Description
This plugin connects your SpinupWP-managed sites to Cloudflare, automatically purging cache when you purge sites, posts, or URLs in SpinupWP. It supports both modern API tokens and legacy API keys for flexible authentication.
Features:
- Automatic cache purging on SpinupWP site purges
- Purge specific URLs from Cloudflare cache
- Manual purge button in WordPress admin bar
- Support for Cloudflare API tokens (recommended) and legacy API keys
- Credential verification is cached, so normal page loads never call the Cloudflare API
- “Test connection” button to re-check credentials on demand
- Site Health entry reporting the state of the integration
- Clean, intuitive settings interface
- Full nonce verification and capability checks
- PSR-12 compliant code with strict typing
A note on stored credentials:
This plugin stores Cloudflare credentials in the WordPress options table, so the security of those credentials follows the security of your WordPress installation. Use strong administrator passwords, keep WordPress and your plugins updated, and consider a Web Application Firewall.
All API requests use HTTPS and verify SSL certificates. All output is escaped, all nonces are verified, and both purging and settings access require the manage_options capability (filterable via spinupwp_cf_capability).
Installation
- Upload the plugin files to the
/wp-content/plugins/webreact-integration-for-spinupwp-cloudflaredirectory, or install via the WordPress plugins screen. - Activate the plugin.
- Go to Settings > SpinupWP Cloudflare and enter your Cloudflare credentials.
- Choose authentication method (API Token or API Key).
- Enable automatic purging if desired.
- Use the “Test connection” button to confirm Cloudflare accepts your credentials.
Authentication Type:
- API Token (Recommended): Modern, scoped authentication method. More secure with granular permissions. Only requires your API token and Zone ID.
- API Key (Legacy): Original authentication method. Requires email, Zone ID, and global API key.
Finding Your Cloudflare Zone ID:
- Log in to Cloudflare
- Select your domain
- In the right sidebar, copy the Zone ID
Creating an API Token:
- Go to Cloudflare Profile > API Tokens
- Create Token with “Cache Purge” permissions
- Copy the token and paste into plugin settings
Using an API Key (Legacy):
- Go to Cloudflare Profile > API Tokens
- Find Global API Key (or create one)
- Copy your email and API key to plugin settings
FAQ
-
Does this work with all Cloudflare plans?
-
Yes, as long as you have API access to your zone.
-
Does it require the SpinupWP plugin?
-
The SpinupWP plugin is required for automatic cache purging. Manual purging from the admin bar works without it — the purge item then appears as its own top-level toolbar entry instead of nested under the SpinupWP menu.
-
Which authentication method should I use?
-
API tokens are recommended for security and should be your default choice. They allow scoped permissions and are easier to rotate.
-
Can I use both API tokens and API keys?
-
No, you can only choose one authentication method at a time via the settings dropdown.
-
What happens if credentials are invalid?
-
The settings page and the Site Health screen both report the error message Cloudflare returned, and the “Purge Cloudflare Cache” button will not appear in the admin bar.
-
Does checking the connection slow down my site?
-
No. The result of a credential check is cached for 12 hours, and the admin bar only performs a local check for whether credentials are filled in. Use the “Test connection” button to force a fresh check.
-
Purging is a full page navigation, which would discard unsaved changes. Since WordPress 7.1 shows the toolbar persistently in the Post and Site Editors, the purge item is deliberately hidden there. Purge from any other admin screen or from the front end instead.
-
Does it cache the purge response?
-
No, each purge request is sent directly to Cloudflare.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Webreact integration for SpinupWP and Cloudflare” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Webreact integration for SpinupWP and Cloudflare” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- Tested up to WordPress 7.1
- Fixed: credential verification no longer runs a Cloudflare API request on every page load; results are cached and keyed to the stored credentials
- Fixed: purging and the admin bar item now require the
manage_optionscapability, filterable viaspinupwp_cf_capability - Fixed: the manual purge admin bar item is no longer silently dropped when the SpinupWP plugin is inactive
- Fixed: the security check failure message on the purge action rendered as a blank error page
- Fixed: uninstall now removes the
spinupwp_cf_api_key_legacyandspinupwp_cf_auth_typeoptions added in 1.1.0 - Fixed: purges that Cloudflare rejected with an HTTP 200 response are no longer reported as successful
- Added: success and failure notices after a manual purge, including the message Cloudflare returned
- Added: “Test connection” button on the settings page
- Added: Site Health entry reporting the state of the Cloudflare integration
- Added: Settings link on the Plugins screen row
- Added: legacy API key credentials are now verified against Cloudflare instead of only being checked for presence
- Changed: the purge item is hidden in the Post and Site Editors, where WordPress 7.1 now shows the toolbar persistently
- Changed: minimum requirements are now WordPress 5.2 and PHP 7.4, matching what the code already used
1.1.0
- Added support for Cloudflare API tokens (recommended authentication method)
- Added authentication type selector in settings (API Token vs API Key)
- Improved settings UI with conditional field display
- Enhanced security with proper sanitization for both auth types
- Default authentication is now API Token
- Improved inline documentation and PHPDoc blocks
1.0.0
- Initial release with API Key authentication