{"id":340850,"date":"2026-09-03T19:12:18","date_gmt":"2026-09-03T19:12:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/nivoli-edge\/"},"modified":"2026-10-14T13:09:46","modified_gmt":"2026-10-14T13:09:46","slug":"nivoli-edge","status":"publish","type":"plugin","link":"https:\/\/haz.wordpress.org\/plugins\/nivoli-edge\/","author":23529952,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.93.5","stable_tag":"1.93.5","tested":"7.1.3","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Nivoli Edge: Login Security, WP Audit and Firewall","header_author":"Nivoli","header_description":"Serve your whole site from the edge: images right-sized and format-negotiated through Cloudflare Image Resizing, plus full-page HTML caching with surgical tag-based purge. Your whole site, served from the edge.","assets_banners_color":"301e66","last_updated":"2026-10-14 13:09:46","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/nivoli.com\/nivoli-edge","header_author_uri":"https:\/\/nivoli.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":1253,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.48.2":{"tag":"1.48.2","author":"calimonk","date":"2026-09-03 19:12:05","revision":3680272},"1.48.3":{"tag":"1.48.3","author":"calimonk","date":"2026-09-03 19:31:40","revision":3680290},"1.49.0":{"tag":"1.49.0","author":"calimonk","date":"2026-09-04 07:51:53","revision":3680823},"1.50.0":{"tag":"1.50.0","author":"calimonk","date":"2026-09-04 07:51:53","revision":3680823},"1.50.1":{"tag":"1.50.1","author":"calimonk","date":"2026-09-04 07:51:53","revision":3680823},"1.50.2":{"tag":"1.50.2","author":"calimonk","date":"2026-09-04 07:51:53","revision":3680823},"1.51.0":{"tag":"1.51.0","author":"calimonk","date":"2026-09-04 09:51:13","revision":3680993},"1.51.1":{"tag":"1.51.1","author":"calimonk","date":"2026-09-04 09:51:13","revision":3680993},"1.52.0":{"tag":"1.52.0","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.52.1":{"tag":"1.52.1","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.52.2":{"tag":"1.52.2","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.53.0":{"tag":"1.53.0","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.53.1":{"tag":"1.53.1","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.54.0":{"tag":"1.54.0","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.54.1":{"tag":"1.54.1","author":"calimonk","date":"2026-09-04 13:33:54","revision":3681289},"1.55.0":{"tag":"1.55.0","author":"calimonk","date":"2026-09-04 18:51:09","revision":3681700},"1.56.0":{"tag":"1.56.0","author":"calimonk","date":"2026-09-04 18:51:09","revision":3681700},"1.56.1":{"tag":"1.56.1","author":"calimonk","date":"2026-09-04 19:01:51","revision":3681711},"1.57.0":{"tag":"1.57.0","author":"calimonk","date":"2026-09-04 19:09:07","revision":3681722},"1.57.1":{"tag":"1.57.1","author":"calimonk","date":"2026-09-06 07:59:36","revision":3683124},"1.57.2":{"tag":"1.57.2","author":"calimonk","date":"2026-09-06 07:59:36","revision":3683124},"1.57.3":{"tag":"1.57.3","author":"calimonk","date":"2026-09-06 07:59:36","revision":3683124},"1.57.4":{"tag":"1.57.4","author":"calimonk","date":"2026-09-07 12:54:44","revision":3684945},"1.57.5":{"tag":"1.57.5","author":"calimonk","date":"2026-09-07 12:54:44","revision":3684945},"1.57.6":{"tag":"1.57.6","author":"calimonk","date":"2026-09-07 12:54:44","revision":3684945},"1.57.7":{"tag":"1.57.7","author":"calimonk","date":"2026-09-07 13:46:51","revision":3685031},"1.57.8":{"tag":"1.57.8","author":"calimonk","date":"2026-09-07 13:46:51","revision":3685031},"1.57.9":{"tag":"1.57.9","author":"calimonk","date":"2026-09-07 13:46:51","revision":3685031},"1.58.0":{"tag":"1.58.0","author":"calimonk","date":"2026-09-07 15:09:15","revision":3685161},"1.58.1":{"tag":"1.58.1","author":"calimonk","date":"2026-09-07 15:09:15","revision":3685161},"1.58.2":{"tag":"1.58.2","author":"calimonk","date":"2026-09-07 15:09:15","revision":3685161},"1.58.3":{"tag":"1.58.3","author":"calimonk","date":"2026-09-07 15:09:15","revision":3685161},"1.58.4":{"tag":"1.58.4","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.59.0":{"tag":"1.59.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.60.0":{"tag":"1.60.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.60.1":{"tag":"1.60.1","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.61.0":{"tag":"1.61.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.62.0":{"tag":"1.62.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.63.0":{"tag":"1.63.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.64.0":{"tag":"1.64.0","author":"calimonk","date":"2026-09-07 22:16:08","revision":3685671},"1.65.0":{"tag":"1.65.0","author":"calimonk","date":"2026-09-09 12:10:47","revision":3688263},"1.66.0":{"tag":"1.66.0","author":"calimonk","date":"2026-09-09 12:10:47","revision":3688263},"1.66.1":{"tag":"1.66.1","author":"calimonk","date":"2026-09-09 12:49:16","revision":3688314},"1.66.2":{"tag":"1.66.2","author":"calimonk","date":"2026-09-09 12:49:16","revision":3688314},"1.67.0":{"tag":"1.67.0","author":"calimonk","date":"2026-09-09 13:42:08","revision":3688392},"1.68.0":{"tag":"1.68.0","author":"calimonk","date":"2026-09-09 16:03:49","revision":3688622},"1.68.1":{"tag":"1.68.1","author":"calimonk","date":"2026-09-09 21:48:23","revision":3689041},"1.68.2":{"tag":"1.68.2","author":"calimonk","date":"2026-09-09 21:48:23","revision":3689041},"1.69.0":{"tag":"1.69.0","author":"calimonk","date":"2026-09-14 08:57:23","revision":3694828},"1.70.0":{"tag":"1.70.0","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.1":{"tag":"1.70.1","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.2":{"tag":"1.70.2","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.3":{"tag":"1.70.3","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.4":{"tag":"1.70.4","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.5":{"tag":"1.70.5","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.70.6":{"tag":"1.70.6","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.71.0":{"tag":"1.71.0","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.71.1":{"tag":"1.71.1","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.0":{"tag":"1.72.0","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.1":{"tag":"1.72.1","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.2":{"tag":"1.72.2","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.3":{"tag":"1.72.3","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.4":{"tag":"1.72.4","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.72.5":{"tag":"1.72.5","author":"calimonk","date":"2026-09-14 20:49:47","revision":3695912},"1.73.0":{"tag":"1.73.0","author":"calimonk","date":"2026-09-15 05:29:43","revision":3696239},"1.73.1":{"tag":"1.73.1","author":"calimonk","date":"2026-09-15 10:25:26","revision":3696739},"1.73.2":{"tag":"1.73.2","author":"calimonk","date":"2026-09-21 08:57:10","revision":3705207},"1.74.0":{"tag":"1.74.0","author":"calimonk","date":"2026-09-21 08:57:10","revision":3705207},"1.75.0":{"tag":"1.75.0","author":"calimonk","date":"2026-09-21 08:57:10","revision":3705207},"1.75.1":{"tag":"1.75.1","author":"calimonk","date":"2026-09-21 08:57:10","revision":3705207},"1.75.2":{"tag":"1.75.2","author":"calimonk","date":"2026-09-21 08:57:10","revision":3705207},"1.75.3":{"tag":"1.75.3","author":"calimonk","date":"2026-09-21 09:09:46","revision":3705223},"1.76.0":{"tag":"1.76.0","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.77.0":{"tag":"1.77.0","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.77.1":{"tag":"1.77.1","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.78.0":{"tag":"1.78.0","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.79.0":{"tag":"1.79.0","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.79.1":{"tag":"1.79.1","author":"calimonk","date":"2026-09-23 14:06:04","revision":3709476},"1.79.2":{"tag":"1.79.2","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.0":{"tag":"1.80.0","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.1":{"tag":"1.80.1","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.2":{"tag":"1.80.2","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.3":{"tag":"1.80.3","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.4":{"tag":"1.80.4","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.5":{"tag":"1.80.5","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.80.6":{"tag":"1.80.6","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.81.0":{"tag":"1.81.0","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.81.1":{"tag":"1.81.1","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.81.2":{"tag":"1.81.2","author":"calimonk","date":"2026-09-23 21:01:24","revision":3710171},"1.81.3":{"tag":"1.81.3","author":"calimonk","date":"2026-09-26 09:57:11","revision":3714060},"1.82.0":{"tag":"1.82.0","author":"calimonk","date":"2026-10-02 12:16:40","revision":3724768},"1.83.0":{"tag":"1.83.0","author":"calimonk","date":"2026-10-03 11:31:51","revision":3726190},"1.84.0":{"tag":"1.84.0","author":"calimonk","date":"2026-10-07 08:50:04","revision":3732165},"1.85.0":{"tag":"1.85.0","author":"calimonk","date":"2026-10-07 09:15:49","revision":3732212},"1.86.0":{"tag":"1.86.0","author":"calimonk","date":"2026-10-07 09:33:49","revision":3732241},"1.87.0":{"tag":"1.87.0","author":"calimonk","date":"2026-10-07 10:33:42","revision":3732369},"1.88.0":{"tag":"1.88.0","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.0":{"tag":"1.89.0","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.1":{"tag":"1.89.1","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.2":{"tag":"1.89.2","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.3":{"tag":"1.89.3","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.4":{"tag":"1.89.4","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.89.5":{"tag":"1.89.5","author":"calimonk","date":"2026-10-07 13:50:18","revision":3732708},"1.90.0":{"tag":"1.90.0","author":"calimonk","date":"2026-10-08 12:02:09","revision":3734480},"1.90.1":{"tag":"1.90.1","author":"calimonk","date":"2026-10-08 15:09:16","revision":3734958},"1.90.2":{"tag":"1.90.2","author":"calimonk","date":"2026-10-09 09:42:29","revision":3736329},"1.91.0":{"tag":"1.91.0","author":"calimonk","date":"2026-10-09 10:51:09","revision":3736440},"1.92.0":{"tag":"1.92.0","author":"calimonk","date":"2026-10-12 07:52:16","revision":3740764},"1.92.1":{"tag":"1.92.1","author":"calimonk","date":"2026-10-14 12:15:23","revision":3746295},"1.93.0":{"tag":"1.93.0","author":"calimonk","date":"2026-10-14 12:34:23","revision":3746340},"1.93.1":{"tag":"1.93.1","author":"calimonk","date":"2026-10-14 12:34:23","revision":3746340},"1.93.2":{"tag":"1.93.2","author":"calimonk","date":"2026-10-14 12:34:23","revision":3746340},"1.93.3":{"tag":"1.93.3","author":"calimonk","date":"2026-10-14 12:51:50","revision":3746387},"1.93.4":{"tag":"1.93.4","author":"calimonk","date":"2026-10-14 13:05:18","revision":3746428},"1.93.5":{"tag":"1.93.5","author":"calimonk","date":"2026-10-14 13:09:46","revision":3746437}},"upgrade_notice":[],"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3680272,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3680272,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3681289,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3681289,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.48.2","1.48.3","1.49.0","1.50.0","1.50.1","1.50.2","1.51.0","1.51.1","1.52.0","1.52.1","1.52.2","1.53.0","1.53.1","1.54.0","1.54.1","1.55.0","1.56.0","1.56.1","1.57.0","1.57.1","1.57.2","1.57.3","1.57.4","1.57.5","1.57.6","1.57.7","1.57.8","1.57.9","1.58.0","1.58.1","1.58.2","1.58.3","1.58.4","1.59.0","1.60.0","1.60.1","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.66.1","1.66.2","1.67.0","1.68.0","1.68.1","1.68.2","1.69.0","1.70.0","1.70.1","1.70.2","1.70.3","1.70.4","1.70.5","1.70.6","1.71.0","1.71.1","1.72.0","1.72.1","1.72.2","1.72.3","1.72.4","1.72.5","1.73.0","1.73.1","1.73.2","1.74.0","1.75.0","1.75.1","1.75.2","1.75.3","1.76.0","1.77.0","1.77.1","1.78.0","1.79.0","1.79.1","1.79.2","1.80.0","1.80.1","1.80.2","1.80.3","1.80.4","1.80.5","1.80.6","1.81.0","1.81.1","1.81.2","1.81.3","1.82.0","1.83.0","1.84.0","1.85.0","1.86.0","1.87.0","1.88.0","1.89.0","1.89.1","1.89.2","1.89.3","1.89.4","1.89.5","1.90.0","1.90.1","1.90.2","1.91.0","1.92.0","1.92.1","1.93.0","1.93.1","1.93.2","1.93.3","1.93.4","1.93.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3714060,"resolution":"1","location":"assets","locale":"","width":1224,"height":996},"screenshot-10.png":{"filename":"screenshot-10.png","revision":3688263,"resolution":"10","location":"assets","locale":"","width":1235,"height":986},"screenshot-11.png":{"filename":"screenshot-11.png","revision":3714060,"resolution":"11","location":"assets","locale":"","width":972,"height":875},"screenshot-12.png":{"filename":"screenshot-12.png","revision":3684945,"resolution":"12","location":"assets","locale":"","width":1226,"height":1098},"screenshot-13.png":{"filename":"screenshot-13.png","revision":3714060,"resolution":"13","location":"assets","locale":"","width":1228,"height":1174},"screenshot-14.png":{"filename":"screenshot-14.png","revision":3714060,"resolution":"14","location":"assets","locale":"","width":1229,"height":867},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3714060,"resolution":"2","location":"assets","locale":"","width":1263,"height":1158},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3714060,"resolution":"3","location":"assets","locale":"","width":978,"height":1290},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3714060,"resolution":"4","location":"assets","locale":"","width":1229,"height":1100},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3714060,"resolution":"5","location":"assets","locale":"","width":981,"height":1313},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3714060,"resolution":"6","location":"assets","locale":"","width":1224,"height":1124},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3714060,"resolution":"7","location":"assets","locale":"","width":973,"height":1018},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3684945,"resolution":"8","location":"assets","locale":"","width":1238,"height":975},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3684945,"resolution":"9","location":"assets","locale":"","width":1222,"height":1020}},"screenshots":{"1":"Overview: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends, under the five tabs Overview, Security, Pages, Images and Account.","2":"Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and search floods) and every shield with its switch, enforced before your server. Every shield on every managed plan.","3":"Locks: change lock, install lock and origin lock, what they refused in the last 14 days with the exact plugin named, and the lock activity log with a filter for state changes only.","4":"Security check: what this WordPress exposes, measured from inside it and from one visit to its own front door, with what this plugin can switch off and what the managed edge already refuses.","5":"Probe shields: stray PHP, enumeration, traversal probes and the scanner lockout, with off, monitor and block for each and the refusal counts.","6":"Stats and overview: hour-by-hour traffic, origin offload, hit rates by window, surgical purges.","7":"Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking, and what the shrinking has saved so far.","8":"Redirects: legacy URLs answered at the edge, patterns and exact rules with usage, unused rules folded away.","9":"Recent 404s: paths your server keeps answering with a 404, with bot share and one-click redirect or block.","10":"Your audience: humans versus bots, served-from-cache speed, referrers, devices and countries, no tracking script.","11":"Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses, bandwidth offloaded.","12":"Query params: which parameters split the cache, which are guarded, with one-click collapse.","13":"Hardening: eight things WordPress exposes by default, one click each, with the ones the edge already refuses grouped and saying so.","14":"Broken images: failed image requests from the last 7 days, files gone from disk with a placeholder ready, and the momentary failures that handled themselves."}},"plugin_section":[262246],"plugin_tags":[146,3882,1174,31093,600],"plugin_category":[52,54],"plugin_contributors":[279069],"plugin_business_model":[],"class_list":["post-340850","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-cache","plugin_tags-cloudflare","plugin_tags-firewall","plugin_tags-hardening","plugin_tags-security","plugin_category-performance","plugin_category-security-and-spam-protection","plugin_contributors-calimonk","plugin_committers-calimonk"],"banners":{"banner":"https:\/\/ps.w.org\/nivoli-edge\/assets\/banner-772x250.png?rev=3681289","banner_2x":"https:\/\/ps.w.org\/nivoli-edge\/assets\/banner-1544x500.png?rev=3681289","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/nivoli-edge\/assets\/icon-128x128.png?rev=3680272","icon_2x":"https:\/\/ps.w.org\/nivoli-edge\/assets\/icon-256x256.png?rev=3680272","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-1.png?rev=3714060","caption":"Overview: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends, under the five tabs Overview, Security, Pages, Images and Account."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-2.png?rev=3714060","caption":"Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and search floods) and every shield with its switch, enforced before your server. Every shield on every managed plan."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-3.png?rev=3714060","caption":"Locks: change lock, install lock and origin lock, what they refused in the last 14 days with the exact plugin named, and the lock activity log with a filter for state changes only."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-4.png?rev=3714060","caption":"Security check: what this WordPress exposes, measured from inside it and from one visit to its own front door, with what this plugin can switch off and what the managed edge already refuses."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-5.png?rev=3714060","caption":"Probe shields: stray PHP, enumeration, traversal probes and the scanner lockout, with off, monitor and block for each and the refusal counts."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-6.png?rev=3714060","caption":"Stats and overview: hour-by-hour traffic, origin offload, hit rates by window, surgical purges."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-7.png?rev=3714060","caption":"Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking, and what the shrinking has saved so far."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-8.png?rev=3684945","caption":"Redirects: legacy URLs answered at the edge, patterns and exact rules with usage, unused rules folded away."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-9.png?rev=3684945","caption":"Recent 404s: paths your server keeps answering with a 404, with bot share and one-click redirect or block."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-10.png?rev=3688263","caption":"Your audience: humans versus bots, served-from-cache speed, referrers, devices and countries, no tracking script."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-11.png?rev=3714060","caption":"Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses, bandwidth offloaded."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-12.png?rev=3684945","caption":"Query params: which parameters split the cache, which are guarded, with one-click collapse."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-13.png?rev=3714060","caption":"Hardening: eight things WordPress exposes by default, one click each, with the ones the edge already refuses grouped and saying so."},{"src":"https:\/\/ps.w.org\/nivoli-edge\/assets\/screenshot-14.png?rev=3714060","caption":"Broken images: failed image requests from the last 7 days, files gone from disk with a placeholder ready, and the momentary failures that handled themselves."}],"raw_content":"<!--section=description-->\n<p><strong>Security one layer above WordPress.<\/strong> Audit what your site exposes, lock down logins, and stop attacks at Cloudflare's edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on.<\/p>\n\n<h4>Login Security<\/h4>\n\n<ul>\n<li><strong>Login rate limit:<\/strong> 10 attempts per 10 minutes per address, answered at the edge<\/li>\n<li><strong>Login country lock:<\/strong> wp-login.php only for the countries you list<\/li>\n<li><strong>wp-admin IP lock:<\/strong> only your addresses, with a self-lockout guard and email rescue<\/li>\n<li><strong>XML-RPC block:<\/strong> no guessing hundreds of passwords in one request<\/li>\n<li><strong>Hidden usernames:<\/strong> nothing to find at ?author=N or in the REST API<\/li>\n<li><strong>Code at login:<\/strong> every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves<\/li>\n<\/ul>\n\n<h4>WordPress Security Audit<\/h4>\n\n<ul>\n<li><strong>Security check:<\/strong> 19 checks of what your site exposes, from inside WordPress and from its own front door<\/li>\n<li><strong>Hidden from itself:<\/strong> unlisted must-use plugins, administrators the Users screen does not show, suspicious login code<\/li>\n<li><strong>Hardening:<\/strong> 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable<\/li>\n<li><strong>Plain answers:<\/strong> every finding says what it means and how to fix it<\/li>\n<\/ul>\n\n<h4>Edge Firewall<\/h4>\n\n<p>Twelve shields at Cloudflare's edge: your server never runs PHP to turn an attack away.<\/p>\n\n<ul>\n<li><strong>Stray-PHP lock:<\/strong> every .php request except WordPress's own entry points refused<\/li>\n<li><strong>Surface lock:<\/strong> user lists, readme.html, the installer and debug.log closed to visitors<\/li>\n<li><strong>Traversal guard:<\/strong> path tricks refused in any encoding<\/li>\n<li><strong>Scanner lockout:<\/strong> five refusals and the address is shut out for ten minutes<\/li>\n<li><strong>Flood limits:<\/strong> comment and search floods stopped per address<\/li>\n<li><strong>AI-crawler block<\/strong> and <strong>security headers<\/strong> on every response<\/li>\n<li><strong>Monitor mode:<\/strong> see what a shield would block before it blocks anything<\/li>\n<li><strong>Cloudflare's managed WAF rulesets<\/strong> in front of every site on the edge<\/li>\n<\/ul>\n\n<h4>Protection that stays on after a takeover<\/h4>\n\n<p>A takeover of wp-admin owns every plugin's settings. These live at the edge.<\/p>\n\n<ul>\n<li><strong>Change lock:<\/strong> weakening protection waits for a click on a link mailed to you<\/li>\n<li><strong>Install lock:<\/strong> plugin and theme installs, updates and file edits refused until you open a 15-minute window by email<\/li>\n<li><strong>Origin lock:<\/strong> code changes that skip the edge are refused, so knowing your server's address does not help<\/li>\n<li><strong>Activity log:<\/strong> every refused attempt in your inbox and on the Locks page<\/li>\n<\/ul>\n\n<h4>Speed and uptime<\/h4>\n\n<ul>\n<li><strong>Edge page cache:<\/strong> full pages from Cloudflare's network, with surgical purge so only the pages a change touches refresh<\/li>\n<li><strong>Origin Shield:<\/strong> your site keeps serving when your server is down<\/li>\n<li><strong>Right-sized images:<\/strong> WebP and AVIF through your own Cloudflare zone or the Managed Images add-on<\/li>\n<li><strong>Analytics without a tracking script:<\/strong> audience, attacks and top URLs from the edge<\/li>\n<\/ul>\n\n<h4>Free and with a plan<\/h4>\n\n<p>Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial.<\/p>\n\n<h4>Requirements<\/h4>\n\n<ul>\n<li>WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.<\/li>\n<li>Image tools on your own zone: Cloudflare with Image Resizing (<strong>Images \u2192 Pipeline check<\/strong> verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.<\/li>\n<li>Managed: an API key, plus the DNS records the setup pane shows.<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>The free tier's core image rewriting sends <strong>no data to any external service<\/strong>; it only rewrites <code>&lt;img&gt;<\/code> URLs in your site's HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.<\/p>\n\n<p><strong>Nivoli managed edge<\/strong> (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used <strong>only if you enter an API key<\/strong>. On activation and on a daily background re-check it sends your API key, this site's URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN\/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No visitor data is ever sent. Terms: https:\/\/nivoli.com\/terms \u00b7 Privacy: https:\/\/nivoli.com\/privacy<\/p>\n\n<p><strong>Cloudflare<\/strong> (api.cloudflare.com): used <strong>only if you configure the Cloudflare Enterprise page-cache backend<\/strong> with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https:\/\/www.cloudflare.com\/terms\/ \u00b7 Privacy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/p>\n\n<p><strong>Fastly<\/strong> (api.fastly.com): used <strong>only if you configure the Fastly page-cache backend<\/strong> with your own API token, to dispatch surrogate-key purges on content change. Terms: https:\/\/www.fastly.com\/terms\/ \u00b7 Privacy: https:\/\/www.fastly.com\/privacy\/<\/p>\n\n<p><strong>TinyPNG \/ Tinify<\/strong> (api.tinify.com): used <strong>only if you add your own Tinify API key and click \"Shrink original\"<\/strong> on an image, to compress that source file. Only the image you choose is sent. Terms &amp; Privacy: https:\/\/tinify.com\/terms<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin. Open <strong>Nivoli Edge \u2192 Security \u2192 Security check<\/strong> and run it: no setup, no account. <strong>Code at login<\/strong> and <strong>Hardening<\/strong> sit beside it.<\/li>\n<li>Free images on your own Cloudflare zone: open <strong>Images \u2192 Hosts &amp; routing<\/strong>, confirm the auto-detected image host and path prefix, then switch Enabled on under <strong>Images \u2192 Optimization<\/strong>. Add rules under <strong>Images \u2192 Rules<\/strong>, or let <strong>Size mapping<\/strong> create them from your theme's sizes in one click.<\/li>\n<li>Free page caching on your own edge: open <strong>Pages \u2192 Cache backend<\/strong> and pick Fastly, Cloudflare Enterprise or a webhook.<\/li>\n<li>Managed edge: paste your API key on the <strong>Account<\/strong> tab. The edge provisions itself and the setup overview walks the rest: the DNS records, the shields, the locks, the report.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"is%20the%20free%20version%20limited%3F\"><h3>Is the free version limited?<\/h3><\/dt>\n<dd><p>No trial, no time limit and no feature walls. Everything that runs on your own server is free and stays free: the security check, Code at login, Hardening, the image tools on your own Cloudflare zone, page-cache purging to your own edge, the audits and WP-CLI. The managed edge is a separate service for what a plugin cannot do from inside the site it protects.<\/p><\/dd>\n<dt id=\"do%20i%20need%20an%20account%3F\"><h3>Do I need an account?<\/h3><\/dt>\n<dd><p>Not for anything free. The security tools work on any WordPress site as soon as the plugin is active. An account and API key only come in when you connect the managed edge.<\/p><\/dd>\n<dt id=\"does%20this%20replace%20wordfence%20or%20sucuri%3F\"><h3>Does this replace Wordfence or Sucuri?<\/h3><\/dt>\n<dd><p>It sits above them. Those plugins inspect requests inside WordPress, after PHP has started; Nivoli Edge refuses hostile traffic at Cloudflare's edge before your server sees it, and its settings cannot be switched off from inside a compromised WordPress. Run both if you like; they do not overlap.<\/p><\/dd>\n<dt id=\"what%20do%20the%20twelve%20shields%20stop%3F\"><h3>What do the twelve shields stop?<\/h3><\/dt>\n<dd><p>Login, comment and search floods, XML-RPC abuse, logins from countries you do not serve, wp-admin from addresses that are not yours, AI crawlers, direct requests to PHP files that are not WordPress entry points, the probes that map a site (user lists, readme, license file, installer, debug.log), path traversal attempts in any encoding, addresses that keep probing after five refusals, and missing security headers. All twelve come with every managed plan.<\/p><\/dd>\n<dt id=\"does%20this%20require%20cloudflare%20pro%3F\"><h3>Does this require Cloudflare Pro?<\/h3><\/dt>\n<dd><p>Only for the free image rewriting on your own zone: Cloudflare Image Resizing is bundled with Pro plans or available pay-as-you-go. The managed edge needs no Cloudflare account at all.<\/p><\/dd>\n<dt id=\"will%20this%20break%20my%20theme%3F\"><h3>Will this break my theme?<\/h3><\/dt>\n<dd><p>No. The plugin only modifies URLs at the filter boundary; the HTML structure your theme outputs is unchanged. Use the <code>no-cf<\/code> CSS class on any element to opt out.<\/p><\/dd>\n<dt id=\"how%20is%20this%20different%20from%20smush%20%2F%20shortpixel%20%2F%20optimole%3F\"><h3>How is this different from Smush \/ ShortPixel \/ Optimole?<\/h3><\/dt>\n<dd><p>Those plugins compress and re-host images on their own CDN. Nivoli Edge transforms on the fly from your origin: no asset duplication, no migration step, no storage bill.<\/p><\/dd>\n<dt id=\"what%27s%20the%20difference%20between%20free%20and%20managed%3F\"><h3>What's the difference between Free and Managed?<\/h3><\/dt>\n<dd><p>Everything the plugin does on your own server is free and fully functional: the security check, Code at login, Hardening, image rewriting, page-cache purging, audits, prewarming and alerts. Nothing phones home. An API key connects the plugin to the Nivoli managed edge: we run the Cloudflare zone and page cache for you (no Cloudflare setup at all) and the service adds what a plugin alone can't, such as edge-side usage statistics, per-URL traffic insights, edge URL rules and security shields, and multi-site fleet management; custom image hostnames and watermarking come with the Managed Images add-on.<\/p><\/dd>\n<dt id=\"what%20if%20i%20lose%20access%20to%20my%20license%20email%3F\"><h3>What if I lose access to my license email?<\/h3><\/dt>\n<dd><p>Confirmation and unlock links go to the email address on your Nivoli license and nowhere else; that is what makes the locks hold against a takeover. Support can move the license to a new address after verifying you own it. Until then the locks stay as they are and the site keeps running; only changes that weaken protection wait.<\/p><\/dd>\n<dt id=\"does%20the%20install%20lock%20break%20automatic%20updates%3F\"><h3>Does the install lock break automatic updates?<\/h3><\/dt>\n<dd><p>No. Automatic background updates run from wp-cron on your server and WP-CLI runs on the box; neither passes through the edge, so neither is affected. Only installs, uploads, updates and deletes started from wp-admin are refused, and you open a 15-minute window by email when you want to do one yourself.<\/p><\/dd>\n<dt id=\"what%20if%20my%20site%20gets%20hacked%20anyway%3F\"><h3>What if my site gets hacked anyway?<\/h3><\/dt>\n<dd><p>The locks stop the intruder from switching the shields off, installing anything through WordPress, or redirecting the confirmation address, and every attempt lands in your inbox and on the Locks page with its time and address. What no edge control can do is undo code already running on your server: cleaning the box is still yours (scan, restore, rotate). The locks make sure the compromise stays where it landed.<\/p><\/dd>\n<dt id=\"does%20the%20page%20caching%20conflict%20with%20my%20security%20plugin%20%28wordfence%2C%20sucuri%29%3F\"><h3>Does the page caching conflict with my security plugin (Wordfence, Sucuri)?<\/h3><\/dt>\n<dd><p>No. Different layers: security plugins inspect requests inside WordPress\/PHP; Nivoli Edge's twelve shields run at Cloudflare's edge, before the request reaches your server. It sheds junk traffic so your origin and your security plugin only see real visitors. They complement each other.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20add%20a%20link%20to%20my%20site%3F\"><h3>Does the plugin add a link to my site?<\/h3><\/dt>\n<dd><p>Not unless you ask it to. Account, Footer credit has a switch, off by default, that prints one small \"Protected by Nivoli Edge\" line in your footer with a nofollow link. Nothing appears on your public site until you tick it, and unticking it removes the line again.<\/p><\/dd>\n<dt id=\"do%20i%20need%20to%20change%20my%20nginx%20%2F%20web-server%20config%3F\"><h3>Do I need to change my nginx \/ web-server config?<\/h3><\/dt>\n<dd><p>Only if your origin runs its own micro-cache (nginx fastcgi\/proxy cache, Varnish) and you use the manual purge trigger; the Cache protection pane shows the exact one-line snippet. A standard PHP-FPM origin needs no server changes at all.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<p>Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page.<\/p>\n\n<h4>1.93.5<\/h4>\n\n<p>WordPress.org listing: every feature name in bold, cleaner lists, and one paragraph at the end on what is free and what comes with a plan. No change to the plugin itself.<\/p>\n\n<h4>1.93.4<\/h4>\n\n<p>Clearer opening line on the WordPress.org listing. No change to the plugin itself.<\/p>\n\n<h4>1.93.3<\/h4>\n\n<p>A shorter WordPress.org listing, organised by what the plugin does: Login Security, WordPress Security Audit, Edge Firewall, the locks, speed and uptime. Managed features are tagged. No change to the plugin itself.<\/p>\n\n<h4>1.93.2<\/h4>\n\n<p>The plugin's name on WordPress.org and in your Plugins list now says what it does: Nivoli Edge: Login Security, WP Audit and Firewall. The Nivoli Edge menu in wp-admin is unchanged.<\/p>\n\n<h4>1.93.1<\/h4>\n\n<p>Wording: eleven messages in the plugin still used long dashes; they now read as plain sentences, and the pipeline probe message points to Images, Pipeline check. This also prepares the plugin's text for translation into Dutch, German, French and Spanish.<\/p>\n\n<h4>1.93.0<\/h4>\n\n<p>A small note on the plugin's own pages asks for a review on WordPress.org once the plugin has done something for your site (a security check run and a hardening switch on) or after two weeks. It says a review needs a free WordPress.org account. \"Maybe later\" asks again in 30 days; \"Leave a review\" and \"Don't ask again\" end it. It never appears on other admin screens.<\/p>\n\n<h4>1.92.1<\/h4>\n\n<p>The WordPress.org listing now leads with what the free plugin does on its own: the security check, Code at login and one-click Hardening, then the free image and page-cache tools, with the managed edge as what to add when you want more. New answers for \"Is the free version limited?\" and \"Do I need an account?\". No change to the plugin itself.<\/p>\n\n<h4>1.92.0<\/h4>\n\n<p>The Nivoli Edge item in the WordPress sidebar now carries a red count when something waits for you, like Comments or Plugins: exposed security-check findings, a change waiting for your emailed click, shields still monitoring, broken, heavy or fake images, a license that needs attention. Each tab entry under it shows its own count, the same numbers as the dots on the tabs. The first entry is now called Overview, like the tab.<\/p>\n\n<h4>1.91.0<\/h4>\n\n<p>XML-RPC has a switch again on the Edge shields pane, and this one the edge obeys. The block is on by default; \"Allow XML-RPC\" opens \/xmlrpc.php for sites that publish through the Jetpack app or the WordPress mobile app, or want pingbacks, and \"Block XML-RPC\" closes it again. With the change lock on, allowing waits for the emailed confirmation. The security check's \"Switch on at the edge\" button for XML-RPC is back.<\/p>\n\n<h4>1.90.2<\/h4>\n\n<p>XML-RPC on the Edge shields pane now reports what the edge does. The edge refuses \/xmlrpc.php on every enabled site with a 404, cached for five minutes, before any URL rule runs, so a site without the old 410 rule no longer reads \"not blocked\". The \"Block XML-RPC (410)\" switch is gone because it changed nothing; a 410 rule already in your list stays. The security check no longer offers \"Switch on at the edge\" for XML-RPC.<\/p>\n\n<h4>1.90.1<\/h4>\n\n<p>Accuracy pass over the listing and the plugin's own wording. The listing names all twelve shields, says how long Origin Shield serves on each plan (up to a day on Shield, 7 days on Shield Plus and Agency), uses the current tab names in the install steps, and its External services section now also covers the cache tags sent on purge and the finding titles sent after a security check. The plan card on free installs no longer says Shield Plus adds shields: every plan has every shield and lock. XML-RPC is described as what the edge really answers, a 404 cached for five minutes. WP-CLI help shows <code>wp nivoli-edge<\/code> examples.<\/p>\n\n<h4>1.90.0<\/h4>\n\n<p>New under Account, Your site: Footer credit, an optional small \"Protected by Nivoli Edge\" line at the bottom of your public pages. It is off unless you switch it on, the link is always nofollow, and it never shows in wp-admin, feeds or API responses. Themes can move or restyle it with two filters.<\/p>\n\n<h4>1.89.5<\/h4>\n\n<p>Code at login: room between its blocks, and the expected list shows every item, one line each under its source with a count, instead of merging them into one line per source.<\/p>\n\n<h4>1.89.4<\/h4>\n\n<p>Fixes Code at login drawing twice and the Edge shields pane appearing underneath it.<\/p>\n\n<h4>1.89.3<\/h4>\n\n<p>Code at login: more room between cards, the level shown as a coloured pill, and where the code lives set out one fact per line: from, file with its line range, the shared copy it links to, last changed.<\/p>","raw_excerpt":"Free security check, one-click hardening and a login-code audit for WordPress. Add the managed edge to refuse attacks before they reach PHP.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/340850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=340850"}],"author":[{"embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/calimonk"}],"wp:attachment":[{"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=340850"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=340850"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=340850"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=340850"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=340850"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/haz.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=340850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}