In my humble opinion, the WP Rocket WordPress caching plugin is the best on the market, beating out all others on performance and ease of use.
Secondly, again in my humble opinion, the iThemes Security plugin is the best on the market for WordPress security.
That said, when you have both installed with the recommended settings turned on for both, you can run into issues.
One of the cool features in iThemes Security is to lock down certain back-end WordPress files such as the wp-config.php and .htaccess. If you’re at all familiar with WordPress you know that the .htaccess contains a plethora of settings for your particular website. Locking it down makes sense.
However, when other plugins try to access that file to save settings, iThemes Security will prevent access. And even though you think the other plugin saved your settings, they in fact did not.
I ran into this problem with WP Rocket and iThemes Security. With both running, I was banging my head against the wall wondering why I kept getting poor performance ratings from GTMetrix. “There must be a problem with WP Rocket”, I thought.
Then it dawned on me that iThemes Security was doing it’s job, preventing anyone and anything from touching the .htaccess file. WP Rocket was trying to touch it to save settings and being denied.
As soon as I allowed access, WP Rocket was happy. A retest of my site at GTMetrix has performance back up near the top.
Irritating and embarrassing lesson in WordPress website management!