Franky

<p><strong>Images Sync for Cloudflare</strong> automatically uploads your WordPress images to Cloudflare Images and stores optimized delivery URLs directly in post meta. Perfect for headless setups, JAMstack sites, or anyone who wants fast, globally-distributed images without changing their workflow.</p>
<h4>Why Use This Plugin?</h4>
<p>Headless frontends need stable, cacheable CDN URLs. This plugin makes WordPress the source of truth while Cloudflare Images handles delivery and optimization. No custom resolvers needed — just query the meta field.</p>
<h4>Features</h4>
<ul>
<li><strong>Flexible Mappings</strong> — Map any image source (Featured Image, ACF fields, post meta) to Cloudflare Images with customizable delivery URL storage</li>
<li><strong>Preset System</strong> — Define reusable presets for OG images, thumbnails, heroes, squares — consistent URLs across your site</li>
<li><strong>Preview Studio</strong> — Visually test how images look with different presets before going live</li>
<li><strong>Auto-Sync</strong> — Images sync automatically on post save, or bulk-process existing content via Action Scheduler</li>
<li><strong>Flexible Variants</strong> — Smart detection prevents broken images and 9429 errors</li>
<li><strong>Headless-Ready</strong> — URLs stored in post meta, perfect for GraphQL/REST API consumption</li>
<li><strong>WP-CLI Support</strong> — <code>wp cfimg sync</code> commands for scripted workflows</li>
<li><strong>Secure Storage</strong> — API token encrypted with libsodium (AES-256 fallback)</li>
<li><strong>No Lock-in</strong> — Your images stay in WordPress Media Library; Cloudflare URLs are plain meta values</li>
</ul>
<h4>Security</h4>
<p>Your Cloudflare API token is encrypted at rest using modern cryptography (libsodium or AES-256-CBC with HMAC). The token is never stored in plain text and is only decrypted when making API requests.</p>
<h4>Requirements</h4>
<ul>
<li>Cloudflare account with <a href="https://www.cloudflare.com/products/cloudflare-images/" rel="nofollow ugc">Cloudflare Images</a> subscription</li>
<li>API Token with “Cloudflare Images: Edit” permission</li>
</ul>
<h3>External services</h3>
<p>This plugin optionally connects to external Cloudflare services to upload, manage, and deliver images. No connection is made until the user configures API credentials and explicitly triggers a sync, test, or preview action.</p>
<h4>Cloudflare Images API</h4>
<p>This plugin sends requests to the <a href="https://api.cloudflare.com/" rel="nofollow ugc">Cloudflare API</a> (<code>api.cloudflare.com</code>).</p>
<p>Data sent to Cloudflare (only when the user configures credentials and triggers actions):</p>
<ul>
<li>API token — for authentication (sent as a Bearer token header, never logged or stored in plain text)</li>
<li>Image files — binary content of WordPress media attachments</li>
<li>Image metadata — WordPress attachment ID and a purpose label (e.g. “preview”)</li>
<li>
<p>Configuration updates — Flexible Variants enable/disable flag</p>
</li>
<li>
<p><a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a></p>
</li>
<li><a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a></li>
<li><a href="https://developers.cloudflare.com/api/" rel="nofollow ugc">Cloudflare API Documentation</a></li>
</ul>
<h4>Cloudflare Image Delivery</h4>
<p>Delivery URLs use the <a href="https://imagedelivery.net/" rel="nofollow ugc">Cloudflare Image Delivery</a> CDN (<code>imagedelivery.net</code>). These URLs are stored in post meta and served directly to site visitors by their browsers. The plugin itself makes one request to this service to detect Flexible Variants support (canary check).</p>
<p>No visitor data, IP addresses, cookies, or personal information is ever sent to Cloudflare by this plugin.</p>
<ul>
<li><a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a></li>
<li><a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a></li>
<li><a href="https://developers.cloudflare.com/images/" rel="nofollow ugc">Cloudflare Images Documentation</a></li>
</ul>
<h3>Privacy Policy</h3>
<p>This plugin does not collect, store, or transmit any personal user data. Only image files and technical metadata (attachment IDs, image hashes) are sent to Cloudflare.</p>
<h3>Credits</h3>
<p>Developed by <a href="https://301.st" rel="nofollow ugc">301st</a> with <a href="https://claude.ai" rel="nofollow ugc">Claude AI</a>.</p>


Images Sync for Cloudflare

Auto-sync WordPress images to Cloudflare Images. Stores optimized CDN URLs in post meta — ready for headless, ACF, or classic themes.

Elementor

<p>Sticklight Connector provides a structured way to use the WordPress user system in external or React-based applications.</p>
<p>The plugin extends the WordPress REST API with additional endpoints that allow authenticated clients to retrieve user context and interact with WordPress data, while fully respecting core authentication methods, roles, and capability checks.</p>
<p>Sticklight does not replace WordPress authentication. It relies on <code>wp_authenticate</code> for credential validation and WordPress Application Passwords for API access, and follows standard permission checks (<code>current_user_can</code>) for all requests.</p>
<h4>Typical use cases</h4>
<ul>
<li>React applications connected to a WordPress site</li>
<li>Headless or hybrid WordPress setups</li>
<li>Admin or user dashboards built outside wp-admin</li>
<li>External tools that require authenticated access to WordPress data</li>
</ul>
<h4>Features</h4>
<ul>
<li>Authenticates via <code>wp_authenticate</code> and issues Application Passwords for API access</li>
<li>Adds REST endpoints for login, logout, and retrieving current user context</li>
<li>Enforces WordPress capability checks on all requests</li>
<li>Supports cross-origin headless setups</li>
<li>Extensible via WordPress hooks and filters</li>
</ul>
<h3>Usage</h3>
<h4>Login</h4>
<p>Authenticate with username (or email) and password:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/login
</code></pre>
<p>On success the response includes an Application Password for subsequent API requests and the authenticated user:</p>
<pre><code>{
  "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX",
  "user": {
    "user_id": 1,
    "username": "admin",
    "display_name": "Admin",
    "email": "admin@example.com",
    "roles": ["administrator"]
  }
}
</code></pre>
<p>Use the returned <code>app_password</code> with HTTP Basic Authentication for all further requests.</p>
<h4>Current user</h4>
<p>Retrieve the current authenticated user:</p>
<pre><code>GET /wp-json/sticklight/v1/auth/me
</code></pre>
<h4>Logout</h4>
<p>Revoke the current Application Password session:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/logout
</code></pre>
<h4>User registration</h4>
<p>User creation is handled through the built-in WordPress REST API (<code>POST /wp-json/wp/v2/users</code>) and requires administrator authentication.</p>
<h4>Accessing protected data</h4>
<p>Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.</p>
<h3>Security</h3>
<p>Sticklight follows WordPress security practices:</p>
<ul>
<li>Authenticates via <code>wp_authenticate</code>, which respects all security plugin hooks (rate limiting, two-factor authentication, brute-force protection)</li>
<li>Issues Application Passwords scoped to individual sessions</li>
<li>Does not provide user registration — accounts must be created by an administrator</li>
<li>Applies capability checks (<code>current_user_can</code>) on all endpoints</li>
<li>Does not expose private data without proper permissions</li>
</ul>
<p>For external applications, it is recommended to:</p>
<ul>
<li>Use HTTPS</li>
<li>Restrict allowed origins</li>
<li>Avoid exposing sensitive endpoints unnecessarily</li>
</ul>


Sticklight

Use WordPress authentication and permissions in external React applications via secure REST API endpoints.

Images Sync for Cloudflare vs Sticklight