[WordPress] 外掛分享： Camouflage Security – Static WordPress Firewall and PHP Isolation

內容簡介

Camouflage Security 是一款靜態 WordPress 防火牆與 PHP 隔離外掛，透過禁用 PHP 執行來保護網站，避免攻擊者利用漏洞。它將每個頁面轉換為靜態 HTML，顯著提升網站安全性與加載速度。

【主要功能】
• 靜態 HTML 提供
• 登入頁面與核心檔案鎖定
• AJAX 端點偽裝
• 動態請求追蹤與允許清單
• 管理員存取工具

外掛標籤

開發者團隊

原文外掛簡介

Every WordPress vulnerability is a PHP vulnerability. Vulnerabilities in core, themes, and plugins are all PHP code. Attackers cannot exploit code that never runs.
Camouflage Security disables PHP for public visitors entirely. It crawls your site, saves a static HTML snapshot of every page, and serves those files directly via .htaccess. When a public request arrives, WordPress never boots. No plugin runs. No theme code executes. There is nothing for an attacker to exploit.
Most security plugins try to block or filter the attacks that reach PHP. Camouflage takes a different position: if PHP never runs for public visitors, there is nothing to block.
Most attacks are bots. They scan for known WordPress URLs, probe the login page, fingerprint installed plugins and themes from URL patterns, and test for known vulnerabilities in specific versions. A site serving static HTML gives them nothing to work with. The login page returns 404. Plugin paths are absent from the page source. WordPress-specific endpoints are hidden or do not respond. Automated scanners pass by without identifying the site as a WordPress installation at all.
Static HTML also means every public page load is faster. Apache serves files directly from disk. No PHP boots. No database query runs. No plugin or theme code executes. Server resources that would otherwise be spent on PHP are freed up entirely, so the site handles more concurrent traffic on the same hardware.
How it works

A built-in crawler saves a static HTML snapshot of every page on the site.
.htaccess serves those files directly. PHP never runs for public visitors.
Anything that cannot be served statically, such as a form submission, an AJAX call, or an unrecognized path, is blocked with a 404 until an administrator explicitly reviews and allows it.

Who this is for
Camouflage Security is built for developers who want the strongest achievable WordPress security. It requires Apache with mod_rewrite and an initial setup session to allow the dynamic requests your site legitimately needs.
Features
Static HTML serving
Pages are crawled and saved as plain HTML, then served by .htaccess with no PHP execution. No WordPress boot. No database query. No plugin or theme code runs for any cached page. Content updates automatically invalidate the relevant cached file.
Login and core file lockdown
The login page and every other WordPress core entry point return 404 to anyone without the admin bypass cookie or a one-time login unlock link. Brute-force attacks against the login page cannot proceed when the login page does not exist for the attacker.
AJAX endpoint disguising
The AJAX endpoint is assigned a configurable decoy path (/assets/sync by default) that the server internally rewrites to the real endpoint. Cached pages reference the decoy path. No WordPress-specific URL is ever visible in the page source or server logs for public visitors.
Optional asset and URL rewriting
When enabled, theme, plugin, and core script, style, and image URLs are mirrored into the static cache under hashed filenames. Cached pages reference those hashed copies. Automated WordPress detection tools like WPScan and Wappalyzer find no identifying information in the page source.
Dynamic request tracking and allow-listing
Every blocked request can be reviewed in the admin and explicitly allowed. Rules match on path, HTTP method, and the set of field names, not exact field values, so a contact form keeps working regardless of what a visitor types. The model is an explicit-permit allowlist, not a blocklist, which means unknown requests are denied by default.
Admin access tools
A signed bypass cookie is issued automatically on login so administrators always see the live, editable site. A one-time login unlock link and a downloadable backup file ensure an administrator can always recover access even if their bypass cookie is lost.
Open Source
Camouflage Security is open source and contributions are welcome. Visit the GitHub repository to report issues, suggest features, or submit a pull request.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)Really Simple Security 是一款輕量級且易於使用的 WordPress...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款功能強大的 WordPress 外掛，旨在提升網站內容...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 是一個讓您在 WordPress 中安全上傳 SVG 檔案的最佳...LoginizerLoginizer 是一款 WordPress 外掛，旨在防止暴力破解攻擊，當...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role EditorUser Role Editor 外掛允許用戶輕鬆變更使用者角色和權限。用...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionKadence Security 是一款專為 WordPress 網站設計的安全外掛...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP PluginSiteGuard WP Plugin 旨在加強 WordPress 網站的登入及管理區...