Сүрөттөө
Nivoli Edge is a security layer that lives one step above WordPress. Attacks, floods, scanners and code changes are refused at Cloudflare’s edge before a request reaches PHP, and the settings that refuse them live there too, behind an email confirmation, so a hacked WordPress cannot switch them off or install anything. The same edge serves whole HTML pages and right-sized images from the node nearest each visitor, and every number shows up inside WP admin.
Free and managed, in one sentence: the plugin is free and GPL and everything that runs on your own server works without an account; the shields, the locks, the edge cache and the numbers need the managed edge, from 15 euro a month with a 14-day trial.
The Edge Security layer
Wordfence and Sucuri run inside the site they protect. This runs one layer up, at the edge, and the site cannot reach it.
Ten shields, refused before PHP. Your server never boots PHP to turn a request away.
- Login flood limit (10 attempts per 10 minutes per address)
- Comment flood limit (5 posts per 5 minutes per address)
- Search flood limit (30 searches per 5 minutes per address)
- XML-RPC block (a cached 410)
- Login country lock (wp-login answers only the countries you list)
- wp-admin IP lock (your own addresses, with a self-lockout guard and an email rescue)
- AI-crawler block (GPTBot, ClaudeBot, CCBot and friends; search engines never affected)
- Stray-PHP lock (every .php request except the real WordPress entry points gets a 404)
- WordPress surface lock (the REST users list, ?author=N, readme.html, license.txt, the installer, debug.log)
- Security-headers pack (HSTS, nosniff, frame and referrer policies; your own values win)
Eight of them come with every managed plan; the AI-crawler block and the wp-admin IP lock from the Growth plan up. The stray-PHP and surface locks have a monitor mode that lists what blocking would have stopped before it blocks anything.
Three locks, nothing inside the site can turn off. A takeover of your WordPress admin owns every plugin’s settings page. Ours refuses to act on WordPress’s say-so.
- Change lock: any change that weakens protection waits for a click on a link mailed to the license holder; the link applies exactly that change, once.
- Install lock: plugin and theme installs, uploads, updates, deletes and the file editors are refused site-wide until a 15-minute window is opened the same way. Automatic updates and WP-CLI run on the server and are never affected.
- Origin lock: the edge stamps a per-site secret on every request it forwards and the plugin refuses code changes that arrive without it, so knowing the server’s address is no longer a way around the locks. A self-test reports whether the server enforces it.
Evidence: who did what, from where.
- Refused installs named by plugin, and every refused attempt in your inbox as it happens.
- A lock activity log with time and address for every unlock request, clicked link, confirmation and lock change.
- An attack-surface strip per fortnight, a monthly report by email, and for agencies a posture matrix across every site.
Underneath all of it, Cloudflare’s managed WAF rulesets, including the WordPress rule set, run in front of every managed site.
Pages served from the edge
Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.
- Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli, Fastly, Cloudflare Enterprise or your own webhook.
- Logged-in visitors, carts and checkout always bypass.
- Stylesheets, scripts and fonts from the edge too, on versioned addresses, so no browser or CDN node holds a stale file after a purge.
- Origin shield: if your server goes down, the edge keeps serving the last good copy of every cached page for up to 7 days and emails you when it engages and when the origin recovers.
Images served from the edge
URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants on the fly. No uploads, no duplicate copies, no migration, no theme changes.
- Per-size presets, one-click Size mapping from your theme’s registered sizes, a catch-all for everything else.
- Broken, heavy and fake images found from real traffic, with where each is used and one-click fixes; heavy originals shrink through Tinify.
The numbers, inside WP admin
- What the edge answered and what it refused, by window, with the most-requested and most-missed URLs.
- Dead URLs on a Live 404s page with one-click redirect or block; a Search Console 404 export imported, matched to your own pages and turned into redirect and block rules family by family; All rules: one ordered list of every edge rule with per-rule counts and reordering.
- Audience without a tracking script: humans versus bots, countries, referrers, devices, served-from-cache speed.
- Static assets: edge hit rate per file type and which files still travel on plain addresses.
- A monthly report by email, white-label copies for clients on Business and up.
Free versus managed
Free, on your own infrastructure, no account: image URL rewriting through your own Cloudflare zone (native WP filters, srcset, Gutenberg, WooCommerce, the_content and full-page scan), image rules and size mapping, page-cache tag headers with surgical purge to Fastly, Cloudflare Enterprise or your webhook, prewarm on save, coverage audit with a weekly regression email, fake-image detection and repair, purge-failure alerts, a weekly header self-test, a printable client report, the debug overlay, and WP-CLI.
Managed, with a Nivoli API key: everything in The Edge Security layer above, the managed page cache and image CDN (no Cloudflare account, plan or DNS work), origin shield, URL rules and the 404 inbox, per-path cache duration, the query-param manager, cache protection, dynamic-content safety for WooCommerce, edge insights and the monthly report, custom image hostname and watermarking, and for agencies a fleet console with one key across sites.
Requirements
- Free: a Cloudflare zone with Image Resizing enabled for the image half (Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten URLs 404; the Tools tab has a one-click probe to verify.
- Managed: none of the above; the managed edge provides both. Just an API key from your Nivoli account.
External services
The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.
Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/
Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms
Скриншоттор
Орнотуу
- Upload the plugin and activate it (or paste your API key on the Managed Edge tab; the managed edge provisions itself and fills the settings in for you).
- Free / bring-your-own-zone: open Nivoli Edge Settings, confirm the auto-detected image host + path prefix, toggle Enabled.
- Add rules under Image rules if specific sizes need specific treatment, or let Size mapping create them from your theme’s registered sizes in one click. Catch-all handles the rest with zero config.
- For HTML caching, open Settings Page cache and pick a backend (managed Nivoli with your API key, or your own Fastly / CF Enterprise / webhook).
- The Dashboard shows whether everything’s working and what the edge is doing for you.
FAQ.KG
-
Does this require Cloudflare Pro?
-
Cloudflare Image Resizing is bundled with Pro plans or available as per-1000-transforms pay-as-you-go. Either is fine.
-
Will this break my theme?
-
No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the
no-cfCSS class on any element to opt out. -
How is this different from Smush / ShortPixel / Optimole?
-
Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.
-
What’s the difference between Free and Managed?
-
Everything the plugin does on your own server is free and fully functional: image rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, custom hostnames, watermarking, and multi-site fleet management.
-
What if I lose access to my license email?
-
Confirmation and unlock links go to the email address on your Nivoli license and nowhere else; that is what makes the locks hold against a takeover. Support can move the license to a new address after verifying you own it. Until then the locks stay as they are and the site keeps running; only changes that weaken protection wait.
-
Does the install lock break automatic updates?
-
No. Automatic background updates run from wp-cron on your server and WP-CLI runs on the box; neither passes through the edge, so neither is affected. Only installs, uploads, updates and deletes started from wp-admin are refused, and you open a 15-minute window by email when you want to do one yourself.
-
What if my site gets hacked anyway?
-
The locks stop the intruder from switching the shields off, installing anything through WordPress, or redirecting the confirmation address, and every attempt lands in your inbox and on the Locks page with its time and address. What no edge control can do is undo code already running on your server: cleaning the box is still yours (scan, restore, rotate). The locks make sure the compromise stays where it landed.
-
Does the page caching conflict with my security plugin (Wordfence, Sucuri)?
-
No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli Edge’s ten shields run at Cloudflare’s edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.
-
Do I need to change my nginx / web-server config?
-
Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.
Сын-пикирлер
There are no reviews for this plugin.
Contributors & Developers
“Nivoli Edge” is open source software. The following people have contributed to this plugin.
Мүчөлөрү
Translate “Nivoli Edge” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Өзгөртүүлөр
Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.
1.64.0
Settings window, with the edge (admin-v2.34.0): the confirmation page now offers Apply, or Apply and unlock settings for 15 minutes. In that window, settings changes from WordPress go through without another email and each one is listed under Lock activity; installs stay locked and the change lock itself still needs a confirmation to turn off. The Locks page shows the window on the change-lock card with a Lock again now button; Lock activity names the new events.
1.63.0
Plan-bound windows, with the edge (admin-v2.33.0): every analytics picker offers 30 and 90 days; options above your plan’s analytics window (7 days on Starter, 30 on Growth, 90 on Business and Agency) show greyed with the plan that has them; the Audience card, the Attack surface card and the Origin shield history gained day pickers. The Origin shield pane says how long your plan covers an outage (a day on Starter, a week from Growth); Email and reports names the weekly report Growth and up receive every Monday.
1.62.0
Rule cap by plan: 100 redirect and block rules per site on Starter, 500 on Growth, 1000 on Business and Agency (the edge used to stop everyone at 100). All rules shows how many of your plan’s rules are in use, turns amber at 80 percent and names the plan that raises it; the Redirects tile counts against the same cap; the 404 import refuses an apply that would not fit before sending it, with the count and the next plan.
1.61.0
All rules (was URL rules): the one ordered list every edge rule runs through, numbered, with move up and down arrows because the first match wins. Redirect rows stay in the list in grey with their position and an Edit on Redirects link; blocks are added and edited here, the form makes blocks only. The per-path analytics split: What your blocks answered under All rules, Where your redirects fired under Redirects.
1.60.1
404 import: the Old URL column kept its width (fixed table layout; it collapsed to one character next to the destination field), a junk URL defaults to Block even when its last segment happens to be a live slug, and a generic last segment such as index or feed never counts as an exact match.
1.60.0
URL handling is four pages: URL rules, Redirects (overview and the add form, now above the list, with generic examples), Live 404s (the suggestions inbox that used to sit under Redirects, on its own page) and the 404 import. The rail order matches the flow: see what is asked for, import what Google still holds, write the rules.
1.59.0
404 import (Managed Edge > URL handling): upload the Search Console Not found (404) export or paste URLs. Every dead path is matched against your posts, pages, tags and categories, grouped by URL family (/tag/, /Walkthroughs/, a year), and shown with a destination preselected where the match is confident and Block preselected for junk. Apply writes the ticked rows as one rule change; a family can be blocked with one shape-matched pattern, or redirected slug for slug when three or more members map onto one prefix. Handled, skipped and awaiting-confirmation rows stay on the list, and a rule that appears on the edge later settles its rows automatically.
1.58.4
Fake images pane: a row recorded before the file sniffer stored what the bytes are is shown as unknown data instead of raising two PHP warnings per row; same for the CLI listing.
1.58.3
Locks page: the install-unlock request has its own marker, so dismissing the change-lock notice can no longer hide an open unlock window; the page keeps reading the edge until the window shows. Stray-PHP allowlist: patterns are checked against the JavaScript regex dialect the edge uses, and PCRE-only syntax such as (?i) or \A is refused with the construct named instead of silently exempting nothing. Adding a 41st path to the allowlist is refused out loud instead of dropped.
1.58.2
Managed Edge pane cache, from the external review: a save no longer wipes every cached pane read (the Locks page came back fully cold and the dashboard widget went blank); forgetting a read that was never cached no longer purges everything; on Redis or Memcached hosts the health check now counts the cached reads through its registry instead of reporting empty; while a confirmation is pending only lock and shield state is re-read live, analytics stay cached, and a failed re-read serves the cached copy instead of fetching twice; a background refresh can no longer overwrite a state a save just changed.