Smart Cache Purge & Warm for Cloudflare

Smart Cache Purge & Warm for Cloudflare purges affected public URLs when
WordPress content changes and can rewarm the site’s own URLs in the
background. The plugin is designed to avoid full-zone purges for
ordinary post, page, and product changes.

Features:

• Selective URL purging for supported posts, pages, and WooCommerce
  products.
• Related homepage, archive, taxonomy, feed, sitemap, and shop URLs
  can be included when affected content changes.
• Full Cloudflare cache purge for theme switches, WordPress core
  updates, theme updates, and updates to this plugin itself.
• Background cache warming without WP-Cron.
• Same-site HTTPS URL validation to help prevent server-side request
  forgery (SSRF).
• TLS certificate verification enabled for cache-warming HTTP
  requests.
• Protected REST warming endpoint with a secret token, request lock,
  and URL limits.
• Sitemap crawling with configurable depth and URL limits.
• Cloudflare API token encrypted before database storage when
  configured through the plugin settings.
• Warm/WAF secret encrypted before database storage when configured
  through the plugin settings.
• Admin dashboard, settings, connection test, instructions, and secure
  in-dashboard debug log.
• No telemetry, advertising, or analytics service operated by the
  plugin author.

Requirements

• WordPress 5.8 or later.
• PHP 7.4 or later.
• A Cloudflare zone for the WordPress site’s hostname.
• A Cloudflare API token with permission to purge cache for the
  configured zone.
• HTTPS enabled on the WordPress site.

Configuration

The recommended production configuration is to define the Cloudflare
credentials in wp-config.php:

define( ‘DT_CF_ZONE_ID’, ‘your-32-character-zone-id’ );
define( ‘DT_CF_API_TOKEN’, ‘your-api-token’ );

Settings entered through the dashboard are stored in the WordPress
options table. The API token and warm secret are encrypted when stored
through the settings UI, provided the OpenSSL PHP extension is
available.

Values defined in wp-config.php take priority over values stored in the
plugin settings.

Security

The cache warmer accepts only HTTPS URLs on the current WordPress site’s
hostname and uses WordPress URL safety validation. Redirects are not
followed by the warmer, helping prevent a same-site URL from being used
to reach a different host.

The REST warming endpoint requires its secret token and enforces a
single active warm operation at a time. Warm operations are also bounded
by configurable URL, sitemap depth, sitemap size, and concurrency
limits.

Cloudflare API credentials are used only for Cloudflare API operations
initiated by the plugin.

Debug logging is stored locally in WordPress options and limited to the
latest 200 entries. No public debug log file is created. Debug logging
is disabled by default.

The plugin does not include telemetry, advertising, or a remote
analytics service operated by the plugin author.

External Services

This plugin requires and connects directly to the Cloudflare API to
manage the cache of the configured Cloudflare zone.

Cloudflare API

Service: Cloudflare API

What it is used for:

The Cloudflare API is used to test the configured Cloudflare connection
and to purge cached content for the configured Cloudflare zone.

What data is sent:

• The Cloudflare Zone ID is included in the API request URL.
• The Cloudflare API token is sent in the Authorization: Bearer HTTP
  header to authenticate the request.
• For targeted purges, the public URLs selected by the plugin are sent
  as purge request data.
• For a full purge, the plugin sends a request asking Cloudflare to
  purge the configured zone’s cache.
• When the administrator uses the connection test, the plugin sends
  the configured Zone ID and API token to Cloudflare and receives the
  zone information returned by Cloudflare.

When data is sent:

• A connection request is sent only when an administrator uses the
  Test Connection action.
• A targeted purge request is sent when the plugin determines that
  configured WordPress content has changed and affected URLs should be
  purged.
• A full purge request is sent for configured events such as a theme
  switch, WordPress core update, theme update, or update to this
  plugin, and when an administrator manually requests a full purge.

The plugin does not send this information to the plugin author or
operate a separate analytics or telemetry service.

Cloudflare service policies:

• Terms of Service: https://www.cloudflare.com/policies/terms/
• Privacy Policy: https://www.cloudflare.com/policies/privacy/

Cache warming and the WordPress site’s Cloudflare service

The cache warmer makes HTTPS requests from the WordPress server to
public URLs on the same WordPress site. These requests are used to
populate or refresh the site’s cache.

The plugin sends normal HTTP request information required to request
those URLs, including the requested URL and standard request headers. If
the optional warm secret is configured, it is sent in the x-wp-cf-warm
HTTP header so that the site administrator can create a Cloudflare WAF
rule for trusted warm requests.

If the WordPress site’s hostname is proxied through Cloudflare, these
cache-warming requests may be processed by Cloudflare as normal traffic
to that site. The plugin does not send site content, analytics data,
or debug logs to the plugin author or to a service operated by the plugin author.

Cloudflare’s handling of traffic is governed by its applicable policies:

• Terms of Service: https://www.cloudflare.com/policies/terms/
• Privacy Policy: https://www.cloudflare.com/policies/privacy/

Privacy

The plugin does not contain telemetry, advertising, or a separate
analytics service.

The plugin stores its configuration and local debug information in the
WordPress database. Cloudflare credentials configured through the plugin
settings are encrypted before storage when OpenSSL is available.

The plugin communicates with Cloudflare only to provide the
cache-management functionality configured by the site administrator.

The cache warmer requests URLs belonging to the current WordPress site.
Those requests may pass through Cloudflare when the site’s hostname is
proxied by Cloudflare.

Site administrators are responsible for reviewing Cloudflare’s policies
and ensuring that their use of Cloudflare is appropriate for their site
and applicable privacy requirements.