Title: Edge Cache & Security for Cloudflare
Author: azmarket
Published: November 14, 2026
Last modified: November 14, 2026
---
Search plugins
# Edge Cache & Security for Cloudflare
By [azmarket](https://profiles.wordpress.org/azmarket/)
[Download](https://downloads.wordpress.org/plugin/edge-cache-security-for-cloudflare.1.0.0.zip)
* [Details](https://wordpress.org/plugins/edge-cache-security-for-cloudflare/#description)
* [Reviews](https://wordpress.org/plugins/edge-cache-security-for-cloudflare/#reviews)
* [Installation](https://wordpress.org/plugins/edge-cache-security-for-cloudflare/#installation)
* [Development](https://wordpress.org/plugins/edge-cache-security-for-cloudflare/#developers)
[Support](https://wordpress.org/support/plugin/edge-cache-security-for-cloudflare/)
## Description
Edge Cache & Security for Cloudflare connects your WordPress site to the Cloudflare
zone it already uses, with a scoped API token. It sets up Cloudflare features for
you and keeps them in sync with your content.
#### Smart Page Cache
* Installs two Cloudflare Cache Rules: pages are cached at the edge for visitors
without a login or cart, while admin pages, logged-in users, previews, the REST
API and other dynamic requests go to your server.
* Choose how long pages stay in the Cloudflare cache. The plan minimum is respected.
* A built-in cache check requests your pages as a visitor and explains the `cf-
cache-status` result.
* Only rules whose name starts with `[CFEH]` are ever created, changed or removed.
Your own rules are left alone.
#### Smart Purge
* When you publish, update or delete content, the changed page and related pages(
home, archives, feeds, sitemap) are purged.
* Purges are batched and sent after the change, never during a normal visitor page
view.
* Purge single URLs or the whole zone from the dashboard, the admin bar or WP-CLI.
#### WooCommerce
* Cart, checkout and My Account pages, and visitors with a cart or session cookie,
always bypass the cache.
* Product, variation, stock, price and scheduled sale changes trigger a purge.
#### Real visitor IP
* Restores the visitor IP from the `CF-Connecting-IP` header, only when the request
really comes from a Cloudflare address. The Cloudflare IP list is bundled with
the plugin and, once you connect your zone, refreshed weekly.
#### Turnstile anti-spam
* Cloudflare Turnstile on the login, registration, lost password and comment forms,
and on WooCommerce My Account and checkout forms.
* Choose what happens if Cloudflare cannot be reached: allow the form and log a
warning (default), or reject it.
#### Edge security
* Hardening presets as Cloudflare WAF custom rules: block XML-RPC, challenge the
login page, block user enumeration, block probes for sensitive files.
* Allowlist and blocklist for IP addresses and ranges. Your own IP, Cloudflare
addresses and private ranges cannot be blocked, and your IP is added to the allowlist
when you connect.
* The dashboard shows each rule’s expression and how many custom rules your plan
allows.
#### Dashboard, logs and safe mode
* Overview with requests and cache hit ratio for the last 24 hours (from Cloudflare
analytics, when your plan and token allow it), security event counts and the
last purge.
* Logs with filters for API calls, purges, cache and security events. Entries are
deleted after 30 days by default.
* Safe mode pauses purges, cache headers and Turnstile checks with one click or
with `define( 'CFEH_SAFE_MODE', true );`.
* Light and dark themes. All assets are bundled with the plugin.
#### WP-CLI
```
wp cfeh status, `wp cfeh purge --all|--urls=`, `wp cfeh rules install|remove|status`, `wp cfeh diagnose`, `wp cfeh safe-mode on|off`, `wp cfeh ip allow|unallow `.
```
### External services
This plugin connects to services provided by Cloudflare, Inc.
#### Cloudflare API (api.cloudflare.com)
Used to verify your API token, find your zone, create and remove the cache and security
rules made by this plugin, purge cached pages, read traffic analytics for the dashboard(
GraphQL Analytics API) and refresh the list of Cloudflare IP addresses. Requests
are sent from your server only when you use the plugin dashboard or WP-CLI, when
content changes require a purge, and from scheduled background tasks (weekly IP
list refresh, retried purges). Nothing is sent to Cloudflare until you connect a
zone with your API token; activating the plugin makes no external request. They
are never sent during a normal visitor page view. Data sent: your API token (as
an authorization header), your zone id, rule definitions (which may include IP addresses
you add to the allowlist or blocklist) and the URLs of pages to purge.
* Terms: https://www.cloudflare.com/website-terms/
* Privacy policy: https://www.cloudflare.com/privacypolicy/
#### Cloudflare Turnstile (challenges.cloudflare.com)
Only when you enable Turnstile and choose forms to protect. The Turnstile script
is loaded from challenges.cloudflare.com on pages that show a protected form, and
runs in the visitor’s browser. When the form is sent, your server sends the Turnstile
token, your secret key and the visitor IP address to challenges.cloudflare.com to
check it.
* Terms: https://www.cloudflare.com/website-terms/
* Privacy policy: https://www.cloudflare.com/turnstile-privacy-policy/
#### Your own site
The cache check on the Cache tab requests your own home page and latest post (and
a WooCommerce product page, if any) from your server, as an anonymous visitor and
with a test cookie, to read the cache status headers. No data is sent to third parties.
## Screenshots
[⌊Overview: Cloudflare connection, token permissions, visitor IP check and traffic
for the last 24 hours with the cache hit ratio.⌉⌊Overview: Cloudflare connection,
token permissions, visitor IP check and traffic for the last 24 hours with the cache
hit ratio.⌉[
Overview: Cloudflare connection, token permissions, visitor IP check and traffic
for the last 24 hours with the cache hit ratio.
[⌊Cache: Smart Page Cache rules on Cloudflare, cache duration, purge tools and the
built-in cache check.⌉⌊Cache: Smart Page Cache rules on Cloudflare, cache duration,
purge tools and the built-in cache check.⌉[
Cache: Smart Page Cache rules on Cloudflare, cache duration, purge tools and the
built-in cache check.
[⌊Security: hardening presets, allowlist and blocklist, and the [CFEH] rules installed
on Cloudflare.⌉⌊Security: hardening presets, allowlist and blocklist, and the [CFEH]
rules installed on Cloudflare.⌉[
Security: hardening presets, allowlist and blocklist, and the [CFEH] rules installed
on Cloudflare.
[⌊Turnstile: protect the login, registration, lost password, comment and WooCommerce
forms.⌉⌊Turnstile: protect the login, registration, lost password, comment and WooCommerce
forms.⌉[
Turnstile: protect the login, registration, lost password, comment and WooCommerce
forms.
[⌊Logs with level, channel, text and date filters.⌉⌊Logs with level, channel, text
and date filters.⌉[
Logs with level, channel, text and date filters.
[⌊Connection wizard: paste a scoped API token; the permissions each feature needs
are listed.⌉⌊Connection wizard: paste a scoped API token; the permissions each feature
needs are listed.⌉[
Connection wizard: paste a scoped API token; the permissions each feature needs
are listed.
[⌊Dark theme.⌉⌊Dark theme.⌉[
Dark theme.
## Installation
1. Install and activate the plugin.
2. In Cloudflare, create a Custom API Token (My Profile > API Tokens) limited to your
site’s zone. The dashboard lists the permissions each feature needs; “Zone > Zone
> Read” is required.
3. Open Edge Cache & Security in the WordPress admin, paste the token and follow the
wizard.
4. On the Cache tab, click “Install cache rules”.
You can also define the token in wp-config.php: `define( 'CFEH_API_TOKEN', '...');`.
It then cannot be changed from the dashboard.
## FAQ
### Which Cloudflare credentials does it use?
A scoped Cloudflare API Token only. The Global API Key is not supported. The token
is stored encrypted and is never shown again after you save it; only its last four
characters are displayed.
### Does it work with another page cache plugin?
It can, but running two page caches or two Cloudflare integrations can cause stale
pages or duplicate purges. The Cache tab warns you when it detects one.
### Will it change my existing Cloudflare rules?
No. It only creates and manages rules whose description starts with `[CFEH]`. It
adds its rules after yours and re-reads the rule list before every change.
### What happens if Cloudflare is unreachable?
Nothing is blocked. Purges are retried later, Turnstile follows the failure mode
you chose (allow by default), and errors are logged.
### I locked myself out. What now?
Add `define( 'CFEH_SAFE_MODE', true );` to wp-config.php. Turnstile checks stop
at once. Edge security rules live on Cloudflare: remove them on the Tools tab, with`
wp cfeh rules remove`, or in the Cloudflare dashboard (Security > WAF > Custom rules,
names starting with `[CFEH]`).
### Does uninstalling remove the rules from Cloudflare?
No. Uninstalling removes local data only (settings, logs, scheduled tasks). Use “
Remove [CFEH] rules” on the Tools tab first if you want the rules gone.
### Does it support WordPress Multisite?
Not yet. On a Multisite network the plugin shows a notice and stays inactive.
### Which data does it store about visitors?
Log entries can contain visitor IP addresses and browser user agents (for example,
failed logins or blocked form submissions). They are stored in your WordPress database
and deleted after the retention period. A suggested text is added to the Privacy
Policy guide.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Edge Cache & Security for Cloudflare” is open source software. The following people
have contributed to this plugin.
Contributors
* [ azmarket ](https://profiles.wordpress.org/azmarket/)
[Translate “Edge Cache & Security for Cloudflare” into your language.](https://translate.wordpress.org/projects/wp-plugins/edge-cache-security-for-cloudflare)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/edge-cache-security-for-cloudflare/),
check out the [SVN repository](https://plugins.svn.wordpress.org/edge-cache-security-for-cloudflare/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/edge-cache-security-for-cloudflare/)
by [RSS](https://plugins.trac.wordpress.org/log/edge-cache-security-for-cloudflare/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* First release: connection wizard, Smart Page Cache with Cache Rules, Smart Purge,
WooCommerce bypass, real visitor IP, Turnstile, hardening presets, IP allowlist
and blocklist, logs, overview analytics, safe mode and WP-CLI.
## Meta
* Version **1.0.0**
* Last updated **22 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.4**
* PHP version ** 8.1 or higher **
* Tags
* [cache](https://wordpress.org/plugins/tags/cache/)[cloudflare](https://wordpress.org/plugins/tags/cloudflare/)
[Purge](https://wordpress.org/plugins/tags/purge/)[security](https://wordpress.org/plugins/tags/security/)
[turnstile](https://wordpress.org/plugins/tags/turnstile/)
* [Advanced View](https://wordpress.org/plugins/edge-cache-security-for-cloudflare/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/edge-cache-security-for-cloudflare/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/edge-cache-security-for-cloudflare/reviews/)
## Contributors
* [ azmarket ](https://profiles.wordpress.org/azmarket/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/edge-cache-security-for-cloudflare/)