ByteCoreStack – Cache Invalidation for Amazon CloudFront

ByteCoreStack – Cache Invalidation for Amazon CloudFront is a dedicated CloudFront cache invalidation plugin for WordPress, built around one job and doing it well: keeping your Amazon CloudFront CDN cache in sync with your content. If your site runs behind a CloudFront distribution, this plugin gives you complete control over cache invalidation — a one-click manual purge, automatic CloudFront cache clearing the moment content changes, or a recurring scheduled cache clear — all from your WordPress admin, with no AWS Console visits required.

This plugin speaks the CloudFront REST API directly using AWS Signature Version 4 request signing, and is purpose-built around how CloudFront invalidations actually work: targeted path invalidation instead of blanket wipes, batching to protect your invalidation quota, and a live invalidation history pulled straight from the CloudFront API.

Features

• Built specifically for Amazon CloudFront — it signs and sends real CloudFront CreateInvalidation, GetDistribution, ListInvalidations, and GetInvalidation API requests directly.
• Smart, targeted CloudFront cache invalidation — auto-clear invalidates the specific permalink, term archives, post-type archive, and homepage affected by a change, instead of always purging the entire distribution.
• No stale content after publishing — automatic cache invalidation on publish, update, unpublish, trash, term edits, menu changes, widget changes, and attachment deletion means visitors don’t keep seeing outdated cached pages.
• Set-and-forget scheduled cache clearing — interval, weekly, or monthly CloudFront cache clears with a live countdown, so you always know when the next invalidation runs.
• Invalidation batching — rapid successive content changes are merged into a single deferred invalidation instead of firing one CloudFront API call per save, protecting your monthly invalidation quota.
• Live Invalidation History — a dedicated tab lists your recent CloudFront invalidations straight from the AWS API, with per-invalidation path details, pagination, and a “show per page” control. Nothing is cached or stored locally.
• Credentials never touch the database — your AWS access key and secret live in wp-config.php only, never stored in wp_options, never exposed in the admin UI, REST API, or AJAX responses.
• IAM instance-role support — running on an EC2 instance with an IAM role attached? Skip static AWS keys entirely; the plugin automatically fetches temporary credentials from the EC2 instance metadata service.
• One-click connection and permission diagnostics — “Test Connection” verifies your credentials and distribution ID instantly, and “Check Permissions” tests each required IAM action individually so a misconfigured policy is diagnosable at a glance instead of guessing which permission is missing.
• WP-CLI support — script CloudFront cache purges from the command line for CI/CD deploy pipelines: wp bcs-cfm flush all or wp bcs-cfm flush <path>.

Key Features

Manual CloudFront Cache Clearing
* Purge your entire CloudFront distribution in one click
* Purge a single specific URL or path without touching the rest of the cache
* Per-user rate limiting prevents accidental repeated clicks from burning through your AWS invalidation quota
* Instant success/failure feedback with clear, actionable AWS error messages

Automatic CloudFront Cache Invalidation
* Fires on publish, update, unpublish/trash, and permanent post deletion
* Targets the exact permalink, taxonomy term archives, post-type archive, and homepage affected — not a blanket /* wipe
* Falls back to a full distribution invalidation only when a single change touches more than 10 paths
* Also triggers on attachment/media deletion, taxonomy term edits, nav menu changes, and active widget changes
* Choose exactly which post types (posts, pages, custom post types, WooCommerce products, etc.) trigger auto-clear
* Rapid successive changes are automatically batched into a single deferred invalidation via WP-Cron

Scheduled CloudFront Cache Clearing
* Interval-based (every 5 minutes up to every 24 hours), weekly, or monthly scheduling
* Choose the exact time, day of week, or day(s) of month
* Live countdown timer to the next scheduled cache clear
* Fully timezone-aware, using your WordPress site’s configured timezone

Invalidation History
* Lists your most recent CloudFront invalidations, fetched live from the AWS API — nothing is stored in your database
* Expand any invalidation inline to see its full path list and status
* Built-in pagination with a configurable “show per page” control

AWS Connection & Permission Tools
* “Test Connection” — verifies your access key, secret key, and distribution ID against the live CloudFront API
* “Check Permissions” — tests GetDistribution, ListInvalidations, and GetInvalidation individually and reports exactly which IAM action is missing
* Actionable, specific error messages for common misconfigurations (wrong distribution ID, bad signature/credentials, insufficient IAM permissions)

Flexible, Secure Configuration
* Credentials read exclusively from wp-config.php constants — never written to the database
* Optional IAM instance-role credential fallback for EC2-hosted sites, no static keys required
* A WordPress Dashboard widget summarizing AWS status, Auto-Clear/Schedule state, next scheduled run, and last cleared time
* WP-CLI command for scripted/CI-driven cache purges

Perfect For

• WordPress sites, blogs, and publishers hosted behind an Amazon CloudFront CDN distribution
• Agencies and freelance developers managing CloudFront cache invalidation across multiple client sites
• News and publishing sites that need fresh content delivered fast after every update
• WooCommerce stores and membership sites with frequently changing content, stock, or pricing
• Developers who want automated, hands-off CloudFront cache invalidation instead of manual AWS Console purges
• Teams who want CI/CD pipelines to trigger a CloudFront cache purge on deploy via WP-CLI

Requirements

• An AWS account with an active Amazon CloudFront distribution
• AWS Access Key ID and Secret Access Key with CloudFront permissions (or an EC2 instance with an IAM role attached)
• WordPress 5.3 or higher
• PHP 7.4 or higher

Documentation

Full setup instructions and documentation available at https://bytecorestack.com/plugins/cloudfront-manager

External Services

This plugin connects to the AWS CloudFront API to perform CDN cache management operations, and — only as a fallback described below — to the EC2 instance metadata service.

AWS CloudFront API

This plugin sends requests to the AWS CloudFront REST API endpoint:

https://cloudfront.amazonaws.com/2020-05-31/distribution/{distributionId}/...

covering invalidation creation, invalidation listing/detail lookups, and distribution status checks.

What data is sent:

• Your CloudFront distribution id (stored locally in wp-config.php)
• A request signed with your AWS credentials using AWS Signature Version 4 — no personal data, user data, or site content is transmitted beyond the distribution id and the invalidation paths

When data is sent:

• When you manually click “Purge Entire Distribution” or “Purge a Specific URL”
• When a post/page is published, updated, unpublished, or deleted; when a term is edited; or when a nav menu or the active widgets change (if Auto-Clear is enabled)
• On a recurring schedule (if Scheduled Auto-Clear is enabled)
• When you click “Test Connection” or “Check Permissions”, or open the Invalidation History tab

AWS EC2 Instance Metadata Service (conditional fallback)

Only if AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY are not defined in wp-config.php, the plugin makes a local network request to http://169.254.169.254 (the standard EC2 instance metadata endpoint, only reachable from within an EC2 instance) to retrieve temporary credentials from an attached IAM role. No data leaves your own EC2 instance for this request. If static credentials are configured, this request is never made.

AWS Terms of Service: https://aws.amazon.com/service-terms/
AWS Privacy Policy: https://aws.amazon.com/privacy/

Support

For support, feature requests, or bug reports, please visit:
* Plugin page: https://bytecorestack.com/plugins/cloudfront-manager
* Author website: https://bytecorestack.com/

Privacy Policy

This plugin does not collect, store, or transmit any user data. All AWS credentials are stored locally in your wp-config.php file and are only used to communicate with the AWS CloudFront API for cache management operations. See the External Services section above for full details on what is sent to AWS.

Credits

Developed by ByteCore Stack.

This plugin bundles the DM Sans and DM Mono fonts, designed by Colophon Foundry / Indian Type Foundry and distributed by Google Fonts (https://fonts.google.com/specimen/DM+Sans and https://fonts.google.com/specimen/DM+Mono), licensed under the SIL Open Font License, Version 1.1 (GPL-compatible).

License

This plugin is licensed under the GPLv2 or later.