Nivoli Edge

Nivoli Edge is a WordPress plugin that puts Cloudflare's network in front of your site: whole HTML pages and right-sized images answered from the node nearest each visitor, attacks and junk stopped before PHP runs, and the numbers to prove it inside wp-admin. It is free and open source under GPL-2.0-or-later.

The starting point is the vendor's own argument: Cloudflare in front of WordPress is the right start, but it is not the whole job. Cloudflare's own WordPress plugin and APO cache pages and purge on save as a black box, with no view of what the cache did, no image pipeline, no WordPress-shaped protection, and no analytics in your admin. Nivoli Edge is the WordPress-aware layer on top of that edge.

The plugin still leaves the render path alone: no minification, no critical CSS, no script deferral, no lazy loading. WP Rocket, FlyingPress and Perfmatters own that work, and Nivoli ships none of it on purpose. Its focus is time to first byte, uptime, security before PHP, and edge-measured analytics.

On the technical side, the plugin hooks WordPress's native image pipeline (wp_get_attachment_image_attributes and wp_calculate_image_srcset) and rewrites image URLs through Cloudflare Image Resizing. Variants are generated once and cached at the edge: right-sized per device, WebP or AVIF depending on the browser. Page caching works through Surrogate-Key response headers (post-N, category-N, author-N, home). When content changes, the plugin dispatches a purge listing only the affected tags, so the rest of the cache stays warm, and stale-while-revalidate serves the old copy while the edge fetches the new one. Stylesheets, scripts and fonts are also answered from the edge, with asset URL versioning that changes their addresses on purge so browsers pick up updated files immediately. The page cache backend can be Fastly, Cloudflare Enterprise, a custom webhook, or the managed Nivoli edge.

Nivoli enforces a set of security rules at the edge, before PHP runs. The managed edge ships seven shields: stray .php requests get a 404, wp-admin can be locked to specific IPs, login attempts are rate limited (10 per 10 minutes per IP), known AI crawlers get a 403, wp-login.php can be restricted to specific countries, xmlrpc.php gets a 410, and a security headers pack can be enabled. Four shields come with every plan; AI-crawler blocking, the wp-admin IP lock and login rate limiting require Growth or higher. The relationship to plugin firewalls is the same as with any edge WAF: Wordfence inspects requests inside PHP, Nivoli stops junk before WordPress loads. They run side by side without conflict.

Nivoli also finds the images that cost you. A 404 inbox lists image requests that failed at the edge in the last 7 days, with one-click placeholders for gone files; where-used lookups show every page referencing a broken image, with edit links; a heaviest-images list shows the originals costing the most bandwidth and can shrink them with Tinify in place, keeping a backup; a scan catches images that never load because of an empty src or a deleted featured image; and fake-image repair finds files named .jpg that actually hold HTML, a classic migration leftover. The scan, repair and coverage audit are part of the free plugin; the traffic-based tools (404 inbox, where-used, heaviest images) are managed-edge features.

The main caveat is logged-in traffic. Pages built for one visitor must never be served to another, so a logged-in visitor's page views are never cached. On membership sites, LMS platforms and forums where the audience is signed in, member pages get no edge caching and no outage coverage; security, image delivery and analytics still apply, and public pages are cached normally. On most sites guests are the majority of traffic, so the limitation rarely shows. Nivoli Edge is free as a plugin; the managed edge runs from €15/month for one site, with yearly billing at 12 months for the price of 11 and a 14-day trial with 2,500 transforms. If you want an edge layer that runs alongside your optimizer and security plugins, it is worth a look. For a broader view of the WordPress WAF landscape, see our best WAF for WordPress guide.