Nivoli Edge docs

How it works

Nivoli Edge has two halves that share one plugin and, on managed plans, one license key:

• Images: the plugin hooks WordPress's native image pipeline (wp_get_attachment_image_attributes, wp_calculate_image_srcset, and optionally the_content plus a full page scan) and rewrites image URLs through Cloudflare Image Resizing. Variants are created on the fly from your originals: right-sized, format-negotiated (WebP/AVIF), never stored twice.
• Pages: every cacheable page response carries Surrogate-Key / Cache-Tag headers (post-N, category-N, author-N, home…). When content changes, the plugin dispatches a purge listing only the affected tags, so exactly the right pages evict and the rest of the cache stays warm.

Quickstart: managed (recommended)

No Cloudflare account, plan, or DNS work.

1. Install and activate the plugin.
2. Open Nivoli Edge → Managed Edge → License and paste your key (it arrives by email the moment checkout completes; every plan starts with a 14-day free trial). Activation provisions a CDN tenant and fills the rewrite settings in automatically.
3. For page caching, paste your dashboard URL from the welcome email under Settings → Page cache.
4. The Dashboard's pipeline check should read ✓ working. Done.

Quickstart: self-hosted (free)

Images need a Cloudflare zone with Image Resizing enabled on the host that serves them (bundled with Cloudflare Pro plans, or pay-per-1000):

1. Proxy the image host through Cloudflare (orange cloud) and enable Speed → Optimization → Image Resizing.
2. Verify with any image: https://yoursite.com/cdn-cgi/image/width=200/wp-content/uploads/….jpg must serve a resized image. A 404 or error 9421 means Image Resizing isn't on.
3. In Nivoli Edge → Settings, confirm the auto-detected image host + path prefix and toggle Enabled.
4. Open Image rules → Size mapping and click once to create rules for your theme's registered sizes. The catch-all covers everything else.

Pages need a tag-aware edge you already run: pick Fastly, Cloudflare Enterprise, or a custom webhook under Settings → Page cache and supply the token. The plugin verifies the token actually has purge permission at setup time.

Image rules & presets

Every rewrite goes through a preset, a named recipe of width, height, fit, format, quality, and srcset behavior. Presets attach to images via bindings:

Size mapping creates presets + bindings from your theme's registered sizes in one click. Inline content, CSS backgrounds, and lazy-load data attributes are covered by the content scan toggles under Settings → Behavior.

Page caching & purging

# Every page response carries the tags it was built from
Surrogate-Key: post-42 category-7 author-3 home

# One post save → one surgical purge
POST /purge  { "keys": ["post-42", "category-7", "home"] }

Purges dispatch non-blocking on save, delete, and comment events, so editing never waits on a CDN round-trip. The purge activity log lives under Diagnostics → Page cache; prewarm-after-purge re-fetches affected URLs ~45s later so the next visitor hits a warm cache. Theme and plugin developers can add tags via the nivoli_edge_pc_keys_for_request / nivoli_edge_pc_keys_for_post filters.

Audits & repair tools

• Coverage audit: scans content and measures the optimized share, with one-click "create rule" links for anything uncovered.
• Runtime misses log: images that matched the path prefix but no rule at serve time, grouped into patterns.
• Fake-image scan & repair: finds files with an image extension whose bytes are actually HTML (old CMS error pages), and swaps the content for a placeholder while keeping the path and a .orig backup.
• Tinify compression: shrink originals in place with your own TinyPNG/Tinify API key; every change keeps a restorable backup.
• Client report: a printable, brandable delivery report; fills with live edge numbers on managed plans.

Automation & alerts

• Weekly scheduled audit emails you when coverage regresses.
• Purge-failure alerts: a daily sweep of the purge log emails when dispatches keep failing.
• Weekly header self-test: fetches your own site with trace mode and verifies tag headers still emit after theme/plugin changes.
• Pre-warm on save: parallel HEAD requests warm new image variants the moment you publish.

Debugging

WP-CLI

# status of both halves
wp nivoli-edge status

# activate a license / enable optimization
wp nivoli-edge activate <key>
wp nivoli-edge enable

# run the coverage audit / probe the pipeline / purge tags
wp nivoli-edge audit
wp nivoli-edge probe
wp nivoli-edge purge post-42 home

Built for agency provisioning: every setup step scriptable, exit codes are meaningful.

The managed service

A license key connects the plugin to the Nivoli edge, which runs both halves for you and adds what a plugin alone can't. Everything below lives in WP admin under Managed Edge; metrics are cached for an hour and served instantly, with a Refresh data link in the rail when you want live numbers.

Origin Shield

Always on, nothing to configure. When your server errors or stops responding, the edge serves the last good cached copy of every page for up to 7 days. You get an email when the shield engages and another when your origin recovers (switchable under Email & reports). The Origin shield pane keeps an incident history with honest durations; scattered single-request errors are counted separately as blips, not stitched into fake outages. "Not covered" requests are pages nobody had visited recently: a higher cache hit rate widens the shield.

The edge security suite

All enforced at Cloudflare's edge, before a request reaches PHP; they complement Wordfence/Sucuri rather than replace them. The Edge shields pane opens with an attack-surface strip: XML-RPC blocked vs reached, logins stopped, AI crawlers and wp-admin hits blocked, over the last 14 days.

• XML-RPC block (all plans): answers /xmlrpc.php with a cached 410.
• Login country lock (all plans): wp-login.php limited to the countries you list; everyone else gets a 403 at the edge. Continent quick-add buttons included; keep a country you can always reach.
• Security headers pack (all plans): one switch adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a conservative Permissions-Policy; your own header values always win. No CSP by design.
• Login rate limiting (Growth+): 10 attempts per 10 minutes per IP; brute-force runs get a cached 429. Self-healing, you cannot lock yourself out.
• wp-admin IP lock (Growth+): /wp-admin restricted to your IPs/CIDR ranges (one per line), with a self-lockout guard and an email self-rescue flow on the 403 page. admin-ajax.php stays open.
• AI-crawler block (Growth+): GPTBot, ClaudeBot, CCBot, Bytespider, Google-Extended, PerplexityBot and friends get a 403; verified search engines are never affected.
• Geo control (all plans): allow or block countries per path via URL rules.

Audience analytics

On Stats & overview: human pageviews vs bots (14 days), visitors per day, top referrers, visitor countries, devices and regions, plus served-from-cache timing vs your origin's render time. Measured entirely at the edge from traffic you already serve: no tracking script, no cookies, no consent banner needed, and no visitor-level data is ever stored. A monthly audience digest rides along with the stats email.

URL rules and the 404 cleanup inbox

URL rules block dead routes with a cached 410 or redirect moved pages with a 301/302, straight from the edge, with per-rule hit counts and a what-was-blocked log. The Redirects pane carries a suggestions inbox: the edge watches which URLs 404 against your origin and proposes block/redirect rules (with guessed targets) that you apply in one click. The Query params pane collapses junk query strings (utm_*, fbclid, and unknowns) into the cached page while functional params keep working.

Client reports and the fleet

The printable client report (Tools) is white-label: your name and logo, no vendor branding. On Business+ the monthly delivery report can also email itself to up to 3 recipients under your brand (Email & reports → Branded client reports), and each site can additionally send its own numbers to its own client. Your sites shows the whole license in one table: images, pages, hit rates, bandwidth and failures per site, with one-click purge-all and a security-baseline apply across the fleet.

What unlocks where

Matching what the server actually enforces:

• Every managed plan: managed CDN + page cache, Origin Shield, XML-RPC block, login country lock, security headers, geo control, URL rules + 404 inbox, query-param manager, audience analytics, broken-image alerts, heaviest images, top URLs, monthly reports.
• Growth+: AI-crawler block, wp-admin IP lock, login rate limiting, white-label image hostname, edge watermarking.
• Business+: multiple sites on one key, fleet view and fleet actions, automatic branded client reports.
• Agency: pooled transform allowance across all client sites, priority support.

FAQ

Will this break my theme?

No. Only URLs change, at the filter boundary. The HTML structure is untouched, and no-cf opts any element out.

How is this different from Smush / ShortPixel / Optimole?

Those compress and re-host your images on their CDN. Nivoli Edge transforms on the fly from your origin: no duplication, no migration, no storage bill.

Does the page caching conflict with Wordfence / Sucuri?

No, these are different layers. Security plugins inspect requests inside PHP; the edge shields stop junk before it reaches your server. They complement each other.

Do I need to change my web-server config?

Only if your origin runs its own micro-cache (nginx fastcgi cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact snippet. A standard PHP-FPM origin needs nothing.

What happens if I cancel a managed plan?

The plugin reverts to serving originals from your own server. Your site stays up; the free feature set keeps working.

Privacy & external services

The free tier's core rewriting contacts no external service. Opt-in integrations: the Nivoli managed edge (license verification + usage stats; no visitor data), Cloudflare / Fastly APIs (only with your own tokens, for purges), and Tinify (only images you explicitly compress, with your own key). Full details in the plugin readme, Terms, and Privacy Policy.