How cache files stay isolated by host and site

POM Cache does not place every homepage in one shared directory. The public HTML tree mirrors the request’s hostname and URL path so that unrelated sites and routes resolve to different index.html files.

The default mapping

With the standard cache location, requests map like this:

https://example.com/
→ wp-content/cache/pom-cache/example.com/index.html

https://example.com/about/
→ wp-content/cache/pom-cache/example.com/about/index.html

https://shop.example.com/about/
→ wp-content/cache/pom-cache/shop.example.com/about/index.html

The filename is always index.html. Isolation comes from the directories before it.

Subdirectory sites and language paths

A site or language mounted below a path naturally receives another branch:

https://example.com/fr/menu/
→ wp-content/cache/pom-cache/example.com/fr/menu/index.html

https://example.com/network-site/news/
→ wp-content/cache/pom-cache/example.com/network-site/news/index.html

This works because the path is part of the key. It does not mean POM Cache understands the business meaning of /fr/ or /network-site/; routing and canonical URLs must already be correct.

Domain mapping

The actual request host participates in file generation. A mapped domain therefore has a separate namespace from the network’s original domain.

For example, these are different keys:

restaurant.network.example/menu/
restaurant.example/menu/

Configure one canonical public hostname and redirect aliases consistently. If several aliases are allowed to render instead of redirecting, each can create its own tree and require its own validation and invalidation path.

Normalization and path protection

Before writing or reading a file, POM Cache:

• removes a port from the host component used for the HTML directory;
• normalizes percent-encoded path sequences;
• strips query strings and fragments from the filesystem path;
• removes traversal markers, backslashes, index.php, and unsafe path characters;
• resolves the real filesystem path;
• confirms that the result remains inside Cache Location.

The storage path is therefore derived from public routing but is not treated as an unrestricted filesystem instruction.

Site tools use the site home URL

Current-site statistics and deletion calculate the site branch from its configured WordPress home URL. In a subdirectory multisite that includes the site path; with mapped or subdomain sites it includes the corresponding hostname.

This has an important operational consequence: the WordPress home URL, canonical redirects, Apache SERVER_NAME, and public request host must agree. A mismatch can make the interface inspect one namespace while visitors populate another.

What is not part of the HTML key

POM Cache does not create HTML variants for:

• HTTP versus HTTPS;
• logged-in identity or role;
• cookie values;
• content-changing query strings;
• browser compression support;
• image format support.

HTTPS should be canonicalized by the site and proxy configuration. Personalized contexts bypass instead of producing private variants. Brotli/Gzip and WebP negotiation belong to the CDN or web server.

Verify isolation deliberately

1. Delete the relevant site cache.
2. Request one URL through its canonical hostname while signed out.
3. Confirm the expected host/path file appears.
4. Request the same path on another mapped site or subsite.
5. Confirm it produces or uses a different branch.
6. Purge the first site and verify the second site’s file remains.
7. Test any public aliases and confirm they redirect to the canonical host before cache delivery.

For network-level behavior and setting inheritance, continue to How POM Cache works on WordPress multisite.