{"id":331374,"date":"2026-07-01T10:54:41","date_gmt":"2026-07-01T10:54:41","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/cache-connector-for-bunny-net\/"},"modified":"2026-10-26T03:18:55","modified_gmt":"2026-10-26T03:18:55","slug":"nahnu-cache-connector-bunny-net","status":"publish","type":"plugin","link":"https:\/\/nl.wordpress.org\/plugins\/nahnu-cache-connector-bunny-net\/","author":14745143,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.12","stable_tag":"1.0.12","tested":"7.1.3","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"Nahnu Cache Connector for Bunny.net","header_author":"ja1me4","header_description":"Connects WordPress cache plugins to Bunny.net CDN. Automatic purging, 75 edge rules, cache warming, Perma-Cache cleanup, and live CDN stats, all in one place.","assets_banners_color":"fafafb","last_updated":"2026-10-26 03:18:55","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/www.wpbunnyconnector.com\/","header_author_uri":"https:\/\/www.nahnuplugins.com\/","rating":0,"author_block_rating":0,"active_installs":20,"downloads":1284,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"ja1me4","date":"2026-09-08 18:05:33","revision":3687106},"1.0.0.0":{"tag":"1.0.0.0","author":"ja1me4","date":"2026-07-01 10:58:48","revision":3592563},"1.0.0.1":{"tag":"1.0.0.1","author":"ja1me4","date":"2026-07-10 04:14:09","revision":3602163},"1.0.0.2":{"tag":"1.0.0.2","author":"ja1me4","date":"2026-07-18 09:17:50","revision":3612440},"1.0.0.3":{"tag":"1.0.0.3","author":"ja1me4","date":"2026-08-15 04:50:29","revision":3648180},"1.0.0.4":{"tag":"1.0.0.4","author":"ja1me4","date":"2026-08-18 09:12:16","revision":3652347},"1.0.0.5":{"tag":"1.0.0.5","author":"ja1me4","date":"2026-08-24 08:47:17","revision":3662946},"1.0.1":{"tag":"1.0.1","author":"ja1me4","date":"2026-09-08 17:59:00","revision":3687103},"1.0.10":{"tag":"1.0.10","author":"ja1me4","date":"2026-10-25 15:52:52","revision":3764866},"1.0.11":{"tag":"1.0.11","author":"ja1me4","date":"2026-10-26 00:01:42","revision":3765372},"1.0.12":{"tag":"1.0.12","author":"ja1me4","date":"2026-10-26 03:18:55","revision":3765468},"1.0.2":{"tag":"1.0.2","author":"ja1me4","date":"2026-09-08 18:13:49","revision":3687126},"1.0.3":{"tag":"1.0.3","author":"ja1me4","date":"2026-09-09 05:00:27","revision":3687585},"1.0.4":{"tag":"1.0.4","author":"ja1me4","date":"2026-10-03 10:44:19","revision":3726119},"1.0.5":{"tag":"1.0.5","author":"ja1me4","date":"2026-10-17 00:16:44","revision":3751273},"1.0.6":{"tag":"1.0.6","author":"ja1me4","date":"2026-10-17 00:29:40","revision":3751284},"1.0.7":{"tag":"1.0.7","author":"ja1me4","date":"2026-10-17 00:46:17","revision":3751291},"1.0.8":{"tag":"1.0.8","author":"ja1me4","date":"2026-10-17 13:36:15","revision":3751963},"1.0.9":{"tag":"1.0.9","author":"ja1me4","date":"2026-10-17 13:36:15","revision":3751963}},"upgrade_notice":{"1.0.12":"<p>Adds ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful and UpdraftCentral support, ends CPU spikes during bulk updates, and fixes a crash on PHP 8.0 and 8.1. Edge rules update automatically after updating.<\/p>","1.0.11":"<p>Security headers: adds Strict-Transport-Security and a Content-Security-Policy at the edge, the full set securityheaders.com grades on. Edge rules redeploy automatically after updating.<\/p>","1.0.10":"<p>MainWP: faster, more reliable syncs. Also fixes CPU spikes and a stuck &quot;edge rules update pending&quot; notice after a failed automatic deploy. Edge rules redeploy automatically after updating. Sync your MainWP sites once afterwards.<\/p>","1.0.9":"<p>Fixes a fatal error on the settings page that stopped data from loading and the tabs from working after an automatic edge rule deploy.<\/p>","1.0.8":"<p>Adds edge protection for the plugin&#039;s own admin files, tab links that work without JavaScript, and a diagnostic banner on the settings page. Edge rules redeploy automatically after updating.<\/p>","1.0.7":"<p>Support for WordPress 7.1 client-side media processing: image uploads in the block editor no longer fail with Bunny Shield or Optimizer active. Edge rules redeploy automatically after updating.<\/p>","1.0.6":"<p>Fixes &quot;Could not load code editor&quot; in the Bricks code element when Bunny Shield is active. Edge rules redeploy automatically after updating.<\/p>","1.0.5":"<p>Security fix for the Shield WAF bypass cookie. Edge rules redeploy automatically and admins get the new cookie on their next admin page load. The bypass now defaults to Administrator and Editor instead of all roles.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3592555,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3592555,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3592555,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3592555,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.0.0","1.0.0.1","1.0.0.2","1.0.0.3","1.0.0.4","1.0.0.5","1.0.1","1.0.10","1.0.11","1.0.12","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3592555,"resolution":"1","location":"assets","locale":"","width":3365,"height":1893},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3592555,"resolution":"2","location":"assets","locale":"","width":3365,"height":1893},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3592555,"resolution":"3","location":"assets","locale":"","width":3365,"height":1893},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3592555,"resolution":"4","location":"assets","locale":"","width":3365,"height":1893},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3592555,"resolution":"5","location":"assets","locale":"","width":3365,"height":1893},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3592555,"resolution":"6","location":"assets","locale":"","width":3365,"height":1893},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3592555,"resolution":"7","location":"assets","locale":"","width":3365,"height":1893},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3592555,"resolution":"8","location":"assets","locale":"","width":3365,"height":1893}},"screenshots":{"1":"Edge Rules tab: rules with on and off switches, deploy button and results table","2":"Settings tab: cache warmer and Perma-Cache cleanup configuration","3":"Settings tab: Cache-Control mode and WAF bypass roles","4":"Settings tab: purge triggers and post types to watch","5":"Settings tab: Bunny API connection and wp-config.php constants","6":"Stats tab: live CDN analytics, DNS stats and cache sync status","7":"Manual Purge tab: full purge and per-URL purge with wildcard support","8":"Stats tab: cache hit rate, bandwidth, requests and cache sync status detail"}},"plugin_section":[],"plugin_tags":[212801,146,3863,7914,18199],"plugin_category":[52,54,59],"plugin_contributors":[267678],"plugin_business_model":[],"class_list":["post-331374","plugin","type-plugin","status-publish","hentry","plugin_tags-bunny-cdn","plugin_tags-cache","plugin_tags-cdn","plugin_tags-purge","plugin_tags-waf","plugin_category-performance","plugin_category-security-and-spam-protection","plugin_category-utilities-and-tools","plugin_contributors-ja1me4","plugin_committers-ja1me4"],"banners":{"banner":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/banner-772x250.png?rev=3592555","banner_2x":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/banner-1544x500.png?rev=3592555","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/icon-128x128.png?rev=3592555","icon_2x":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/icon-256x256.png?rev=3592555","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-1.png?rev=3592555","caption":"Edge Rules tab: rules with on and off switches, deploy button and results table"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-2.png?rev=3592555","caption":"Settings tab: cache warmer and Perma-Cache cleanup configuration"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-3.png?rev=3592555","caption":"Settings tab: Cache-Control mode and WAF bypass roles"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-4.png?rev=3592555","caption":"Settings tab: purge triggers and post types to watch"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-5.png?rev=3592555","caption":"Settings tab: Bunny API connection and wp-config.php constants"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-6.png?rev=3592555","caption":"Stats tab: live CDN analytics, DNS stats and cache sync status"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-7.png?rev=3592555","caption":"Manual Purge tab: full purge and per-URL purge with wildcard support"},{"src":"https:\/\/ps.w.org\/nahnu-cache-connector-bunny-net\/assets\/screenshot-8.png?rev=3592555","caption":"Stats tab: cache hit rate, bandwidth, requests and cache sync status detail"}],"raw_content":"<!--section=description-->\n<p>Nahnu Cache Connector for Bunny.net connects your WordPress site to Bunny.net CDN. It mirrors every cache purge to Bunny, deploys a complete set of production-ready edge rules for you and keeps them current, makes Bunny Shield WAF safe to run on WordPress, and shows live CDN stats in your admin.<\/p>\n\n<p>Full documentation: <a href=\"https:\/\/www.wpbunnyconnector.com\/\">wpbunnyconnector.com<\/a>.<\/p>\n\n<h4>Highlights<\/h4>\n\n<ul>\n<li>Purge sync for 18 cache plugins, combined into a single Bunny API call per request<\/li>\n<li>More than 75 edge rules covering SSL, caching, bypasses, Shield WAF and security headers<\/li>\n<li>Edge rules redeploy automatically whenever the plugin is updated, reinstalled or activated<\/li>\n<li>Fast deploys: only changed rules are sent, so a redeploy with nothing new is a single API call<\/li>\n<li>Bunny Shield WAF bypass for your team, protected by a per-site secret cookie<\/li>\n<li>All six security headers graded by securityheaders.com, set at the edge<\/li>\n<li>Built-in support for MainWP, ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful and UpdraftCentral<\/li>\n<li>Bulk updates are spread out, so a server hosting many sites never redeploys them all at once<\/li>\n<li>Works with Nahnu Login Shield to block brute-force attackers at the CDN edge<\/li>\n<li>Ready for WordPress 7.1 client-side media processing<\/li>\n<li>WP-CLI commands, REST API and PHP hooks for automation<\/li>\n<\/ul>\n\n<h4>Automatic cache purge sync<\/h4>\n\n<p>Hooks into your cache plugin so every purge is mirrored to Bunny CDN. Per-URL purges are used where the cache plugin supports them, instead of wiping the whole zone. Purges triggered during one request (post saves, plugin, theme and core updates, cache plugin clears) are combined into one Bunny API call at the end of the request, after your local cache has finished clearing.<\/p>\n\n<p><strong>Supported cache plugins (18):<\/strong><\/p>\n\n<ul>\n<li>WP Rocket<\/li>\n<li>LiteSpeed Cache<\/li>\n<li>W3 Total Cache<\/li>\n<li>WP Fastest Cache<\/li>\n<li>WP Super Cache<\/li>\n<li>FlyingPress<\/li>\n<li>Swift Performance<\/li>\n<li>Hummingbird<\/li>\n<li>Cache Enabler<\/li>\n<li>Breeze (Cloudways)<\/li>\n<li>WP-Optimize<\/li>\n<li>SpeedyCache<\/li>\n<li>Super Page Cache (WP Cloudflare Page Cache)<\/li>\n<li>ZiziCache<\/li>\n<li>RunCache (Beta)<\/li>\n<li>SWIS Performance by EWWW Image Optimizer<\/li>\n<li>BerqWP<\/li>\n<li>xSpeed Cache<\/li>\n<\/ul>\n\n<h4>Edge rules that look after themselves<\/h4>\n\n<p>One click deploys a complete set of rules to your Bunny pull zone: HTTPS redirect, HTML caching for visitors, admin and logged-in bypasses, ecommerce, membership, LMS and booking bypasses, long browser caching for assets, query string handling, CORS for fonts, Shield WAF exceptions and security headers. Rules are tracked by GUID, so redeploying never creates duplicates, and rules you created yourself in the Bunny dashboard are left alone.<\/p>\n\n<p>You do not have to remember to redeploy:<\/p>\n\n<ul>\n<li>Rules redeploy in the background as soon as the plugin is updated, reinstalled from a zip or activated, using the new version's code.<\/li>\n<li>Rules redeploy when a supported ecommerce, membership, LMS or booking plugin is activated or deactivated.<\/li>\n<li>A check every five minutes catches anything missed.<\/li>\n<li>A manual deploy always takes priority over a pending automatic one.<\/li>\n<li>Only what changed is sent to Bunny. A redeploy with nothing new costs one API call, and rules stay in place the whole time.<\/li>\n<li>Bulk updates are spread out. After an update pushed from a dashboard, by WordPress auto-updates or WP-CLI, each site waits its own fixed slot of up to 5 minutes, and at most two sites on one server deploy at the same time.<\/li>\n<li>If Bunny rejects a rule, automatic retries back off (5 minutes, 15 minutes, 1 hour, 6 hours, then daily) and the admin notice tells you which rule failed and why.<\/li>\n<\/ul>\n\n<h4>Bunny Shield WAF, without locking yourself out<\/h4>\n\n<p>Bunny Shield is a powerful WAF, but WordPress admin screens, the block editor and page builders send requests that WAF rules often flag. This plugin turns Shield off for those areas for your team only, and keeps inspecting everyone else.<\/p>\n\n<ul>\n<li>The bypass uses a cookie holding a per-site secret, so it cannot be forged. Rotate the secret from Settings at any time.<\/li>\n<li>Choose which roles get the bypass. The default is Administrator and Editor.<\/li>\n<li>Covers wp-admin, the REST API for logged-in users, the Bricks builder and code editor, WordPress 7.1 media processing and this plugin's own admin files.<\/li>\n<li>Trusted IP whitelist: turn Shield off for specific IPs or CIDR ranges, such as payment gateways, SaaS callbacks, office networks or staging servers.<\/li>\n<li>Shield WAF event log on the Stats tab: blocked IPs, triggered rules and URLs for the last 1, 6, 24 or 72 hours.<\/li>\n<\/ul>\n\n<h4>Security headers<\/h4>\n\n<p>Sets the six response headers that securityheaders.com grades on, at the Bunny edge, so they apply to cached pages too: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.<\/p>\n\n<p>The defaults are safe for any WordPress site. HSTS is set for one year without includeSubDomains or preload, and the Content-Security-Policy restricts framing and plugins without blocking the inline scripts WordPress and most themes rely on. Developers can replace any value with the <code>wpbc_security_headers<\/code> filter.<\/p>\n\n<h4>Remote management: MainWP, ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful and UpdraftCentral<\/h4>\n\n<p>Putting Bunny in front of sites you manage from a dashboard can cause slow syncs, sites reported as disconnected, and long updates that run twice. The plugin fixes this for every major remote management service:<\/p>\n\n<ul>\n<li><strong>Trusted dashboard IPs.<\/strong> Once the service itself has verified a request as coming from its dashboard, that dashboard's IP is added to the Shield trusted IP rule. Unverified requests are never trusted, learned IPs expire when the dashboard stops using them, and at most 5 are kept per service.<\/li>\n<li><strong>No timeouts or repeats.<\/strong> Pull zones wait the full 60 seconds for the origin and never resend a timed-out request, so a long update or sync never runs twice.<\/li>\n<li><strong>Nothing private is cached.<\/strong> One-click login links, connect links and WP Umbrella requests always bypass the CDN cache.<\/li>\n<li><strong>Calm bulk updates.<\/strong> Updates pushed from a dashboard are spread out per site, and at most two sites on one server redeploy at once.<\/li>\n<li><strong>Status at a glance.<\/strong> The Integrations tab lists each service and the IPs it is trusted from.<\/li>\n<\/ul>\n\n<p><strong>MainWP extras.<\/strong> On the MainWP Dashboard, requests to child sites running this plugin go straight to their origin server, skipping the CDN, its WAF and its 60 second limit. Each origin is checked before use and rechecked weekly, and sites that cannot be reached directly keep using the CDN. The Integrations tab shows each child's status plus server cron and timeout recommendations.<\/p>\n\n<p><strong>WP Umbrella extras.<\/strong> Umbrella's login protection is given Bunny's edge server list, so it sees each visitor's real IP instead of a Bunny server, and Bunny is purged whenever Umbrella clears caches.<\/p>\n\n<h4>Works with Nahnu Login Shield<\/h4>\n\n<p><a href=\"https:\/\/wordpress.org\/plugins\/nahnu-login-shield\/\">Nahnu Login Shield<\/a> is our free login security plugin. It locks out brute-force attackers and can push their IPs to the Bunny.net WAF, so they are blocked at the CDN edge before they ever reach your server. It reuses this plugin's Bunny connection, so there is nothing extra to set up. Its status and a one-click install are at the top of the Integrations tab.<\/p>\n\n<h4>Ready for WordPress 7.1<\/h4>\n\n<p>WordPress 7.1 processes images in the browser using about 13 MB of WebAssembly and JavaScript. Bunny Optimizer is kept off those files, and Shield is turned off for them for your team, so image uploads in the block editor work with Shield and Optimizer active. These rules deploy only on WordPress 7.1 and later.<\/p>\n\n<h4>Ecommerce bypass<\/h4>\n\n<p>Bypass rules are built automatically from each plugin's own page settings. No manual URL entry needed.<\/p>\n\n<p><strong>Supported ecommerce and donation plugins (6):<\/strong><\/p>\n\n<ul>\n<li>WooCommerce<\/li>\n<li>SureCart<\/li>\n<li>FluentCart<\/li>\n<li>Easy Digital Downloads (EDD)<\/li>\n<li>GiveWP<\/li>\n<li>WP User Frontend (WPUF)<\/li>\n<\/ul>\n\n<h4>Membership bypass<\/h4>\n\n<p><strong>Supported membership plugins (13):<\/strong><\/p>\n\n<ul>\n<li>Ultimate Member<\/li>\n<li>Simple Membership<\/li>\n<li>Paid Member Subscriptions<\/li>\n<li>User Registration and Membership<\/li>\n<li>WP-Members<\/li>\n<li>WCFM Multivendor Membership<\/li>\n<li>Restrict Content \/ Kadence Membership<\/li>\n<li>ProfilePress<\/li>\n<li>Indeed Ultimate Membership Pro<\/li>\n<li>Paid Memberships Pro<\/li>\n<li>ARMember<\/li>\n<li>MemberPress<\/li>\n<li>GiveWP<\/li>\n<\/ul>\n\n<h4>LMS and community bypass<\/h4>\n\n<p><strong>Supported LMS plugins (9):<\/strong><\/p>\n\n<ul>\n<li>WP User Frontend<\/li>\n<li>MasterStudy LMS<\/li>\n<li>Masteriyo LMS<\/li>\n<li>LearnDash<\/li>\n<li>Sensei LMS<\/li>\n<li>Academy LMS<\/li>\n<li>LifterLMS<\/li>\n<li>Tutor LMS<\/li>\n<li>FluentCommunity<\/li>\n<\/ul>\n\n<p><strong>Affiliate and community plugins with bypass rules (2):<\/strong><\/p>\n\n<ul>\n<li>FluentAffiliate<\/li>\n<li>SureDash<\/li>\n<\/ul>\n\n<h4>Booking and event bypass<\/h4>\n\n<p><strong>Supported booking and event plugins (4):<\/strong><\/p>\n\n<ul>\n<li>Events Manager<\/li>\n<li>Amelia Booking<\/li>\n<li>LatePoint<\/li>\n<li>WP Event Manager<\/li>\n<\/ul>\n\n<h4>Multilingual support<\/h4>\n\n<p>When WPML, Polylang or TranslatePress is active, bypass rules include translated page URLs automatically, and the pull zone varies its cache by Accept-Language so each visitor gets the right language.<\/p>\n\n<h4>Cache warmer<\/h4>\n\n<p>After a full purge, a background job crawls your sitemap to pre-warm the CDN edge.<\/p>\n\n<p><strong>Supported SEO plugins for sitemap auto-detection:<\/strong><\/p>\n\n<ul>\n<li>Yoast SEO<\/li>\n<li>Rank Math<\/li>\n<li>All in One SEO<\/li>\n<li>SEOPress<\/li>\n<li>SlimSEO<\/li>\n<li>The SEO Framework<\/li>\n<li>Squirrly SEO<\/li>\n<li>WordPress core sitemap (fallback)<\/li>\n<\/ul>\n\n<h4>Live CDN analytics<\/h4>\n\n<p>Pull zone stats, DNS stats, bandwidth breakdown, cache hit rate, Shield WAF events and cache sync status, all inside WordPress admin.<\/p>\n\n<h4>Perma-Cache cleanup<\/h4>\n\n<p>Deletes stale Perma-Cache files from Bunny Storage right after a full purge, without waiting for them to expire.<\/p>\n\n<h4>Automation: WP-CLI, REST API and PHP hooks<\/h4>\n\n<ul>\n<li><strong>WP-CLI:<\/strong> <code>wp bunny deploy<\/code>, <code>wp bunny purge<\/code>, <code>wp bunny status<\/code>, <code>wp bunny rules<\/code><\/li>\n<li><strong>REST API<\/strong> under <code>\/wp-json\/wpbc\/v1\/<\/code>: <code>GET \/status<\/code>, <code>POST \/purge<\/code>, <code>POST \/purge-url<\/code>, <code>POST \/deploy<\/code>. Authenticated with a token from Settings or a WordPress admin session.<\/li>\n<li><strong>PHP API<\/strong> for other plugins: check the connection, read status, purge, deploy and reuse the Bunny connection.<\/li>\n<\/ul>\n\n<p>The API tab in the plugin shows every endpoint, filter and action with copy-paste examples.<\/p>\n\n<h4>Checked, no integration needed<\/h4>\n\n<p>These plugins were analysed and confirmed fully compatible with no bypass rules required:<\/p>\n\n<ul>\n<li>Wordfence, All-In-One Security, Jetpack, Solid Security, Security by CleanTalk<\/li>\n<li>Complianz GDPR, CookieYes<\/li>\n<li>SureMembers, WishList Member, Members (by MemberPress)<\/li>\n<li>bbPress, Fluent Boards<\/li>\n<li>The Events Calendar, FluentBooking<\/li>\n<li>Autoptimize, FlyWP, Redis Object Cache, Aruba HiSpeed Cache, Comet Cache, SiteGround Speed Optimizer, EWWW Image Optimizer<\/li>\n<\/ul>\n\n<p>For the full compatibility list visit <a href=\"https:\/\/www.wpbunnyconnector.com\/\">wpbunnyconnector.com<\/a>.<\/p>\n\n<h4>Developer hooks<\/h4>\n\n<p>Other plugins can integrate without any changes to this plugin.<\/p>\n\n<p><strong>Filters<\/strong><\/p>\n\n<ul>\n<li><code>wpbc_shield_bypass_ips<\/code>: add trusted IPs or CIDR ranges to the Shield WAF bypass list.<\/li>\n<li><code>wpbc_shield_bypass_urls<\/code>: turn Shield off for specific URL patterns.<\/li>\n<li><code>wpbc_cache_bypass_urls<\/code>: add URL patterns to the CDN cache bypass list.<\/li>\n<li><code>wpbc_security_headers<\/code>: change, add or remove security header values.<\/li>\n<li><code>wpbc_compatible_plugins<\/code>: list your plugin on the Integrations tab.<\/li>\n<li><code>wpbc_bunny_connection<\/code>: reuse the Bunny API key, pull zone and Shield zone.<\/li>\n<li><code>wpbc_is_connected<\/code>, <code>wpbc_status<\/code>, <code>wpbc_last_purge_time<\/code>: read connection and purge status.<\/li>\n<li><code>wpbc_watched_post_types<\/code>: choose which post types purge on save.<\/li>\n<li><code>wpbc_stagger_window<\/code>, <code>wpbc_server_deploy_slots<\/code>: tune how bulk updates are spread out.<\/li>\n<\/ul>\n\n<p><strong>Actions<\/strong><\/p>\n\n<ul>\n<li><code>wpbc_purge_all<\/code>, <code>wpbc_purge_url<\/code>: purge the CDN.<\/li>\n<li><code>wpbc_deploy<\/code>, <code>wpbc_update_rules<\/code>: redeploy edge rules.<\/li>\n<li><code>wpbc_deploy_bypass_urls<\/code>: redeploy only the third-party bypass rules, in a few API calls.<\/li>\n<li><code>wpbc_mark_rules_stale<\/code>: flag rules as out of date so they redeploy in the background.<\/li>\n<\/ul>\n\n<p>Full developer documentation and examples: <a href=\"https:\/\/www.wpbunnyconnector.com\/\">wpbunnyconnector.com<\/a>.<\/p>\n\n<h4>External services<\/h4>\n\n<p>This plugin connects to the Bunny.net API (api.bunny.net) to purge cache, manage edge rules and pull zone settings, and retrieve statistics, and to Bunny Storage when Perma-Cache cleanup is enabled. When WP Umbrella is active, it also downloads Bunny's public edge server IP list (api.bunny.net\/system\/edgeserverlist) once a week; no key or site data is sent with that request. On a MainWP Dashboard, it checks whether each child site's own origin server answers directly; those requests only go to your own sites. An active Bunny.net account and API key are required. No visitor data is sent. See the Bunny.net <a href=\"https:\/\/bunny.net\/privacy\">Privacy Policy<\/a> and <a href=\"https:\/\/bunny.net\/tos\">Terms of Service<\/a>.<\/p>\n\n<h4>Disclaimer<\/h4>\n\n<p>This is an independent third-party tool. It is not affiliated with, endorsed by, or sponsored by Bunny.net.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p>Nahnu Cache Connector for Bunny.net does not collect or send any data about your site's visitors. No analytics, no tracking, no third-party data sharing.<\/p>\n\n<p>The plugin talks to the Bunny.net API to purge cache, fetch statistics and manage edge rules. The data sent is limited to your Bunny API key (in request headers), pull zone and Shield zone IDs, your site's hostnames and the URLs to purge. On sites managed by MainWP, ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful or UpdraftCentral, the IP address of the managing dashboard is stored on your site and added to your own Shield trusted IP rule. For UpdraftCentral this can be the IP of the administrator's browser; it is deleted after 7 days without use. See <a href=\"https:\/\/bunny.net\/privacy\">Bunny.net's Privacy Policy<\/a> for how Bunny.net handles this data.<\/p>\n\n<p>No data is sent to Nahnu Plugins or any third party other than Bunny.net.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install from <strong>Plugins &gt; Add New<\/strong> by searching for \"Nahnu Cache Connector\", or upload the <code>nahnu-cache-connector-bunny-net<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu.<\/li>\n<li>Go to <strong>Settings &gt; Bunny Connector<\/strong>.<\/li>\n<li>Paste your Bunny.net Account API Key and click <strong>Test<\/strong>. The key is saved as soon as Bunny accepts it.<\/li>\n<li>Pick your pull zone from the searchable list.<\/li>\n<li>Open the Edge Rules tab and click <strong>Save &amp; deploy<\/strong>.<\/li>\n<\/ol>\n\n<p>Your API key is the <strong>Account API Key<\/strong> found in the Bunny.net dashboard under <strong>Account &gt; API<\/strong>, not a pull zone access key.<\/p>\n\n<p>Full setup instructions: <a href=\"https:\/\/www.wpbunnyconnector.com\/\">wpbunnyconnector.com<\/a>.<\/p>\n\n<h4>Defining constants (optional)<\/h4>\n\n<p>Lock any value in <code>wp-config.php<\/code> so it is not stored in, or changed through, the database. When a constant is defined, the matching field is hidden in the settings screen.<\/p>\n\n<pre><code>define( 'WPBC_API_KEY',             'your-bunny-api-key' );\ndefine( 'WPBC_PULL_ZONE_ID',        '123456' );\ndefine( 'WPBC_DNS_ZONE_ID',         '789012' );\ndefine( 'WPBC_PERMA_ZONE_NAME',     'your-storage-zone' );\ndefine( 'WPBC_PERMA_ZONE_PASSWORD', 'storage-zone-password' );\ndefine( 'WPBC_PERMA_REGION',        'de' );\n<\/code><\/pre>\n\n<p>Available values for <code>WPBC_PERMA_REGION<\/code>: <code>de<\/code> (Falkenstein), <code>uk<\/code> (London), <code>ny<\/code> (New York), <code>la<\/code> (Los Angeles), <code>sg<\/code> (Singapore), <code>se<\/code> (Stockholm), <code>br<\/code> (Sao Paulo), <code>syd<\/code> (Sydney), <code>jh<\/code> (Johannesburg).<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20work%20with%20any%20cache%20plugin%3F\"><h3>Does this work with any cache plugin?<\/h3><\/dt>\n<dd><p>It integrates with the 18 cache plugins listed above. Without one of them you can still use the edge rules, manual purge, admin bar button, CDN stats and the post save and update purge triggers. Purges just are not mirrored from a cache plugin.<\/p><\/dd>\n<dt id=\"do%20i%20need%20to%20redeploy%20edge%20rules%20after%20updating%20the%20plugin%3F\"><h3>Do I need to redeploy edge rules after updating the plugin?<\/h3><\/dt>\n<dd><p>No. Rules redeploy automatically in the background after every update, reinstall or activation, and a five-minute check catches anything missed. You can still deploy manually from the Edge Rules tab at any time, and a manual deploy always takes priority.<\/p><\/dd>\n<dt id=\"do%20the%20ecommerce%2C%20membership%20and%20lms%20bypass%20rules%20deploy%20automatically%3F\"><h3>Do the ecommerce, membership and LMS bypass rules deploy automatically?<\/h3><\/dt>\n<dd><p>Yes. Each bypass rule checks for its plugin at deploy time. If WooCommerce is not active, the WooCommerce rules are skipped. When a supported plugin is activated or deactivated, rules redeploy in the background.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20wpml%2C%20polylang%20or%20translatepress%3F\"><h3>Does it work with WPML, Polylang or TranslatePress?<\/h3><\/dt>\n<dd><p>Yes. Bypass rules include translated page URLs, and the pull zone varies its cache by Accept-Language.<\/p><\/dd>\n<dt id=\"how%20does%20the%20shield%20waf%20bypass%20work%2C%20and%20is%20it%20safe%3F\"><h3>How does the Shield WAF bypass work, and is it safe?<\/h3><\/dt>\n<dd><p>When someone with a selected role logs in or opens an admin page, the plugin sets a cookie holding a secret that is unique to your site. Edge rules turn Shield off only for requests carrying that exact value, and only for admin, logged-in REST, builder and media processing URLs. Visitors are always inspected. You can choose the roles in Settings (Administrator and Editor by default) and rotate the secret at any time.<\/p><\/dd>\n<dt id=\"will%20this%20get%20an%20a%20on%20securityheaders.com%3F\"><h3>Will this get an A on securityheaders.com?<\/h3><\/dt>\n<dd><p>It sets all six headers the scanner grades on. Test both your www and non-www addresses after the rules deploy. If your site needs a stricter Content-Security-Policy, or HSTS with includeSubDomains and preload, set it with the <code>wpbc_security_headers<\/code> filter.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20mainwp%3F\"><h3>Does it work with MainWP?<\/h3><\/dt>\n<dd><p>Yes, on both the dashboard and child sites. Child sites trust the dashboard's IP in Shield automatically, the dashboard can reach child sites directly at their origin, and pull zones never resend timed-out MainWP requests. For best results use a real server cron on the dashboard and set MainWP's child request timeout to at least 300 seconds. The Integrations tab shows the status for each site.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20managewp%2C%20infinitewp%2C%20wp%20umbrella%2C%20modular%20ds%2C%20watchful%20or%20updraftcentral%3F\"><h3>Does it work with ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful or UpdraftCentral?<\/h3><\/dt>\n<dd><p>Yes. Each dashboard's IP is trusted in Shield after its first verified request, its login links are never cached, and long updates are not cut short or sent twice. If a dashboard is blocked before its first request gets through, add its IP once under Settings, in the Shield WAF trusted IP whitelist. UpdraftCentral sends commands from your browser by default, so the IP it learns is yours and expires after 7 days.<\/p><\/dd>\n<dt id=\"i%20updated%20the%20plugin%20on%20many%20sites%20at%20once.%20why%20did%20some%20redeploy%20a%20few%20minutes%20later%3F\"><h3>I updated the plugin on many sites at once. Why did some redeploy a few minutes later?<\/h3><\/dt>\n<dd><p>To avoid a CPU spike on servers that host many sites. Updates pushed from a dashboard, by WordPress auto-updates or by WP-CLI give each site its own fixed slot of up to 5 minutes, and at most two sites on one server deploy at once. Updates you click in a site's own admin deploy straight away. Developers can change the window with the <code>wpbc_stagger_window<\/code> filter and the per-server limit with <code>wpbc_server_deploy_slots<\/code>.<\/p><\/dd>\n<dt id=\"the%20bricks%20code%20editor%20or%20wordpress%207.1%20image%20uploads%20fail%20with%20shield%20on.%20what%20do%20i%20do%3F\"><h3>The Bricks code editor or WordPress 7.1 image uploads fail with Shield on. What do I do?<\/h3><\/dt>\n<dd><p>Both are covered by edge rules since versions 1.0.6 and 1.0.7. Update the plugin and the rules redeploy automatically. If an Author or another role uploads media, add that role to the WAF bypass roles in Settings.<\/p><\/dd>\n<dt id=\"what%20is%20force%20cache%20mode%3F\"><h3>What is Force Cache mode?<\/h3><\/dt>\n<dd><p>Some cache plugins send <code>Cache-Control: max-age=0<\/code> to Bunny, which tells Bunny not to cache. Force Cache mode overrides this on your pull zone so Bunny caches HTML for the TTL you set, whatever the origin sends.<\/p><\/dd>\n<dt id=\"can%20i%20use%20this%20with%20bunny%20perma-cache%3F\"><h3>Can I use this with Bunny Perma-Cache?<\/h3><\/dt>\n<dd><p>Yes. Enable Perma-Cache cleanup in Settings and enter your Bunny Storage zone details. After every full purge the plugin deletes stale Perma-Cache files so visitors always get fresh content.<\/p><\/dd>\n<dt id=\"where%20do%20i%20find%20my%20bunny%20api%20key%3F\"><h3>Where do I find my Bunny API key?<\/h3><\/dt>\n<dd><p>In the Bunny.net dashboard, go to <strong>Account &gt; API<\/strong> and use the <strong>Account API Key<\/strong>, not a pull zone access key. The account key is needed to manage edge rules and list pull zones.<\/p><\/dd>\n<dt id=\"why%20do%20some%20rules%20show%20%281%2F6%29%20or%20%282%2F6%29%20in%20the%20name%3F\"><h3>Why do some rules show (1\/6) or (2\/6) in the name?<\/h3><\/dt>\n<dd><p>Bunny allows 5 URL patterns per rule trigger. Rules that cover many paths or file types are split into batches of 5, and each batch is a separate rule. The suffix shows which batch you are looking at.<\/p><\/dd>\n<dt id=\"why%20is%20the%20rule%20count%20in%20bunny%20higher%20than%2075%3F\"><h3>Why is the rule count in Bunny higher than 75?<\/h3><\/dt>\n<dd><p>Batched rules each take several slots, and some rules are added only when a matching plugin is active. On a site with www and non-www hostnames and several integrations, the count in Bunny is higher. The plugin tracks every rule and cleans up old batches when it redeploys.<\/p><\/dd>\n<dt id=\"why%20are%20lms%20course%20and%20lesson%20pages%20not%20bypassed%3F\"><h3>Why are LMS course and lesson pages not bypassed?<\/h3><\/dt>\n<dd><p>Most LMS plugins publish courses and lessons as normal public pages that are safe to cache. Only per-user pages (student dashboards, checkout, registration, account) need a bypass, and the plugin makes this distinction for each LMS.<\/p><\/dd>\n<dt id=\"is%20this%20compatible%20with%20security%20plugins%20like%20wordfence%20or%20aios%3F\"><h3>Is this compatible with security plugins like Wordfence or AIOS?<\/h3><\/dt>\n<dd><p>Yes. Security plugins work at the request or firewall layer and are fully compatible. See the Integrations tab for the complete list.<\/p><\/dd>\n<dt id=\"will%20nitropack%20work%20alongside%20this%20plugin%3F\"><h3>Will NitroPack work alongside this plugin?<\/h3><\/dt>\n<dd><p>Not as a CDN. NitroPack runs its own CDN, and using NitroPack CDN and Bunny CDN together creates a double-CDN conflict.<\/p><\/dd>\n<dt id=\"can%20my%20plugin%20integrate%20with%20nahnu%20cache%20connector%20for%20bunny.net%3F\"><h3>Can my plugin integrate with Nahnu Cache Connector for Bunny.net?<\/h3><\/dt>\n<dd><p>Yes. See the Developer hooks section above and the API tab inside the plugin for filters, actions, REST endpoints and examples.<\/p><\/dd>\n<dt id=\"my%20plugin%20is%20not%20listed.%20can%20you%20add%20it%3F\"><h3>My plugin is not listed. Can you add it?<\/h3><\/dt>\n<dd><p>Yes. Visit <a href=\"https:\/\/www.wpbunnyconnector.com\/support\/\">wpbunnyconnector.com\/support<\/a> to request a plugin check.<\/p><\/dd>\n<dt id=\"how%20is%20the%20api%20key%20stored%3F%20is%20it%20secure%3F\"><h3>How is the API key stored? Is it secure?<\/h3><\/dt>\n<dd><p>The API key is stored in the WordPress options table, or in <code>wp-config.php<\/code> if you define it there. It is never printed in the page, never sent to the browser and never included in an AJAX response. It is only sent in request headers to the Bunny.net API. Every admin action requires a valid nonce and the <code>manage_options<\/code> capability.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.12<\/h4>\n\n<ul>\n<li>Fixed: CPU spikes when many sites were updated at once. Every edge rule deploy deleted all of the site's rules, waited, and created them again: 200 to 300 Bunny API calls, each with its own encrypted connection, even when nothing had changed, and a few seconds with no rules at all. A bulk update ran this on every site in the same minute.<\/li>\n<li>Improved: Deploys now compare the rules with what is live on Bunny and send only what changed. A redeploy with no changes costs one API call. Rules are updated in place, so the site is never left without rules. If anything unexpected happens, the deploy falls back to the full rebuild.<\/li>\n<li>Improved: Bulk updates are spread out. After an update pushed from a remote dashboard, by WordPress auto-updates or by WP-CLI, each site waits its own fixed slot of up to 5 minutes before redeploying and warming its cache. Updates clicked in the site's own admin still deploy straight away.<\/li>\n<li>Improved: At most two automatic deploys run at the same time on one server, coordinated between all sites on it. Others try again a minute or two later.<\/li>\n<li>Improved: Pull zone settings are only written when they differ from Bunny's.<\/li>\n<li>Added: ManageWP, InfiniteWP, WP Umbrella, Modular DS, Watchful and UpdraftCentral support. After the service itself has verified a request, its dashboard IP is added to the Shield trusted IP rule. Learned IPs expire when no longer used (30 days, or 7 for IPs that belong to a person's browser) and at most 5 are kept per service.<\/li>\n<li>Added: Cache bypass for remote management login and connect links, and for WP Umbrella requests, which can otherwise answer a normal page URL with JSON that the CDN would cache.<\/li>\n<li>Added: On sites managed by any of these services, the pull zone waits the full 60 seconds for the origin and never resends a timed-out request.<\/li>\n<li>Added: WP Umbrella's login protection receives Bunny's edge server list, so it sees visitors' real IPs. Bunny is purged when WP Umbrella clears caches.<\/li>\n<li>Added: Remote management card on the Integrations tab showing each service and the IPs it is trusted from.<\/li>\n<li>Added: Filters wpbc_stagger_window, wpbc_server_deploy_slots and wpbc_throttle_lock_dir.<\/li>\n<li>Fixed: The plugin could not load on PHP 8.0 or 8.1, its stated minimum. Six functions used a type that only exists from PHP 8.2. Also removed a call PHP 8.5 reports as deprecated.<\/li>\n<\/ul>\n\n<h4>1.0.11<\/h4>\n\n<ul>\n<li>Added: Strict-Transport-Security (1 year) and a Content-Security-Policy (frame-ancestors 'self'; object-src 'none'; upgrade-insecure-requests) to the security headers rule, so a site now carries all six headers securityheaders.com grades on. The CSP deliberately does not restrict scripts or styles, WordPress and most themes need inline ones; sites with their own policy can replace any value with the wpbc_security_headers filter. X-XSS-Protection is no longer sent (deprecated and flagged by scanners).<\/li>\n<\/ul>\n\n<h4>1.0.10<\/h4>\n\n<ul>\n<li>Fixed: CPU spikes and a notice that never went away. When an automatic deploy ended with any failed rule, the rule version was never recorded, so the 5-minute check ran a full deploy (around 160 Bunny API calls) every time WP-Cron was kicked, and every MainWP sync kicks it. The \"edge rules update pending\" notice stayed up for the same reason. Automatic retries now back off (5 min, 15 min, 1 h, 6 h, then daily), and the notice says which rule failed and why, with a link to deploy manually.<\/li>\n<li>Added: MainWP integration. Slow syncs and sites that showed as disconnected until reconnected came from the CDN sitting between the dashboard and the child: Bunny Shield inspecting the dashboard's requests, and Bunny's origin response timeout, which is capped at 60 seconds and by default re-sends the request when hit. A reply without MainWP's envelope (a Shield challenge or a Bunny error page) is what MainWP reports as \"MainWP Child plugin not detected\".<\/li>\n<li>Added: On child sites, the connected dashboard's IP is learned from its authenticated requests and added to the Shield trusted-IP rule automatically (rules redeploy in the background). This is what MainWP's documentation asks for on every firewall and CDN. Detected IPs are shown on the Integrations tab.<\/li>\n<li>Added: On the dashboard, child sites running this plugin report their CDN origin server during sync. After a reachability check, MainWP's requests to that site are pinned to the origin and skip Bunny entirely: no WAF, no 60-second limit, no retries. Origins are re-checked weekly and after any change; sites whose origin cannot be reached keep using the CDN. Per-site status on the Integrations tab; toggle in Settings (on by default).<\/li>\n<li>Added: On both, the pull zone's origin response timeout is set to the 60-second maximum and \"retry on response timeout\" is turned off, so a long update or sync is never duplicated.<\/li>\n<li>Added: Dashboard recommendations on the Integrations tab: use a real server cron for scheduled syncs, and raise MainWP's child request timeout to at least 300 seconds when it is lower.<\/li>\n<li>Improved: Edge rules after a plugin update. The background deploy that runs right after an update now clears the plugin's files from PHP's OPcache first and refuses to run unless it is executing the version that is on disk; otherwise it retries 30 seconds later. Before, a host whose OPcache lagged by a few seconds could deploy the previous version's rules first and only get the new ones from the 5-minute check.<\/li>\n<li>Added: Bunny API: get_pull_zone(). Hooks used: mainwp_child_login_required_authed, mainwp_site_sync_others_data, mainwp_site_synced, mainwp_curl_curlopt_resolve.<\/li>\n<\/ul>\n\n<h4>1.0.9<\/h4>\n\n<ul>\n<li>Fixed: Fatal error on the settings page (\"Undefined array key context\" \/ str_replace() TypeError). Automatic edge rule deploys wrote Purge Log entries in a different shape, and the Purge Log tab crashed on them. The page stopped partway, before its script was printed, so no data loaded and the tabs did nothing. Since 1.0.5 automatic deploys run on every update, so most sites with a recent update were affected.<\/li>\n<li>Fixed: All Purge Log entries are now written in one format, and older entries already stored on your site are read correctly. Malformed entries are skipped instead of breaking the page.<\/li>\n<li>Fixed: The Purge button, WP-CLI (wp bunny purge) and the REST purge endpoint judged success by the newest log entry, which could belong to another event. They now use the purge result itself.<\/li>\n<li>Fixed: wpbc_status and wpbc_last_purge_time reported the time of the newest log entry, which could be a deploy. They now report the last successful full purge.<\/li>\n<\/ul>\n\n<h4>1.0.8<\/h4>\n\n<ul>\n<li>Added: Edge protection for the plugin's own admin files (assets\/). Two new edge rules turn Bunny Optimizer off for them, and turn Bunny Shield off for them for logged-in admins only (same secret-cookie protection as the admin and REST rules). Both follow the existing admin switches.<\/li>\n<li>Improved: Settings page tabs are now real links (?tab=settings and so on). A tab can be bookmarked, a reload keeps the current tab, and the tabs still work if the page script is unavailable.<\/li>\n<li>Added: Diagnostic banner. If the settings page script cannot start, the page explains why (blocked with an HTTP error, a challenge page instead of JavaScript, or altered on the way) and offers a \"Redeploy edge rules now\" button that works without JavaScript.<\/li>\n<li>Fixed: \"Deploy now\" links in the update notices opened the Stats tab instead of Edge Rules.<\/li>\n<\/ul>\n\n<h4>1.0.7<\/h4>\n\n<ul>\n<li>Added: Support for WordPress 7.1 client-side media processing (https:\/\/make.wordpress.org\/core\/2026\/07\/22\/client-side-media-processing-in-wordpress-7-1\/). The block editor processes images in the browser with WebAssembly, loading about 13 MB of JavaScript from wp-includes\/js\/dist\/script-modules\/vips\/ and video-conversion\/. Bunny Shield could block these files and Bunny Optimizer could try to re-minify them, so image uploads failed unless client-side processing was turned off.<\/li>\n<li>Added: Edge rule that turns Bunny Optimizer off for the media processing modules, for everyone. They are already minified. Follows the \"Disable Optimizer: admin\" switch.<\/li>\n<li>Added: Role-restricted edge rule that turns Shield off for the media processing modules. Like the admin and REST rules, it requires the secret bypass cookie, so visitors are still inspected. Follows the \"Disable Shield &amp; WAF: admin\" switch.<\/li>\n<li>Note: The upload requests themselves (\/wp-json\/wp\/v2\/media\/{id}\/sideload and \/finalize) are covered by the existing REST rule for the roles selected in Settings. If Authors or other roles upload media, add them to the WAF bypass roles.<\/li>\n<li>Both rules are only deployed on WordPress 7.1 and later.<\/li>\n<\/ul>\n\n<h4>1.0.6<\/h4>\n\n<ul>\n<li>Fixed: With Bunny Shield active, the Bricks code element could show \"Could not load code editor\". The editor is a large script loaded from the theme folder that contains PHP keyword lists, which WAF rules can flag. When Bricks is the active theme, the role-restricted Shield bypass (rule 2) now also covers the builder and the theme's editor assets. It still requires the secret bypass cookie, so visitors are inspected as before.<\/li>\n<\/ul>\n\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Security: The Shield\/WAF bypass cookie (wpbc_role) could be forged. Its value was always \"1\" and edge rules 2 and 3 only pattern-matched the cookie name, so any request carrying wpbc_role=1 had Shield and the WAF switched off for \/wp-admin\/* and \/wp-json\/*. The cookie now carries a per-site secret generated once and stored in a non-autoloaded option, and both edge rules match that exact value.<\/li>\n<li>Security: Default WAF bypass roles changed from all logged-in users to Administrator + Editor. Sites that explicitly selected roles keep their selection. \"All logged-in users\" is still available as an explicit choice.<\/li>\n<li>Added: \"Rotate bypass secret\" button in Settings. Generates a new secret, redeploys edge rules, and re-issues the cookie.<\/li>\n<li>Added: The bypass cookie is refreshed on admin page loads when it is missing or holds an old secret, so rotating the secret or upgrading does not require admins to log in again.<\/li>\n<li>Fixed: Third-party cache bypass URLs (wpbc_cache_bypass_urls filter) were deployed as rule 76, after the Cache HTML rule (62). Bunny's Override Cache Time action is short-circuiting (lowest OrderIndex wins), so those bypasses were ignored and paths such as a custom login URL could be cached for the full TTL. The rule now deploys at OrderIndex 61, before Cache HTML.<\/li>\n<li>Added: Works with Nahnu Login Shield (https:\/\/wordpress.org\/plugins\/nahnu-login-shield\/), our free login security plugin. Login Shield locks out brute-force attackers and can push their IPs to the Bunny.net WAF so they are blocked at the CDN edge. It now appears at the top of the Integrations tab, showing whether it is active, with a one-click install.<\/li>\n<li>Added: wpbc_bunny_connection filter. Returns api_key, pull_zone_id, shield_zone_id and from_constants so other plugins can reuse the Bunny connection instead of reading settings directly.<\/li>\n<li>Added: shield_zone_id in the wpbc_status filter output.<\/li>\n<li>Added: wpbc_deploy_bypass_urls action. Redeploys only the third-party bypass rule(s), a few API calls instead of a full wipe-and-recreate.<\/li>\n<li>Improved: Edge rules now redeploy automatically the moment the plugin is updated, reinstalled from a zip (same or new version) or activated, with no visitor or WP-Cron needed. The update starts a short background request on the site itself, which loads the new plugin code and deploys the new rules. Previously the deploy ran inside the update request with the old code still loaded, which pushed the old rule set and made remote managers such as MainWP time out and report the update as failed. A WP-Cron fallback runs 60 seconds later if the background request is blocked by the host, and skips itself if the deploy already succeeded.<\/li>\n<li>Fixed: When a second copy of the plugin was installed in another folder (for example by uploading a zip that WordPress unpacked as nahnu-cache-connector-bunny-net-1.0.5), activating it caused \"constant already defined\" warnings and a fatal error. The second copy now stands down and shows an admin notice naming the folder to remove. Deleting a duplicate copy from the Plugins screen no longer erases the settings shared with the copy that stays.<\/li>\n<li>Fixed: Deploy failed with \"Order index must be unique\" for rules split into batches (static asset browser cache, force cache, country lists and similar). Bunny requires a unique OrderIndex for every rule on a pull zone, and all batches of a rule shared one. Every rule now gets its own index, in the intended order, and indices used by rules you created yourself in the Bunny dashboard are left alone.<\/li>\n<li>Fixed: Settings screen during setup. Test, Refresh (pull zones) and Find zone (DNS, Shield) only used saved settings, so a newly pasted API key reported \"No API key saved\" and Shield lookup failed for a pull zone picked but not saved. They now use what is in the form, the key is saved as soon as Bunny accepts it, the pull zone list fills in after a successful Test, and the Shield WAF events section appears on the Stats tab as soon as a Shield zone is found. No page reload needed.<\/li>\n<li>Fixed: The pull zone name was never saved, so the zone picker could show a blank label after a reload.<\/li>\n<li>Fixed: Two deploys could overlap (for example the automatic deploy and the admin button) and delete each other's rules. Deploys are now serialised with a lock.<\/li>\n<li>Improved: A manual deploy (Deploy \/ Update buttons, Rotate bypass secret, WP-CLI, REST) always takes priority. If an automatic deploy is running, it stops at its next step and hands over; any automatic deploy still pending (after an update or a plugin activation) sees that a newer deploy already succeeded and skips itself. An automatic deploy that has to wait is retried a minute later instead of being logged as a failure.<\/li>\n<li>Fixed: Duplicate auto-deploy cron events could be scheduled because the duplicate check never matched.<\/li>\n<li>Fixed: Every automatic purge hit the Bunny API twice, because wpbc_purge_all had two listeners.<\/li>\n<li>Improved: Automatic purges (post saves, plugin\/theme\/core updates, cache plugin clear hooks) are now coalesced into one Bunny API call at the end of the request, after local cache plugins have finished clearing. A single MainWP plugin update could previously trigger 4-6 blocking purges.<\/li>\n<li>Improved: The cache warmer no longer fetches sitemaps inside the purging request (blocking loopback requests with a 10-second timeout each), and Perma-Cache cleanup no longer calls the Storage API inline. Both now run in WP-Cron. The admin \"Warm now\" button, WP-CLI and REST purges still run immediately.<\/li>\n<li>Fixed: The bypass cookie refresh now also runs on admin-ajax.php requests, so MainWP and similar managers pick up a rotated secret on their next call.<\/li>\n<li>Added: Hint in the trusted IP whitelist card when MainWP Child is detected, pointing to the dashboard's outbound IP.<\/li>\n<li>Fixed: Background deploys (cron, auto-deploy, wpbc_deploy, WP-CLI, REST) read the cache TTL from the wrong option and reset rule 62 to 7 days, ignoring the TTL saved in the Edge Rules tab.<\/li>\n<li>Fixed: When specific rules were selected in the Edge Rules tab, batched rules (any pattern list over 5 entries) only deployed their first batch.<\/li>\n<li>Added: wpbc_mark_rules_stale action. Flags rules as out of date; the 5-minute cron check redeploys and admins see a pending notice with a Deploy now button.<\/li>\n<\/ul>\n\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Added: xSpeed Cache cache purge sync via xspeed_after_purge_all (full purge).<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Added: Auto-deploy edge rules when the plugin updates or a supported plugin is activated\/deactivated. Runs in the background via WP-Cron 30 seconds after the trigger. Result logged to the Purge Log.<\/li>\n<li>Added: WP-CLI commands: wp bunny deploy, wp bunny purge, wp bunny status, wp bunny rules.<\/li>\n<li>Added: Admin notice when a supported plugin is activated or deactivated confirming background rule update. Persists until the deploy completes or the admin dismisses it.<\/li>\n<li>Added: Public PHP API (filters and actions) for third-party plugin integration: wpbc_is_connected, wpbc_status, wpbc_last_purge_time, wpbc_purge_all, wpbc_purge_url, wpbc_deploy, wpbc_update_rules.<\/li>\n<li>Added: REST API endpoints under \/wp-json\/wpbc\/v1\/: GET \/status, POST \/purge, POST \/purge-url, POST \/deploy. Authenticated via X-WPBC-Token header or WordPress admin session.<\/li>\n<li>Added: REST API token field in Settings with copy and regenerate buttons.<\/li>\n<li>Added: API documentation tab in the plugin admin showing all REST endpoints, PHP filters, PHP actions, and integration filters with copy-paste code examples.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Fixed: Stable tag corrected to 1.0.2 to resolve WordPress.org serving incorrect version.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Added: Vary Cache by Accept-Language: automatically configured on the pull zone when WPML, Polylang, or TranslatePress is active.<\/li>\n<li>Added: Shield WAF event log panel on the Stats tab: view blocked IPs, triggered rules, and URLs for the last 1, 6, 24, or 72 hours.<\/li>\n<li>Added: Shield Zone ID field in Settings.<\/li>\n<li>Added: Request Coalescing toggle in Settings.<\/li>\n<li>Added: Admin notice after plugin updates prompting a redeploy of edge rules.<\/li>\n<li>Updated: Tested up to WordPress 7.1.<\/li>\n<\/ul>\n\n<h4>1.0.0.5<\/h4>\n\n<ul>\n<li>Added: wpbc_shield_bypass_ips filter: third-party plugins can add trusted IPs\/CIDRs to the Bunny Shield WAF bypass list (rule 74) without any code changes to this plugin.<\/li>\n<li>Added: wpbc_shield_bypass_urls filter: third-party plugins can disable Shield WAF on specific URL path patterns (rule 75, new).<\/li>\n<li>Added: wpbc_cache_bypass_urls filter: third-party plugins can add URL paths to the Bunny cache bypass list (rule 76, new).<\/li>\n<li>Added: wpbc_compatible_plugins filter: third-party plugins can register themselves in the Integrations tab.<\/li>\n<\/ul>\n\n<h4>1.0.0.4<\/h4>\n\n<ul>\n<li>Fixed: Plugin settings (API key, pull zone) could be wiped during plugin updates, option imports, or multisite sync. Added a sanitize guard that aborts if the incoming data has no recognisable form submission markers, and a pre_update_option filter as a second line of defence.<\/li>\n<\/ul>\n\n<h4>1.0.0.3<\/h4>\n\n<ul>\n<li>Fixed: Bunny edge cache now always purges when a cache plugin is updated, regardless of the \"Plugin\/theme updates\" trigger setting. Previously the purge was skipped if that toggle was off.<\/li>\n<\/ul>\n\n<h4>1.0.0.2<\/h4>\n\n<ul>\n<li>Added: BerqWP integration: berqwp_flush_all_cache and berqwp_purge_cdn (full purge), berqwp_flush_page_cache (per-URL path slug).<\/li>\n<\/ul>\n\n<h4>1.0.0.1<\/h4>\n\n<ul>\n<li>Added: SWIS Performance by EWWW Image Optimizer integration: swis_complete_cache_cleared and swis_site_cache_cleared (full purge), swis_cache_by_url_cleared (per-URL).<\/li>\n<li>Updated: Tested up to WordPress 7.0.1.<\/li>\n<\/ul>\n\n<h4>1.0.0.0<\/h4>\n\n<ul>\n<li>Initial public release.<\/li>\n<\/ul>","raw_excerpt":"Bunny.net CDN for WordPress: purge sync for 18 cache plugins, 75+ edge rules, Shield WAF bypasses, security headers and MainWP\/ManageWP support.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/331374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=331374"}],"author":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ja1me4"}],"wp:attachment":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=331374"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=331374"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=331374"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=331374"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=331374"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=331374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}