=== Smart Cache Purge & Warm for Cloudflare ===
Tags: cloudflare, cache, purge, performance, caching
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.4.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Targeted cache purging and controlled cache warming for WordPress sites
using Cloudflare.

== Description ==

Smart Cache Purge & Warm for Cloudflare purges affected public URLs when
WordPress content changes and can rewarm the site’s own URLs in the
background. The plugin is designed to avoid full-zone purges for
ordinary post, page, and product changes.

Features:

-   Selective URL purging for supported posts, pages, and WooCommerce
    products.
-   Related homepage, archive, taxonomy, feed, sitemap, and shop URLs
    can be included when affected content changes.
-   Full Cloudflare cache purge for theme switches, WordPress core
    updates, theme updates, and updates to this plugin itself.
-   Background cache warming without WP-Cron.
-   Same-site HTTPS URL validation to help prevent server-side request
    forgery (SSRF).
-   TLS certificate verification enabled for cache-warming HTTP
    requests.
-   Protected REST warming endpoint with a secret token, request lock,
    and URL limits.
-   Sitemap crawling with configurable depth and URL limits.
-   Cloudflare API token encrypted before database storage when
    configured through the plugin settings.
-   Warm/WAF secret encrypted before database storage when configured
    through the plugin settings.
-   Admin dashboard, settings, connection test, instructions, and secure
    in-dashboard debug log.
-   No telemetry, advertising, or analytics service operated by the
    plugin author.

== Requirements ==

-   WordPress 5.8 or later.
-   PHP 7.4 or later.
-   A Cloudflare zone for the WordPress site’s hostname.
-   A Cloudflare API token with permission to purge cache for the
    configured zone.
-   HTTPS enabled on the WordPress site.

== Installation ==

1.  Upload the plugin to /wp-content/plugins/.
2.  Activate it from Plugins → Installed Plugins.
3.  Go to Smart Cache Purge → Settings.
4.  Enter the Cloudflare Zone ID and API token, or define DT_CF_ZONE_ID
    and DT_CF_API_TOKEN in wp-config.php.
5.  Optionally configure the warm secret and Cloudflare WAF rule
    described in the Instructions tab.
6.  Test the Cloudflare connection from the Settings tab before relying
    on automatic purging.

== Configuration ==

The recommended production configuration is to define the Cloudflare
credentials in wp-config.php:

define( 'DT_CF_ZONE_ID', 'your-32-character-zone-id' );
define( 'DT_CF_API_TOKEN', 'your-api-token' );

Settings entered through the dashboard are stored in the WordPress
options table. The API token and warm secret are encrypted when stored
through the settings UI, provided the OpenSSL PHP extension is
available.

Values defined in wp-config.php take priority over values stored in the
plugin settings.

== Security ==

The cache warmer accepts only HTTPS URLs on the current WordPress site’s
hostname and uses WordPress URL safety validation. Redirects are not
followed by the warmer, helping prevent a same-site URL from being used
to reach a different host.

The REST warming endpoint requires its secret token and enforces a
single active warm operation at a time. Warm operations are also bounded
by configurable URL, sitemap depth, sitemap size, and concurrency
limits.

Cloudflare API credentials are used only for Cloudflare API operations
initiated by the plugin.

Debug logging is stored locally in WordPress options and limited to the
latest 200 entries. No public debug log file is created. Debug logging
is disabled by default.

The plugin does not include telemetry, advertising, or a remote
analytics service operated by the plugin author.

== External Services ==

This plugin requires and connects directly to the Cloudflare API to
manage the cache of the configured Cloudflare zone.

=== Cloudflare API ===

Service: Cloudflare API

What it is used for:

The Cloudflare API is used to test the configured Cloudflare connection
and to purge cached content for the configured Cloudflare zone.

What data is sent:

-   The Cloudflare Zone ID is included in the API request URL.
-   The Cloudflare API token is sent in the Authorization: Bearer HTTP
    header to authenticate the request.
-   For targeted purges, the public URLs selected by the plugin are sent
    as purge request data.
-   For a full purge, the plugin sends a request asking Cloudflare to
    purge the configured zone’s cache.
-   When the administrator uses the connection test, the plugin sends
    the configured Zone ID and API token to Cloudflare and receives the
    zone information returned by Cloudflare.

When data is sent:

-   A connection request is sent only when an administrator uses the
    Test Connection action.
-   A targeted purge request is sent when the plugin determines that
    configured WordPress content has changed and affected URLs should be
    purged.
-   A full purge request is sent for configured events such as a theme
    switch, WordPress core update, theme update, or update to this
    plugin, and when an administrator manually requests a full purge.

The plugin does not send this information to the plugin author or
operate a separate analytics or telemetry service.

Cloudflare service policies:

-   Terms of Service: https://www.cloudflare.com/policies/terms/
-   Privacy Policy: https://www.cloudflare.com/policies/privacy/

=== Cache warming and the WordPress site’s Cloudflare service ===

The cache warmer makes HTTPS requests from the WordPress server to
public URLs on the same WordPress site. These requests are used to
populate or refresh the site’s cache.

The plugin sends normal HTTP request information required to request
those URLs, including the requested URL and standard request headers. If
the optional warm secret is configured, it is sent in the x-wp-cf-warm
HTTP header so that the site administrator can create a Cloudflare WAF
rule for trusted warm requests.

If the WordPress site’s hostname is proxied through Cloudflare, these
cache-warming requests may be processed by Cloudflare as normal traffic
to that site. The plugin does not send site content, analytics data, 
or debug logs to the plugin author or to a service operated by the plugin author.

Cloudflare’s handling of traffic is governed by its applicable policies:

-   Terms of Service: https://www.cloudflare.com/policies/terms/
-   Privacy Policy: https://www.cloudflare.com/policies/privacy/

== Privacy ==

The plugin does not contain telemetry, advertising, or a separate
analytics service.

The plugin stores its configuration and local debug information in the
WordPress database. Cloudflare credentials configured through the plugin
settings are encrypted before storage when OpenSSL is available.

The plugin communicates with Cloudflare only to provide the
cache-management functionality configured by the site administrator.

The cache warmer requests URLs belonging to the current WordPress site.
Those requests may pass through Cloudflare when the site’s hostname is
proxied by Cloudflare.

Site administrators are responsible for reviewing Cloudflare’s policies
and ensuring that their use of Cloudflare is appropriate for their site
and applicable privacy requirements.

== Frequently Asked Questions ==

= Does the plugin purge the whole Cloudflare zone after every post
update? =

No. Normal supported post, page, and product changes purge affected
public URLs and related archive/taxonomy URLs instead of performing a
full-zone purge.

= When does the plugin perform a full purge? =

A full purge is triggered by a theme switch, a WordPress core update, a
theme update, or an update to this plugin. A full purge can also be
started manually by an administrator.

= Does warming use WP-Cron? =

No. Warming is triggered through a protected WordPress REST request and
runs in the background.

= Can the warmer request another domain? =

The cache warmer validates warm and sitemap URLs against the current
WordPress site’s HTTPS hostname. Redirects are not followed, and unsafe
URLs are rejected.

= Why is my warm request rejected? =

Check that the URL uses HTTPS, belongs to the current site, and is not
redirected to another host. Also check the Logs tab when debug logging
is enabled.

= Does the plugin track site visitors? =

No. The plugin does not include telemetry, advertising, visitor
analytics, or a tracking service operated by the plugin author.

= Does the plugin send my site’s data to the plugin author? =

No. The plugin does not operate a remote service for collecting site
data. Cloudflare API requests are sent directly from the WordPress site
to Cloudflare because Cloudflare is required for the plugin’s
cache-purge functionality.

== Screenshots ==

1.  Dashboard and cache status.
2.  Cloudflare credentials and tuning settings.
3.  Connection test.
4.  Instructions and WAF configuration.
5.  Secure debug log viewer.

== Changelog ==

= 1.4.1 =
* Expanded the External Services documentation to clearly disclose Cloudflare API usage, data sent, when requests are made, and Cloudflare policy links.
* Clarified cache-warming requests and their interaction with Cloudflare when the site's hostname is proxied.
* Clarified privacy and telemetry behavior.

= 1.4.0 =
* Hardened cache warming against SSRF and unsafe redirects.
* Enabled TLS certificate and hostname verification for cURL warming.
* Added REST input validation, URL limits and a warm-operation lock.
* Added server-side bounds for tuning settings.
* Encrypted the warm/WAF secret and upgraded API-token storage to authenticated encryption with legacy compatibility.
* Removed broad purge hooks for unrelated plugin activation/deactivation/deletion.
* Added activation/deactivation lifecycle handling.
* Replaced the public debug log file with a bounded in-dashboard log.
* Added security, privacy and external-service documentation.

= 1.3.0 =
* Converted to a proper installable plugin with admin UI (Dashboard, Settings, Instructions, Logs).
* Credentials and tuning options can be managed from the Settings page or wp-config.php.
* API token stored encrypted in the database.
* Debug log viewer and one-click clear/toggle.