Nivoli Edge: Login Security, WP Audit and Firewall

Security one layer above WordPress. Audit what your site exposes, lock down logins, and stop attacks at Cloudflare’s edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on.

Login Security

• Login rate limit: 10 attempts per 10 minutes per address, answered at the edge
• Login country lock: wp-login.php only for the countries you list
• wp-admin IP lock: only your addresses, with a self-lockout guard and email rescue
• XML-RPC block: no guessing hundreds of passwords in one request
• Hidden usernames: nothing to find at ?author=N or in the REST API
• Code at login: every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves

WordPress Security Audit

• Security check: 19 checks of what your site exposes, from inside WordPress and from its own front door
• Hidden from itself: unlisted must-use plugins, administrators the Users screen does not show, suspicious login code
• Hardening: 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable
• Plain answers: every finding says what it means and how to fix it

Edge Firewall

Thirteen shields at Cloudflare’s edge: your server never runs PHP to turn an attack away.

• Stray-PHP lock: every .php request except WordPress’s own entry points refused
• Surface lock: user lists, readme.html, the installer and debug.log closed to visitors
• Traversal guard: path tricks refused in any encoding
• PHP parser guard: malformed or oversized uploads and other requests built to exploit PHP’s own request handling are refused before PHP reads them, and virtual patches for newly disclosed PHP flaws reach every site within minutes. It reduces exposure to flaws like PHP2Shell (October 2026) but does not replace updating PHP, and it only sees traffic that comes through Cloudflare, so your server should accept connections from Cloudflare only.
• Scanner lockout: five refusals and the address is shut out for ten minutes
• Flood limits: comment and search floods stopped per address
• AI-crawler block and security headers on every response
• Monitor mode: see what a shield would block before it blocks anything
• Cloudflare’s managed WAF rulesets in front of every site on the edge

Protection that stays on after a takeover

A takeover of wp-admin owns every plugin’s settings. These are held at the edge.

• Change lock: weakening protection waits for a click on a link mailed to you
• Install lock: plugin and theme installs, updates and activations refused until you open a 15-minute window by email, whether they come from wp-admin or a remote-management key (UpdraftCentral, ManageWP, MainWP, Jetpack), and the wp-admin file editors closed. It cannot stop code already running on your server or files written to it directly
• Origin lock: code changes that skip the edge are refused, so knowing your server’s address does not help
• Activity log: every refused attempt on the Locks page, with what was tried and how it arrived

Speed and uptime

• Edge page cache: full pages from Cloudflare’s network, with surgical purge so only the pages a change touches refresh
• Origin Shield: your site keeps serving when your server is down
• Right-sized images: WebP and AVIF through your own Cloudflare zone or the Managed Images add-on
• Analytics without a tracking script: audience, attacks and top URLs from the edge

Free and with a plan

Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial.

Requirements

• WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.
• Image tools on your own zone: Cloudflare with Image Resizing (Images → Pipeline check verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.
• Managed: an API key, plus the DNS records the setup pane shows.

External services

The free tier’s core image rewriting sends no data to any external service; it only rewrites <img> URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.

Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. When you look at a shield’s findings, it sends the IP address of your own browser (the administrator viewing the page) in a request header, so the edge can mark requests that came from you; that address is not stored. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No data about your site’s visitors is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy

Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/

TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms