Nivoli Edge

Shields and locks for WordPress, enforced at the edge

SaaS

WordPress

Security

Visit WebsiteSee on Product HuntWordpress ⧉

Hi all, Ivo here! I have been a Product Hunt member for a long time, but I haven't had the pleasure of launching a product I built entirely from scratch, until today :-) For years I have run a handful of WordPress sites, together a little over a million pageviews a month. As every WordPress owner knows, sooner or later one of them gets hacked. The last time it was links to casino sites, silently injected through JavaScript, weeks before anyone noticed (myself included). That one made me want to fix this fundamentally rather than clean up in hindsight. They're a pain to purge entirely! I had already been running my own Cloudflare Worker for a few years: first to cache my sites' HTML at the edge so the server specs could shrink, later to serve right-sized images to my audiences as well. That led to the thought: if I am already looking at every request at the edge to decide between a cached page and the origin, I can do far more serious security filtering in that same place. It started with blocking a few attack patterns and dropping stray PHP requests. It grew into a full system: login floods, XML-RPC, scanner paths and dead URLs refused before a request ever reaches the server; a change lock and an install lock, so turning a shield off or installing new code needs a click on an emailed link that a hacked wp-admin does not have. Later I expanded with an origin lock, so code changes that skip the edge are refused by the server itself, plus an audit log of what was refused and who unlocked what. On one of my sites, the server never sees about a million requests a month because of edge filtering! The fast part, with caching HTML at the edge, comes along for free: whole pages and images cached at the edge, purged surgically on save, and every number the plugin shows measured at the edge, where the traffic actually is. I built all of this iteratively over years, based on real everyday usage. After running this on my own sites for several months, it is time to release it to other WordPress owners, especially those hosting several sites, so attacks are not merely blocked at the PHP level but well before any request hits a webserver. The plugin itself is free: with your own Cloudflare zone it gives you the page caching and image optimization along with some tweakable security settings. The deeper security layer runs at my edge, so it comes with the managed plans, where I handle everything. Every plan gets every shield and lock; the plans differ in sites and traffic, not in how safe your site is. I would love to hear which attack you see most on your sites, and what you would like refused at the edge next!