First release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3801446,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3801446,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3801446,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3801446,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3801446,"resolution":"1","location":"assets","locale":"","width":1280,"height":1244},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3801446,"resolution":"2","location":"assets","locale":"","width":1280,"height":1714},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3801446,"resolution":"3","location":"assets","locale":"","width":1280,"height":1730},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3801446,"resolution":"4","location":"assets","locale":"","width":1280,"height":951},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3801446,"resolution":"5","location":"assets","locale":"","width":1280,"height":907},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3801446,"resolution":"6","location":"assets","locale":"","width":1280,"height":700},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3801446,"resolution":"7","location":"assets","locale":"","width":1280,"height":1244}},"screenshots":{"1":"Overview: Cloudflare connection, token permissions, visitor IP check and traffic for the last 24 hours with the cache hit ratio.","2":"Cache: Smart Page Cache rules on Cloudflare, cache duration, purge tools and the built-in cache check.","3":"Security: hardening presets, allowlist and blocklist, and the [CFEH] rules installed on Cloudflare.","4":"Turnstile: protect the login, registration, lost password, comment and WooCommerce forms.","5":"Logs with level, channel, text and date filters.","6":"Connection wizard: paste a scoped API token; the permissions each feature needs are listed.","7":"Dark theme."}},"plugin_section":[],"plugin_tags":[146,3882,7914,600,214603],"plugin_category":[52,54],"plugin_contributors":[169474],"plugin_business_model":[],"class_list":["post-402399","plugin","type-plugin","status-publish","hentry","plugin_tags-cache","plugin_tags-cloudflare","plugin_tags-purge","plugin_tags-security","plugin_tags-turnstile","plugin_category-performance","plugin_category-security-and-spam-protection","plugin_contributors-azmarket","plugin_committers-azmarket"],"banners":{"banner":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/banner-772x250.png?rev=3801446","banner_2x":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/banner-1544x500.png?rev=3801446","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/icon-128x128.png?rev=3801446","icon_2x":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/icon-256x256.png?rev=3801446","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-1.png?rev=3801446","caption":"Overview: Cloudflare connection, token permissions, visitor IP check and traffic for the last 24 hours with the cache hit ratio."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-2.png?rev=3801446","caption":"Cache: Smart Page Cache rules on Cloudflare, cache duration, purge tools and the built-in cache check."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-3.png?rev=3801446","caption":"Security: hardening presets, allowlist and blocklist, and the [CFEH] rules installed on Cloudflare."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-4.png?rev=3801446","caption":"Turnstile: protect the login, registration, lost password, comment and WooCommerce forms."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-5.png?rev=3801446","caption":"Logs with level, channel, text and date filters."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-6.png?rev=3801446","caption":"Connection wizard: paste a scoped API token; the permissions each feature needs are listed."},{"src":"https:\/\/ps.w.org\/edge-cache-security-for-cloudflare\/assets\/screenshot-7.png?rev=3801446","caption":"Dark theme."}],"raw_content":"\n
Edge Cache & Security for Cloudflare connects your WordPress site to the Cloudflare zone it already uses, with a scoped API token. It sets up Cloudflare features for you and keeps them in sync with your content.<\/p>\n\n
cf-cache-status<\/code> result.<\/li>\n- Only rules whose name starts with
[CFEH]<\/code> are ever created, changed or removed. Your own rules are left alone.<\/li>\n<\/ul>\n\nSmart Purge<\/h4>\n\n\n- When you publish, update or delete content, the changed page and related pages (home, archives, feeds, sitemap) are purged.<\/li>\n
- Purges are batched and sent after the change, never during a normal visitor page view.<\/li>\n
- Purge single URLs or the whole zone from the dashboard, the admin bar or WP-CLI.<\/li>\n<\/ul>\n\n
WooCommerce<\/h4>\n\n\n- Cart, checkout and My Account pages, and visitors with a cart or session cookie, always bypass the cache.<\/li>\n
- Product, variation, stock, price and scheduled sale changes trigger a purge.<\/li>\n<\/ul>\n\n
Real visitor IP<\/h4>\n\n\n- Restores the visitor IP from the
CF-Connecting-IP<\/code> header, only when the request really comes from a Cloudflare address. The Cloudflare IP list is bundled with the plugin and, once you connect your zone, refreshed weekly.<\/li>\n<\/ul>\n\nTurnstile anti-spam<\/h4>\n\n\n- Cloudflare Turnstile on the login, registration, lost password and comment forms, and on WooCommerce My Account and checkout forms.<\/li>\n
- Choose what happens if Cloudflare cannot be reached: allow the form and log a warning (default), or reject it.<\/li>\n<\/ul>\n\n
Edge security<\/h4>\n\n\n- Hardening presets as Cloudflare WAF custom rules: block XML-RPC, challenge the login page, block user enumeration, block probes for sensitive files.<\/li>\n
- Allowlist and blocklist for IP addresses and ranges. Your own IP, Cloudflare addresses and private ranges cannot be blocked, and your IP is added to the allowlist when you connect.<\/li>\n
- The dashboard shows each rule's expression and how many custom rules your plan allows.<\/li>\n<\/ul>\n\n
Dashboard, logs and safe mode<\/h4>\n\n\n- Overview with requests and cache hit ratio for the last 24 hours (from Cloudflare analytics, when your plan and token allow it), security event counts and the last purge.<\/li>\n
- Logs with filters for API calls, purges, cache and security events. Entries are deleted after 30 days by default.<\/li>\n
- Safe mode pauses purges, cache headers and Turnstile checks with one click or with
define( 'CFEH_SAFE_MODE', true );<\/code>.<\/li>\n- Light and dark themes. All assets are bundled with the plugin.<\/li>\n<\/ul>\n\n
WP-CLI<\/h4>\n\nwp cfeh status, `wp cfeh purge --all|--urls=<urls>`, `wp cfeh rules install|remove|status`, `wp cfeh diagnose`, `wp cfeh safe-mode on|off`, `wp cfeh ip allow|unallow <ip>`.\n<\/code><\/pre>\n\nExternal services<\/h3>\n\n
This plugin connects to services provided by Cloudflare, Inc.<\/p>\n\n
Cloudflare API (api.cloudflare.com)<\/h4>\n\n
Used to verify your API token, find your zone, create and remove the cache and security rules made by this plugin, purge cached pages, read traffic analytics for the dashboard (GraphQL Analytics API) and refresh the list of Cloudflare IP addresses. Requests are sent from your server only when you use the plugin dashboard or WP-CLI, when content changes require a purge, and from scheduled background tasks (weekly IP list refresh, retried purges). Nothing is sent to Cloudflare until you connect a zone with your API token; activating the plugin makes no external request. They are never sent during a normal visitor page view. Data sent: your API token (as an authorization header), your zone id, rule definitions (which may include IP addresses you add to the allowlist or blocklist) and the URLs of pages to purge.<\/p>\n\n
\n- Terms: https:\/\/www.cloudflare.com\/website-terms\/<\/li>\n
- Privacy policy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/li>\n<\/ul>\n\n
Cloudflare Turnstile (challenges.cloudflare.com)<\/h4>\n\n
Only when you enable Turnstile and choose forms to protect. The Turnstile script is loaded from challenges.cloudflare.com on pages that show a protected form, and runs in the visitor's browser. When the form is sent, your server sends the Turnstile token, your secret key and the visitor IP address to challenges.cloudflare.com to check it.<\/p>\n\n
\n- Terms: https:\/\/www.cloudflare.com\/website-terms\/<\/li>\n
- Privacy policy: https:\/\/www.cloudflare.com\/turnstile-privacy-policy\/<\/li>\n<\/ul>\n\n
Your own site<\/h4>\n\n
The cache check on the Cache tab requests your own home page and latest post (and a WooCommerce product page, if any) from your server, as an anonymous visitor and with a test cookie, to read the cache status headers. No data is sent to third parties.<\/p>\n\n\n
\n- Install and activate the plugin.<\/li>\n
- In Cloudflare, create a Custom API Token (My Profile > API Tokens) limited to your site's zone. The dashboard lists the permissions each feature needs; \"Zone > Zone > Read\" is required.<\/li>\n
- Open Edge Cache & Security in the WordPress admin, paste the token and follow the wizard.<\/li>\n
- On the Cache tab, click \"Install cache rules\".<\/li>\n<\/ol>\n\n
You can also define the token in wp-config.php: define( 'CFEH_API_TOKEN', '...' );<\/code>. It then cannot be changed from the dashboard.<\/p>\n\n\n\nWhich Cloudflare credentials does it use?<\/h3><\/dt>\nA scoped Cloudflare API Token only. The Global API Key is not supported. The token is stored encrypted and is never shown again after you save it; only its last four characters are displayed.<\/p><\/dd>\n
Does it work with another page cache plugin?<\/h3><\/dt>\nIt can, but running two page caches or two Cloudflare integrations can cause stale pages or duplicate purges. The Cache tab warns you when it detects one.<\/p><\/dd>\n
Will it change my existing Cloudflare rules?<\/h3><\/dt>\nNo. It only creates and manages rules whose description starts with [CFEH]<\/code>. It adds its rules after yours and re-reads the rule list before every change.<\/p><\/dd>\nWhat happens if Cloudflare is unreachable?<\/h3><\/dt>\nNothing is blocked. Purges are retried later, Turnstile follows the failure mode you chose (allow by default), and errors are logged.<\/p><\/dd>\n
I locked myself out. What now?<\/h3><\/dt>\nAdd define( 'CFEH_SAFE_MODE', true );<\/code> to wp-config.php. Turnstile checks stop at once. Edge security rules live on Cloudflare: remove them on the Tools tab, with wp cfeh rules remove<\/code>, or in the Cloudflare dashboard (Security > WAF > Custom rules, names starting with [CFEH]<\/code>).<\/p><\/dd>\nDoes uninstalling remove the rules from Cloudflare?<\/h3><\/dt>\nNo. Uninstalling removes local data only (settings, logs, scheduled tasks). Use \"Remove [CFEH] rules\" on the Tools tab first if you want the rules gone.<\/p><\/dd>\n
Does it support WordPress Multisite?<\/h3><\/dt>\nNot yet. On a Multisite network the plugin shows a notice and stays inactive.<\/p><\/dd>\n
Which data does it store about visitors?<\/h3><\/dt>\nLog entries can contain visitor IP addresses and browser user agents (for example, failed logins or blocked form submissions). They are stored in your WordPress database and deleted after the retention period. A suggested text is added to the Privacy Policy guide.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.0<\/h4>\n\n\n- First release: connection wizard, Smart Page Cache with Cache Rules, Smart Purge, WooCommerce bypass, real visitor IP, Turnstile, hardening presets, IP allowlist and blocklist, logs, overview analytics, safe mode and WP-CLI.<\/li>\n<\/ul>","raw_excerpt":"Cloudflare page caching with automatic purge, real visitor IP, Turnstile anti-spam and edge security rules, from one dashboard.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/402399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=402399"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/azmarket"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=402399"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=402399"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=402399"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=402399"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=402399"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=402399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}