![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changeset 3776031
- Timestamp:
- 10/30/2026 09:11:10 PM (22 hours ago)
- Location:
- edge-doctor
- Files:
-
- 12 edited
- 1 copied
-
tags/1.0.2 (copied) (copied from edge-doctor/trunk )
-
tags/1.0.2/edge-doctor.php (modified) (3 diffs)
-
tags/1.0.2/languages/edge-doctor.pot (modified) (7 diffs)
-
tags/1.0.2/readme.txt (modified) (2 diffs)
-
tags/1.0.2/src/Check/PrivateCache/C1AdminCache.php (modified) (4 diffs)
-
tags/1.0.2/src/Check/Result.php (modified) (1 diff)
-
tags/1.0.2/src/Check/ServerRequests/E2AccessAjax.php (modified) (1 diff)
-
trunk/edge-doctor.php (modified) (3 diffs)
-
trunk/languages/edge-doctor.pot (modified) (7 diffs)
-
trunk/readme.txt (modified) (2 diffs)
-
trunk/src/Check/PrivateCache/C1AdminCache.php (modified) (4 diffs)
-
trunk/src/Check/Result.php (modified) (1 diff)
-
trunk/src/Check/ServerRequests/E2AccessAjax.php (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
edge-doctor/tags/1.0.2/edge-doctor.php
r3775965 r3776031 4 4 * Plugin URI: https://rxnwebsolutions.com/edge-doctor/ 5 5 * Description: Detects common misconfigurations between Cloudflare and WordPress and explains how to fix them. Read-only. 6 * Version: 1.0. 16 * Version: 1.0.2 7 7 * Requires at least: 6.5 8 8 * Requires PHP: 7.4 … … 18 18 defined( 'ABSPATH' ) || exit; 19 19 20 define( 'EDGE_DOCTOR_VERSION', '1.0. 1' );20 define( 'EDGE_DOCTOR_VERSION', '1.0.2' ); 21 21 define( 'EDGE_DOCTOR_FILE', __FILE__ ); 22 22 define( 'EDGE_DOCTOR_DIR', plugin_dir_path( __FILE__ ) ); … … 27 27 define( 'EDGE_DOCTOR_DOCS_SR', false ); 28 28 // Address for "Report a false positive". Empty until the plugin is published on WordPress.org, and the link is not in the HTML until then (DECISIONS.md, D7). 29 define( 'EDGE_DOCTOR_SUPPORT_URL', ' ' );29 define( 'EDGE_DOCTOR_SUPPORT_URL', 'https://wordpress.org/support/plugin/edge-doctor/' ); 30 30 define( 'EDGE_DOCTOR_MIN_PHP', '7.4' ); 31 31 define( 'EDGE_DOCTOR_MIN_WP', '6.5' ); -
edge-doctor/tags/1.0.2/languages/edge-doctor.pot
r3775965 r3776031 3 3 msgid "" 4 4 msgstr "" 5 "Project-Id-Version: Edge Doctor for Cloudflare® 1.0. 1\n"5 "Project-Id-Version: Edge Doctor for Cloudflare® 1.0.2\n" 6 6 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/edge-doctor\n" 7 7 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" … … 10 10 "Content-Type: text/plain; charset=UTF-8\n" 11 11 "Content-Transfer-Encoding: 8bit\n" 12 "POT-Creation-Date: 2026-10- 29T00:02:08+00:00\n"12 "POT-Creation-Date: 2026-10-30T20:42:34+00:00\n" 13 13 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" 14 14 "X-Generator: WP-CLI 2.12.0\n" … … 600 600 601 601 #: src/Check/PrivateCache/C1AdminCache.php:148 602 msgid "The login page could not be confirmed at wp-login.php, so this result rests on wp-admin alone."602 msgid "The login page could not be confirmed at the address WordPress gives, so this result rests on wp-admin alone." 603 603 msgstr "" 604 604 605 605 #: src/Check/PrivateCache/C1AdminCache.php:155 606 msgid "Cloudflare answered for wp-login.phpfrom its cache, but the answer was not the login page, so it is not the login page that is cached."606 msgid "Cloudflare answered for the login page address from its cache, but the answer was not the login page, so it is not the login page that is cached." 607 607 msgstr "" 608 608 … … 620 620 621 621 #: src/Check/PrivateCache/C1AdminCache.php:285 622 msgid "Find the cache rule that covers these addresses and exclude wp-admin and wp-login.phpfrom it."622 msgid "Find the cache rule that covers these addresses and exclude wp-admin and the login page from it." 623 623 msgstr "" 624 624 … … 632 632 633 633 #: src/Check/PrivateCache/C1AdminCache.php:294 634 msgid "Narrow the rule so it does not cover wp-admin and wp-login.phpat all."634 msgid "Narrow the rule so it does not cover wp-admin and the login page at all." 635 635 msgstr "" 636 636 … … 1054 1054 1055 1055 #: src/Check/Result.php:306 1056 msgid "The login page did not answer at wp-login.php, so it could not be checked. Its address has probably been changed, often by a security plugin."1056 msgid "The login page could not be confirmed at the address WordPress gives, so it could not be checked. It may be hidden in a way WordPress does not know about." 1057 1057 msgstr "" 1058 1058 … … 1174 1174 1175 1175 #: src/Check/ServerRequests/E2AccessAjax.php:93 1176 msgid "Narrow the Access application so it covers wp-admin and wp-login.phpbut leaves admin-ajax.php alone."1176 msgid "Narrow the Access application so it covers wp-admin and the login page but leaves admin-ajax.php alone." 1177 1177 msgstr "" 1178 1178 -
edge-doctor/tags/1.0.2/readme.txt
r3775965 r3776031 5 5 Tested up to: 7.1 6 6 Requires PHP: 7.4 7 Stable tag: 1.0. 17 Stable tag: 1.0.2 8 8 License: GPLv2 or later 9 9 License URI: https://www.gnu.org/licenses/gpl-2.0.html … … 75 75 == Changelog == 76 76 77 = 1.0.2 = 78 * The report page links to the support forum on WordPress.org for reporting a false positive. 79 * The texts for a login page that could not be confirmed now speak of the address WordPress gives for it, which is what has been measured since 1.0.1, and the cache and Access advice names the login page wherever it was moved. 80 77 81 = 1.0.1 = 78 82 * The REST routes are registered on every site, also where the REST API is not under /wp-json/, as in WordPress Playground. -
edge-doctor/tags/1.0.2/src/Check/PrivateCache/C1AdminCache.php
r3775965 r3776031 142 142 * unconfirmed login page becomes a note on it. Only when wp-admin 143 143 * is in order does the result say it could not look. A cached 404 144 * at wp-login.phpis not the login page leaking.144 * at the login page address is not the login page leaking. 145 145 */ 146 146 if ( in_array( $admin_class, array( self::CACHEABLE, self::BYPASS ), true ) ) { 147 147 $result = $this->judge( $admin_class ); 148 $result->with_note( __( 'The login page could not be confirmed at wp-login.php, so this result rests on wp-admin alone.', 'edge-doctor' ) );148 $result->with_note( __( 'The login page could not be confirmed at the address WordPress gives, so this result rests on wp-admin alone.', 'edge-doctor' ) ); 149 149 $result->with_note( Result::reason_text( $reason ) ); 150 150 } else { … … 153 153 154 154 if ( self::CACHEABLE === $login_class ) { 155 $result->with_note( __( 'Cloudflare answered for wp-login.phpfrom its cache, but the answer was not the login page, so it is not the login page that is cached.', 'edge-doctor' ) );155 $result->with_note( __( 'Cloudflare answered for the login page address from its cache, but the answer was not the login page, so it is not the login page that is cached.', 'edge-doctor' ) ); 156 156 } 157 157 … … 283 283 $result->title = __( 'Cloudflare is caching your admin pages', 'edge-doctor' ); 284 284 $result->summary = __( 'Cloudflare answered for wp-admin or the login page from its cache. A page built for one signed in person can be handed to somebody else, or to a visitor who is not signed in at all.', 'edge-doctor' ); 285 $result->with_note( __( 'Find the cache rule that covers these addresses and exclude wp-admin and wp-login.phpfrom it.', 'edge-doctor' ) );285 $result->with_note( __( 'Find the cache rule that covers these addresses and exclude wp-admin and the login page from it.', 'edge-doctor' ) ); 286 286 287 287 return $result; … … 292 292 $result->title = __( 'A cache rule reaches your admin pages', 'edge-doctor' ); 293 293 $result->summary = __( 'A cache rule covers wp-admin or the login page and is bypassing the cache for now. Only the headers your server sends keep those pages out, so a change at either end could start caching them.', 'edge-doctor' ); 294 $result->with_note( __( 'Narrow the rule so it does not cover wp-admin and wp-login.phpat all.', 'edge-doctor' ) );294 $result->with_note( __( 'Narrow the rule so it does not cover wp-admin and the login page at all.', 'edge-doctor' ) ); 295 295 296 296 return $result; -
edge-doctor/tags/1.0.2/src/Check/Result.php
r3775965 r3776031 304 304 return __( 'Edge Doctor could not learn the public address of your server, because the Cloudflare trace did not answer or SERVER_ADDR is not a public address.', 'edge-doctor' ); 305 305 case self::REASON_LOGIN_NOT_FOUND: 306 return __( 'The login page did not answer at wp-login.php, so it could not be checked. Its address has probably been changed, often by a security plugin.', 'edge-doctor' );306 return __( 'The login page could not be confirmed at the address WordPress gives, so it could not be checked. It may be hidden in a way WordPress does not know about.', 'edge-doctor' ); 307 307 case self::REASON_EDGE_CHALLENGE: 308 308 return __( 'Cloudflare answered the plugin with a challenge or a sign in page instead of the page, so it could not be read. The checks for requests from your server to itself report this.', 'edge-doctor' ); -
edge-doctor/tags/1.0.2/src/Check/ServerRequests/E2AccessAjax.php
r3775965 r3776031 91 91 $result->title = __( 'Cloudflare Access is in front of admin-ajax.php', 'edge-doctor' ); 92 92 $result->summary = __( 'A request to admin-ajax.php was sent to a Cloudflare Access sign in page. Your front end calls that address too, so features on the public site stop working for visitors who were never meant to sign in.', 'edge-doctor' ); 93 $result->with_note( __( 'Narrow the Access application so it covers wp-admin and wp-login.phpbut leaves admin-ajax.php alone.', 'edge-doctor' ) );93 $result->with_note( __( 'Narrow the Access application so it covers wp-admin and the login page but leaves admin-ajax.php alone.', 'edge-doctor' ) ); 94 94 $result->with_evidence( new Evidence( 'admin-ajax.php', (string) $ajax->status . ' to ' . $ajax_host, Evidence::LOOPBACK, true ) ); 95 95 -
edge-doctor/trunk/edge-doctor.php
r3775965 r3776031 4 4 * Plugin URI: https://rxnwebsolutions.com/edge-doctor/ 5 5 * Description: Detects common misconfigurations between Cloudflare and WordPress and explains how to fix them. Read-only. 6 * Version: 1.0. 16 * Version: 1.0.2 7 7 * Requires at least: 6.5 8 8 * Requires PHP: 7.4 … … 18 18 defined( 'ABSPATH' ) || exit; 19 19 20 define( 'EDGE_DOCTOR_VERSION', '1.0. 1' );20 define( 'EDGE_DOCTOR_VERSION', '1.0.2' ); 21 21 define( 'EDGE_DOCTOR_FILE', __FILE__ ); 22 22 define( 'EDGE_DOCTOR_DIR', plugin_dir_path( __FILE__ ) ); … … 27 27 define( 'EDGE_DOCTOR_DOCS_SR', false ); 28 28 // Address for "Report a false positive". Empty until the plugin is published on WordPress.org, and the link is not in the HTML until then (DECISIONS.md, D7). 29 define( 'EDGE_DOCTOR_SUPPORT_URL', ' ' );29 define( 'EDGE_DOCTOR_SUPPORT_URL', 'https://wordpress.org/support/plugin/edge-doctor/' ); 30 30 define( 'EDGE_DOCTOR_MIN_PHP', '7.4' ); 31 31 define( 'EDGE_DOCTOR_MIN_WP', '6.5' ); -
edge-doctor/trunk/languages/edge-doctor.pot
r3775965 r3776031 3 3 msgid "" 4 4 msgstr "" 5 "Project-Id-Version: Edge Doctor for Cloudflare® 1.0. 1\n"5 "Project-Id-Version: Edge Doctor for Cloudflare® 1.0.2\n" 6 6 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/edge-doctor\n" 7 7 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" … … 10 10 "Content-Type: text/plain; charset=UTF-8\n" 11 11 "Content-Transfer-Encoding: 8bit\n" 12 "POT-Creation-Date: 2026-10- 29T00:02:08+00:00\n"12 "POT-Creation-Date: 2026-10-30T20:42:34+00:00\n" 13 13 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" 14 14 "X-Generator: WP-CLI 2.12.0\n" … … 600 600 601 601 #: src/Check/PrivateCache/C1AdminCache.php:148 602 msgid "The login page could not be confirmed at wp-login.php, so this result rests on wp-admin alone."602 msgid "The login page could not be confirmed at the address WordPress gives, so this result rests on wp-admin alone." 603 603 msgstr "" 604 604 605 605 #: src/Check/PrivateCache/C1AdminCache.php:155 606 msgid "Cloudflare answered for wp-login.phpfrom its cache, but the answer was not the login page, so it is not the login page that is cached."606 msgid "Cloudflare answered for the login page address from its cache, but the answer was not the login page, so it is not the login page that is cached." 607 607 msgstr "" 608 608 … … 620 620 621 621 #: src/Check/PrivateCache/C1AdminCache.php:285 622 msgid "Find the cache rule that covers these addresses and exclude wp-admin and wp-login.phpfrom it."622 msgid "Find the cache rule that covers these addresses and exclude wp-admin and the login page from it." 623 623 msgstr "" 624 624 … … 632 632 633 633 #: src/Check/PrivateCache/C1AdminCache.php:294 634 msgid "Narrow the rule so it does not cover wp-admin and wp-login.phpat all."634 msgid "Narrow the rule so it does not cover wp-admin and the login page at all." 635 635 msgstr "" 636 636 … … 1054 1054 1055 1055 #: src/Check/Result.php:306 1056 msgid "The login page did not answer at wp-login.php, so it could not be checked. Its address has probably been changed, often by a security plugin."1056 msgid "The login page could not be confirmed at the address WordPress gives, so it could not be checked. It may be hidden in a way WordPress does not know about." 1057 1057 msgstr "" 1058 1058 … … 1174 1174 1175 1175 #: src/Check/ServerRequests/E2AccessAjax.php:93 1176 msgid "Narrow the Access application so it covers wp-admin and wp-login.phpbut leaves admin-ajax.php alone."1176 msgid "Narrow the Access application so it covers wp-admin and the login page but leaves admin-ajax.php alone." 1177 1177 msgstr "" 1178 1178 -
edge-doctor/trunk/readme.txt
r3775965 r3776031 5 5 Tested up to: 7.1 6 6 Requires PHP: 7.4 7 Stable tag: 1.0. 17 Stable tag: 1.0.2 8 8 License: GPLv2 or later 9 9 License URI: https://www.gnu.org/licenses/gpl-2.0.html … … 75 75 == Changelog == 76 76 77 = 1.0.2 = 78 * The report page links to the support forum on WordPress.org for reporting a false positive. 79 * The texts for a login page that could not be confirmed now speak of the address WordPress gives for it, which is what has been measured since 1.0.1, and the cache and Access advice names the login page wherever it was moved. 80 77 81 = 1.0.1 = 78 82 * The REST routes are registered on every site, also where the REST API is not under /wp-json/, as in WordPress Playground. -
edge-doctor/trunk/src/Check/PrivateCache/C1AdminCache.php
r3775965 r3776031 142 142 * unconfirmed login page becomes a note on it. Only when wp-admin 143 143 * is in order does the result say it could not look. A cached 404 144 * at wp-login.phpis not the login page leaking.144 * at the login page address is not the login page leaking. 145 145 */ 146 146 if ( in_array( $admin_class, array( self::CACHEABLE, self::BYPASS ), true ) ) { 147 147 $result = $this->judge( $admin_class ); 148 $result->with_note( __( 'The login page could not be confirmed at wp-login.php, so this result rests on wp-admin alone.', 'edge-doctor' ) );148 $result->with_note( __( 'The login page could not be confirmed at the address WordPress gives, so this result rests on wp-admin alone.', 'edge-doctor' ) ); 149 149 $result->with_note( Result::reason_text( $reason ) ); 150 150 } else { … … 153 153 154 154 if ( self::CACHEABLE === $login_class ) { 155 $result->with_note( __( 'Cloudflare answered for wp-login.phpfrom its cache, but the answer was not the login page, so it is not the login page that is cached.', 'edge-doctor' ) );155 $result->with_note( __( 'Cloudflare answered for the login page address from its cache, but the answer was not the login page, so it is not the login page that is cached.', 'edge-doctor' ) ); 156 156 } 157 157 … … 283 283 $result->title = __( 'Cloudflare is caching your admin pages', 'edge-doctor' ); 284 284 $result->summary = __( 'Cloudflare answered for wp-admin or the login page from its cache. A page built for one signed in person can be handed to somebody else, or to a visitor who is not signed in at all.', 'edge-doctor' ); 285 $result->with_note( __( 'Find the cache rule that covers these addresses and exclude wp-admin and wp-login.phpfrom it.', 'edge-doctor' ) );285 $result->with_note( __( 'Find the cache rule that covers these addresses and exclude wp-admin and the login page from it.', 'edge-doctor' ) ); 286 286 287 287 return $result; … … 292 292 $result->title = __( 'A cache rule reaches your admin pages', 'edge-doctor' ); 293 293 $result->summary = __( 'A cache rule covers wp-admin or the login page and is bypassing the cache for now. Only the headers your server sends keep those pages out, so a change at either end could start caching them.', 'edge-doctor' ); 294 $result->with_note( __( 'Narrow the rule so it does not cover wp-admin and wp-login.phpat all.', 'edge-doctor' ) );294 $result->with_note( __( 'Narrow the rule so it does not cover wp-admin and the login page at all.', 'edge-doctor' ) ); 295 295 296 296 return $result; -
edge-doctor/trunk/src/Check/Result.php
r3775965 r3776031 304 304 return __( 'Edge Doctor could not learn the public address of your server, because the Cloudflare trace did not answer or SERVER_ADDR is not a public address.', 'edge-doctor' ); 305 305 case self::REASON_LOGIN_NOT_FOUND: 306 return __( 'The login page did not answer at wp-login.php, so it could not be checked. Its address has probably been changed, often by a security plugin.', 'edge-doctor' );306 return __( 'The login page could not be confirmed at the address WordPress gives, so it could not be checked. It may be hidden in a way WordPress does not know about.', 'edge-doctor' ); 307 307 case self::REASON_EDGE_CHALLENGE: 308 308 return __( 'Cloudflare answered the plugin with a challenge or a sign in page instead of the page, so it could not be read. The checks for requests from your server to itself report this.', 'edge-doctor' ); -
edge-doctor/trunk/src/Check/ServerRequests/E2AccessAjax.php
r3775965 r3776031 91 91 $result->title = __( 'Cloudflare Access is in front of admin-ajax.php', 'edge-doctor' ); 92 92 $result->summary = __( 'A request to admin-ajax.php was sent to a Cloudflare Access sign in page. Your front end calls that address too, so features on the public site stop working for visitors who were never meant to sign in.', 'edge-doctor' ); 93 $result->with_note( __( 'Narrow the Access application so it covers wp-admin and wp-login.phpbut leaves admin-ajax.php alone.', 'edge-doctor' ) );93 $result->with_note( __( 'Narrow the Access application so it covers wp-admin and the login page but leaves admin-ajax.php alone.', 'edge-doctor' ) ); 94 94 $result->with_evidence( new Evidence( 'admin-ajax.php', (string) $ajax->status . ' to ' . $ajax_host, Evidence::LOOPBACK, true ) ); 95 95
Note:
See TracChangeset
for help on using the changeset viewer.
