Themeisle Docs

Appearance

Super Page Cache Cloudflare Permissions ​

Super Page Cache can connect to Cloudflare using either an API Token (recommended for security) or a Global API Key. Each method requires a specific set of permissions.

In this article

Authentication Methods ​

The plugin supports two methods to authenticate with Cloudflare's API:

API Tokens provide granular access control with specific permissions for better security. To set up using an API Token:

  1. Log into your Cloudflare dashboard
  2. Navigate to My Profile > API Tokens
  3. Click Create Token
  4. Select the WordPress template
  5. Add the Zone > Cache Rules > Edit and Zone > Transform Rules > Edit permissions
  6. Click Continue to summary
  7. Review the token summary. Confirm it includes Zone > Zone > Read, Zone > Cache Rules > Edit, Zone > Transform Rules > Edit, and the zone-level permission that allows cache purging (clearing Cloudflare's cached copies of your site's pages). If any are missing, return to the permission editor and add them without removing the template's other permissions. Then click Create Token.
  8. Copy the generated token
  9. In plugin settings:
    • Select "API Token" authentication mode
    • Paste your API token
    • Select your domain from the dropdown after the token is verified

Keep all permissions supplied by the WordPress template. Verify that the finished token includes Zone > Zone > Read, which lets the plugin load the list of domains (zones) on your Cloudflare account, and the zone-level permission that allows cache purging. Do not assume the template includes everything required: check the token summary and add any missing permissions, including:

  • Zone > Cache Rules > Edit
  • Zone > Transform Rules > Edit

⚠️ Important: If you build a custom token instead of starting from the WordPress template, include all required permissions listed above, not only Zone > Zone > Read. Without that reading permission, the plugin cannot fetch your domain list. Missing cache-purging or rule-editing permissions can also cause permission errors. Review every permission on the summary screen before you click Create Token.

If a permission error appears when connecting ​

If the domain selector stays empty after connecting, your API token is commonly missing Zone > Zone > Read. This is not the only cause of a permission error: a missing zone-level cache-purging permission can cause a persistent permission error, prevent the selected domain configuration from saving, or leave Cloudflare caching disabled. To fix it:

  1. In your Cloudflare dashboard, open My Profile > API Tokens and edit the token you connected (or create a new one).
  2. Add any missing permissions: Zone > Zone > Read, Zone > Cache Rules > Edit, Zone > Transform Rules > Edit, and the zone-level permission that allows cache purging. Keep the token's other required permissions, review the summary, and save the edited token or create the replacement token.
  3. In WordPress, go to Settings > Super Page Cache > Cloudflare. Re-enter the updated or replacement token in Cloudflare API Token, then use the connection control to reconnect to Cloudflare. Reload the settings page.
  4. Under Zone Selection, select the domain that matches your WordPress site and save the selection.

The domain configuration should save successfully, and Cloudflare caching should no longer remain disabled.

For more recovery steps, see Troubleshooting: Cloudflare zone dropdown is blank or frozen.

API Key ​

The Global API Key provides full account access and is less secure:

  1. Log into your Cloudflare dashboard
  2. Navigate to My Profile > API Tokens
  3. Scroll down to API Keys section
  4. Click View next to Global API Key
  5. Copy the API Key
  6. In plugin settings:
    • Select "API Key" authentication mode
    • Enter your Cloudflare account email
    • Paste your Global API Key

Note: API Token is the recommended authentication method as it follows security best practices by limiting access to only required permissions.

Was this helpful?