Hardened WordPress. Nothing inside the site can turn it off.
Nivoli Edge puts Cloudflare's edge in front of your WordPress site and adds the WordPress layer on top. Attacks, floods, scanners and code changes are refused before a request reaches PHP, and the settings that refuse them live at the edge, behind an email confirmation, where a compromised WordPress cannot reach them. The same layer serves whole HTML pages and right-sized images from the node nearest each visitor. Keep your optimizer and your security plugin. We sit in front of both.
Cloudflare in front of WordPress is the right start. It is not the whole job. Cloudflare's own plugin and APO cache pages and purge on save, as a black box: no view of what it did, no image pipeline, no WordPress-shaped protection, no numbers in your admin. Nivoli Edge is the layer that knows WordPress, running at the edge:
- surgical purge: only the pages that feature what you saved
- right-sized WebP/AVIF from your media library, per slot
- wp-login, XML-RPC and stray-PHP floods stopped before PHP
- stylesheets, scripts and fonts with purge-proof addresses
- every number, incident and broken image inside WP admin
1.1Mattacks and junk requests refused before PHP in 30 days
60%of all requests answered at the edge, never reaching the server
41% fasterHTML pages arrive in 307 ms; the server alone takes about 517 ms
73 GBof bandwidth the origin never carried
One real month on one real production site, measured at the edge (the screenshots on this page). Not averages or projections; your numbers depend on traffic shape and cache fit.
What it fixes
Six problems every WordPress site owner recognizes.
In your words, not ours. Each one has a section below with what we do about it.
Problem 1Bots hammer wp-login, XML-RPC and stray PHP, and my server boots PHP to turn each one away.1.1Mturned awayHow we fix it →
Problem 2If a plugin gets hacked, whoever is inside owns my security plugin's settings too.0changes without your emailHow we fix it →
Problem 3Every visitor, everywhere, waits on my one server.41%fasterHow we fix it →
Problem 4When the server has a bad hour, the site is just gone.7 daysof coverHow we fix it →
Problem 5Thousands of images in my media library. No idea which are broken, oversized, or not even images.1 screento find and fixHow we fix it →
Problem 6I can't see what the CDN answered, refused or broke.0tracking scriptsHow we fix it →
Attacks and junk
Stopped before PHP starts.
The problemWordfence and Sucuri inspect requests inside WordPress, which means your server already booted PHP to decide it did not want the request. Login floods, XML-RPC abuse, scanners and AI crawlers all cost you compute first.
Login floods10 attempts per 10 minutes per IP gets a cached 429; wp-login can also answer only the countries you list. You cannot lock yourself out.managed
Scanners and stray PHPEvery direct .php request except your real entry points gets a 404 at the edge. Monitor mode shows what it would block before it blocks anything.managed
AI crawlersGPTBot, ClaudeBot, CCBot and friends get a 403 before they consume bandwidth or train on your writing. Search engines never affected.growth+
wp-admin IP lockYour own addresses only, with a self-lockout guard and an email rescue flow for the day you travel.growth+
XML-RPC and headers/xmlrpc.php answered with a cached 410; one switch adds HSTS, nosniff, frame and referrer policies. Your own values always win.managed
User enumeration and leftoversThe REST users list, ?author=N and rest_route probes that turn ids into login names get a 404, as do readme.html, license.txt, the installer and debug.log. Logged-in visitors are never affected. Monitor mode first.managed
Comment and search floodsTwo separate switches: 5 comment posts per 5 minutes per IP, 30 searches per 5 minutes per IP. Spam runs and search hammering are answered with a 429 before PHP renders anything.managed
Cloudflare managed WAFEvery managed site sits on a Cloudflare zone with the managed rulesets on, including the WordPress rule set that virtual-patches known plugin vulnerabilities. Cloudflare’s network absorbs volumetric floods before they reach us or you.managed
Dead URLs and junk pathsOld CMS ghosts, probe paths and retired routes get a cached 410 or a 301, from one rule. A 404 inbox lists what to handle; families of one-off redirects merge into one pattern with a click.managed
Takeovers
If a plugin gets hacked, the edge still answers to you.
The problemOne plugin with a hole hands an attacker an administrator account, and no shield stops that: it arrives as a normal request. From there, every security plugin is a settings page they own. They switch it off, install a plugin of their own, edit a theme file, and you find out weeks later, if at all. Our settings page is theirs too.
So the edge refuses to take WordPress at its word. What still holds once someone is inside:
- The shields stay on. Turning one off, loosening a rule or opening the purge allowlist is a change the edge refuses until a link in your email is clicked. Turning shields on never needs it.
- No new code through wp-admin. Plugin and theme installs, uploads, updates, deletes and the file editors are refused at the edge. WordPress's own install button shows the refusal below. Automatic updates and WP-CLI run on the server and keep working.
- You hear about it. Every refused attempt lands in your inbox and on the Locks page with its time and address, so you learn it was not you while it is happening, not from a blacklist warning later.
- The address cannot be redirected. Confirmation links go to the email on your Nivoli license, held at the edge. It is not a WordPress setting, so a takeover cannot point it elsewhere.
- The server itself refuses side doors. With the origin lock on, the edge stamps a secret on every request it forwards and the plugin refuses code changes that arrive without it: straight to the origin IP, through a forgotten staging hostname, past the edge entirely. Only the edge and the plugin know the secret.
- The honest limit. Code already running on your server can do what PHP can do. The locks stop a takeover from extending itself through WordPress tooling or switching protection off, and they leave a log. Cleaning the server is still your job: scan, restore, rotate.
Change lockA WordPress takeover also owns the plugin settings page. With the lock on, clicking any change that weakens protection does nothing yet: an email to the address on your Nivoli license asks you to confirm that exact change, and the link applies it. A takeover cannot switch the shields off, and every attempt reaches you as that email.managed
Install lockInstalling, uploading or updating plugins and themes and the file editors are refused at the edge until you confirm by email; the blocked page has the button, or unlock for 15 minutes from the Locks page. Automatic updates and WP-CLI run on the server and are unaffected. A takeover cannot extend itself through WordPress tooling.managed
Origin lockKnowing the origin IP used to be a way around every edge control. The edge stamps a per-site secret on what it forwards; the plugin answers code-change requests that lack it with a 403 and reports whether that check is in place. Turning it off is a confirmed change.managed
The Locks pageWhat the locks refused, by plugin or theme, and a lock activity log: every unlock request, clicked link, confirmation and lock change with its time and address. The wp-admin IP lock and login country lock live there too.managed
Slow pages
Faster for every visitor, not just a lighter load on you.
The problemEvery caching plugin still answers from, or renders on, your one server in one location. A reader in Sydney pays the round trip to Amsterdam on every page and every file the page pulls in.
Whole HTML pages from the edgeCached across Cloudflare’s network with stale-while-revalidate: visitors never wait on your server for a cached page. Logged-in visitors always bypass; carts, checkout and account pages too.managed
Surgical purgeEvery page carries Surrogate-Key tags. A save purges only the pages featuring that post; the rest of the cache stays hot. Works with Fastly, Cloudflare Enterprise, a webhook, or the managed edge.free too
Right-sized images, WebP/AVIFEach image at the dimensions its slot needs, in the lightest format the browser supports, generated once from your originals. No migration, no storage bill.free too
Stylesheets, scripts and fontsAnswered from the nearest node; your server keeps its PHP workers for rendering. Browser lifetimes stay exactly what you set.managed
Purges that reach the browserAsset URL versioning gives every stylesheet, script and font an address that changes when you purge, so browsers pick up changed files immediately instead of a week later.managed
Speculative loadingOn hover, Chrome prerenders the next page. Delivered as a header, so your theme is never modified; cart, checkout and admin links are excluded. Off by default.managed
Downtime
Your server can go down. Your site doesn't.
The problemA deploy goes wrong, PHP-FPM hangs, the host has a bad hour. Visitors get an error page, and if it lasts, Google starts dropping your pages from the index.
Origin ShieldWhen your server errors or stops responding, the edge serves the last good copy of every cached page for up to 7 days. Visitors keep browsing; you get an email when it engages and when it recovers.managed
Honest incident historyEvery outage logged with real durations; single-request blips kept apart from incidents. “Down for 40 minutes last night” instead of never knowing.managed
Graceful image fallbackOver cap or during an outage, images serve straight from your own site. Never a broken page.managed
Alerts that mean somethingPurge failures, broken images, coverage regressions, origin errors: emailed when they happen, not found a week later.free too
Origin Shield covers cached pages, which means public pages. A signed-in member's page views go to your server and are not covered. Read this before you buy if your audience logs in.
Broken and heavy images
Every broken, heavy or fake image on your site, found for you. Fixed from one screen.
The problemSomewhere in years of posts an image was renamed, a migration saved an error page as a .jpg, a featured image was deleted, and a 9 MB original is still going out full size. Nothing in WordPress tells you. A reader does, eventually.
Broken images, from real trafficEvery image request that failed at the edge in the last 7 days, sorted into what can be fixed here and what needs you. Gone files get a placeholder in one click; malformed references show the exact content that carries them.managed
Where usedOne click finds every post and page still referencing a broken image, with edit links. Fix them, click again, watch the list empty.managed
Heaviest imagesThe originals costing you the most bandwidth this week, with requests, size and dimensions. Shrink any of them with Tinify from the list: compress only, or compress and cap the width. Backup kept, restore any time.managed
Never-loading imagesAn empty src or a deleted featured image makes no request, so no analytics can see it. A content scan finds them anyway.free too
Fake images on diskFiles named .jpg that hold HTML: the classic migration leftover. Detected from the CDN failing on them or from a walk of your uploads, repaired in place.free too
Coverage audit and misses logA weekly scan of your own pages says which content images are optimized and which are not, with an email when it regresses. The misses log names every image the rewrite skipped and why.free too
Alerts ride along: a spike in failing images or a coverage drop is emailed when it happens.
Blind spots
Numbers measured where the traffic actually is.
The problemA plugin can only see what reaches PHP. Everything the CDN answered, everything it refused, every bot wave and every slow country, is invisible from inside WordPress.
Audience without a tracking scriptHuman pageviews against bots, countries, referrers, devices, and how fast pages arrived, measured at the edge. No cookies, no consent banner.managed
What the cache didHit rates by window, most-requested and most-missed URLs, bandwidth carried, errors with their paths.managed
Static assetsEdge hit rate for stylesheets, scripts and fonts by type, which files still travel on plain addresses, which ones your server refuses to let the edge cache.managed
A monthly report in your inboxWhat was protected, delivered and saved last month, with deltas. White-label copies for clients on Business and up.managed
Free or managed?
The plugin is free. The managed edge is what you pay for.
Everything that runs on your own server is free, forever, GPL, any number of sites, nothing phones home. Bring your own Cloudflare zone for images and your own Fastly, Cloudflare Enterprise or webhook purge backend for pages. The managed edge is the part you cannot self-host: we run the CDN and the page cache, and add what only the edge can measure and enforce.
| Capability | Your own Cloudflare (free) | Managed edge |
|---|---|---|
| Fast | ||
| Right-sized WebP/AVIF images | ✓ your zone with Image Resizing | ✓ zero setup |
| Full-page cache with surgical purge | ✓ Fastly / CF Enterprise / webhook | ✓ included, no Enterprise plan |
| Static assets from the edge, URL versioning | your zone's own rules | ✓ |
| Stays up | ||
| Origin Shield, incident history | not available | ✓ |
| Alerts: purge failures, broken images, coverage | ✓ | ✓ plus origin down and recovered |
| Defended | ||
| Ten shields before PHP | not available | ✓ the eight attack shields on every plan; AI-crawler block and wp-admin IP lock from Growth |
| Origin lock: the server refuses code changes that skipped the edge | not available | ✓ |
| Cloudflare managed WAF and DDoS absorption | ✓ your zone’s plan decides the rulesets | ✓ included, WordPress rule set on |
| URL rules, redirects, 404 inbox | not available | ✓ |
| Change lock and install lock: weakening a shield or changing code needs an emailed confirmation | not available | ✓ |
| Images | ||
| Broken images from edge traffic, Where used, Heaviest images with Tinify | not available | ✓ |
| Never-loading scan, fake-image repair, coverage audit, misses log | ✓ | ✓ |
| Measured | ||
| Edge analytics and audience | not available | ✓ |
| Monthly report, client reports, agency console | printable report only | ✓ client reports and console from Business |
We do not replace your optimizer. Minification, critical CSS, script deferral and lazy loading are the render path, inside PHP and inside the browser. WP Rocket, FlyingPress and Perfmatters do that well and Nivoli Edge ships none of it on purpose. The edge owns time to first byte, uptime, enforcement before PHP and edge-measured numbers. Run both; they do not overlap.
Read this first if your members log in
Membership, LMS and forum sites.
Never cachedA logged-in visitor's pages always go to your server. Caching a page built for one member and serving it to another is the one mistake a cache must not make. So on those page views there is no edge time to first byte and no outage cover. We have not built per-user cache buckets and are not going to imply we have.
Still works for themSecurity before PHP, image delivery, edge analytics and surgical purge apply whoever the visitor is.
Still works for everyone elseYour sales page, catalog, pricing, blog and guest-readable forum pages are cached and shielded normally, and they are the traffic that decides whether somebody signs up.
Setup
Running in three steps.
1 · INSTALL
Install the plugin
From WordPress.org or the zip in any trial or plan email. Nothing phones home until you connect something.
2 · CONNECT
Pick your edge
Managed: paste the license key and the plugin provisions itself. Own zone: confirm the auto-detected image host and pick a purge backend.
3 · VERIFY
Probe it
One click fetches a real image and a real page through the whole pipeline and shows you the headers. The Dashboard then shows what the edge carries for you.
Questions? support@nivoli.com