Description

Nivoli Edge puts Cloudflare’s edge in front of your WordPress site and adds the WordPress layer Cloudflare alone does not have. Three things happen before a request reaches PHP.

Pages served from the edge

Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.

Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli, Fastly, Cloudflare Enterprise or your own webhook.
Logged-in visitors, carts and checkout always bypass.
Stylesheets, scripts and fonts from the edge too, with URL versioning: every purge moves them to a new address, so no browser or CDN node holds a stale file after a change.
The Static assets pane shows the edge hit rate per file type and which files still travel on plain addresses.

Images served from the edge

URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants on the fly.

No uploads, no duplicate copies, no migration, no theme changes.
Per-size presets, one-click Size mapping from your theme’s registered sizes, a catch-all for everything else.

Attacks stopped before PHP

Ten shields run at the edge, earlier than any security plugin can. Your server never boots PHP to refuse a request.

Login, comment and search flood limits
XML-RPC block
Login country lock
wp-admin IP lock
AI-crawler block
Stray-PHP lock: every .php request except the real WordPress entry points gets a 404
WordPress surface lock: user enumeration (the REST users list, ?rest_route=, ?author=N) and leftover files (readme.html, license.txt, the installer, debug.log)
Security-headers pack
Change lock: weakening any of the above from WordPress needs an unlock link mailed to the email address on your Nivoli license, so a takeover cannot switch the shields off
Install lock: installing, uploading, updating or deleting plugins and themes and the file editors are refused at the edge until you confirm by email from the blocked page; automatic updates and WP-CLI are unaffected

Wordfence or Sucuri keep inspecting what gets through. They simply see far less.

The numbers to prove it, inside WP admin

What the edge answered and what it refused, by window
Broken and heavy images found from real traffic, with one-click fixes
Dead URLs in a 404 inbox with one-click redirect or block
Audience without a tracking script: humans versus bots, countries, referrers, devices
A monthly report by email

One plugin, one API key. Everything that runs on your own server is free; the managed edge is the part you cannot self-host.

Free (everything that runs on your own infrastructure)

Images: URL rewriting through your own Cloudflare zone: right-sized AVIF/WebP via native WP filters (the_post_thumbnail, srcset, Gutenberg, WooCommerce), the_content + full-page scan, catch-all optimization.
Rules: presets + size-name / filename-glob bindings, one-click Size mapping from your theme’s registered sizes.
Page caching: tag headers + surgical tag purge on save/delete/comment, dispatched to Fastly, Cloudflare Enterprise, or your own webhook. Activity log + trace mode.
Audit & automation: coverage audit with weekly regression email, runtime-misses log, fake-image detection & repair, pre-warm on save and after purges, purge-failure alerts, weekly header self-test, printable client report.
Tools: ?cfdebug=1 overlay, live pipeline probe, Tinify source compression (your own API key), WP-CLI (status / activate / purge / probe / audit).

The managed service (optional)

Everything above is fully functional without an account. Connecting your Nivoli API key links the plugin to the managed edge, which adds what only a hosted service can do:

Change lock and install lock: once on, any change that weakens protection, and any wp-admin request that changes code (plugin and theme install, upload, update, delete, the file editors), needs a confirmation link mailed to the email address on your Nivoli license, the one your license key went to. It lives at the edge and cannot be redirected from WordPress, so a takeover cannot switch the shields off or extend itself through WordPress tooling. Refused attempts email you.
Edge shields, enforced before PHP: XML-RPC block, login country lock and the security-headers pack on every plan; login, comment and search flood limits, the stray-PHP lock, the WordPress surface lock, the wp-admin IP lock and the AI-crawler block from the Growth plan up. Each has an off switch, the two locks have a monitor mode that lists what blocking would have stopped, and an attack-surface strip shows what every shield did in the last 14 days. Underneath them, Cloudflare’s managed WAF rulesets, including the WordPress rule set, run in front of every managed site.
URL rules and the 404 inbox: block or redirect legacy paths at the edge with a cached 410 or 301, one rule per family of URLs, with per-rule fire counts; live 404s your server keeps answering are listed with one-click redirect or block.
Origin shield: if your server goes down, the edge keeps serving the last good copy of every cached page (up to 7 days) and emails you when the shield engages and when your origin recovers.
Managed page cache: full-page HTML caching with no Cloudflare Enterprise plan required. Bundled in every plan; fair-use, doesn’t touch your image quota. Static assets (stylesheets, scripts, fonts) served from the edge with URL versioning so purges reach browsers.
Managed image CDN: we run the Cloudflare zone; no CF account, plan, or DNS work. Custom hostname (img.yoursite.com), CDN-level watermarking.
Edge insights: usage & quota, cache-hit / bandwidth / origin-offload stats, 48-hour hourly traffic chart, Top URLs (most-missed / most-requested), audience (humans vs bots, countries, referrers, devices, no tracking script), broken-image alerts with “where used”, heaviest images with one-click Tinify shrinking, and a monthly report by email.
Edge controls: per-path cache duration (TTL), query-param manager, cache protection (purge-IP allowlist), and dynamic content (WooCommerce cart and checkout safety, plus how the edge treats the Cache-Control headers your site sends).
Agency: multi-site fleet view, one API key across sites, white-label client reports, priority support.

Requirements

Free: a Cloudflare zone with Image Resizing enabled for the image half (Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten URLs 404; the Tools tab has a one-click probe to verify.
Managed: none of the above; the managed edge provides both. Just an API key from your Nivoli account.

External services

The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.

Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy

Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/

TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms

Screenshots

Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends.

Edge shields: the attack surface strip and every shield with its switch, enforced before your server. — Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends.

Installation

Upload the plugin and activate it (or paste your API key on the Managed Edge tab; the managed edge provisions itself and fills the settings in for you).
Free / bring-your-own-zone: open Nivoli Edge Settings, confirm the auto-detected image host + path prefix, toggle Enabled.
Add rules under Image rules if specific sizes need specific treatment, or let Size mapping create them from your theme’s registered sizes in one click. Catch-all handles the rest with zero config.
For HTML caching, open Settings Page cache and pick a backend (managed Nivoli with your API key, or your own Fastly / CF Enterprise / webhook).
The Dashboard shows whether everything’s working and what the edge is doing for you.

FAQ

Does this require Cloudflare Pro?: Cloudflare Image Resizing is bundled with Pro plans or available as per-1000-transforms pay-as-you-go. Either is fine.
Will this break my theme?: No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the no-cf CSS class on any element to opt out.
How is this different from Smush / ShortPixel / Optimole?: Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.
What’s the difference between Free and Managed?: Everything the plugin does on your own server is free and fully functional: image rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, custom hostnames, watermarking, and multi-site fleet management.
Does the page caching conflict with my security plugin (Wordfence, Sucuri)?: No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli Edge’s ten shields (XML-RPC block, login country lock, login, comment and search flood limits, stray-PHP and WordPress surface locks, AI-crawler block, wp-admin IP lock, security headers) run at Cloudflare’s edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.
Do I need to change my nginx / web-server config?: Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Nivoli Edge” is open source software. The following people have contributed to this plugin.

calimonk

Translate “Nivoli Edge” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.

1.51.1

Edge shields: the change lock and install lock sit in one Locks block that states the confirmation address once, the email on your Nivoli license, with the two cards side by side; the logins tile reads as one number with the real logins that got through as its sub line.

1.51.0

Install lock, on the Edge shields pane: the edge refuses wp-admin requests that change code on your server (installing, uploading, updating or deleting plugins and themes, the file editors) until you confirm by email; the blocked page carries the button, so the lock stays on and you confirm when you mean it. Automatic updates and WP-CLI run on the server and are unaffected. The attack-surface strip is one row: logins stopped and the real logins that reached the server share a tile, and the stray-PHP tile lives on its own page now. Copy says the confirmation goes to the email address on your Nivoli license. Needs edge v2.6.2 / admin v2.22.0.

1.50.2

Readme only: the Description is headings and bullet lists instead of paragraphs; the ten shields are a list. No code change.

1.50.1

Readme only: changelog entries are single paragraphs so the WordPress plugin dialog stops rendering the old hard line breaks, and the Description now covers static assets at the edge with URL versioning. No code change.

1.50.0

The stray-PHP lock and the WordPress surface lock have their own page under Security, PHP & surface locks, with their two counters and one plain sentence that was missing: what they refuse is traffic arriving from the internet. Code running on your own server (plugins including their files, WP-Cron, WP-CLI) and anything carrying your login cookie is never affected. Edge shields is shorter as a result and points there.

1.49.0

Change lock, on the Edge shields pane. With it on, the edge refuses any change from this WordPress that weakens protection (a shield off, the purge allowlist, the wp-admin IP list, a rule removed, the lock itself) unless you first click an unlock link mailed to the email address on your Nivoli license, which lives at the edge and cannot be redirected from WordPress. Turning shields on never needs it. Refused attempts email you. Needs edge admin v2.21.0.

1.48.3

Readme rewritten around what happens before a request reaches PHP: pages and images served from the edge, and the ten security shields, which the previous text barely mentioned. No code change.

1.48.2

Weekly header self-test: the plugin now tells the edge which address this server connects from right before the probe, so the edge recognizes its own site even when the server reaches it over IPv6 or from an address DNS does not name. Fixes the false “Page-cache headers stopped emitting” alert on servers with IPv6 whose origin hostname has no AAAA record. A probe that runs in the minute after a new address is registered is recorded as pending, not alerted.

1.48.1

Edge shields pane: the one-switch cards sit in two rows, the three flood limiters together and AI crawlers with security headers below, instead of five narrow columns. The WordPress surface lock card has one Block control; the duplicate “Turn on blocking” button is gone.

1.48.0

Three new edge shields, all Growth and up, all off until you turn them on. WordPress surface lock: anonymous requests for the REST users list (also via ?rest_route=), the ?author=N enumeration trick, readme.html, license.txt, the installer and debug.log get a cached 404 at the edge; logged-in sessions are never affected; off, monitor or block, with the measured list while monitoring. Comment flood limit: 5 posts to the comment form per 5 minutes per address. Search flood limit: 30 searches per 5 minutes per address. Two separate switches. The Attack surface strip gains a tile for each, and the Dashboard’s Protected pillar now reads Floods stopped (login, comment and search) with the surface lock counted among the probes, the same sums the monthly report uses.

1.47.1

Heaviest images: “Shrink original” refused files whose folder or file name contains two dots in a row (“File not found under the uploads directory” on a file that was serving fine). The traversal guard checked for “..” anywhere in the path; it now checks path segments, the same rule the placeholder flow already used, so real file names pass while “../” stays blocked.