Security one layer above WordPress. Audit what your site exposes, lock down logins, and stop attacks at Cloudflare’s edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on.
Login Security
- Login rate limit: 10 attempts per 10 minutes per address, answered at the edge
- Login country lock: wp-login.php only for the countries you list
- wp-admin IP lock: only your addresses, with a self-lockout guard and email rescue
- XML-RPC block: no guessing hundreds of passwords in one request
- Hidden usernames: nothing to find at ?author=N or in the REST API
- Code at login: every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves
WordPress Security Audit
- Security check: 19 checks of what your site exposes, from inside WordPress and from its own front door
- Hidden from itself: unlisted must-use plugins, administrators the Users screen does not show, suspicious login code
- Hardening: 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable
- Plain answers: every finding says what it means and how to fix it
Edge Firewall
Thirteen shields at Cloudflare’s edge: your server never runs PHP to turn an attack away.
- Stray-PHP lock: every .php request except WordPress’s own entry points refused
- Surface lock: user lists, readme.html, the installer and debug.log closed to visitors
- Traversal guard: path tricks refused in any encoding
- PHP parser guard: malformed or oversized uploads and other requests built to exploit PHP’s own request handling are refused before PHP reads them, and virtual patches for newly disclosed PHP flaws reach every site within minutes. It reduces exposure to flaws like PHP2Shell (October 2026) but does not replace updating PHP, and it only sees traffic that comes through Cloudflare, so your server should accept connections from Cloudflare only.
- Scanner lockout: five refusals and the address is shut out for ten minutes
- Flood limits: comment and search floods stopped per address
- AI-crawler block and security headers on every response
- Monitor mode: see what a shield would block before it blocks anything
- Cloudflare’s managed WAF rulesets in front of every site on the edge
Protection that stays on after a takeover
A takeover of wp-admin owns every plugin’s settings. These are held at the edge.
- Change lock: weakening protection waits for a click on a link mailed to you
- Install lock: plugin and theme installs, updates and activations refused until you open a 15-minute window by email, whether they come from wp-admin or a remote-management key (UpdraftCentral, ManageWP, MainWP, Jetpack), and the wp-admin file editors closed. It cannot stop code already running on your server or files written to it directly
- Origin lock: code changes that skip the edge are refused, so knowing your server’s address does not help
- Activity log: every refused attempt on the Locks page, with what was tried and how it arrived
Speed and uptime
- Edge page cache: full pages from Cloudflare’s network, with surgical purge so only the pages a change touches refresh
- Origin Shield: your site keeps serving when your server is down
- Right-sized images: WebP and AVIF through your own Cloudflare zone or the Managed Images add-on
- Analytics without a tracking script: audience, attacks and top URLs from the edge
Free and with a plan
Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial.
Requirements
- WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.
- Image tools on your own zone: Cloudflare with Image Resizing (Images Pipeline check verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.
- Managed: an API key, plus the DNS records the setup pane shows.
External services
The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.
Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. When you look at a shield’s findings, it sends the IP address of your own browser (the administrator viewing the page) in a request header, so the edge can mark requests that came from you; that address is not stored. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No data about your site’s visitors is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/
Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms
Screenshots
Overview: what the edge did for you in the last 30 days. Delivered, Protected and your plan at work, with 30-day trends, under the five tabs Overview, Security, Pages, Images and Account.
Edge shields: the attack surface strip (XML-RPC, logins, AI crawlers, comment and search floods) and every shield with its switch, enforced before your server. Every shield on every managed plan.
Locks: change lock, install lock and origin lock, what they refused in the last 14 days with the exact plugin named, and the lock activity log with a filter for state changes only.
Security check: what this WordPress exposes, measured from inside it and from one visit to its own front door, with what this plugin can switch off and what the managed edge already refuses.
Probe shields: stray PHP, enumeration, traversal probes, the PHP parser guard and the scanner lockout, with off, monitor and block for each, the refusal counts, and what each one caught.
Stats and overview: hour-by-hour traffic, origin offload, hit rates by window, surgical purges.
Heaviest images: the files costing the most bandwidth, one-click Tinify shrinking, and what the shrinking has saved so far.
Redirects: legacy URLs answered at the edge, patterns and exact rules with usage, unused rules folded away.
Recent 404s: paths your server keeps answering with a 404, with bot share and one-click redirect or block.
Your audience: humans versus bots, served-from-cache speed, referrers, devices and countries, no tracking script.
Static assets: edge hit rate for stylesheets, scripts and fonts, versioned addresses, bandwidth offloaded.
Query params: which parameters split the cache, which are guarded, with one-click collapse.
Hardening: eight things WordPress exposes by default, one click each, with the ones the edge already refuses grouped and saying so.
Broken images: failed image requests from the last 7 days, files gone from disk with a placeholder ready, and the momentary failures that handled themselves.