What it does
On the Scale plan, WPClientHub connects to your own Cloudflare account with an API token you create, and then, for every site you link to its Cloudflare zone:
- Purges the cache automatically after safe updates finish, after an AutoPilot rollback and after a restore — so visitors get the updated pages instead of old cached copies. Every purge (and every failed one, with the reason) is written to the site's activity log, e.g. “Cloudflare cache purged after update batch #12”.
- Adds a Purge cache button and a Development mode switch to the site page. Development mode stops Cloudflare caching the zone; Cloudflare switches it off by itself after 3 hours, and the page shows when.
- Checks SSL and DNS once a day and when you link the site: the zone's SSL/TLS mode (Off and Flexible are flagged), Always Use HTTPS, whether the site's A/AAAA/CNAME record is proxied (orange cloud), and whether an active edge certificate covers the site's hostname. Problems appear in the site's Security report under Access & transport, with a plain-English explanation and the steps to fix them.
- Collects cache stats once a day from Cloudflare's GraphQL Analytics API — requests, the share served from cache, bandwidth saved and threats blocked — and shows the last 7 and 30 days on the site page and in a Cloudflare section of the site's client reports.
What it doesn't do
- We don't proxy your traffic, sit between Cloudflare and your sites, or change DNS. Everything goes through Cloudflare's own API with your token.
- We don't sell or resell Cloudflare plans. Your Cloudflare account, plan and bill stay yours. Cloudflare's free plan works.
- We never change SSL, DNS or cache settings for you. The only settings call is the Development mode switch you press.
- Cache stats are for the whole zone, as Cloudflare reports them. If several sites share one zone (shop.example.com and blog.example.com), each shows the zone's totals.
- A purge purges everything in the zone, not only the one hostname.
Create the API token
- In Cloudflare, open My Profile → API Tokens → Create Token, and choose Create Custom Token.
- Give it these permissions (the minimum — nothing account-wide):
| Permission | Used for |
|---|---|
| Zone → Zone → Read | Finding the zone for each site |
| Zone → Cache Purge → Purge | Purges after updates, rollbacks and restores, and the Purge cache button |
| Zone → Zone Settings → Edit | The Development mode switch, and reading the SSL mode and Always Use HTTPS |
| Zone → SSL and Certificates → Read | Checking the edge certificate covers the site |
| Zone → DNS → Read | Checking the site's record is proxied |
| Zone → Analytics → Read | Cache stats on the site page and in reports |
- Under Zone Resources, include all zones, or only the zones of the clients you manage here.
- Create the token and copy it. Don't use the Global API Key — it can do anything in your account, and WPClientHub doesn't accept it.
How to
- In WPClientHub, open Settings → Integrations, paste the token into Cloudflare and press Verify & connect. We check it with Cloudflare straight away (/user/tokens/verify) and confirm it can read zones; a token that can't is refused with the reason.
- The token is stored encrypted. From then on only its last four characters are shown. Agencies with more than one Cloudflare account can connect a token for each.
- Open a site → Overview. In the Cloudflare card press Find zone by domain: we look for a zone named after the site's hostname, then its parent domains (www.client.com → client.com). If none matches, press Pick the zone and choose it from the token's list.
- Linking runs the SSL/DNS checks and pulls the last 31 days of stats. The card then shows the checks, the cache stats, and which permissions the token has for that zone.
- Leave Purge automatically after updates, rollbacks and restores on (the default), or switch it off per site.
- Use Purge cache (it asks first) and the Dev mode switch whenever you need them. Check again re-runs the checks and refreshes the stats.
Limits & defaults
| Plans | Scale only. Not part of the Agency trial. |
| Cloudflare plan | Any, including Free |
| Automatic purge | On for every linked site; purges everything in the zone |
| Checks and stats | Daily, and when a site is linked or you press Check again |
| Retries | A purge that hits Cloudflare's rate limit or an API outage is retried (30 s, 2 min, 5 min, 15 min, honouring Cloudflare's Retry-After). A bad token, a missing permission or a missing zone is reported at once instead. |
| Security score | SSL mode Off/Flexible and an uncovered edge certificate are failed checks under Access & transport; Always Use HTTPS off and a DNS-only record are warnings |
| Permissions | Owners and admins connect and remove tokens; owners, admins and techs link sites, purge and use development mode; viewers can look |
| Leaving Scale | Nothing is deleted. Tokens, links, the last checks and the stats stay visible, marked paused; daily checks and automatic purges stop and start again when you're back on Scale |
Troubleshooting
“The Cloudflare token is missing the … permission”
The token works but Cloudflare refused that one call. In Cloudflare, go to My Profile → API Tokens, edit the token, add the permission named in the message for that zone (or all zones), and save. You don't need to paste the token again — the next check or purge picks it up.
“Cloudflare rejected the API token”
The token was deleted, rolled or has expired in Cloudflare. Create a new one with the permissions above, connect it in Settings → Integrations, and link the affected sites again (the old token can be disconnected).
Find zone by domain says no zone was found
None of your connected tokens can see a zone named after the site's hostname or its parent domains. Either the token is limited to other zones (edit its Zone Resources in Cloudflare), the site is on a different Cloudflare account (connect that account's token too), or the zone is named differently — press Pick the zone and choose it from the list.
The SSL check says Flexible
On Flexible, Cloudflare talks to your server over plain HTTP, which WordPress often answers with a redirect back to HTTPS — the “too many redirects” loop. Make sure the server has a certificate, then set SSL/TLS to Full (strict) in Cloudflare and press Check again.
A purge failed after an update
The site's Cloudflare card and its activity log show the reason. Rate limits and Cloudflare outages are retried automatically; for anything else, fix the cause and press Purge cache.