Description
Edge Cache & Security for Cloudflare connects your WordPress site to the Cloudflare zone it already uses, with a scoped API token. It sets up Cloudflare features for you and keeps them in sync with your content.
Smart Page Cache
- Installs two Cloudflare Cache Rules: pages are cached at the edge for visitors without a login or cart, while admin pages, logged-in users, previews, the REST API and other dynamic requests go to your server.
- Choose how long pages stay in the Cloudflare cache. The plan minimum is respected.
- A built-in cache check requests your pages as a visitor and explains the
cf-cache-statusresult. - Only rules whose name starts with
[CFEH]are ever created, changed or removed. Your own rules are left alone.
Smart Purge
- When you publish, update or delete content, the changed page and related pages (home, archives, feeds, sitemap) are purged.
- Purges are batched and sent after the change, never during a normal visitor page view.
- Purge single URLs or the whole zone from the dashboard, the admin bar or WP-CLI.
WooCommerce
- Cart, checkout and My Account pages, and visitors with a cart or session cookie, always bypass the cache.
- Product, variation, stock, price and scheduled sale changes trigger a purge.
Real visitor IP
- Restores the visitor IP from the
CF-Connecting-IPheader, only when the request really comes from a Cloudflare address. The Cloudflare IP list is bundled with the plugin and, once you connect your zone, refreshed weekly.
Turnstile anti-spam
- Cloudflare Turnstile on the login, registration, lost password and comment forms, and on WooCommerce My Account and checkout forms.
- Choose what happens if Cloudflare cannot be reached: allow the form and log a warning (default), or reject it.
Edge security
- Hardening presets as Cloudflare WAF custom rules: block XML-RPC, challenge the login page, block user enumeration, block probes for sensitive files.
- Allowlist and blocklist for IP addresses and ranges. Your own IP, Cloudflare addresses and private ranges cannot be blocked, and your IP is added to the allowlist when you connect.
- The dashboard shows each rule’s expression and how many custom rules your plan allows.
Dashboard, logs and safe mode
- Overview with requests and cache hit ratio for the last 24 hours (from Cloudflare analytics, when your plan and token allow it), security event counts and the last purge.
- Logs with filters for API calls, purges, cache and security events. Entries are deleted after 30 days by default.
- Safe mode pauses purges, cache headers and Turnstile checks with one click or with
define( 'CFEH_SAFE_MODE', true );. - Light and dark themes. All assets are bundled with the plugin.
WP-CLI
wp cfeh status, `wp cfeh purge --all|--urls=<urls>`, `wp cfeh rules install|remove|status`, `wp cfeh diagnose`, `wp cfeh safe-mode on|off`, `wp cfeh ip allow|unallow <ip>`.
External services
This plugin connects to services provided by Cloudflare, Inc.
Cloudflare API (api.cloudflare.com)
Used to verify your API token, find your zone, create and remove the cache and security rules made by this plugin, purge cached pages, read traffic analytics for the dashboard (GraphQL Analytics API) and refresh the list of Cloudflare IP addresses. Requests are sent from your server only when you use the plugin dashboard or WP-CLI, when content changes require a purge, and from scheduled background tasks (weekly IP list refresh, retried purges). Nothing is sent to Cloudflare until you connect a zone with your API token; activating the plugin makes no external request. They are never sent during a normal visitor page view. Data sent: your API token (as an authorization header), your zone id, rule definitions (which may include IP addresses you add to the allowlist or blocklist) and the URLs of pages to purge.
- Terms: https://www.cloudflare.com/website-terms/
- Privacy policy: https://www.cloudflare.com/privacypolicy/
Cloudflare Turnstile (challenges.cloudflare.com)
Only when you enable Turnstile and choose forms to protect. The Turnstile script is loaded from challenges.cloudflare.com on pages that show a protected form, and runs in the visitor’s browser. When the form is sent, your server sends the Turnstile token, your secret key and the visitor IP address to challenges.cloudflare.com to check it.
- Terms: https://www.cloudflare.com/website-terms/
- Privacy policy: https://www.cloudflare.com/turnstile-privacy-policy/
Your own site
The cache check on the Cache tab requests your own home page and latest post (and a WooCommerce product page, if any) from your server, as an anonymous visitor and with a test cookie, to read the cache status headers. No data is sent to third parties.
Screenshots
![Security: hardening presets, allowlist and blocklist, and the [CFEH] rules installed on Cloudflare.](https://ps.w.org/edge-cache-security-for-cloudflare/assets/screenshot-3.png?rev=3801446)
Installation
- Install and activate the plugin.
- In Cloudflare, create a Custom API Token (My Profile > API Tokens) limited to your site’s zone. The dashboard lists the permissions each feature needs; “Zone > Zone > Read” is required.
- Open Edge Cache & Security in the WordPress admin, paste the token and follow the wizard.
- On the Cache tab, click “Install cache rules”.
You can also define the token in wp-config.php: define( 'CFEH_API_TOKEN', '...' );. It then cannot be changed from the dashboard.
FAQ
-
Which Cloudflare credentials does it use?
-
A scoped Cloudflare API Token only. The Global API Key is not supported. The token is stored encrypted and is never shown again after you save it; only its last four characters are displayed.
-
Does it work with another page cache plugin?
-
It can, but running two page caches or two Cloudflare integrations can cause stale pages or duplicate purges. The Cache tab warns you when it detects one.
-
Will it change my existing Cloudflare rules?
-
No. It only creates and manages rules whose description starts with
[CFEH]. It adds its rules after yours and re-reads the rule list before every change. -
What happens if Cloudflare is unreachable?
-
Nothing is blocked. Purges are retried later, Turnstile follows the failure mode you chose (allow by default), and errors are logged.
-
I locked myself out. What now?
-
Add
define( 'CFEH_SAFE_MODE', true );to wp-config.php. Turnstile checks stop at once. Edge security rules live on Cloudflare: remove them on the Tools tab, withwp cfeh rules remove, or in the Cloudflare dashboard (Security > WAF > Custom rules, names starting with[CFEH]). -
Does uninstalling remove the rules from Cloudflare?
-
No. Uninstalling removes local data only (settings, logs, scheduled tasks). Use “Remove [CFEH] rules” on the Tools tab first if you want the rules gone.
-
Does it support WordPress Multisite?
-
Not yet. On a Multisite network the plugin shows a notice and stays inactive.
-
Which data does it store about visitors?
-
Log entries can contain visitor IP addresses and browser user agents (for example, failed logins or blocked form submissions). They are stored in your WordPress database and deleted after the retention period. A suggested text is added to the Privacy Policy guide.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Edge Cache & Security for Cloudflare” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Edge Cache & Security for Cloudflare” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- First release: connection wizard, Smart Page Cache with Cache Rules, Smart Purge, WooCommerce bypass, real visitor IP, Turnstile, hardening presets, IP allowlist and blocklist, logs, overview analytics, safe mode and WP-CLI.