Title: Nivoli Edge
Author: calimonk
Published: September 3, 2026
Last modified: September 4, 2026
---
Search plugins
# Nivoli Edge
By [calimonk](https://profiles.wordpress.org/calimonk/)
[Download](https://downloads.wordpress.org/plugin/nivoli-edge.1.57.0.zip)
* [Details](https://wordpress.org/plugins/nivoli-edge/#description)
* [Reviews](https://wordpress.org/plugins/nivoli-edge/#reviews)
* [Installation](https://wordpress.org/plugins/nivoli-edge/#installation)
* [Development](https://wordpress.org/plugins/nivoli-edge/#developers)
[Support](https://wordpress.org/support/plugin/nivoli-edge/)
## Description
Nivoli Edge puts Cloudflare’s edge in front of your WordPress site and adds the
WordPress layer Cloudflare alone does not have. Attacks are refused before a request
reaches PHP, the settings that refuse them live where a compromised site cannot
reach them, and the same layer serves whole pages and right-sized images from the
edge.
#### Attacks stopped before PHP
Ten shields run at the edge, earlier than any security plugin can, and your server
never boots PHP to refuse a request.
* Login, comment and search flood limits
* XML-RPC block
* Login country lock
* wp-admin IP lock
* AI-crawler block
* Stray-PHP lock: every .php request except the real WordPress entry points gets
a 404
* WordPress surface lock: user enumeration (the REST users list, ?rest_route=, ?
author=N) and leftover files (readme.html, license.txt, the installer, debug.
log)
* Security-headers pack
* Install lock: installing, uploading, updating or deleting plugins and themes
and the file editors are refused at the edge until you confirm by email from
the blocked page; automatic updates and WP-CLI are unaffected
Wordfence or Sucuri keep inspecting what gets through. They simply see far less.
#### Locks: nothing inside the site can turn it off
A WordPress takeover also owns every plugin’s settings page. Ours refuses to act
on WordPress’s say-so.
* Change lock: click any change that weakens protection and nothing happens yet;
an email to the address on your Nivoli license asks you to confirm exactly that
change, and the link applies it.
* Install lock: installing, uploading, updating or deleting plugins and themes,
and the file editors, are refused at the edge until you confirm by email; the
blocked page has the button. Automatic updates and WP-CLI run on the server and
are unaffected.
* Every refused attempt reaches you as that email, so you also learn when it was
not you.
* Origin lock: the edge stamps a secret on what it forwards; the plugin refuses
code changes that arrive without it, so knowing the server’s address is no longer
a way around the locks. A self-test reports whether the server enforces it.
* The Locks page: what the locks refused (code changes by plugin or theme, wp-admin
visits, logins by country), the wp-admin IP lock and login country lock, and
a lock activity log: every unlock request, clicked link, confirmation and lock
change with its time and address.
#### Pages served from the edge
Full-page HTML caching with surgical purge: only the pages featuring a changed post
refresh, never the whole cache.
* Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli,
Fastly, Cloudflare Enterprise or your own webhook.
* Logged-in visitors, carts and checkout always bypass.
* Stylesheets, scripts and fonts from the edge too, with URL versioning: every
purge moves them to a new address, so no browser or CDN node holds a stale file
after a change.
* The Static assets pane shows the edge hit rate per file type and which files
still travel on plain addresses.
#### Images served from the edge
URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants
on the fly.
* No uploads, no duplicate copies, no migration, no theme changes.
* Per-size presets, one-click Size mapping from your theme’s registered sizes,
a catch-all for everything else.
#### The numbers to prove it, inside WP admin
* What the edge answered and what it refused, by window
* Broken and heavy images found from real traffic, with one-click fixes
* Dead URLs in a 404 inbox with one-click redirect or block
* Audience without a tracking script: humans versus bots, countries, referrers,
devices
* A monthly report by email
One plugin, one API key. Everything that runs on your own server is free; the managed
edge is the part you cannot self-host.
#### Free (everything that runs on your own infrastructure)
* **Images:** URL rewriting through your own Cloudflare zone: right-sized AVIF/
WebP via native WP filters (`the_post_thumbnail`, srcset, Gutenberg, WooCommerce),
the_content + full-page scan, catch-all optimization.
* **Rules:** presets + size-name / filename-glob bindings, one-click Size mapping
from your theme’s registered sizes.
* **Page caching:** tag headers + surgical tag purge on save/delete/comment, dispatched
to Fastly, Cloudflare Enterprise, or your own webhook. Activity log + trace mode.
* **Audit & automation:** coverage audit with weekly regression email, runtime-
misses log, fake-image detection & repair, pre-warm on save and after purges,
purge-failure alerts, weekly header self-test, printable client report.
* **Tools:** `?cfdebug=1` overlay, live pipeline probe, Tinify source compression(
your own API key), WP-CLI (status / activate / purge / probe / audit).
#### The managed service (optional)
Everything above is fully functional without an account. Connecting your Nivoli
API key links the plugin to the managed edge, which adds what only a hosted service
can do:
* **Change lock and install lock:** once on, any change that weakens protection,
and any wp-admin request that changes code (plugin and theme install, upload,
update, delete, the file editors), needs a confirmation link mailed to the email
address on your Nivoli license, the one your license key went to. It lives at
the edge and cannot be redirected from WordPress, so a takeover cannot switch
the shields off or extend itself through WordPress tooling. Refused attempts
email you.
* **Edge shields, enforced before PHP:** eight attack shields on every managed
plan (XML-RPC block, login country lock, security headers, login, comment and
search flood limits, stray-PHP lock, WordPress surface lock); the AI-crawler
block and the wp-admin IP lock from the Growth plan up. Each has an off switch,
the two PHP and surface shields have a monitor mode that lists what blocking
would have stopped, and an attack-surface strip shows what every shield did in
the last 14 days. Underneath them, Cloudflare’s managed WAF rulesets, including
the WordPress rule set, run in front of every managed site.
* **URL rules and the 404 inbox:** block or redirect legacy paths at the edge with
a cached 410 or 301, one rule per family of URLs, with per-rule fire counts;
live 404s your server keeps answering are listed with one-click redirect or block.
* **Origin shield:** if your server goes down, the edge keeps serving the last
good copy of every cached page (up to 7 days) and emails you when the shield
engages and when your origin recovers.
* **Managed page cache:** full-page HTML caching with no Cloudflare Enterprise
plan required. Bundled in every plan; fair-use, doesn’t touch your image quota.
Static assets (stylesheets, scripts, fonts) served from the edge with URL versioning
so purges reach browsers.
* **Managed image CDN:** we run the Cloudflare zone; no CF account, plan, or DNS
work. Custom hostname (img.yoursite.com), CDN-level watermarking.
* **Edge insights:** usage & quota, cache-hit / bandwidth / origin-offload stats,
48-hour hourly traffic chart, Top URLs (most-missed / most-requested), audience(
humans vs bots, countries, referrers, devices, no tracking script), broken-image
alerts with “where used”, heaviest images with one-click Tinify shrinking, and
a monthly report by email.
* **Edge controls:** per-path cache duration (TTL), query-param manager, cache
protection (purge-IP allowlist), and dynamic content (WooCommerce cart and checkout
safety, plus how the edge treats the Cache-Control headers your site sends).
* **Agency:** multi-site fleet view, one API key across sites, white-label client
reports, priority support.
#### Requirements
* **Free:** a Cloudflare zone with **Image Resizing** enabled for the image half(
Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your
webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten
URLs 404; the Tools tab has a one-click probe to verify.
* **Managed:** none of the above; the managed edge provides both. Just an API key
from your Nivoli account.
### External services
The free tier’s core image rewriting sends **no data to any external service**;
it only rewrites `![]()
` URLs in your site’s HTML so browsers fetch through your
own Cloudflare zone. Beyond that, the plugin contacts external services only for
the specific, opt-in features listed below.
**Nivoli managed edge** (api at html-caching-admin.nivoli.workers.dev, dashboard
at console.nivoli.com): used **only if you enter an API key**. On activation and
on a daily background re-check it sends your API key, this site’s URL, the plugin
version, and the list of broken-image file paths you have marked handled (so the
monthly report can exclude them; these are addresses the CDN already sees in its
own traffic) to validate the key and provision your managed CDN/page-cache tenant;
it then reads back the aggregate usage statistics shown on the dashboard. If you
configure monthly reports or alerts, the recipient email address and optional report
branding (a name and logo URL) are stored with your account. No visitor data is
ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
**Cloudflare** (api.cloudflare.com): used **only if you configure the Cloudflare
Enterprise page-cache backend** with your own API token, to dispatch tag-based cache
purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy:
https://www.cloudflare.com/privacypolicy/
**Fastly** (api.fastly.com): used **only if you configure the Fastly page-cache
backend** with your own API token, to dispatch surrogate-key purges on content change.
Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
**TinyPNG / Tinify** (api.tinify.com): used **only if you add your own Tinify API
key and click “Shrink original”** on an image, to compress that source file. Only
the image you choose is sent. Terms & Privacy: https://tinify.com/terms
## Screenshots
[⌊Dashboard: what the edge did for you in the last 30 days. Delivered, Protected
and your plan at work, with 30-day trends.⌉⌊Dashboard: what the edge did for you
in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends
.⌉[
Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and
your plan at work, with 30-day trends.
[⌊Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment
and search floods) and every shield with its switch, enforced before your server.⌉⌊
Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and
search floods) and every shield with its switch, enforced before your server.⌉[
Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and
search floods) and every shield with its switch, enforced before your server.
[⌊Stats and overview: hour-by-hour traffic, origin offload, hit rates by window,
surgical purges.⌉⌊Stats and overview: hour-by-hour traffic, origin offload, hit
rates by window, surgical purges.⌉[
Stats and overview: hour-by-hour traffic, origin offload, hit rates by window, surgical
purges.
[⌊Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking,
and what the shrinking has saved so far.⌉⌊Heaviest images: the files costing the
most bandwidth, one-click Tinify shrinking, and what the shrinking has saved so
far.⌉[
Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking,
and what the shrinking has saved so far.
[⌊Redirects: legacy URLs answered at the edge, patterns and exact rules with usage,
unused rules folded away.⌉⌊Redirects: legacy URLs answered at the edge, patterns
and exact rules with usage, unused rules folded away.⌉[
Redirects: legacy URLs answered at the edge, patterns and exact rules with usage,
unused rules folded away.
[⌊Suggestions from live 404s: paths your server keeps answering with a 404, with
bot share and one-click redirect or block.⌉⌊Suggestions from live 404s: paths your
server keeps answering with a 404, with bot share and one-click redirect or block
.⌉[
Suggestions from live 404s: paths your server keeps answering with a 404, with bot
share and one-click redirect or block.
[⌊Your audience: humans versus bots, served-from-cache speed, referrers, devices
and countries, no tracking script.⌉⌊Your audience: humans versus bots, served-from-
cache speed, referrers, devices and countries, no tracking script.⌉[
Your audience: humans versus bots, served-from-cache speed, referrers, devices and
countries, no tracking script.
[⌊Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses,
bandwidth offloaded.⌉⌊Static assets: edge hit rate for stylesheets, scripts and
fonts, versioned addresses, bandwidth offloaded.⌉[
Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses,
bandwidth offloaded.
[⌊Query params: which parameters split the cache, which are guarded, with one-click
collapse.⌉⌊Query params: which parameters split the cache, which are guarded, with
one-click collapse.⌉[
Query params: which parameters split the cache, which are guarded, with one-click
collapse.
[⌊Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.⌉⌊
Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.⌉[
Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.
[⌊PHP & surface shields: stray PHP and enumeration or leftover requests refused,
with off, monitor and block for each.⌉⌊PHP & surface shields: stray PHP and enumeration
or leftover requests refused, with off, monitor and block for each.⌉[
PHP & surface shields: stray PHP and enumeration or leftover requests refused, with
off, monitor and block for each.
## Installation
1. Upload the plugin and activate it (or paste your API key on the **Managed Edge**
tab; the managed edge provisions itself and fills the settings in for you).
2. Free / bring-your-own-zone: open **Nivoli Edge Settings**, confirm the auto-detected
image host + path prefix, toggle Enabled.
3. Add rules under **Image rules** if specific sizes need specific treatment, or let**
Size mapping** create them from your theme’s registered sizes in one click. Catch-
all handles the rest with zero config.
4. For HTML caching, open **Settings Page cache** and pick a backend (managed Nivoli
with your API key, or your own Fastly / CF Enterprise / webhook).
5. The **Dashboard** shows whether everything’s working and what the edge is doing
for you.
## FAQ
### Does this require Cloudflare Pro?
Cloudflare Image Resizing is bundled with Pro plans or available as per-1000-transforms
pay-as-you-go. Either is fine.
### Will this break my theme?
No. The plugin only modifies URLs at the filter boundary; the HTML structure your
theme outputs is unchanged. Use the `no-cf` CSS class on any element to opt out.
### How is this different from Smush / ShortPixel / Optimole?
Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms
on the fly from your origin: no asset duplication, no migration step, no storage
bill.
### What’s the difference between Free and Managed?
Everything the plugin does on your own server is free and fully functional: image
rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones
home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare
zone and page cache for you (no Cloudflare setup at all) and the service adds what
a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights,
edge URL rules and security shields, custom hostnames, watermarking, and multi-site
fleet management.
### Does the page caching conflict with my security plugin (Wordfence, Sucuri)?
No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli
Edge’s ten shields (XML-RPC block, login country lock, login, comment and search
flood limits, stray-PHP and WordPress surface locks, AI-crawler block, wp-admin
IP lock, security headers) run at Cloudflare’s edge, before the request reaches
your server. It sheds junk traffic so your origin and your security plugin only
see real visitors. They complement each other.
### Do I need to change my nginx / web-server config?
Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish)
and you use the manual purge trigger; the Cache protection pane shows the exact
one-line snippet. A standard PHP-FPM origin needs no server changes at all.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Nivoli Edge” is open source software. The following people have contributed to
this plugin.
Contributors
* [ calimonk ](https://profiles.wordpress.org/calimonk/)
[Translate “Nivoli Edge” into your language.](https://translate.wordpress.org/projects/wp-plugins/nivoli-edge)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/nivoli-edge/), check
out the [SVN repository](https://plugins.svn.wordpress.org/nivoli-edge/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/nivoli-edge/) by
[RSS](https://plugins.trac.wordpress.org/log/nivoli-edge/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
Recent releases are listed below. The full history for every version is in CHANGELOG.
md, which ships with the plugin, and on the GitHub releases page.
#### 1.57.0
Every attack shield on every managed plan: the stray-PHP lock, the WordPress surface
lock, the login rate limit and the comment and search flood limits no longer need
the Growth plan. Their Growth+ pills and disabled buttons are gone. The AI-crawler
block and the wp-admin IP lock stay Growth and up. Pairs with edge admin v2.29.0.
#### 1.56.1
Locks page: when the license has no account email on file, the header says so and
points at support, instead of every lock refusing with a message that explained
nothing.
#### 1.56.0
Origin lock, on the Locks page: the edge stamps a secret on every request it forwards
and this plugin refuses installs, updates, uploads, the file editors and plugin
activation that arrive without it, closing the way around every edge lock for anyone
who knows the server’s own address. A self-test tells you whether the server enforces
it; turning it off at the edge is a confirmed change. Needs edge v2.8.0.
#### 1.55.0
Locks page hardening after a security review: a lock the plugin could not read shows
as state unknown instead of off; Dismiss and Lock again now work even when the edge
is unreachable; a pending confirmation shows as a warning, not a green success,
and is recognised from the response rather than its wording; refused-install rows
resist hostile input; the Dashboard URL (which carries your token) is a password
field. Pairs with edge v2.7.0, where confirmation and unlock links now show a page
and act on a button press, the install window no longer unlocks settings, and the
install lock reads request bodies the way PHP does.
#### 1.54.1
The pending-confirmation notice on the Locks page has a Dismiss button, for when
you decide not to click the link; the change stays unapplied. Readme and screenshots
cover the Locks page.
#### 1.54.0
Locks page: the wp-admin IP lock and the login country lock moved here from Attack
surface, with one row of counts (code changes refused, wp-admin visits blocked,
logins blocked by country), a list of exactly which plugin or theme installs were
refused, and a lock activity log showing unlock requests, clicked links, confirmations
and lock changes with time and address. The unlocked-for-N-minutes badge now shows
after clicking the mailed link too.
#### 1.53.1
Install lock: the Locks page can unlock installs for 15 minutes (it emails you the
link, like the blocked page’s button) and lock again early, and shows the minutes
left while the window is open. Pairs with the edge fix that makes WordPress’s install
button show the refusal instead of spinning.
#### 1.53.0
Security now has three pages: Edge shields, PHP & surface shields (renamed from
locks, same address), and Locks, where the change lock and install lock live with
the confirmation address stated once. Shields refuse requests; locks keep a takeover
from switching anything off.
#### 1.52.2
Change lock: while a confirmation email is out, the Edge shields pane reads the
edge directly on every load, so the change shows up as soon as you have clicked
the link, and the Locks header says a confirmation is pending. Pairs with edge admin
v2.24.1, which fixes the confirmation links themselves.
#### 1.52.1
Readme and banner lead with hardening: shields first, then the two locks in their
own section, then pages, images and the numbers. Short description and tagline follow.
#### 1.52.0
Change lock: instead of unlock windows, every refused change is confirmed by email.
Click the change in WordPress, an email names it, the link applies exactly that
change once. The Send me an unlock link button is gone. The install lock keeps its
15-minute window and the button on its blocked page. Needs edge admin v2.23.0.
#### 1.51.1
Edge shields: the change lock and install lock sit in one Locks block that states
the confirmation address once, the email on your Nivoli license, with the two cards
side by side; the logins tile reads as one number with the real logins that got
through as its sub line.
#### 1.51.0
Install lock, on the Edge shields pane: the edge refuses wp-admin requests that
change code on your server (installing, uploading, updating or deleting plugins
and themes, the file editors) until you confirm by email; the blocked page carries
the button, so the lock stays on and you confirm when you mean it. Automatic updates
and WP-CLI run on the server and are unaffected. The attack-surface strip is one
row: logins stopped and the real logins that reached the server share a tile, and
the stray-PHP tile lives on its own page now. Copy says the confirmation goes to
the email address on your Nivoli license. Needs edge v2.6.2 / admin v2.22.0.
#### 1.50.2
Readme only: the Description is headings and bullet lists instead of paragraphs;
the ten shields are a list. No code change.
## Meta
* Version **1.57.0**
* Last updated **4 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.2 or higher **
* Tested up to **7.1**
* PHP version ** 7.4 or higher **
* Tags
* [cache](https://wordpress.org/plugins/tags/cache/)[cloudflare](https://wordpress.org/plugins/tags/cloudflare/)
[image optimization](https://wordpress.org/plugins/tags/image-optimization/)[performance](https://wordpress.org/plugins/tags/performance/)
[security](https://wordpress.org/plugins/tags/security/)
* [Advanced View](https://wordpress.org/plugins/nivoli-edge/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/nivoli-edge/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/nivoli-edge/reviews/)
## Contributors
* [ calimonk ](https://profiles.wordpress.org/calimonk/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/nivoli-edge/)