Skip to content
2 min readEngineeringThe NextPDF team

Rendering PDFs at the edge with Cloudflare Workers

The NextPDF Cloudflare adapter turns a Worker into an edge rendering endpoint your PHP app can call, with SSRF hardening and custom fonts from R2.

The NextPDF engine runs in-process, and for most applications that is the right place for it. Network edge rendering fits a specific need: turning HTML into a PDF close to the user, on demand, while Cloudflare operates the browser runtime.

NextPDF Cloudflare turns any Cloudflare Worker into a PDF rendering endpoint that your PHP application calls over HTTP. You send HTML and receive rendered PDF bytes. Cloudflare’s Browser Rendering API handles the rendering at the edge.

Calling it from PHP

The adapter is vendor-agnostic about HTTP—it takes any PSR-18 client and PSR-17 factories, so it drops into whatever your app already uses (Guzzle, Symfony HttpClient, Buzz):

edge-render.php
use NextPDF\Cloudflare\CloudflareHtmlRenderer;
use NextPDF\Cloudflare\CloudflareRendererConfig;

$config = new CloudflareRendererConfig(
workerUrl: 'https://pdf-renderer.your-subdomain.workers.dev/render',
apiToken: 'your-api-token',
);

$renderer = new CloudflareHtmlRenderer(
config: $config,
httpClient: $httpClient, // PSR-18 ClientInterface
requestFactory: $requestFactory, // PSR-17 RequestFactoryInterface
streamFactory: $streamFactory, // PSR-17 StreamFactoryInterface
);

$result = $renderer->render('<h1>Hello from the edge!</h1>');
file_put_contents('output.pdf', $result->pdfData);

Configure the Worker URL and token, provide your HTTP plumbing, and call render().

What it handles for you

The adapter applies default controls when a remote browser renders untrusted HTML:

  • SSRF protection—blocks crafted HTML from directing the Worker to internal resources, with HTML size limits, meta-refresh blocking, and base64-bomb detection.
  • Custom fonts from R2—loads fonts, including CJK fonts, from a Cloudflare R2 bucket for edge-rendered documents.
  • Automatic fallback—can use local Chrome through the Artisan extension when the Worker is unreachable.
  • Edge telemetry—render time, edge location (CF-Ray), and content-height metadata come back with the result for observability.

It accepts both binary application/pdf and JSON (base64) responses, so it works with whatever shape your Worker returns.

When to reach for it

If you generate your own application’s documents at scale, the in-process engine is simpler and removes a whole tier. The edge adapter fits when proximity to the user or offloading rendering from your app tier is the goal—a deliberate, bounded use of a remote renderer.

Every NextPDF adapter is free and uses the Apache License 2.0. You can inspect the code before sending it your HTML.