Description
Security one layer above WordPress. Audit what your site exposes, lock down logins, and stop attacks at Cloudflare’s edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on.
Login Security
- Login rate limit: 10 attempts per 10 minutes per address, answered at the edge
- Login country lock: wp-login.php only for the countries you list
- wp-admin IP lock: only your addresses, with a self-lockout guard and email rescue
- XML-RPC block: no guessing hundreds of passwords in one request
- Hidden usernames: nothing to find at ?author=N or in the REST API
- Code at login: every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves
WordPress Security Audit
- Security check: 19 checks of what your site exposes, from inside WordPress and from its own front door
- Hidden from itself: unlisted must-use plugins, administrators the Users screen does not show, suspicious login code
- Hardening: 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable
- Plain answers: every finding says what it means and how to fix it
Edge Firewall
Thirteen shields at Cloudflare’s edge: your server never runs PHP to turn an attack away.
- Stray-PHP lock: every .php request except WordPress’s own entry points refused
- Surface lock: user lists, readme.html, the installer and debug.log closed to visitors
- Traversal guard: path tricks refused in any encoding
- PHP parser guard: malformed or oversized uploads and other requests built to exploit PHP’s own request handling are refused before PHP reads them, and virtual patches for newly disclosed PHP flaws reach every site within minutes. It reduces exposure to flaws like PHP2Shell (October 2026) but does not replace updating PHP, and it only sees traffic that comes through Cloudflare, so your server should accept connections from Cloudflare only.
- Scanner lockout: five refusals and the address is shut out for ten minutes
- Flood limits: comment and search floods stopped per address
- AI-crawler block and security headers on every response
- Monitor mode: see what a shield would block before it blocks anything
- Cloudflare’s managed WAF rulesets in front of every site on the edge
Protection that stays on after a takeover
A takeover of wp-admin owns every plugin’s settings. These are held at the edge.
- Change lock: weakening protection waits for a click on a link mailed to you
- Install lock: plugin and theme installs, updates and activations refused until you open a 15-minute window by email, whether they come from wp-admin or a remote-management key (UpdraftCentral, ManageWP, MainWP, Jetpack), and the wp-admin file editors closed. It cannot stop code already running on your server or files written to it directly
- Origin lock: code changes that skip the edge are refused, so knowing your server’s address does not help
- Activity log: every refused attempt on the Locks page, with what was tried and how it arrived
Speed and uptime
- Edge page cache: full pages from Cloudflare’s network, with surgical purge so only the pages a change touches refresh
- Origin Shield: your site keeps serving when your server is down
- Right-sized images: WebP and AVIF through your own Cloudflare zone or the Managed Images add-on
- Analytics without a tracking script: audience, attacks and top URLs from the edge
Free and with a plan
Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial.
Requirements
- WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.
- Image tools on your own zone: Cloudflare with Image Resizing (Images Pipeline check verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.
- Managed: an API key, plus the DNS records the setup pane shows.
External services
The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.
Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. When you look at a shield’s findings, it sends the IP address of your own browser (the administrator viewing the page) in a request header, so the edge can mark requests that came from you; that address is not stored. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No data about your site’s visitors is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/
Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms
Screenshots
Installation
- Install and activate the plugin. Open Nivoli Edge Security Security check and run it: no setup, no account. Code at login and Hardening sit beside it.
- Free images on your own Cloudflare zone: open Images Hosts & routing, confirm the auto-detected image host and path prefix, then switch Enabled on under Images Optimization. Add rules under Images Rules, or let Size mapping create them from your theme’s sizes in one click.
- Free page caching on your own edge: open Pages Cache backend and pick Fastly, Cloudflare Enterprise or a webhook.
- Managed edge: paste your API key on the Account tab. The edge provisions itself and the setup overview walks the rest: the DNS records, the shields, the locks, the report.
FAQ
-
Is the free version limited?
-
No trial, no time limit and no feature walls. Everything that runs on your own server is free and stays free: the security check, Code at login, Hardening, the image tools on your own Cloudflare zone, page-cache purging to your own edge, the audits and WP-CLI. The managed edge is a separate service for what a plugin cannot do from inside the site it protects.
-
Do I need an account?
-
Not for anything free. The security tools work on any WordPress site as soon as the plugin is active. An account and API key only come in when you connect the managed edge.
-
Does this replace Wordfence or Sucuri?
-
It sits above them. Those plugins inspect requests inside WordPress, after PHP has started; Nivoli Edge refuses hostile traffic at Cloudflare’s edge before your server sees it, and its settings cannot be switched off from inside a compromised WordPress. Run both if you like; they do not overlap.
-
What do the thirteen shields stop?
-
Login, comment and search floods, XML-RPC abuse, logins from countries you do not serve, wp-admin from addresses that are not yours, AI crawlers, direct requests to PHP files that are not WordPress entry points, the probes that map a site (user lists, readme, license file, installer, debug.log), path traversal attempts in any encoding, requests built to exploit PHP’s own request handling, addresses that keep probing after five refusals, and missing security headers. All thirteen come with every managed plan. Each probe shield can watch before it blocks, and lists what it caught: the path, what in the request tripped the rule, the sender’s network and country, and every request with its time, never the visitor’s IP address.
-
Does this require Cloudflare Pro?
-
Only for the free image rewriting on your own zone: Cloudflare Image Resizing is bundled with Pro plans or available pay-as-you-go. The managed edge needs no Cloudflare account at all.
-
Will this break my theme?
-
No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the
no-cfCSS class on any element to opt out. -
How is this different from Smush / ShortPixel / Optimole?
-
Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.
-
What’s the difference between Free and Managed?
-
Everything the plugin does on your own server is free and fully functional: the security check, Code at login, Hardening, image rewriting, page-cache purging, audits, prewarming and alerts. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can’t, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, and multi-site fleet management; custom image hostnames and watermarking come with the Managed Images add-on.
-
What if I lose access to my license email?
-
Confirmation and unlock links go to the email address on your Nivoli license and nowhere else; that is what makes the locks hold against a takeover. Support can move the license to a new address after verifying you own it. Until then the locks stay as they are and the site keeps running; only changes that weaken protection wait.
-
Does the install lock break automatic updates?
-
No. WordPress’s automatic background updates and WP-CLI keep working with the lock on. What waits for a 15-minute window, opened by email, is everything else: installs, uploads, updates, activations and deletes started from wp-admin, and the same changes arriving through remote management such as UpdraftCentral, ManageWP, MainWP or Jetpack, which the plugin refuses inside WordPress. If you update through one of those, open the window first.
-
What if my site gets hacked anyway?
-
The locks stop the intruder from switching the shields off, installing or activating plugins and themes through WordPress’s installer (from wp-admin or a stolen remote-management key), or redirecting the confirmation address, and every attempt is recorded on the Locks page. What no lock can do is undo code already running on your server or stop files written to it directly: cleaning the box is still yours (scan, restore, rotate). The locks make sure the compromise stays where it landed.
-
Does the page caching conflict with my security plugin (Wordfence, Sucuri)?
-
No. Different layers: security plugins inspect requests inside WordPress/PHP; Nivoli Edge’s thirteen shields run at Cloudflare’s edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.
-
Does the plugin add a link to my site?
-
Not unless you ask it to. Account, Footer credit has a switch, off by default, that prints one small Protected by Nivoli Edge” line in your footer with a nofollow link. Nothing appears on your public site until you tick it, and unticking it removes the line again.
-
Do I need to change my nginx / web-server config?
-
Only if your origin runs its own micro-cache (nginx fastcgi/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.
Reviews
Contributors & Developers
“Nivoli Edge: Login Security, WP Audit and Firewall” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Nivoli Edge: Login Security, WP Audit and Firewall” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.
1.102.1
A license with several sites now shows its shared image allowance on the Usage & quota pane and the dashboard card (all its sites’ usage against the license’s budget, the number a pause is decided on) instead of this site’s own count beside a pause it did not explain. The dashboard card counts unique variants, like the Usage pane.
1.102.0
New Security log (Security, Activity): everything the edge refused or watched on your site and every change to its locks and settings on one timeline, newest first. Filter by shield, result, window, sender (people or bots), path shape, network, country and your own requests; account activity by kind and channel. Every shield card’s request log opens it pre-filtered, and Lock activity links to it. Shield Plus and Agency add saved views and CSV export. The page says how long each record is kept and that no visitor address is stored.
1.101.1
The 404 import counts an old address as wanted by people only when two or more visitors asked or a link on another site led there; one scanner sending a browser’s name no longer fills the list. Recent 404s points to the 404 import’s visitor list.
1.101.0
Every request log row says what the edge answered (404, 403 lockout, 429, 423, or watched), with the run count beside it. Triggers say what they are (query -s), long paths are shortened at slashes, countries show as codes with their name on hover, network names drop legal suffixes, and opaque path shapes get readable names. The lockout tile says how many sources its refusals came from.
1.100.0
404 import with a second source, your own visitors: one click loads every dead address real people reached in the last 30 days straight from the edge, with how many visitors, where they came from and how many bots, into the same worklist as a Search Console export, families people hit most first. Addresses only bots asked for are left out. An old index file of a live page (/2017/05/15/post/index.php) gets the page itself as its redirect, one by one or as one pattern, and the edge answers it before Block stray PHP. The Overview counts old URLs people still followed last week.
1.99.0
The plugin tells the edge this server’s address as soon as the site is connected and refreshes it weekly from wp-admin, instead of waiting for a scheduled task that may never run. The edge uses it to recognize the site’s own requests, including WordPress’s scheduled tasks.
1.98.0
The request log reads at a glance: two-line rows with the path on one line, day headers, details on click, and a summary of the paths, networks and countries hitting the site, each a filter. A By path view folds thousands of similar URLs into one row with a seven-day sparkline.
1.97.1
The PHP parser guard’s new rule against malformed session cookies has a name and a plain explanation on the shield card and in the request log.
1.97.0
The request logs group repeats: consecutive requests from one sender refused by the same rule are one row with the count, the paths and the time span, so one scanner’s hundreds of lockout repeats no longer bury everything else. The every-shield log can be narrowed to one shield.
1.96.3
The PHP parser guard card reads right when the edge default blocks every rule: every rule and the virtual patches block”, the tile says shield on, and no watch list is shown for the default.
1.96.2
Readme only: thirteen shields throughout, and the external-services section now says that viewing a shield’s findings sends your own browser’s IP address to the edge, unstored, to mark your own requests.
1.96.1
Times on the plugin’s pages show in your own timezone and language, read from your browser, instead of the site’s timezone (UTC on a site without one). Relative times stay relative; hovering any time shows the exact moment with its UTC equivalent.
1.96.0
Shield findings you can act on: every shield card says how many suspicious requests on how many paths, from how many sources, with what in each request tripped the rule, a plain explanation of each rule and whether any of it looks like a real visitor. A request log under each card and under the refused counters lists the individual requests with time, network, country, bot flags and Cloudflare ray ID, and marks your own. No visitor IP address is stored. Monitor lists refresh every five minutes instead of every hour.
1.95.0
PHP parser guard on the Probe shields page: on, monitor or off, with the list of what its watching rules would have refused and which rule each one tripped, including the virtual patches. Its refusals count in the Probe shields tiles and the Dashboard’s Protected numbers.