Every WordPress security plugin runs inside the site it protects. When the site is taken over, so is the plugin: its settings page belongs to the intruder, its rules can be switched off, and every attack it inspects has already reached PHP on your server.<\/p>\n\n
Nivoli Edge runs one layer up. Twelve shields refuse attacks, floods, scanners and stray PHP requests at Cloudflare's edge, before a single byte reaches your server. Three locks keep the settings behind an email confirmation held at the edge, so a hacked WordPress cannot switch a shield off, install a plugin, or redirect the confirmation address. The same edge serves whole HTML pages from the node nearest each visitor and keeps the site up when your server goes down. Every number, what was refused, what was served, who did what, shows inside WP admin.<\/p>\n\n
Free and managed, in one sentence:<\/strong> the plugin is free and GPL, and everything that runs on your own server works without an account; the shields, the locks, the edge cache and the numbers run on the managed edge, which you connect with an API key. Right-sized WebP and AVIF images from the edge are an optional add-on for the sites that want them.<\/p>\n\n Wordfence and Sucuri run inside the site they protect. This runs one layer up, at the edge, and the site cannot reach it.<\/p>\n\n Twelve shields, refused before PHP.<\/strong> Your server never boots PHP to turn a request away.<\/p>\n\n Eight of them come with every managed plan; the AI-crawler block and the wp-admin IP lock from Shield Plus up. The stray-PHP and surface locks have a monitor mode that lists what blocking would have stopped before it blocks anything.<\/p>\n\n Three locks, nothing inside the site can turn off.<\/strong> A takeover of your WordPress admin owns every plugin's settings page. Ours refuses to act on WordPress's say-so.<\/p>\n\n Evidence: who did what, from where.<\/strong><\/p>\n\n Underneath all of it, Cloudflare's managed WAF rulesets, including the WordPress rule set, run in front of every managed site.<\/p>\n\n Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.<\/p>\n\n URLs rewrite through Cloudflare Image Resizing into right-sized WebP\/AVIF variants on the fly. No uploads, no duplicate copies, no migration, no theme changes.<\/p>\n\n Free, on your own infrastructure, no account: image URL rewriting through your own Cloudflare zone (native WP filters, srcset, Gutenberg, WooCommerce, the_content and full-page scan), image rules and size mapping, page-cache tag headers with surgical purge to Fastly, Cloudflare Enterprise or your webhook, prewarm on save, coverage audit with a weekly regression email, fake-image detection and repair, purge-failure alerts, a weekly header self-test, a printable client report, the debug overlay, and WP-CLI.<\/p>\n\n Managed, with a Nivoli API key: everything in The Edge Security layer above, the managed page cache (no Cloudflare account, plan or DNS work), origin shield, URL rules and the 404 inbox, per-path cache duration, the query-param manager, cache protection, dynamic-content safety for WooCommerce, edge insights and the monthly report, custom image hostname and watermarking, and for agencies a fleet console with one key across sites.<\/p>\n\n Managed Images, the optional add-on: right-sized WebP and AVIF variants created once at the edge and served from the node nearest each visitor, no Cloudflare account and no plugin configuration. Without it your images serve from your own server, untouched; the free image tools keep working.<\/p>\n\n The free tier's core image rewriting sends no data to any external service<\/strong>; it only rewrites Nivoli managed edge<\/strong> (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key<\/strong>. On activation and on a daily background re-check it sends your API key, this site's URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN\/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https:\/\/nivoli.com\/terms \u00b7 Privacy: https:\/\/nivoli.com\/privacy<\/p>\n\n Cloudflare<\/strong> (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend<\/strong> with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https:\/\/www.cloudflare.com\/terms\/ \u00b7 Privacy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/p>\n\n Fastly<\/strong> (api.fastly.com): used only if you configure the Fastly page-cache backend<\/strong> with your own API token, to dispatch surrogate-key purges on content change. Terms: https:\/\/www.fastly.com\/terms\/ \u00b7 Privacy: https:\/\/www.fastly.com\/privacy\/<\/p>\n\n TinyPNG \/ Tinify<\/strong> (api.tinify.com): used only if you add your own Tinify API key and click \"Shrink original\"<\/strong> on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https:\/\/tinify.com\/terms<\/p>\n\n\n It sits above them. Those plugins inspect requests inside WordPress, after PHP has started; Nivoli Edge refuses hostile traffic at Cloudflare's edge before your server sees it, and its settings cannot be switched off from inside a compromised WordPress. Run both if you like; they do not overlap.<\/p><\/dd>\n Login, comment and search floods, XML-RPC abuse, logins from countries you do not serve, wp-admin from addresses that are not yours, AI crawlers, direct requests to PHP files that are not WordPress entry points, the probes that map a site (user lists, readme, license file, installer, debug.log), path traversal attempts in any encoding, addresses that keep probing after five refusals, and missing security headers. Ten come with every managed plan; the AI-crawler block and the wp-admin IP lock from the second plan up.<\/p><\/dd>\n Only for the free image rewriting on your own zone: Cloudflare Image Resizing is bundled with Pro plans or available pay-as-you-go. The managed edge needs no Cloudflare account at all.<\/p><\/dd>\n No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.<\/p><\/dd>\n Everything the plugin does on your own server is free and fully functional: image rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can't, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, custom hostnames, watermarking, and multi-site fleet management.<\/p><\/dd>\n Confirmation and unlock links go to the email address on your Nivoli license and nowhere else; that is what makes the locks hold against a takeover. Support can move the license to a new address after verifying you own it. Until then the locks stay as they are and the site keeps running; only changes that weaken protection wait.<\/p><\/dd>\n No. Automatic background updates run from wp-cron on your server and WP-CLI runs on the box; neither passes through the edge, so neither is affected. Only installs, uploads, updates and deletes started from wp-admin are refused, and you open a 15-minute window by email when you want to do one yourself.<\/p><\/dd>\n The locks stop the intruder from switching the shields off, installing anything through WordPress, or redirecting the confirmation address, and every attempt lands in your inbox and on the Locks page with its time and address. What no edge control can do is undo code already running on your server: cleaning the box is still yours (scan, restore, rotate). The locks make sure the compromise stays where it landed.<\/p><\/dd>\n No. Different layers: security plugins inspect requests inside WordPress\/PHP; Nivoli Edge's twelve shields run at Cloudflare's edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.<\/p><\/dd>\n Only if your origin runs its own micro-cache (nginx fastcgi\/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.<\/p><\/dd>\n\n<\/dl>\n\n\n Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.<\/p>\n\n Security, tidied after a first look: the scanner lockout sits with the other probe shields; the login rate limit, the login country lock and the wp-admin IP lock share one Login & admin pane; the security check groups its findings (exposed, worth fixing, what only the edge refuses, and the fine ones folded away with a count), shows nothing to press on a finding that is already fine, and reads \"refused at the edge\" in green on a managed site. Images opens on Coverage, with Health above Optimization.<\/p>\n\n The admin is regrouped by what you are doing: Overview, Security, Pages, Images and Account replace the Managed Edge, Tools and Settings tabs. Every pane kept its place in old links and mails. Free and managed panes sit together under their subject, marked by a dot; a free install sees the managed panes folded into one \"Switch on the edge\" line per tab. New under Security: a Hardening pane with eight switches (the five the check offered, plus the version in asset URLs and headers, head clutter and minor core updates) and a generated must-use plugin that keeps them on when this plugin is off.<\/p>\n\n Shield 12, the scanner lockout: an address that collects five refusals from the shields within ten minutes gets a 403 on every further request for ten minutes, at the edge. Logged-in sessions and verified search engines are never locked out. On by default for every site; its card on the Edge shields page shows off, monitor or block and lists what locked-out addresses kept asking for. Turning it down waits for the change lock.<\/p>\n\n The traversal guard's description on the PHP & surface shields page says what the shield does and nothing else.<\/p>\n\n Shield 11, the traversal guard: any request whose path or query string carries ..\/ in any encoding, after up to three rounds of decoding, gets a 404 at the edge. On by default for every site. Its card on the PHP & surface shields page shows off, monitor or block and lists what monitoring saw; turning it down waits for the change lock. The onboarding shields step and the Protected pillar count it.<\/p>\n\n Page caching has a switch: on, or pass-through with every shield and lock still on and every page from your own server, for sites that want the protection without the cache. The Stats & overview pane carries it. When the plan policy sets pass-through (a site far above its pageviews for two monthly checks) the pane says so and points at the plan change.<\/p>\n\n The WordPress.org listing tells the security story first: what runs one layer above WordPress, what the shields stop, what the locks hold, and where the free plugin ends and the managed edge begins. No prices on the listing; plans live on the pricing page.<\/p>\n\n The \"traffic is not reaching the managed CDN\" warning no longer fires on the edge's own pass-through redirects (an allowance used up, the add-on not on), Refresh data re-runs its probe, and on a nivoli.com hostname it names the symptom instead of a Cloudflare CNAME you do not have.<\/p>\n\n The account card says whether Managed Images is on, with the allowance and the variants created in the last 30 days. A change made on the edge (a block added, a plan change) shows up on the next page view: the hub re-checks the key by itself when its status is older than ten minutes.<\/p>\n\n Your account: the Account tab opens console.nivoli.com\/account, where the email on the license signs you in to your plan, sites, Managed Images and invoices; Change plan and Managed Images go straight to the billing portal. When the image allowance fills, the one path is another block; the one-time pack is gone.<\/p>\n\n Plans are Shield, Shield Plus and Agency, and image transformation at the edge is the Managed Images add-on. On a managed plan without it the plugin leaves image URLs alone (images serve from your server, untouched) and the Usage, Custom hostname, Watermark, Broken images and Heaviest images panes show one card that explains and sells the add-on. The setup overview runs key, pages, shields, locks, images (optional), report. Plan names everywhere come from one label map.<\/p>\n\n The Cloudflare DNS callout on the site-CNAME step now actually appears when the zone runs on Cloudflare nameservers; the check behind it could never match before.<\/p>\n\n Fake images: a pending row whose file is a real image again is settled when the pane opens. If the plugin's backup store holds the original, the row becomes replaced (the record had been lost); if not, the file was fixed outside and the row goes. Replace on such a row does the same instead of refusing with \"That file is a real image\".<\/p>","raw_excerpt":"Security one layer above WordPress: attacks refused before they reach PHP, locks a hacked site cannot switch off, and whole pages served from Cloudfla …","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/340850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=340850"}],"author":[{"embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/calimonk"}],"wp:attachment":[{"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=340850"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=340850"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=340850"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=340850"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=340850"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/es.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=340850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Edge Security layer<\/h4>\n\n
\n
\n
\n
Pages served from the edge<\/h4>\n\n
\n
Images served from the edge<\/h4>\n\n
\n
The numbers, inside WP admin<\/h4>\n\n
\n
Free versus managed<\/h4>\n\n
Requirements<\/h4>\n\n
\n
External services<\/h3>\n\n
<img><\/code> URLs in your site's HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.<\/p>\n\n\n
\n
Does this replace Wordfence or Sucuri?<\/h3><\/dt>\n
What do the twelve shields stop?<\/h3><\/dt>\n
Does this require Cloudflare Pro?<\/h3><\/dt>\n
Will this break my theme?<\/h3><\/dt>\n
no-cf<\/code> CSS class on any element to opt out.<\/p><\/dd>\nHow is this different from Smush \/ ShortPixel \/ Optimole?<\/h3><\/dt>\n
What's the difference between Free and Managed?<\/h3><\/dt>\n
What if I lose access to my license email?<\/h3><\/dt>\n
Does the install lock break automatic updates?<\/h3><\/dt>\n
What if my site gets hacked anyway?<\/h3><\/dt>\n
Does the page caching conflict with my security plugin (Wordfence, Sucuri)?<\/h3><\/dt>\n
Do I need to change my nginx \/ web-server config?<\/h3><\/dt>\n
1.79.1<\/h4>\n\n
1.79.0<\/h4>\n\n
1.78.0<\/h4>\n\n
1.77.1<\/h4>\n\n
1.77.0<\/h4>\n\n
1.76.0<\/h4>\n\n
1.75.3<\/h4>\n\n
1.75.2<\/h4>\n\n
1.75.1<\/h4>\n\n
1.75.0<\/h4>\n\n
1.74.0<\/h4>\n\n
1.73.2<\/h4>\n\n
1.73.1<\/h4>\n\n