Seven systems, explained mechanism by mechanism.

Everything below ships in the extension today. Nothing here is a roadmap item, and nothing carries a number it can't earn — just what each part does and how it does it.

7 systems 49 mechanisms All of it in one license

Page Cache

Served before OpenCart boots.

A hit is answered from catalog/index.php, ahead of the framework. Everything below governs what gets served, for how long, and what happens while it's being rebuilt.

Pre-framework serving: Cached pages are served from catalog/index.php before OpenCart boots — zero database queries on a hit.
Precompressed copies: Every cached page keeps a precompressed .gz copy on disk, so gzip compression happens once instead of on every request.
ETag and Last-Modified: Cached pages carry an ETag and a Last-Modified header, so an unchanged repeat request gets a 304 instead of the page again.
Per-route TTL: Individual routes can override the default cache lifetime, and every TTL carries expiry jitter so pages don't all expire at the same instant.
Soft-bust epoch: A soft-bust epoch marks the whole cache stale at once, without deleting a single file from disk.
stale-while-revalidate: An expired page keeps being served while a fresh copy is rebuilt in the background — a visitor never waits on the rebuild.
stale-if-error: If a background rebuild fails, the last good cached copy keeps being served instead of an error.
Caching for logged-in customers: Optional. Signed-in visitors read the same shared guest cache; their cart and account details are filled in server-side, before the response is sent, by Dynamic Fragments — and a logged-in render is never itself stored. Not recommended for stores with per-group pricing — the admin warns about this.
Dynamic Fragments: Per-visitor regions — the cart, above all — are filled with that visitor's own markup entirely server-side, before the bytes are sent: no JavaScript, no mask and no post-paint swap needed. Three steps do it, all fail-open: stash keeps a visitor's live render of a fragment route from after their last cart action; mark locates that fragment's configured id-selector element in a shared cached page and wraps it in markers; apply replaces the wrapped element with the visitor's stashed copy at serve time. It matches id selectors only, not classes, and any step that can't find its match just leaves the cached guest markup in place.
Entity purge and re-warm: Editing a product, category, information page or manufacturer purges just the pages it affects and queues them for the next warm run.
The cron watcher: Catches edits made outside OpenCart entirely — an ERP or feed script writing straight to the database — by watching each row's date_modified.
Canonical Domain Redirect: Optional. 301-redirects the un-configured www or apex twin of a store domain to the configured one, so there's one cache tree and no duplicate URLs for search engines. The host map is generated from the store table, never hand-edited.

Query & Data Cache

One write invalidates one table, not everything.

The database work behind a page is cached too, with invalidation narrow enough that a single write doesn't have to empty the whole cache.

Query cache: Storefront SELECT results are cached with per-table invalidation markers, so a write to one table drops only that table's cached reads.
Journal3 result cache: Journal3's own result cache is included alongside the rest of the query cache.
Fast File Cache: Optional. Replaces the internals of OpenCart's stock Cache\File driver: exact-name reads and a 30-minute folder sweep, instead of a whole-folder glob on every request.
Slow-query log: Every slow query is logged with an EXPLAIN summary attached.
Oversized-result log: Database queries that return an oversized result set are logged separately.

Assets

Smaller payloads, without paying for it twice.

CSS and JS are processed once and reused, and the processing itself is spent only where the result is kept.

Minification: HTML, inline and file CSS, and JS are all minified.
Bundling: CSS and JS files are bundled to cut the number of requests a page needs.
Async and critical CSS: Critical CSS is inlined so above-the-fold content can render immediately, while the rest of the stylesheet loads asynchronously.
Deferred JS: Scripts are deferred so they don't block the page from rendering.
Delayed third-party scripts: Third-party scripts load later, after the page itself.
Resource hints: Hints are added to the page so the browser can start work on resources it will need before it asks for them outright.
Speculation Rules: Likely next pages are prefetched and prerendered through the Speculation Rules API, with an intent-based fallback for browsers that don't support it yet.
Minification is skipped on uncached renders: Byte-shaving minification only runs on responses that get stored and re-served — a dynamic, uncached page never pays a minification cost it can't get back.

Images

Every image pulls its weight, not more.

Image handling runs through OpenCart's own resizer rather than a parallel pipeline, so it stays in step with everything else on the page.

Lazy loading: Images load only as they approach the viewport.
Explicit dimensions: Images carry explicit width and height, so the browser reserves their space and the page doesn't jump as they load.
LCP preload: The page's largest expected image is preloaded, so it isn't the reason Largest Contentful Paint runs late.
WebP generation: WebP versions are generated through hooks into OpenCart's own image resizer, rather than a separate pipeline.
Fast-resize prepass: Unusually large source images go through a fast-resize prepass before OpenCart's normal resize step runs.

Protection

Bad traffic is turned away before it costs anything.

The same pre-framework path that hands back a finished page also turns away requests that have no business reaching OpenCart at all.

Request firewall: URL patterns and user agents are matched before the framework loads; a blocked request gets a 403 pre-framework, the same as a cache hit.
Bot throttling: Cache misses from listed scrapers get a 503 instead of running the full request.
Reverse-DNS verification: A visitor claiming to be a major crawler is checked against reverse DNS — a fake Googlebot gets throttled instead of trusted.
Instant 404: Optional. Requests for static files that don't exist get an instant 404, pre-framework.
Cookie-less session guard: Optional. Stops bots that don't carry cookies from bloating the session store.
Admin login lockout: Repeated failed admin login attempts lock the account out.

Warmer

The cache fills itself in, before a visitor has to.

A crawler run from cron keeps the cache populated as a guest, so a real visitor rarely finds a cold page.

CLI cron crawler: Runs from cron as a guest visitor, crawling the store to rebuild its cache.
Load-aware and resumable: The warm run backs off under load and can resume where it left off instead of starting over.
Seeded from real traffic and page links: What to crawl comes from real traffic plus the links found on each page already warmed.
Every device variant: When per-device caching is on, the warmer builds a cached copy for every device variant, not just one.

Dashboard

Everything the engine is doing, in one place.

The admin dashboard is where the cache, the warmer and the firewall are watched, tuned and cleared.

Health score: A health score with actionable recommendations, built from runtime checks: bypass share, un-configured domains, and warm-cron freshness.
Hit-ratio history: A history of the cache's hit ratio over time.
Live traffic monitor: A live view of traffic hitting the store.
Slow queries: The slow-query log, surfaced on the dashboard itself.
URL purge: Individual URLs can be purged from the cache on demand.
Database index and table tools: Tools for managing database indexes and tables directly from the dashboard.
Orphan and stale row maintenance: Orphaned and stale rows can be found and cleaned up from the dashboard.
Settings export and import: The settings blob can be exported and imported.
Live-bypass browsing: A ?nitro=<token> query string lets you browse the live, uncached page for testing, while every other visitor still gets the cache.

Design principles

Three rules the rest of this page assumes.

Fail open, everywhere: Any internal error falls through to stock OpenCart behavior — the request continues as though Nitro were not installed.
Never cache personalized output: Dynamic renders are structurally excluded from the shared cache — there is no path that would let one in.
Every ocmod hook is guarded: Every core patch no-ops when Nitro is disabled or absent, so turning it off leaves nothing behind.

Every setting

Every switch, and what it actually does.

Nitro ships with sensible defaults and a profile that sets them all at once. This is the whole surface, in case you want to go further.

Cache

What is served from disk, for how long, and who never gets a cached page.

Status: Master switch. Off means Nitro does nothing and OpenCart runs as it always did.
Profile: Sets every switch below in one go: Safe, Recommended or Aggressive. Lists and credentials are never touched.
Full-Page Cache: Serves cached HTML to guests before OpenCart boots. Logged-in visitors and carts always get a live page.
Cache Lifetime: How long a page is served before it is rebuilt. A catalogue edit clears it immediately anyway.
Background Refresh After: Past this age the page is still served instantly and refreshed behind the visitor, so nobody waits.
Per-route Cache Lifetime: A different lifetime for pages matching a pattern. First match wins.
Ignored URLs: Any page whose URL contains one of these is never cached and never served from cache.
Ignored URL Parameters: Stripped before the URL becomes a cache key, so utm and gclid links share one cached page.
No-cache Cookies: A visitor holding one of these cookies is served live — nothing of theirs is cached or stored.
Separate Cache per Cookie: A different cached page rather than no cache at all — for a chosen store or a B2B price group.
Per-Device Cache: Desktop, mobile and tablet cached apart. Only needed if your theme sends different HTML to each.
Cache for Logged-in Customers: Serves logged-in customers from cache with their own cart filled in on the server.
Skip Cache for Active Visitors: Anyone who already has a cart or a voucher gets a live page, so the cart area is right on every theme.
Serve Stale On Error: If a page errors while rendering and a cached copy exists, the last good copy is served instead.
Max Cache Size: Caps the cache on disk. The warmer deletes the oldest files when it goes over. 0 is unlimited.
Browser Cache Headers: Cache-Control, ETag and Last-Modified on cached pages, so browsers and CDNs revalidate cheaply.
Canonical Product URLs: Caches a product once instead of once per category path it can be reached through.
No-index Filtered URLs: Keeps filtered and sorted listings out of search results without stopping them being crawled.
Query Cache: Caches storefront SELECT results and invalidates them per table, so a write drops only that table.
Fast File Cache: Replaces OpenCart's own file cache, which slows every page down as it grows. Same data, same behaviour.
Query Optimization: Curated, safe rewrites of known OpenCart product queries — nothing speculative.
Product Price Index: Precomputes special and discount prices so listing pages do not work them out per product.
Template Optimization: Renders with a faster template engine, and falls back to the standard one if anything is unusual.
License Email: Your license covers this address and this domain together, so it must be the address you bought with.

Frontend

What reaches the browser, in what order, and what is allowed to block the first paint.

Minify HTML: Strips whitespace and comments from the cached document.
Minify CSS & JS: Byte-shaving only. It does not change load order, so it is safe on essentially any theme.
Bundle CSS Files: Combines local stylesheets into one file, rebasing url() so fonts and images still resolve.
Bundle JS Files: Combines local scripts into one, skipping async, defer and module scripts to preserve execution.
Bundle Exclude: Filenames kept out of the bundles — theme libraries that ship their own loader.
Async CSS: Loads stylesheets without blocking the first paint, with a noscript fallback.
Critical CSS: Above-the-fold CSS inlined at the top of the head so the first paint waits for nothing.
Automatic Critical CSS: Works out those styles for you. A heuristic — check the result rather than assuming it.
Defer JavaScript: Adds defer to external scripts so they stop blocking rendering.
Defer Exclude: The one library that breaks when deferred, left blocking on purpose.
Delay Third-party JS: Matching third-party scripts wait for the first interaction instead of loading with the page.
Resource Hints: preconnect, dns-prefetch and preload lines for the hosts and files the page really needs.
Prefetch on Hover: Fetches the next page the moment a visitor shows intent, so navigation feels instant.
Prefetch Mode: Prefetch downloads the next page; prerender builds it too — faster, but heavier.
Content Visibility: Lets the browser skip layout and paint for sections until they scroll into view.
Below-fold Selectors: Which sections that applies to, one selector per line.
Journal3 CSS to Files: Moves Journal3's theme CSS out of every page and into cached files.
Dynamic Fragments: The regions filled with each visitor's own version — the cart, and anything like it.
Fill Personal Areas on the Server: Fills those regions before the page is sent, so one cached page works for everyone.

Images

Image work runs through OpenCart's own resizer, so it stays in step with the rest of the page.

Serve WebP: Serves WebP where a smaller copy can be made, linking it directly so old browsers still get the original.
Image Quality: Encode quality for resized JPEG and WebP. 80 is the balance point.
Fast Image Resize: Makes thumbnails of very large images without timing out — the usual cause of a broken thumbnail.
Image Dimensions: Adds width and height where they are missing, so the browser reserves the space and nothing jumps.
Lazy-load Images: Off-screen images load late; the first one stays eager so the largest paint is not delayed.
Learn LCP Image: Measures which image a real browser paints largest, then preloads exactly that one next time.

Protection

The same pre-framework path that hands back a finished page also turns away what should never reach OpenCart.

Request Firewall: Refuses known attack and probe requests before OpenCart loads, so they cost almost nothing.
Blocked Patterns: Common attacks are blocked already. This is for your own additions, like /phpmyadmin.
Blocked User-Agents: Bots refused outright. Never put Google or Bing here.
Throttle Scraper Bots: Scrapers still get cached pages; they just stop forcing fresh ones.
Throttled Bot Agents: Which bot names that applies to.
Block Bot Sessions: Stops bots filling the session table, which is what grows it to gigabytes.
Instant Static 404: Answers requests for missing images, CSS and fonts instantly instead of building an error page.
Client IP Source: Where the visitor's address is read from — direct, or from the proxy in front of you.
Trust Forwarded HTTPS: Only for a store behind Cloudflare, a CDN or a load balancer that terminates HTTPS.

Warming and diagnosis

Keeping the cache full without a visitor paying for it, and seeing what is slow.

Cron Command: Crawls the storefront as a guest from cron so a real visitor rarely finds a cold page.
Warm Load Ceiling: Warming pauses while the server load is above this, so it never competes with real traffic.
Track Slow Queries: Logs database queries past the threshold, grouped with literals masked, so you can see what to index.
Slow Threshold: How many milliseconds counts as slow. 50 is a sensible starting point.

See what it costs.

One license, one store domain, forever. No tiers.

See pricing