Camouflage Security
WordPress’s login page, admin AJAX endpoint, REST API, and core files are among the most commonly scanned and attacked surfaces on the web, simply because so many sites run WordPress. Most visitors to a typical site only ever read content. Camouflage Security takes the position that if a request is not something the site actually needs to serve dynamically, it should not reach WordPress at all, and if it is, it should only be reachable after an administrator has explicitly reviewed and allowed it.
Camouflage Security disables PHP for public visitors. Attackers routinely target PHP written by themes and plugins, and even by WordPress core itself. When public requests never reach PHP, most of those attacks simply cannot happen, which significantly improves your website’s security.
How it works
- A built in crawler walks the site’s sitemap and internal links and saves a static HTML snapshot of every page it finds.
.htaccessserves those static files directly to visitors, so most requests never boot PHP or WordPress at all.- Anything that cannot be served statically, such as an unrecognized path, an AJAX call, or a form submission, is blocked with a 404 by default until an administrator explicitly allows it.
- Logged in administrators automatically receive a signed bypass cookie, so they always see the live, editable site instead of the static cache.
Features
Static page caching
Pages are crawled and saved as plain HTML, then served by .htaccess with no PHP execution for cache hits. Content updates automatically invalidate the relevant cached page.
Login and core file lockdown
wp-login.php and every other standalone WordPress core script at the site root are blocked for anyone without the admin bypass cookie or a one time login unlock link, closing off the most commonly targeted entry points.
AJAX endpoint disguising
admin-ajax.php is given a decoy public path (`/assets/sync` by default, configurable) that quietly proxies to the real endpoint, so cached pages never reveal the real WordPress AJAX URL.
Optional asset and URL rewriting
When enabled, theme, plugin, and core script, style, and image URLs are mirrored into the static cache under hashed filenames, so cached pages never reveal which theme or plugins are installed, or that the site runs WordPress at all.
Dynamic request tracking and allow listing
Every blocked request can be reviewed in the admin and explicitly allowed. Rules match on path, HTTP method, and the set of field names involved, not exact values, so a real form keeps working no matter what a visitor types into it.
Admin access tools
A signed bypass cookie is issued automatically on login. A backup login URL and a downloadable backup file are provided so an administrator can always get back in even if their browser cookie is lost.
Open Source
Camouflage Security is open source and contributions are welcome. Visit the GitHub repository to report issues, suggest features, or submit a pull request.