Title: Nivoli Edge
Author: calimonk
Published: 03 Setember 2026
Last modified: 07 Setember 2026
---
Search plugins
# Nivoli Edge
By [calimonk](https://profiles.wordpress.org/calimonk/)
[Download](https://downloads.wordpress.org/plugin/nivoli-edge.1.58.3.zip)
* [Details](https://lmo.wordpress.org/plugins/nivoli-edge/#description)
* [Reviews](https://lmo.wordpress.org/plugins/nivoli-edge/#reviews)
* [Installation](https://lmo.wordpress.org/plugins/nivoli-edge/#installation)
* [Development](https://lmo.wordpress.org/plugins/nivoli-edge/#developers)
[Support](https://wordpress.org/support/plugin/nivoli-edge/)
## Description
Nivoli Edge is a security layer that lives one step above WordPress. Attacks, floods,
scanners and code changes are refused at Cloudflare’s edge before a request reaches
PHP, and the settings that refuse them live there too, behind an email confirmation,
so a hacked WordPress cannot switch them off or install anything. The same edge
serves whole HTML pages and right-sized images from the node nearest each visitor,
and every number shows up inside WP admin.
**Free and managed, in one sentence:** the plugin is free and GPL and everything
that runs on your own server works without an account; the shields, the locks, the
edge cache and the numbers need the managed edge, from 15 euro a month with a 14-
day trial.
#### The Edge Security layer
Wordfence and Sucuri run inside the site they protect. This runs one layer up, at
the edge, and the site cannot reach it.
**Ten shields, refused before PHP.** Your server never boots PHP to turn a request
away.
* Login flood limit (10 attempts per 10 minutes per address)
* Comment flood limit (5 posts per 5 minutes per address)
* Search flood limit (30 searches per 5 minutes per address)
* XML-RPC block (a cached 410)
* Login country lock (wp-login answers only the countries you list)
* wp-admin IP lock (your own addresses, with a self-lockout guard and an email
rescue)
* AI-crawler block (GPTBot, ClaudeBot, CCBot and friends; search engines never
affected)
* Stray-PHP lock (every .php request except the real WordPress entry points gets
a 404)
* WordPress surface lock (the REST users list, ?author=N, readme.html, license.
txt, the installer, debug.log)
* Security-headers pack (HSTS, nosniff, frame and referrer policies; your own values
win)
Eight of them come with every managed plan; the AI-crawler block and the wp-admin
IP lock from the Growth plan up. The stray-PHP and surface locks have a monitor
mode that lists what blocking would have stopped before it blocks anything.
**Three locks, nothing inside the site can turn off.** A takeover of your WordPress
admin owns every plugin’s settings page. Ours refuses to act on WordPress’s say-
so.
* Change lock: any change that weakens protection waits for a click on a link mailed
to the license holder; the link applies exactly that change, once.
* Install lock: plugin and theme installs, uploads, updates, deletes and the file
editors are refused site-wide until a 15-minute window is opened the same way.
Automatic updates and WP-CLI run on the server and are never affected.
* Origin lock: the edge stamps a per-site secret on every request it forwards and
the plugin refuses code changes that arrive without it, so knowing the server’s
address is no longer a way around the locks. A self-test reports whether the
server enforces it.
**Evidence: who did what, from where.**
* Refused installs named by plugin, and every refused attempt in your inbox as
it happens.
* A lock activity log with time and address for every unlock request, clicked link,
confirmation and lock change.
* An attack-surface strip per fortnight, a monthly report by email, and for agencies
a posture matrix across every site.
Underneath all of it, Cloudflare’s managed WAF rulesets, including the WordPress
rule set, run in front of every managed site.
#### Pages served from the edge
Full-page HTML caching with surgical purge: only the pages featuring a changed post
refresh, never the whole cache.
* Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli,
Fastly, Cloudflare Enterprise or your own webhook.
* Logged-in visitors, carts and checkout always bypass.
* Stylesheets, scripts and fonts from the edge too, on versioned addresses, so
no browser or CDN node holds a stale file after a purge.
* Origin shield: if your server goes down, the edge keeps serving the last good
copy of every cached page for up to 7 days and emails you when it engages and
when the origin recovers.
#### Images served from the edge
URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants
on the fly. No uploads, no duplicate copies, no migration, no theme changes.
* Per-size presets, one-click Size mapping from your theme’s registered sizes,
a catch-all for everything else.
* Broken, heavy and fake images found from real traffic, with where each is used
and one-click fixes; heavy originals shrink through Tinify.
#### The numbers, inside WP admin
* What the edge answered and what it refused, by window, with the most-requested
and most-missed URLs.
* Dead URLs in a 404 inbox with one-click redirect or block; URL rules with per-
rule counts.
* Audience without a tracking script: humans versus bots, countries, referrers,
devices, served-from-cache speed.
* Static assets: edge hit rate per file type and which files still travel on plain
addresses.
* A monthly report by email, white-label copies for clients on Business and up.
#### Free versus managed
Free, on your own infrastructure, no account: image URL rewriting through your own
Cloudflare zone (native WP filters, srcset, Gutenberg, WooCommerce, the_content
and full-page scan), image rules and size mapping, page-cache tag headers with surgical
purge to Fastly, Cloudflare Enterprise or your webhook, prewarm on save, coverage
audit with a weekly regression email, fake-image detection and repair, purge-failure
alerts, a weekly header self-test, a printable client report, the debug overlay,
and WP-CLI.
Managed, with a Nivoli API key: everything in The Edge Security layer above, the
managed page cache and image CDN (no Cloudflare account, plan or DNS work), origin
shield, URL rules and the 404 inbox, per-path cache duration, the query-param manager,
cache protection, dynamic-content safety for WooCommerce, edge insights and the
monthly report, custom image hostname and watermarking, and for agencies a fleet
console with one key across sites.
#### Requirements
* **Free:** a Cloudflare zone with **Image Resizing** enabled for the image half(
Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your
webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten
URLs 404; the Tools tab has a one-click probe to verify.
* **Managed:** none of the above; the managed edge provides both. Just an API key
from your Nivoli account.
### External services
The free tier’s core image rewriting sends **no data to any external service**;
it only rewrites `![]()
` URLs in your site’s HTML so browsers fetch through your
own Cloudflare zone. Beyond that, the plugin contacts external services only for
the specific, opt-in features listed below.
**Nivoli managed edge** (api at html-caching-admin.nivoli.workers.dev, dashboard
at console.nivoli.com): used **only if you enter an API key**. On activation and
on a daily background re-check it sends your API key, this site’s URL, the plugin
version, and the list of broken-image file paths you have marked handled (so the
monthly report can exclude them; these are addresses the CDN already sees in its
own traffic) to validate the key and provision your managed CDN/page-cache tenant;
it then reads back the aggregate usage statistics shown on the dashboard. If you
configure monthly reports or alerts, the recipient email address and optional report
branding (a name and logo URL) are stored with your account. No visitor data is
ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
**Cloudflare** (api.cloudflare.com): used **only if you configure the Cloudflare
Enterprise page-cache backend** with your own API token, to dispatch tag-based cache
purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy:
https://www.cloudflare.com/privacypolicy/
**Fastly** (api.fastly.com): used **only if you configure the Fastly page-cache
backend** with your own API token, to dispatch surrogate-key purges on content change.
Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
**TinyPNG / Tinify** (api.tinify.com): used **only if you add your own Tinify API
key and click “Shrink original”** on an image, to compress that source file. Only
the image you choose is sent. Terms & Privacy: https://tinify.com/terms
## Screenshots
[⌊Dashboard: what the edge did for you in the last 30 days. Delivered, Protected
and your plan at work, with 30-day trends.⌉⌊Dashboard: what the edge did for you
in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends
.⌉[
Dashboard: what the edge did for you in the last 30 days. Delivered, Protected and
your plan at work, with 30-day trends.
[⌊Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment
and search floods) and every shield with its switch, enforced before your server.⌉⌊
Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and
search floods) and every shield with its switch, enforced before your server.⌉[
Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and
search floods) and every shield with its switch, enforced before your server.
[⌊Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.⌉⌊
Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.⌉[
Locks: change lock and install lock, what they refused (by plugin), the wp-admin
IP lock and login country lock, and the lock activity log with time and address.
[⌊Lock activity: what the locks refused in the last 14 days, the exact plugin someone
tried to install or update, and the log of who unlocked what, when, from which address.⌉⌊
Lock activity: what the locks refused in the last 14 days, the exact plugin someone
tried to install or update, and the log of who unlocked what, when, from which address
.⌉[
Lock activity: what the locks refused in the last 14 days, the exact plugin someone
tried to install or update, and the log of who unlocked what, when, from which address.
[⌊PHP & surface shields: stray PHP and enumeration or leftover requests refused,
with off, monitor and block for each.⌉⌊PHP & surface shields: stray PHP and enumeration
or leftover requests refused, with off, monitor and block for each.⌉[
PHP & surface shields: stray PHP and enumeration or leftover requests refused, with
off, monitor and block for each.
[⌊Stats and overview: hour-by-hour traffic, origin offload, hit rates by window,
surgical purges.⌉⌊Stats and overview: hour-by-hour traffic, origin offload, hit
rates by window, surgical purges.⌉[
Stats and overview: hour-by-hour traffic, origin offload, hit rates by window, surgical
purges.
[⌊Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking,
and what the shrinking has saved so far.⌉⌊Heaviest images: the files costing the
most bandwidth, one-click Tinify shrinking, and what the shrinking has saved so
far.⌉[
Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking,
and what the shrinking has saved so far.
[⌊Redirects: legacy URLs answered at the edge, patterns and exact rules with usage,
unused rules folded away.⌉⌊Redirects: legacy URLs answered at the edge, patterns
and exact rules with usage, unused rules folded away.⌉[
Redirects: legacy URLs answered at the edge, patterns and exact rules with usage,
unused rules folded away.
[⌊Suggestions from live 404s: paths your server keeps answering with a 404, with
bot share and one-click redirect or block.⌉⌊Suggestions from live 404s: paths your
server keeps answering with a 404, with bot share and one-click redirect or block
.⌉[
Suggestions from live 404s: paths your server keeps answering with a 404, with bot
share and one-click redirect or block.
[⌊Your audience: humans versus bots, served-from-cache speed, referrers, devices
and countries, no tracking script.⌉⌊Your audience: humans versus bots, served-from-
cache speed, referrers, devices and countries, no tracking script.⌉[
Your audience: humans versus bots, served-from-cache speed, referrers, devices and
countries, no tracking script.
[⌊Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses,
bandwidth offloaded.⌉⌊Static assets: edge hit rate for stylesheets, scripts and
fonts, versioned addresses, bandwidth offloaded.⌉[
Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses,
bandwidth offloaded.
[⌊Query params: which parameters split the cache, which are guarded, with one-click
collapse.⌉⌊Query params: which parameters split the cache, which are guarded, with
one-click collapse.⌉[
Query params: which parameters split the cache, which are guarded, with one-click
collapse.
## Installation
1. Upload the plugin and activate it (or paste your API key on the **Managed Edge**
tab; the managed edge provisions itself and fills the settings in for you).
2. Free / bring-your-own-zone: open **Nivoli Edge Settings**, confirm the auto-detected
image host + path prefix, toggle Enabled.
3. Add rules under **Image rules** if specific sizes need specific treatment, or let**
Size mapping** create them from your theme’s registered sizes in one click. Catch-
all handles the rest with zero config.
4. For HTML caching, open **Settings Page cache** and pick a backend (managed Nivoli
with your API key, or your own Fastly / CF Enterprise / webhook).
5. The **Dashboard** shows whether everything’s working and what the edge is doing
for you.
## FAQ
### Does this require Cloudflare Pro?
Cloudflare Image Resizing is bundled with Pro plans or available as per-1000-transforms
pay-as-you-go. Either is fine.
### Will this break my theme?
No. The plugin only modifies URLs at the filter boundary; the HTML structure your
theme outputs is unchanged. Use the `no-cf` CSS class on any element to opt out.
### How is this different from Smush / ShortPixel / Optimole?
Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms
on the fly from your origin: no asset duplication, no migration step, no storage
bill.
### What’s the difference between Free and Managed?
Everything the plugin does on your own server is free and fully functional: image
rewriting, page-cache purging, audits, prewarming, alerts, reports. Nothing phones
home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare
zone and page cache for you (no Cloudflare setup at all) and the service adds what
a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights,
edge URL rules and security shields, custom hostnames, watermarking, and multi-site
fleet management.
### What if I lose access to my license email?
Confirmation and unlock links go to the email address on your Nivoli license and
nowhere else; that is what makes the locks hold against a takeover. Support can
move the license to a new address after verifying you own it. Until then the locks
stay as they are and the site keeps running; only changes that weaken protection
wait.
### Does the install lock break automatic updates?
No. Automatic background updates run from wp-cron on your server and WP-CLI runs
on the box; neither passes through the edge, so neither is affected. Only installs,
uploads, updates and deletes started from wp-admin are refused, and you open a 15-
minute window by email when you want to do one yourself.
### What if my site gets hacked anyway?
The locks stop the intruder from switching the shields off, installing anything
through WordPress, or redirecting the confirmation address, and every attempt lands
in your inbox and on the Locks page with its time and address. What no edge control
can do is undo code already running on your server: cleaning the box is still yours(
scan, restore, rotate). The locks make sure the compromise stays where it landed.
### Does the page caching conflict with my security plugin (Wordfence, Sucuri)?
No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli
Edge’s ten shields run at Cloudflare’s edge, before the request reaches your server.
It sheds junk traffic so your origin and your security plugin only see real visitors.
They complement each other.
### Do I need to change my nginx / web-server config?
Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish)
and you use the manual purge trigger; the Cache protection pane shows the exact
one-line snippet. A standard PHP-FPM origin needs no server changes at all.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Nivoli Edge” is open source software. The following people have contributed to
this plugin.
Contributors
* [ calimonk ](https://profiles.wordpress.org/calimonk/)
[Translate “Nivoli Edge” into your language.](https://translate.wordpress.org/projects/wp-plugins/nivoli-edge)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/nivoli-edge/), check
out the [SVN repository](https://plugins.svn.wordpress.org/nivoli-edge/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/nivoli-edge/) by
[RSS](https://plugins.trac.wordpress.org/log/nivoli-edge/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
Recent releases are listed below. The full history for every version is in CHANGELOG.
md, which ships with the plugin, and on the GitHub releases page.
#### 1.58.3
Locks page: the install-unlock request has its own marker, so dismissing the change-
lock notice can no longer hide an open unlock window; the page keeps reading the
edge until the window shows. Stray-PHP allowlist: patterns are checked against the
JavaScript regex dialect the edge uses, and PCRE-only syntax such as (?i) or \A
is refused with the construct named instead of silently exempting nothing. Adding
a 41st path to the allowlist is refused out loud instead of dropped.
#### 1.58.2
Managed Edge pane cache, from the external review: a save no longer wipes every
cached pane read (the Locks page came back fully cold and the dashboard widget went
blank); forgetting a read that was never cached no longer purges everything; on
Redis or Memcached hosts the health check now counts the cached reads through its
registry instead of reporting empty; while a confirmation is pending only lock and
shield state is re-read live, analytics stay cached, and a failed re-read serves
the cached copy instead of fetching twice; a background refresh can no longer overwrite
a state a save just changed.
#### 1.58.1
Stray-PHP shield: the edge now says whether the allowed-paths list is your own or
the built-in defaults, and the plugin sends your list along with every monitor/block
switch and with a Save that leaves it untouched. Before, a custom list could be
wiped by the next click, so a path you had allowed started returning 404 under a
green message. Needs edge admin-v2.30.1 (live); an older edge is treated as holding
a custom list, never wiping.
#### 1.58.0
Locks page hardening from an external code review: pressing Enter in the country
field saves the typed list instead of adding Europe; the wp-admin IP lock accepts
CIDR ranges and names any line it cannot use instead of dropping it silently; a
failed rules read shows the country lock as state unknown instead of off; the Locks
pages point at setup when no dashboard URL is pasted yet; the unlock badge follows
the install lock. Every save handler treats the change lock’s confirmation-mailed
answer as pending rather than failed and drops its cached list, so a confirmed removal
is never undone by the next save. The feature map lists the locks and the PHP &
surface shields.
#### 1.57.9
Origin lock: a refused install from the WordPress installer shows a plain sentence
with what to do, not a block of JSON. Pairs with edge v2.8.1, which fixes the edge
not stamping requests at all.
#### 1.57.8
Origin lock: the reach flag is answered before any WordPress helper runs, so lean
bootstraps and the earliest hooks cannot trip on it. No behaviour change for sites.
#### 1.57.7
Origin lock: never locks you out. It refuses direct requests only while requests
through the edge have been arriving with the secret in the last 24 hours; otherwise
it stands down and the Locks page says the edge is not stamping. The self-test now
checks the edge path too.
#### 1.57.6
Readme rewritten around the Edge Security layer: ten shields listed as ten, three
locks, evidence; free versus managed stated once; three FAQ answers on the locks;
screenshots reordered with security first. No code change.
#### 1.57.5
Origin lock self-test: it first proves the loopback request reaches this WordPress(
a default vhost’s 404 is no longer reported as “not enforced”), tries the address
and port the site actually runs on before plain 127.0.0.1, and remembers what worked.
#### 1.57.4
Screenshot 12 shows the Locks page’s Refused row and Lock activity log. No code
change.
#### 1.57.3
URL rules: the listing under the rules is now What your rules answered, split into
Redirected and Blocked (a 301 was shown as a block). Query-matched rules show the
path with ?… and a query tag, the country lock and removed rules are tagged, and
the Top URLs column reads By rule instead of Blocked.
#### 1.57.2
Query params: collapsing or keeping a parameter shows an Undo button in the notice.
Top URLs: junk-query buckets (paths ending in ?…) offer a link to Query params instead
of a Warm button that could never warm them, and their hit rate reads grey with
the reason instead of red.
#### 1.57.1
Shorter copy on the Locks page; the notes about the change lock gating an off switch
sit on their own line under the buttons; the pointer to the Locks page spans the
full width; Origin shield’s low-rate error note is one quiet line and its outage
summary pluralises.
#### 1.57.0
Every attack shield on every managed plan: the stray-PHP lock, the WordPress surface
lock, the login rate limit and the comment and search flood limits no longer need
the Growth plan. Their Growth+ pills and disabled buttons are gone. The AI-crawler
block and the wp-admin IP lock stay Growth and up. Pairs with edge admin v2.29.0.
## Meta
* Version **1.58.3**
* Last updated **7 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.2 or higher **
* Tested up to **7.1**
* PHP version ** 7.4 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/nivoli-edge/)
* Tags
* [cache](https://lmo.wordpress.org/plugins/tags/cache/)[cloudflare](https://lmo.wordpress.org/plugins/tags/cloudflare/)
[image optimization](https://lmo.wordpress.org/plugins/tags/image-optimization/)
[performance](https://lmo.wordpress.org/plugins/tags/performance/)[security](https://lmo.wordpress.org/plugins/tags/security/)
* [Advanced View](https://lmo.wordpress.org/plugins/nivoli-edge/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/nivoli-edge/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/nivoli-edge/reviews/)
## Contributors
* [ calimonk ](https://profiles.wordpress.org/calimonk/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/nivoli-edge/)