Nivoli Edge

Description

Find out what your WordPress site gives away, and close most of it in one click. Free, on your own server, with no account and no key.

Nivoli Edge starts with three security tools that run inside WordPress and need nothing else. When you want protection a plugin cannot give from inside the site it protects, the managed edge adds it one layer up.

Security check (free)

Nineteen checks of what this site exposes, measured from inside WordPress and from one visit to its own front door: XML-RPC, readable usernames, the code editors, security headers, the WordPress version, readme.html, debug.log, directory listings, a user named admin, HTTPS. It also finds what a site hides from itself: must-use plugins and drop-ins that WordPress does not list, administrators the Users screen does not show, and code hooked to the login from places it should not be. Every finding says what it means and what to do about it.

Code at login (free)

Every piece of code that runs when someone logs in, and on the Users and Plugins screens, listed in plain words: what it does, which plugin, theme or file put it there, and the warning signs a password thief leaves behind (hidden code, sending data out, writing files, storing what was typed). WordPress itself and well-known plugins are grouped as expected; anything else is yours to confirm, and you can accept what you recognise so it stops asking.

Hardening, one switch each (free)

Eight things WordPress exposes by default, switched off from the next page load: XML-RPC, username enumeration, the code editors in wp-admin, missing security headers, the version in the page, the version in asset URLs and headers, head clutter, and minor core updates kept on. One click gives you the same switches as a must-use plugin, which WordPress loads first and nothing in wp-admin can deactivate.

Also free

• Images through your own Cloudflare zone: URLs rewritten into right-sized WebP and AVIF (native WordPress filters, srcset, Gutenberg, WooCommerce, the content and a full-page scan), presets and one-click size mapping from your theme’s sizes, a coverage audit with a weekly regression email, fake-image detection and repair, never-loading images, and your heaviest uploads with Tinify shrinking.
• Page caching on the edge you already run: Surrogate-Key / Cache-Tag headers and surgical purge to Fastly, Cloudflare Enterprise or your own webhook, prewarm on save, a page cache check and purge-failure alerts.
• WP-CLI, a debug overlay and a weekly header self-test.

The security tools need nothing from outside your server. Nothing is sent anywhere unless you connect a service yourself; the External services section lists each one.

When you want more: the managed edge

Every security plugin, this one’s free tools included, runs inside the site it protects. When the site is taken over, so is the plugin: its settings belong to the intruder, and every attack it inspects has already reached PHP on your server. The managed edge runs one layer up, at Cloudflare’s edge, where a hacked WordPress cannot reach it. Connect it with an API key from the Account tab; every plan starts with a 14-day free trial.

Twelve shields, refused before PHP. Your server never boots PHP to turn a request away.

• Login flood limit (10 attempts per 10 minutes per address)
• Comment flood limit (5 posts per 5 minutes per address)
• Search flood limit (30 searches per 5 minutes per address)
• XML-RPC block, on by default (a 404 at the edge, cached for five minutes), with a switch to allow it
• Login country lock (wp-login answers only the countries you list)
• wp-admin IP lock (your own addresses, with a self-lockout guard and an email rescue)
• AI-crawler block (GPTBot, ClaudeBot, CCBot and friends; search engines never affected)
• Stray-PHP lock (every .php request except the real WordPress entry points gets a 404)
• WordPress surface lock (the REST users list, ?author=N, readme.html, license.txt, the installer, debug.log)
• Security-headers pack (HSTS, nosniff, frame and referrer policies; your own values win)
• Traversal guard (a request carrying a parent-directory sequence, in any encoding, gets a 404)
• Scanner lockout (five refusals in ten minutes and the address gets a 403 for ten minutes)

All of them come with every managed plan. The stray-PHP lock, the surface lock, the traversal guard and the scanner lockout have a monitor mode that lists what blocking would have stopped before it blocks anything.

Three locks, nothing inside the site can turn off. A takeover of your WordPress admin owns every plugin’s settings page. Ours refuses to act on WordPress’s say-so.

• Change lock: any change that weakens protection waits for a click on a link mailed to the license holder; the link applies exactly that change, once.
• Install lock: plugin and theme installs, uploads, updates, deletes and the file editors are refused site-wide until a 15-minute window is opened the same way. Automatic updates and WP-CLI run on the server and are never affected.
• Origin lock: the edge stamps a per-site secret on every request it forwards and the plugin refuses code changes that arrive without it, so knowing the server’s address is no longer a way around the locks. A self-test reports whether the server enforces it.

Evidence: who did what, from where.

• Refused installs named by plugin, and every refused attempt in your inbox as it happens.
• A lock activity log with time and address for every unlock request, clicked link, confirmation and lock change.
• An attack-surface strip per fortnight, a monthly report by email, and for agencies a posture matrix across every site.

Underneath all of it, Cloudflare’s managed WAF rulesets, including the WordPress rule set, run in front of every managed site.

Pages served from the edge (managed)

Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.

• Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli, Fastly, Cloudflare Enterprise or your own webhook.
• Logged-in visitors, carts and checkout always bypass.
• Stylesheets, scripts and fonts from the edge too, on versioned addresses, so no browser or CDN node holds a stale file after a purge.
• Origin shield: if your server goes down, the edge keeps serving the last good copy of every cached page, for up to a day on Shield and up to 7 days on Shield Plus and Agency, and emails you when it engages and when the origin recovers.

Images served from the edge (managed)

With the Managed Images add-on, right-sized WebP and AVIF variants are created once at the edge and served from the node nearest each visitor: no Cloudflare account, no uploads, no duplicate copies, no theme changes. Without it, your images serve from your own server, untouched, and the free image tools keep working.

• Broken and heaviest images found from real traffic at the edge, with where each is used and one-click fixes.

The numbers, inside WP admin (managed)

• What the edge answered and what it refused, by window, with the most-requested and most-missed URLs.
• Dead URLs on a Recent 404s page with one-click redirect or block; a Search Console 404 export imported, matched to your own pages and turned into redirect and block rules family by family; All rules: one ordered list of every edge rule with per-rule counts and reordering.
• Audience without a tracking script: humans versus bots, countries, referrers, devices, served-from-cache speed.
• Static assets: edge hit rate per file type and which files still travel on plain addresses.
• A monthly report by email, white-label copies for clients on Agency.

Requirements

• Free security tools: nothing. The security check, Code at login and Hardening work on any WordPress 6.2+ site.
• Free image and page-cache tools: a Cloudflare zone with Image Resizing enabled for the image half (Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your webhook) for the page-cache half. If Image Resizing isn’t enabled the rewritten URLs 404; Images → Pipeline check has a one-click probe to verify.
• Managed: none of the above for pages and security; for images, the Managed Images add-on. An API key from your Nivoli account, plus the DNS records the setup pane shows to put the site behind the edge.

External services

The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.

Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy

Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/

TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms