Themeisle Docs

Appearance

Super Page Cache Cloudflare Permissions ​

Super Page Cache can connect to Cloudflare using either an API Token (recommended for security) or a Global API Key. Each method requires a specific set of permissions.

In this article

Authentication Methods ​

The plugin supports two methods to authenticate with Cloudflare's API:

API Tokens provide granular access control with specific permissions for better security. To set up using an API Token:

  1. Log into your Cloudflare dashboard and go to My Profile > API Tokens.
  2. Select Create Token and choose the option to create a custom token instead of using a template.
  3. Create a Zone policy and limit its resource rules to the domain this WordPress site uses.
  4. For the Zone policy, select these permissions:
    • Zone Read — lets the plugin list and select your Cloudflare domain.
    • Cache Purge — lets the plugin purge cached pages.
    • Cache Rules Edit — lets the plugin create and update its Cache Rule.
    • Transform Rules Edit — lets the plugin manage its Transform Rule.
  5. Continue to the summary, confirm the token has these permissions and is limited to the intended domain, then create it.
  6. Copy the generated token.
  7. In your WordPress settings, select API Token as the authentication mode, paste the token, and select your domain after the connection is verified.

These four Zone permissions are sufficient for the standard Cloudflare caching integration; it does not require account-level permissions. Cloudflare's WordPress template includes other permissions and does not include the two rule-editing permissions. If you use that template, review its permissions and add Cache Rules Edit and Transform Rules Edit before creating the token.

⚠️ Important: Without Zone Read, the plugin cannot fetch your domain list. Missing Cache Purge, Cache Rules Edit, or Transform Rules Edit can cause permission errors or prevent Cloudflare caching from working.

If a permission error appears when connecting ​

If the domain selector stays empty after connecting, your API token may be missing Zone Read. Missing Cache Purge, Cache Rules Edit, or Transform Rules Edit can also cause permission errors or prevent Cloudflare caching from working. To fix the permissions:

  1. In your Cloudflare dashboard, open My Profile > API Tokens and edit the token (or create a new custom token).
  2. Add any missing permissions from the list above, then save the edited token or create the replacement token.
  3. In WordPress, go to Super Page Cache > Settings > Cloudflare. Enter the updated token in Cloudflare API Token and reconnect to Cloudflare.
  4. Under Zone Selection, select the domain that matches your WordPress site and save the selection.

The domain configuration should save successfully, and Cloudflare caching should no longer remain disabled.

For more recovery steps, see Troubleshooting: Cloudflare zone dropdown is blank or frozen.

API Key ​

The Global API Key provides full account access and is less secure:

  1. Log into your Cloudflare dashboard
  2. Navigate to My Profile > API Tokens
  3. Scroll down to API Keys section
  4. Click View next to Global API Key
  5. Copy the API Key
  6. In plugin settings:
    • Select "API Key" authentication mode
    • Enter your Cloudflare account email
    • Paste your Global API Key

Note: API Token is the recommended authentication method as it follows security best practices by limiting access to only required permissions.

Was this helpful?