Description

Nivoli Edge puts Cloudflare’s edge in front of your WordPress site and adds the WordPress layer Cloudflare alone does not have. Attacks are refused before a request reaches PHP, the settings that refuse them live where a compromised site cannot reach them, and the same layer serves whole pages and right-sized images from the edge.

Attacks stopped before PHP

Ten shields run at the edge, earlier than any security plugin can, and your server never boots PHP to refuse a request.

Login, comment and search flood limits
XML-RPC block
Login country lock
wp-admin IP lock
AI-crawler block
Stray-PHP lock: every .php request except the real WordPress entry points gets a 404
WordPress surface lock: user enumeration (the REST users list, ?rest_route=, ?author=N) and leftover files (readme.html, license.txt, the installer, debug.log)
Security-headers pack
Install lock: installing, uploading, updating or deleting plugins and themes and the file editors are refused at the edge until you confirm by email from the blocked page; automatic updates and WP-CLI are unaffected

Wordfence or Sucuri keep inspecting what gets through. They simply see far less.

Locks: nothing inside the site can turn it off

A WordPress takeover also owns every plugin’s settings page. Ours refuses to act on WordPress’s say-so.

Change lock: click any change that weakens protection and nothing happens yet; an email to the address on your Nivoli license asks you to confirm exactly that change, and the link applies it.
Install lock: installing, uploading, updating or deleting plugins and themes, and the file editors, are refused at the edge until you confirm by email; the blocked page has the button. Automatic updates and WP-CLI run on the server and are unaffected.
Every refused attempt reaches you as that email, so you also learn when it was not you.
The Locks page: what the locks refused (code changes by plugin or theme, wp-admin visits, logins by country), the wp-admin IP lock and login country lock, and a lock activity log: every unlock request, clicked link, confirmation and lock change with its time and address.

Pages served from the edge

Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.

Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli, Fastly, Cloudflare Enterprise or your own webhook.
Logged-in visitors, carts and checkout always bypass.
Stylesheets, scripts and fonts from the edge too, with URL versioning: every purge moves them to a new address, so no browser or CDN node holds a stale file after a change.
The Static assets pane shows the edge hit rate per file type and which files still travel on plain addresses.

Images served from the edge

URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants on the fly.

No uploads, no duplicate copies, no migration, no theme changes.
Per-size presets, one-click Size mapping from your theme’s registered sizes, a catch-all for everything else.

The numbers to prove it, inside WP admin

What the edge answered and what it refused, by window
Broken and heavy images found from real traffic, with one-click fixes
Dead URLs in a 404 inbox with one-click redirect or block
Audience without a tracking script: humans versus bots, countries, referrers, devices
A monthly report by email

One plugin, one API key. Everything that runs on your own server is free; the managed edge is the part you cannot self-host.

Free (everything that runs on your own infrastructure)

Images: URL rewriting through your own Cloudflare zone: right-sized AVIF/WebP via native WP filters (the_post_thumbnail, srcset, Gutenberg, WooCommerce), the_content + full-page scan, catch-all optimization.
Rules: presets + size-name / filename-glob bindings, one-click Size mapping from your theme’s registered sizes.
Page caching: tag headers + surgical tag purge on save/delete/comment, dispatched to Fastly, Cloudflare Enterprise, or your own webhook. Activity log + trace mode.
Audit & automation: coverage audit with weekly regression email, runtime-misses log, fake-image detection & repair, pre-warm on save and after purges, purge-failure alerts, weekly header self-test, printable client report.
Tools: ?cfdebug=1 overlay, live pipeline probe, Tinify source compression (your own API key), WP-CLI (status / activate / purge / probe / audit).

The managed service (optional)

Everything above is fully functional without an account. Connecting your Nivoli API key links the plugin to the managed edge, which adds what only a hosted service can do:

Change lock and install lock: once on, any change that weakens protection, and any wp-admin request that changes code (plugin and theme install, upload, update, delete, the file editors), needs a confirmation link mailed to the email address on your Nivoli license, the one your license key went to. It lives at the edge and cannot be redirected from WordPress, so a takeover cannot switch the shields off or extend itself through WordPress tooling. Refused attempts email you.
Edge shields, enforced before PHP: XML-RPC block, login country lock and the security-headers pack on every plan; login, comment and search flood limits, the stray-PHP lock, the WordPress surface lock, the wp-admin IP lock and the AI-crawler block from the Growth plan up. Each has an off switch, the two locks have a monitor mode that lists what blocking would have stopped, and an attack-surface strip shows what every shield did in the last 14 days. Underneath them, Cloudflare’s managed WAF rulesets, including the WordPress rule set, run in front of every managed site.
URL rules and the 404 inbox: block or redirect legacy paths at the edge with a cached 410 or 301, one rule per family of URLs, with per-rule fire counts; live 404s your server keeps answering are listed with one-click redirect or block.
Origin shield: if your server goes down, the edge keeps serving the last good copy of every cached page (up to 7 days) and emails you when the shield engages and when your origin recovers.
Managed page cache: full-page HTML caching with no Cloudflare Enterprise plan required. Bundled in every plan; fair-use, doesn’t touch your image quota. Static assets (stylesheets, scripts, fonts) served from the edge with URL versioning so purges reach browsers.
Managed image CDN: we run the Cloudflare zone; no CF account, plan, or DNS work. Custom hostname (img.yoursite.com), CDN-level watermarking.
Edge insights: usage & quota, cache-hit / bandwidth / origin-offload stats, 48-hour hourly traffic chart, Top URLs (most-missed / most-requested), audience (humans vs bots, countries, referrers, devices, no tracking script), broken-image alerts with “where used”, heaviest images with one-click Tinify shrinking, and a monthly report by email.
Edge controls: per-path cache duration (TTL), query-param manager, cache protection (purge-IP allowlist), and dynamic content (WooCommerce cart and checkout safety, plus how the edge treats the Cache-Control headers your site sends).
Agency: multi-site fleet view, one API key across sites, white-label client reports, priority support.

Requirements

Free: a Cloudflare zone with Image Resizing enabled for the image half (Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten URLs 404; the Tools tab has a one-click probe to verify.
Managed: none of the above; the managed edge provides both. Just an API key from your Nivoli account.

External services

The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.

Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy

Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/

TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms

Screenshots

Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends.

Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and search floods) and every shield with its switch, enforced before your server. — Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends.

Installation

Upload the plugin and activate it (or paste your API key on the Managed Edge tab; the managed edge provisions itself and fills the settings in for you).
Free / bring-your-own-zone: open Nivoli Edge Settings, confirm the auto-detected image host + path prefix, toggle Enabled.
Add rules under Image rules if specific sizes need specific treatment, or let Size mapping create them from your theme’s registered sizes in one click. Catch-all handles the rest with zero config.
For HTML caching, open Settings Page cache and pick a backend (managed Nivoli with your API key, or your own Fastly / CF Enterprise / webhook).
The Dashboard shows whether everything’s working and what the edge is doing for you.

FAQ

Does this require Cloudflare Pro?: Cloudflare Image Resizing is bundled with Pro plans or available as per-1000-transforms pay-as-you-go. Either is fine.
Will this break my theme?: No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the no-cf CSS class on any element to opt out.
How is this different from Smush / ShortPixel / Optimole?: Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.
What’s the difference between Free and Managed?: Everything the plugin does on your own server is free and fully functional: image rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, custom hostnames, watermarking, and multi-site fleet management.
Does the page caching conflict with my security plugin (Wordfence, Sucuri)?: No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli Edge’s ten shields (XML-RPC block, login country lock, login, comment and search flood limits, stray-PHP and WordPress surface locks, AI-crawler block, wp-admin IP lock, security headers) run at Cloudflare’s edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.
Do I need to change my nginx / web-server config?: Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Nivoli Edge” is open source software. The following people have contributed to this plugin.

calimonk

Translate “Nivoli Edge” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.

1.54.1

The pending-confirmation notice on the Locks page has a Dismiss button, for when you decide not to click the link; the change stays unapplied. Readme and screenshots cover the Locks page.

1.54.0

Locks page: the wp-admin IP lock and the login country lock moved here from Attack surface, with one row of counts (code changes refused, wp-admin visits blocked, logins blocked by country), a list of exactly which plugin or theme installs were refused, and a lock activity log showing unlock requests, clicked links, confirmations and lock changes with time and address. The unlocked-for-N-minutes badge now shows after clicking the mailed link too.

1.53.1

Install lock: the Locks page can unlock installs for 15 minutes (it emails you the link, like the blocked page’s button) and lock again early, and shows the minutes left while the window is open. Pairs with the edge fix that makes WordPress’s install button show the refusal instead of spinning.

1.53.0

Security now has three pages: Edge shields, PHP & surface shields (renamed from locks, same address), and Locks, where the change lock and install lock live with the confirmation address stated once. Shields refuse requests; locks keep a takeover from switching anything off.

1.52.2

Change lock: while a confirmation email is out, the Edge shields pane reads the edge directly on every load, so the change shows up as soon as you have clicked the link, and the Locks header says a confirmation is pending. Pairs with edge admin v2.24.1, which fixes the confirmation links themselves.

1.52.1

Readme and banner lead with hardening: shields first, then the two locks in their own section, then pages, images and the numbers. Short description and tagline follow.

1.52.0

Change lock: instead of unlock windows, every refused change is confirmed by email. Click the change in WordPress, an email names it, the link applies exactly that change once. The Send me an unlock link button is gone. The install lock keeps its 15-minute window and the button on its blocked page. Needs edge admin v2.23.0.

1.51.1

Edge shields: the change lock and install lock sit in one Locks block that states the confirmation address once, the email on your Nivoli license, with the two cards side by side; the logins tile reads as one number with the real logins that got through as its sub line.

1.51.0

Install lock, on the Edge shields pane: the edge refuses wp-admin requests that change code on your server (installing, uploading, updating or deleting plugins and themes, the file editors) until you confirm by email; the blocked page carries the button, so the lock stays on and you confirm when you mean it. Automatic updates and WP-CLI run on the server and are unaffected. The attack-surface strip is one row: logins stopped and the real logins that reached the server share a tile, and the stray-PHP tile lives on its own page now. Copy says the confirmation goes to the email address on your Nivoli license. Needs edge v2.6.2 / admin v2.22.0.

1.50.2

Readme only: the Description is headings and bullet lists instead of paragraphs; the ten shields are a list. No code change.

1.50.1

Readme only: changelog entries are single paragraphs so the WordPress plugin dialog stops rendering the old hard line breaks, and the Description now covers static assets at the edge with URL versioning. No code change.

1.50.0

The stray-PHP lock and the WordPress surface lock have their own page under Security, PHP & surface locks, with their two counters and one plain sentence that was missing: what they refuse is traffic arriving from the internet. Code running on your own server (plugins including their files, WP-Cron, WP-CLI) and anything carrying your login cookie is never affected. Edge shields is shorter as a result and points there.

1.49.0

Change lock, on the Edge shields pane. With it on, the edge refuses any change from this WordPress that weakens protection (a shield off, the purge allowlist, the wp-admin IP list, a rule removed, the lock itself) unless you first click an unlock link mailed to the email address on your Nivoli license, which lives at the edge and cannot be redirected from WordPress. Turning shields on never needs it. Refused attempts email you. Needs edge admin v2.21.0.