Get it free on WordPress.orgFree, GPLv2 or later.

What it does, and what it does not

What it does

Runs 25 checks in six groups on the connection between Cloudflare and your WordPress site.
Shows the results in Site Health, in the Site Health Info section, on its own report page under Tools, and through WP-CLI.
Says for every finding how confident it is, shows the evidence it used, and links to a guide on this site.
Reports a check as could not check, with the reason, when it cannot measure something reliably, instead of guessing.

What it does not do

It changes nothing. It does not write to Cloudflare, to your server, or to the settings of WordPress or of any other plugin.
It does not touch your Cloudflare account. It has no Cloudflare API token and asks for none.
It stores only its own options and transients.
It does not fix anything for you. Each guide explains what you can change yourself, in the Cloudflare dashboard or in WordPress.

Privacy

Several checks can only be answered by reading a real response from the edge, so the plugin sends HTTP requests to your own site, including a request to /cdn-cgi/trace on your own domain, which Cloudflare answers with information about the connection. It never sends your administrator cookies with those requests.

Requests go only to your own site: the hosts of your Site Address and WordPress Address. An address WordPress gives on another host, such as a single sign on page, is never requested.
No telemetry and no analytics.
It does not store visitor IP addresses.
Results are stored in your own database and shown only to users who can view Site Health checks.
The report you copy from the plugin, and its printout, mask the IP address of your server and your domain, and show a login page that was moved to another address as [custom login URL].
If your site asks for a password at the server level (Basic Auth), the plugin passes it on only to your own site, only when you run the checks yourself, and only after it has checked the credentials.

The one request to a third party is optional and off by default. When an administrator turns on the weekly refresh of the Cloudflare IP list, or runs wp edge-doctor ips --refresh, the plugin requests https://api.cloudflare.com/client/v4/ips to download the current IP ranges. Only standard HTTP headers are sent. No data about your site or your visitors is sent. That service is provided by Cloudflare, Inc.: see their terms and privacy policy.

The 25 checks

Each check has a guide: what it looks at, what every result means, how to confirm it by hand and where to fix it. See all checks with a short description of each.

Cloudflare connection and SSL

Visitor IP behind Cloudflare

Private pages and Cloudflare cache

Cloudflare features that affect WordPress

Requests from your server to itself

DNS and origin exposure

Screenshots

Edge Doctor for Cloudflare screenshot 1: The report under Tools, Edge Doctor: a count by status, then every check, group by group. — The report under Tools, Edge Doctor: a count by status, then every check, group by group.

Edge Doctor for Cloudflare screenshot 2: A finding opened: what the plugin saw, what to do about it, and the evidence it read. — A finding opened: what the plugin saw, what to do about it, and the evidence it read.

Edge Doctor for Cloudflare screenshot 3: The same finding in Site Health, where each group appears as one test. — The same finding in Site Health, where each group appears as one test.

Edge Doctor for Cloudflare screenshot 4: The printed report, with the server address and the domain masked. — The printed report, with the server address and the domain masked.

Requirements

WordPress 6.5 or later
PHP 7.4 or later
Tested up to WordPress 7.1
License GPLv2 or later

Install it from WordPress.org or from the Plugins screen of your site. After you activate it, open Tools, Edge Doctor, or open Tools, Site Health and read the Edge Doctor tests. On the command line:

wp edge-doctor run
wp edge-doctor run --group=c --format=json --redact
wp edge-doctor results --format=markdown

Questions

Why does the plugin send requests to my own site?

Several checks can only be answered by looking at a real response from the edge. The plugin requests pages on your own domain and reads the response headers. It never sends your administrator cookies with those requests.

Does it change my Cloudflare settings?

No. The plugin has no Cloudflare API token and makes no changes anywhere. It reads and reports.

Is this plugin made by Cloudflare?

No. Edge Doctor is not affiliated with or endorsed by Cloudflare, Inc.

What does could not check mean?

It means the plugin could not measure that check reliably on this site, for example because a request to your own site failed or because the cache key ignores the query string. The result names the reason and links to a guide. The reasons that have their own guide.

Where do I see the results?

In Site Health, where each group appears as one test, in the Site Health Info section, on the report page under Tools, Edge Doctor, and through wp edge-doctor run and wp edge-doctor results.

Can I share the report with someone who helps me?

Yes. The report you copy from the plugin, and its printout, mask the IP address of your server and your domain, and show a moved login page as [custom login URL]. On the command line, --redact masks IP addresses and the domain, and the Markdown format is always masked.

Get it free on WordPress.orgFree, GPLv2 or later.

Edge Doctor is made by RXN Web Solutions, a small WordPress studio. If you would rather have someone look at your Cloudflare and WordPress setup, get in touch.

Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.