Oh My Cache!

Description

Clears the page cache on your own server first, then the copy Cloudflare holds at the edge. One
plugin, one list of URLs, so the two cannot disagree about what was cleared.

• NGINX FastCGI and proxy cache, by deleting the cache files or through ngx_cache_purge
• Redis page cache, using SCAN instead of a blocking KEYS sweep
• Cloudflare, one batch per API call, so a failed batch retries on its own
• A queue screen showing what was cleared, what failed, and who asked for it
• Sitemaps too, read from the index your site publishes rather than guessed from its name
• WooCommerce stock, prices and variations, which never fire a post save
• A switch per post type, for the ones whose changes should not clear anything
• A list of extra paths, such as /llms.txt, cleared alongside every purge
• A setup wizard that checks your token, finds your zone and adds two cache rules
• A public API for other plugins, and WP-CLI commands for deploys

External services

The plugin talks to one outside service, the Cloudflare API. It clears the copy of your pages
Cloudflare holds at the edge, and, if you run the wizard’s optional steps, reads and writes the
caching configuration of your own zone. Nothing else leaves your server: no update checker, no
licence check, no analytics.

Cloudflare API (https://api.cloudflare.com/client/v4/)

Only contacted once you have configured a Cloudflare API token. Without one the plugin refuses
the request before anything leaves your server.

What it sends, and when:

• Your Cloudflare API token, as an authorization header on every request below.
• The URLs to clear, in batches, whenever content changes on your site (a post saved, published
  or deleted, a comment or term edited, the theme switched), when you press a purge button on
  the dashboard or admin bar, when a WP-CLI purge runs, and when the queue retries a batch that
  failed earlier.
• Your site’s hostname, once, while the wizard works out which zone belongs to it.
• Your zone identifier, on every request about that zone.
• The cache rules, if you ask the wizard to create them. They contain your WordPress and
  WooCommerce cookie name prefixes and, for a store, the cart, checkout and account paths taken
  from your WooCommerce settings.
• The zone settings being changed, if you ask the wizard to apply the recommended ones.

It never sends visitor data, personal data or post content.

Cloudflare IP address ranges (https://api.cloudflare.com/client/v4/ips)

Once a week WP-Cron fetches Cloudflare’s published list of its own IP ranges. The plugin checks
that list to confirm a request really arrived through Cloudflare before it trusts the visitor
address in the CF-Connecting-IP header. The fetch carries no authentication and nothing about
your site beyond the user agent WordPress puts on any HTTP request. Until it first succeeds, the
plugin falls back to a copy of the list shipped with it.

This one runs whenever the plugin is active, including on sites that never configured Cloudflare.

Cloudflare’s terms

Cloudflare, Inc. provides the service. Their terms and privacy policy:

• Terms of use: https://www.cloudflare.com/website-terms/
• Privacy policy: https://www.cloudflare.com/privacypolicy/

Requests to your own site

The plugin’s other network requests never leave your own infrastructure and involve no third
party: clearing NGINX through ngx_cache_purge, reading your sitemap index, warming pages with the
preloader, and reaching the Redis server whose address you configure yourself.

What the plugin stores

One custom table, {prefix}oh_my_cache_jobs, holds the queue of jobs waiting to run or retry.
Settings live in the options table. WP-Cron runs the queue and cleans it up; the jobs that refresh
the sitemap list and the Cloudflare IP ranges are scheduled only while the features that need them
are on, and removed when you switch them off. Turning on «delete data on uninstall» removes all of
it when you delete the plugin. Leave it off and nothing is removed, so deactivating to debug a
conflict does not cost you your configuration.

Credits

Licensed GPL-3.0-or-later, because it derives from two GPL projects and one of them is GPLv3.

Nginx Helper by rtCamp, GPL-2.0-or-later, https://github.com/rtCamp/nginx-helper. Source of the
approach to clearing a local page cache: the nginx cache file path derivation, the ngx_cache_purge
alternative, the Redis key shape, and which WordPress events invalidate which URLs.

App for Cloudflare by Digital Point, GPL-3.0, https://wordpress.org/plugins/app-for-cf/. Source of
the approach to Cloudflare: the API client, resolving a zone from the hostname, the URLs a post
change invalidates, the guest-HTML cache rule and its s-maxage header, the static-content
extension list, and the recommended zone settings.

Both were reimplemented rather than copied. No code from App for Cloudflare Pro was used; it is
proprietary, and has no cache clearing logic in any case. Nothing third party is bundled.