validate_timestamps=0

; Save compiled bytecode to disk across PHP-FPM restarts
opcache.file_cache=/var/cache/php-opcache

; JIT: PHP 8.x improves throughput on uncached requests
opcache.jit=1255
opcache.jit_buffer_size=128M

; Then reload PHP-FPM:
; $ sudo systemctl reload php8.2-fpm

# Cloudflare dashboard -> Caching -> Cache Rules
# (Equivalent settings exist for Bunny CDN, KeyCDN, Fastly, and Vercel)

# Rule name: WordPress HTML at edge
# When incoming requests match:
#   (http.host eq "example.com" and http.request.uri.path matches "^/(?!wp-admin|wp-login|cart|checkout|my-account).*")
#   and not (http.cookie contains "wordpress_logged_in")
#   and not (http.cookie contains "wp-postpass")
#   and not (http.cookie contains "woocommerce_items_in_cart")
# Then:
#   Cache eligibility: Eligible for cache
#   Edge TTL: Override origin -> 1 hour
#   Browser TTL: Respect origin
#   Cache key: include scheme + host + URI + device-type

# Add an origin header to confirm at the edge
# WP filter: send Cache-Control + Surrogate-Control
add_filter('wp_headers', function ($headers) {
  if (!is_user_logged_in() && !is_admin()) {
    $headers['Cache-Control']     = 'public, max-age=0, s-maxage=3600';
    $headers['Surrogate-Control'] = 'max-age=3600';
  }
  return $headers;
});

# Verify cache hit:
# $ curl -sI https://example.com/ | grep -iE 'cf-cache-status|age'
# expected: cf-cache-status: HIT

# Nginx -- enable HTTP/2 and Brotli (requires nginx-module-brotli)
server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  # Add HTTP/3 if your Nginx build supports QUIC
  # listen 443 quic reuseport;
  # add_header Alt-Svc 'h3=":443"; ma=86400';

  brotli              on;
  brotli_comp_level   5;
  brotli_types        text/html text/css application/javascript application/json image/svg+xml;
  brotli_static       on;

  gzip                on;
  gzip_types          text/html text/css application/javascript application/json image/svg+xml;
  gzip_min_length     256;
}

# Apache 2.4 -- enable HTTP/2 + Brotli
# In httpd.conf or a vhost include:
Protocols h2 h2c http/1.1
LoadModule brotli_module modules/mod_brotli.so
<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# Verify in DevTools (Network -> document request -> Headers):
# - HTTP/2 200      (protocol)
# - content-encoding: br  (Brotli active)