On every plan
One real site, the last 14 days
Pricing
Everything that runs on your own server costs nothing. A plan adds the part you cannot run yourself: a security layer above WordPress and a page cache at the edge, sized by sites and pageviews. Keep whatever optimizer you already run.
14 days free on every plan. Card at checkout, nothing charged until the trial ends, and cancelling before that costs nothing. The license key arrives by email the moment checkout completes.
Every plan
All twelve shields and all three locks on every plan, Shield included, working at the edge before a request reaches your server. What you pay for is sites, pageviews and how far back the numbers go.
Logins limited per address, guessing through XML-RPC refused, and the login page only for the countries and addresses you allow.
login limitXML-RPC blockcountry lockwp-admin IP lockRequests for stray PHP files, user lists, leftover files and path tricks in any encoding are refused before WordPress runs.
stray-PHP locksurface locktraversal guardAn address that keeps probing is shut out of the whole site after its fifth refusal, for ten minutes.
scanner lockoutComment and search floods from one address are slowed down before they reach your database.
comment flood limitsearch flood limitChanging a shield or installing code waits for your click on an emailed link; code changes that skip the edge are refused.
change lockinstall lockorigin lockAI training crawlers turned away if you choose, and the browser security headers on every response.
AI-crawler blocksecurity headersOn one real site in 14 days: 31.2k login attempts, 169k requests for stray PHP files and 3.2k scanners refused at the edge.
On your own server and your own Cloudflare zone.
€0forever
No account, no key.
One site, protected and cached.
€9/month
billed monthly
A busy site that wants a week of cover and a month of numbers.
€19/month
billed monthly
Ten client sites on one key, with images included.
€99/month
billed monthly
Compare
| Feature | Shield | Shield Plus | Agency |
|---|---|---|---|
| Size | |||
| SitesSites on one license key. | 1 | 1 | 10 |
| Pageviews a monthHuman pageviews served by the edge in a rolling 30 days, bots and prerenders excluded, summed across the sites on the plan. Shields and locks never pause; you get a note at 100% and 150%, and a license that stays above 150% for two monthly checks has HTML caching set to pass-through until it moves up. | 500k | 3M | 15M pooled |
| Edge URL rulesRedirects and block rules answered at the edge, per site, before your server renders anything. | 100 | 500 | 1,000 |
| Stays up | |||
| Origin ShieldWhen your server errors or goes down, the edge keeps serving the cached site for this long and emails you when it engages and when it recovers. | 1 day | 7 days | 7 days |
| Numbers | |||
| HistoryHow far back every pane looks: audience, attacks, top URLs, redirects, broken images. | 7 days | 30 days | 90 days |
| Report by emailWeekly plans also get the monthly one. | monthly | weekly | weekly |
| Images | |||
| Managed ImagesRight-sized WebP and AVIF from the edge. An add-on on Shield and Shield Plus, see below. | add-on | add-on | 100k pooled |
| Agency | |||
| Agency console and fleet actions | no | no | yes |
| White-label client reports | no | no | yes |
| Priority support | no | no | yes |
Every plan also has the page cache with surgical purge, edge controls (cache duration per path, query parameters, cache protection, WooCommerce safety, asset versioning, speculative loading), audience analytics without a tracking script, the 404 cleanup inbox and broken-image detection, on top of the free plugin's own tools.
Add-on
Right-sized WebP and AVIF from the edge, with no Cloudflare account and nothing to configure. Sold per license in blocks of unique variants per 30 days; blocks stack and cancel any time. Without it, your images keep serving from your own server, untouched.
1 variant = one image at one size and format, made once. Serving it again is free.
On every plan
Questions
Nothing at first. Shields and locks never pause. You get a note at 100% and at 150%. A license that stays above 150% for two monthly checks has HTML caching set to pass-through until it moves up a plan; everything else keeps working.
When the 14-day trial ends. Cancel before then and nothing is charged.
Any time, in place: the same subscription, prorated, and the same license key. Use Change my plan above.
No. We run the edge. You add the DNS records the plugin's setup shows, and that is all.
At checkout. Purchases are sold through Link, Stripe's merchant-of-record service, which calculates and remits VAT.
Prices are launch pricing and may change. Managed plans bill after the 14-day trial and can be cancelled anytime; yearly prices are shown per month and billed once a year (12 months for the price of 11); Managed Images blocks are a separate monthly subscription tied to your license, cancellable any time and effective to the end of the paid period; a variant is one unique image size and format in a rolling 30-day window. Full-page caching is included under fair use. VAT is handled at checkout; purchases are sold through Link, Stripe’s merchant-of-record service. Questions: support@nivoli.com.