What's inside
Seven systems, explained mechanism by mechanism.
Everything below ships in the extension today. Nothing here is a roadmap item, and nothing carries a number it can't earn — just what each part does and how it does it.
7 systems 49 mechanisms All of it in one licence
Page cache
Served before OpenCart boots.
A hit is answered from catalog/index.php, ahead of the framework. Everything below governs what gets served, for how long, and what happens while it's being rebuilt.
- Pre-framework serving
- Cached pages are served from catalog/index.php before OpenCart boots — zero database queries on a hit.
- Precompressed copies
- Every cached page keeps a precompressed .gz copy on disk, so gzip compression happens once instead of on every request.
- ETag and Last-Modified
- Cached pages carry an ETag and a Last-Modified header, so an unchanged repeat request gets a 304 instead of the page again.
- Per-route TTL
- Individual routes can override the default cache lifetime, and every TTL carries expiry jitter so pages don't all expire at the same instant.
- Soft-bust epoch
- A soft-bust epoch marks the whole cache stale at once, without deleting a single file from disk.
- stale-while-revalidate
- An expired page keeps being served while a fresh copy is rebuilt in the background — a visitor never waits on the rebuild.
- stale-if-error
- If a background rebuild fails, the last good cached copy keeps being served instead of an error.
- Caching for logged-in customers
- Optional. Signed-in visitors read the same shared guest cache; their cart and account details are filled in server-side, before the response is sent, by Dynamic Fragments — and a logged-in render is never itself stored. Not recommended for stores with per-group pricing — the admin warns about this.
- Dynamic Fragments
- Per-visitor regions — the cart, above all — are filled with that visitor's own markup entirely server-side, before the bytes are sent: no JavaScript, no mask and no post-paint swap needed. Three steps do it, all fail-open: stash keeps a visitor's live render of a fragment route from after their last cart action; mark locates that fragment's configured id-selector element in a shared cached page and wraps it in markers; apply replaces the wrapped element with the visitor's stashed copy at serve time. It matches id selectors only, not classes, and any step that can't find its match just leaves the cached guest markup in place.
- Entity purge and re-warm
- Editing a product, category, information page or manufacturer purges just the pages it affects and queues them for the next warm run.
- The cron watcher
- Catches edits made outside OpenCart entirely — an ERP or feed script writing straight to the database — by watching each row's date_modified.
- Canonical Domain Redirect
- Optional. 301-redirects the un-configured www or apex twin of a store domain to the configured one, so there's one cache tree and no duplicate URLs for search engines. The host map is generated from the store table, never hand-edited.
Query & data cache
One write invalidates one table, not everything.
The database work behind a page is cached too, with invalidation narrow enough that a single write doesn't have to empty the whole cache.
- Query cache
- Storefront SELECT results are cached with per-table invalidation markers, so a write to one table drops only that table's cached reads.
- Journal3 result cache
- Journal3's own result cache is included alongside the rest of the query cache.
- Fast File Cache
- Optional. Replaces the internals of OpenCart's stock Cache\File driver: exact-name reads and a 30-minute folder sweep, instead of a whole-folder glob on every request.
- Slow-query log
- Every slow query is logged with an EXPLAIN summary attached.
- Oversized-result log
- Queries that return an oversized result set are logged separately.
Assets
Smaller payloads, without paying for it twice.
CSS and JS are processed once and reused, and the processing itself is spent only where the result is kept.
- Minification
- HTML, inline and file CSS, and JS are all minified.
- Bundling
- CSS and JS files are bundled to cut the number of requests a page needs.
- Async and critical CSS
- Critical CSS is inlined so above-the-fold content can render immediately, while the rest of the stylesheet loads asynchronously.
- Deferred JS
- Scripts are deferred so they don't block the page from rendering.
- Delayed third-party scripts
- Third-party scripts load later, after the page itself.
- Resource hints
- Hints are added to the page so the browser can start work on resources it will need before it asks for them outright.
- Speculation Rules
- Likely next pages are prefetched and prerendered through the Speculation Rules API, with an intent-based fallback for browsers that don't support it yet.
- Minification is skipped on uncached renders
- Byte-shaving minification only runs on responses that get stored and re-served — a dynamic, uncached page never pays a minification cost it can't get back.
Images
Every image pulls its weight, not more.
Image handling runs through OpenCart's own resizer rather than a parallel pipeline, so it stays in step with everything else on the page.
- Lazy loading
- Images load only as they approach the viewport.
- Explicit dimensions
- Images carry explicit width and height, so the browser reserves their space and the page doesn't jump as they load.
- LCP preload
- The page's largest expected image is preloaded, so it isn't the reason Largest Contentful Paint runs late.
- WebP generation
- WebP versions are generated through hooks into OpenCart's own image resizer, rather than a separate pipeline.
- Fast-resize prepass
- Unusually large source images go through a fast-resize prepass before OpenCart's normal resize step runs.
Protection
Bad traffic is turned away before it costs anything.
The same pre-framework path that serves a cache hit also turns away requests that shouldn't reach OpenCart at all.
- Request firewall
- URL patterns and user agents are matched before the framework loads; a blocked request gets a 403 pre-framework, the same as a cache hit.
- Bot throttling
- Cache misses from listed scrapers get a 503 instead of running the full request.
- Reverse-DNS verification
- A visitor claiming to be a major crawler is checked against reverse DNS — a fake Googlebot gets throttled instead of trusted.
- Instant 404
- Optional. Requests for static files that don't exist get an instant 404, pre-framework.
- Cookie-less session guard
- Optional. Stops bots that don't carry cookies from bloating the session store.
- Admin login lockout
- Repeated failed admin login attempts lock the account out.
Warmer
The cache fills itself in, before a visitor has to.
A crawler run from cron keeps the cache populated as a guest, so a real visitor rarely finds a cold page.
- CLI cron crawler
- Runs from cron as a guest visitor, crawling the store to rebuild its cache.
- Load-aware and resumable
- The warm run backs off under load and can resume where it left off instead of starting over.
- Seeded from real traffic and page links
- What to crawl comes from real traffic plus the links found on each page already warmed.
- Every device variant
- When per-device caching is on, the warmer builds a cached copy for every device variant, not just one.
Dashboard
Everything the engine is doing, in one place.
The admin dashboard is where the cache, the warmer and the firewall are watched, tuned and cleared.
- Health score
- A health score with actionable recommendations, built from runtime checks: bypass share, un-configured domains, and warm-cron freshness.
- Hit-ratio history
- A history of the cache's hit ratio over time.
- Live traffic monitor
- A live view of traffic hitting the store.
- Slow queries
- The slow-query log, surfaced on the dashboard itself.
- URL purge
- Individual URLs can be purged from the cache on demand.
- Database index and table tools
- Tools for managing database indexes and tables directly from the dashboard.
- Orphan and stale row maintenance
- Orphaned and stale rows can be found and cleaned up from the dashboard.
- Settings export and import
- The settings blob can be exported and imported.
- Live-bypass browsing
- A ?nitro=<token> query string lets you browse the live, uncached page for testing, while every other visitor still gets the cache.
Design principles
Three rules the rest of this page assumes.
- Fail open, everywhere
- Any internal error falls through to stock OpenCart behavior — the request continues as though Nitro were not installed.
- Never cache personalized output
- Dynamic renders are structurally excluded from the shared cache — there is no path that would let one in.
- Every ocmod hook is guarded
- Every core patch no-ops when Nitro is disabled or absent, so turning it off leaves nothing behind.
See what it costs.
One licence, one store domain, forever. No tiers.