{"id":355928,"date":"2026-08-31T08:22:47","date_gmt":"2026-08-31T08:22:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/smart-cache-purge-warm-for-cloudflare\/"},"modified":"2026-08-31T08:19:32","modified_gmt":"2026-08-31T08:19:32","slug":"smart-cache-purge-warm-for-cloudflare","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/smart-cache-purge-warm-for-cloudflare\/","author":23159621,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.4.1","stable_tag":"trunk","tested":"7.1","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Smart Cache Purge & Warm for Cloudflare","header_author":"Divyanshu Tailor","header_description":"Smart cache purging and cache warming for WordPress sites using Cloudflare.","assets_banners_color":"94a5b7","last_updated":"2026-08-31 08:19:32","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/divyanshu-portfolio-eta.vercel.app\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":39,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"gretzky85","date":"2026-08-31 08:22:30","revision":3673661}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3673733,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3673733,"resolution":"256x256","location":"assets","locale":"","width":128,"height":128}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3673733,"resolution":"1544x500","location":"assets","locale":"","width":1343,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3673733,"resolution":"772x250","location":"assets","locale":"","width":672,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Dashboard and cache status.","2":"Cloudflare credentials and tuning settings.","3":"Connection test.","4":"Instructions and WAF configuration.","5":"Secure debug log viewer."}},"plugin_section":[],"plugin_tags":[146,144,3882,247,7914],"plugin_category":[52,54],"plugin_contributors":[],"plugin_business_model":[],"class_list":["post-355928","plugin","type-plugin","status-publish","hentry","plugin_tags-cache","plugin_tags-caching","plugin_tags-cloudflare","plugin_tags-performance","plugin_tags-purge","plugin_category-performance","plugin_category-security-and-spam-protection","plugin_committers-gretzky85"],"banners":{"banner":"https:\/\/ps.w.org\/smart-cache-purge-warm-for-cloudflare\/assets\/banner-772x250.png?rev=3673733","banner_2x":"https:\/\/ps.w.org\/smart-cache-purge-warm-for-cloudflare\/assets\/banner-1544x500.png?rev=3673733","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/smart-cache-purge-warm-for-cloudflare\/assets\/icon-128x128.png?rev=3673733","icon_2x":"https:\/\/ps.w.org\/smart-cache-purge-warm-for-cloudflare\/assets\/icon-256x256.png?rev=3673733","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Smart Cache Purge &amp; Warm for Cloudflare purges affected public URLs when\nWordPress content changes and can rewarm the site\u2019s own URLs in the\nbackground. The plugin is designed to avoid full-zone purges for\nordinary post, page, and product changes.<\/p>\n\n<p>Features:<\/p>\n\n<ul>\n<li>Selective URL purging for supported posts, pages, and WooCommerce\nproducts.<\/li>\n<li>Related homepage, archive, taxonomy, feed, sitemap, and shop URLs\ncan be included when affected content changes.<\/li>\n<li>Full Cloudflare cache purge for theme switches, WordPress core\nupdates, theme updates, and updates to this plugin itself.<\/li>\n<li>Background cache warming without WP-Cron.<\/li>\n<li>Same-site HTTPS URL validation to help prevent server-side request\nforgery (SSRF).<\/li>\n<li>TLS certificate verification enabled for cache-warming HTTP\nrequests.<\/li>\n<li>Protected REST warming endpoint with a secret token, request lock,\nand URL limits.<\/li>\n<li>Sitemap crawling with configurable depth and URL limits.<\/li>\n<li>Cloudflare API token encrypted before database storage when\nconfigured through the plugin settings.<\/li>\n<li>Warm\/WAF secret encrypted before database storage when configured\nthrough the plugin settings.<\/li>\n<li>Admin dashboard, settings, connection test, instructions, and secure\nin-dashboard debug log.<\/li>\n<li>No telemetry, advertising, or analytics service operated by the\nplugin author.<\/li>\n<\/ul>\n\n<h3>Requirements<\/h3>\n\n<ul>\n<li>WordPress 5.8 or later.<\/li>\n<li>PHP 7.4 or later.<\/li>\n<li>A Cloudflare zone for the WordPress site\u2019s hostname.<\/li>\n<li>A Cloudflare API token with permission to purge cache for the\nconfigured zone.<\/li>\n<li>HTTPS enabled on the WordPress site.<\/li>\n<\/ul>\n\n<h3>Configuration<\/h3>\n\n<p>The recommended production configuration is to define the Cloudflare\ncredentials in wp-config.php:<\/p>\n\n<p>define( 'DT_CF_ZONE_ID', 'your-32-character-zone-id' );\ndefine( 'DT_CF_API_TOKEN', 'your-api-token' );<\/p>\n\n<p>Settings entered through the dashboard are stored in the WordPress\noptions table. The API token and warm secret are encrypted when stored\nthrough the settings UI, provided the OpenSSL PHP extension is\navailable.<\/p>\n\n<p>Values defined in wp-config.php take priority over values stored in the\nplugin settings.<\/p>\n\n<h3>Security<\/h3>\n\n<p>The cache warmer accepts only HTTPS URLs on the current WordPress site\u2019s\nhostname and uses WordPress URL safety validation. Redirects are not\nfollowed by the warmer, helping prevent a same-site URL from being used\nto reach a different host.<\/p>\n\n<p>The REST warming endpoint requires its secret token and enforces a\nsingle active warm operation at a time. Warm operations are also bounded\nby configurable URL, sitemap depth, sitemap size, and concurrency\nlimits.<\/p>\n\n<p>Cloudflare API credentials are used only for Cloudflare API operations\ninitiated by the plugin.<\/p>\n\n<p>Debug logging is stored locally in WordPress options and limited to the\nlatest 200 entries. No public debug log file is created. Debug logging\nis disabled by default.<\/p>\n\n<p>The plugin does not include telemetry, advertising, or a remote\nanalytics service operated by the plugin author.<\/p>\n\n<h3>External Services<\/h3>\n\n<p>This plugin requires and connects directly to the Cloudflare API to\nmanage the cache of the configured Cloudflare zone.<\/p>\n\n<h3>Cloudflare API<\/h3>\n\n<p>Service: Cloudflare API<\/p>\n\n<p>What it is used for:<\/p>\n\n<p>The Cloudflare API is used to test the configured Cloudflare connection\nand to purge cached content for the configured Cloudflare zone.<\/p>\n\n<p>What data is sent:<\/p>\n\n<ul>\n<li>The Cloudflare Zone ID is included in the API request URL.<\/li>\n<li>The Cloudflare API token is sent in the Authorization: Bearer HTTP\nheader to authenticate the request.<\/li>\n<li>For targeted purges, the public URLs selected by the plugin are sent\nas purge request data.<\/li>\n<li>For a full purge, the plugin sends a request asking Cloudflare to\npurge the configured zone\u2019s cache.<\/li>\n<li>When the administrator uses the connection test, the plugin sends\nthe configured Zone ID and API token to Cloudflare and receives the\nzone information returned by Cloudflare.<\/li>\n<\/ul>\n\n<p>When data is sent:<\/p>\n\n<ul>\n<li>A connection request is sent only when an administrator uses the\nTest Connection action.<\/li>\n<li>A targeted purge request is sent when the plugin determines that\nconfigured WordPress content has changed and affected URLs should be\npurged.<\/li>\n<li>A full purge request is sent for configured events such as a theme\nswitch, WordPress core update, theme update, or update to this\nplugin, and when an administrator manually requests a full purge.<\/li>\n<\/ul>\n\n<p>The plugin does not send this information to the plugin author or\noperate a separate analytics or telemetry service.<\/p>\n\n<p>Cloudflare service policies:<\/p>\n\n<ul>\n<li>Terms of Service: https:\/\/www.cloudflare.com\/policies\/terms\/<\/li>\n<li>Privacy Policy: https:\/\/www.cloudflare.com\/policies\/privacy\/<\/li>\n<\/ul>\n\n<h3>Cache warming and the WordPress site\u2019s Cloudflare service<\/h3>\n\n<p>The cache warmer makes HTTPS requests from the WordPress server to\npublic URLs on the same WordPress site. These requests are used to\npopulate or refresh the site\u2019s cache.<\/p>\n\n<p>The plugin sends normal HTTP request information required to request\nthose URLs, including the requested URL and standard request headers. If\nthe optional warm secret is configured, it is sent in the x-wp-cf-warm\nHTTP header so that the site administrator can create a Cloudflare WAF\nrule for trusted warm requests.<\/p>\n\n<p>If the WordPress site\u2019s hostname is proxied through Cloudflare, these\ncache-warming requests may be processed by Cloudflare as normal traffic\nto that site. The plugin does not send site content, analytics data, \nor debug logs to the plugin author or to a service operated by the plugin author.<\/p>\n\n<p>Cloudflare\u2019s handling of traffic is governed by its applicable policies:<\/p>\n\n<ul>\n<li>Terms of Service: https:\/\/www.cloudflare.com\/policies\/terms\/<\/li>\n<li>Privacy Policy: https:\/\/www.cloudflare.com\/policies\/privacy\/<\/li>\n<\/ul>\n\n<h3>Privacy<\/h3>\n\n<p>The plugin does not contain telemetry, advertising, or a separate\nanalytics service.<\/p>\n\n<p>The plugin stores its configuration and local debug information in the\nWordPress database. Cloudflare credentials configured through the plugin\nsettings are encrypted before storage when OpenSSL is available.<\/p>\n\n<p>The plugin communicates with Cloudflare only to provide the\ncache-management functionality configured by the site administrator.<\/p>\n\n<p>The cache warmer requests URLs belonging to the current WordPress site.\nThose requests may pass through Cloudflare when the site\u2019s hostname is\nproxied by Cloudflare.<\/p>\n\n<p>Site administrators are responsible for reviewing Cloudflare\u2019s policies\nand ensuring that their use of Cloudflare is appropriate for their site\nand applicable privacy requirements.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin to \/wp-content\/plugins\/.<\/li>\n<li>Activate it from Plugins \u2192 Installed Plugins.<\/li>\n<li>Go to Smart Cache Purge \u2192 Settings.<\/li>\n<li>Enter the Cloudflare Zone ID and API token, or define DT_CF_ZONE_ID\nand DT_CF_API_TOKEN in wp-config.php.<\/li>\n<li>Optionally configure the warm secret and Cloudflare WAF rule\ndescribed in the Instructions tab.<\/li>\n<li>Test the Cloudflare connection from the Settings tab before relying\non automatic purging.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20plugin%20purge%20the%20whole%20cloudflare%20zone%20after%20every%20post\"><h3>Does the plugin purge the whole Cloudflare zone after every post<\/h3><\/dt>\n<dd><p>update? =<\/p>\n\n<p>No.\u00a0Normal supported post, page, and product changes purge affected\npublic URLs and related archive\/taxonomy URLs instead of performing a\nfull-zone purge.<\/p><\/dd>\n<dt id=\"when%20does%20the%20plugin%20perform%20a%20full%20purge%3F\"><h3>When does the plugin perform a full purge?<\/h3><\/dt>\n<dd><p>A full purge is triggered by a theme switch, a WordPress core update, a\ntheme update, or an update to this plugin. A full purge can also be\nstarted manually by an administrator.<\/p><\/dd>\n<dt id=\"does%20warming%20use%20wp-cron%3F\"><h3>Does warming use WP-Cron?<\/h3><\/dt>\n<dd><p>No.\u00a0Warming is triggered through a protected WordPress REST request and\nruns in the background.<\/p><\/dd>\n<dt id=\"can%20the%20warmer%20request%20another%20domain%3F\"><h3>Can the warmer request another domain?<\/h3><\/dt>\n<dd><p>The cache warmer validates warm and sitemap URLs against the current\nWordPress site\u2019s HTTPS hostname. Redirects are not followed, and unsafe\nURLs are rejected.<\/p><\/dd>\n<dt id=\"why%20is%20my%20warm%20request%20rejected%3F\"><h3>Why is my warm request rejected?<\/h3><\/dt>\n<dd><p>Check that the URL uses HTTPS, belongs to the current site, and is not\nredirected to another host. Also check the Logs tab when debug logging\nis enabled.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20track%20site%20visitors%3F\"><h3>Does the plugin track site visitors?<\/h3><\/dt>\n<dd><p>No.\u00a0The plugin does not include telemetry, advertising, visitor\nanalytics, or a tracking service operated by the plugin author.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20send%20my%20site%E2%80%99s%20data%20to%20the%20plugin%20author%3F\"><h3>Does the plugin send my site\u2019s data to the plugin author?<\/h3><\/dt>\n<dd><p>No.\u00a0The plugin does not operate a remote service for collecting site\ndata. Cloudflare API requests are sent directly from the WordPress site\nto Cloudflare because Cloudflare is required for the plugin\u2019s\ncache-purge functionality.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.4.1<\/h4>\n\n<ul>\n<li>Expanded the External Services documentation to clearly disclose Cloudflare API usage, data sent, when requests are made, and Cloudflare policy links.<\/li>\n<li>Clarified cache-warming requests and their interaction with Cloudflare when the site's hostname is proxied.<\/li>\n<li>Clarified privacy and telemetry behavior.<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>Hardened cache warming against SSRF and unsafe redirects.<\/li>\n<li>Enabled TLS certificate and hostname verification for cURL warming.<\/li>\n<li>Added REST input validation, URL limits and a warm-operation lock.<\/li>\n<li>Added server-side bounds for tuning settings.<\/li>\n<li>Encrypted the warm\/WAF secret and upgraded API-token storage to authenticated encryption with legacy compatibility.<\/li>\n<li>Removed broad purge hooks for unrelated plugin activation\/deactivation\/deletion.<\/li>\n<li>Added activation\/deactivation lifecycle handling.<\/li>\n<li>Replaced the public debug log file with a bounded in-dashboard log.<\/li>\n<li>Added security, privacy and external-service documentation.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Converted to a proper installable plugin with admin UI (Dashboard, Settings, Instructions, Logs).<\/li>\n<li>Credentials and tuning options can be managed from the Settings page or wp-config.php.<\/li>\n<li>API token stored encrypted in the database.<\/li>\n<li>Debug log viewer and one-click clear\/toggle.<\/li>\n<\/ul>","raw_excerpt":"Targeted cache purging and controlled cache warming for WordPress sites using Cloudflare.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/355928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=355928"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/gretzky85"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=355928"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=355928"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=355928"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=355928"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=355928"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=355928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}