Title: Camouflage Security – Static WordPress Firewall and PHP Isolation Author: Hamza Mairaj Published: 28. август 2026. Last modified: 10. септембар 2026. --- Претражи додатке ![](https://ps.w.org/camouflage/assets/icon-256x256.png?rev=3671259) # Camouflage Security – Static WordPress Firewall and PHP Isolation [Hamza Mairaj](https://profiles.wordpress.org/thevisionofhamza/) [Преузимање](https://downloads.wordpress.org/plugin/camouflage.1.0.2.zip) * [Детаљи](https://sr.wordpress.org/plugins/camouflage/#description) * [Прегледи](https://sr.wordpress.org/plugins/camouflage/#reviews) * [Постављање](https://sr.wordpress.org/plugins/camouflage/#installation) * [Изградња](https://sr.wordpress.org/plugins/camouflage/#developers) [Подршка](https://wordpress.org/support/plugin/camouflage/) ## Опис Every WordPress vulnerability is a PHP vulnerability. Vulnerabilities in core, themes, and plugins are all PHP code. Attackers cannot exploit code that never runs. Camouflage Security disables PHP for public visitors entirely. It crawls your site, saves a static HTML snapshot of every page, and serves those files directly via `. htaccess`. When a public request arrives, WordPress never boots. No plugin runs. No theme code executes. There is nothing for an attacker to exploit. Most security plugins try to block or filter the attacks that reach PHP. Camouflage takes a different position: if PHP never runs for public visitors, there is nothing to block. Most attacks are bots. They scan for known WordPress URLs, probe the login page, fingerprint installed plugins and themes from URL patterns, and test for known vulnerabilities in specific versions. A site serving static HTML gives them nothing to work with. The login page returns 404. Plugin paths are absent from the page source. WordPress- specific endpoints are hidden or do not respond. Automated scanners pass by without identifying the site as a WordPress installation at all. Static HTML also means every public page load is faster. Apache serves files directly from disk. No PHP boots. No database query runs. No plugin or theme code executes. Server resources that would otherwise be spent on PHP are freed up entirely, so the site handles more concurrent traffic on the same hardware. #### How it works * A built-in crawler saves a static HTML snapshot of every page on the site. * `.htaccess` serves those files directly. PHP never runs for public visitors. * Anything that cannot be served statically, such as a form submission, an AJAX call, or an unrecognized path, is blocked with a 404 until an administrator explicitly reviews and allows it. #### Who this is for Camouflage Security is built for developers who want the strongest achievable WordPress security. It requires Apache with `mod_rewrite` and an initial setup session to allow the dynamic requests your site legitimately needs. ### Features #### Static HTML serving Pages are crawled and saved as plain HTML, then served by `.htaccess` with no PHP execution. No WordPress boot. No database query. No plugin or theme code runs for any cached page. Content updates automatically invalidate the relevant cached file. #### Login and core file lockdown The login page and every other WordPress core entry point return 404 to anyone without the admin bypass cookie or a one-time login unlock link. Brute-force attacks against the login page cannot proceed when the login page does not exist for the attacker. #### AJAX endpoint disguising The AJAX endpoint is assigned a configurable decoy path (`/assets/sync` by default) that the server internally rewrites to the real endpoint. Cached pages reference the decoy path. No WordPress-specific URL is ever visible in the page source or server logs for public visitors. #### Optional asset and URL rewriting When enabled, theme, plugin, and core script, style, and image URLs are mirrored into the static cache under hashed filenames. Cached pages reference those hashed copies. Automated WordPress detection tools like WPScan and Wappalyzer find no identifying information in the page source. #### Dynamic request tracking and allow-listing Every blocked request can be reviewed in the admin and explicitly allowed. Rules match on path, HTTP method, and the set of field names, not exact field values, so a contact form keeps working regardless of what a visitor types. The model is an explicit-permit allowlist, not a blocklist, which means unknown requests are denied by default. #### Admin access tools A signed bypass cookie is issued automatically on login so administrators always see the live, editable site. A one-time login unlock link and a downloadable backup file ensure an administrator can always recover access even if their bypass cookie is lost. ### Open Source Camouflage Security is open source and contributions are welcome. Visit the [GitHub repository](https://github.com/hamza-mairaj/camouflage) to report issues, suggest features, or submit a pull request. ## Снимци екрана [⌊General settings tab⌉⌊General settings tab⌉[ General settings tab [⌊Cache tab⌉⌊Cache tab⌉[ Cache tab [⌊Admin access tab⌉⌊Admin access tab⌉[ Admin access tab ## Постављање 1. Upload the plugin to `wp-content/plugins/camouflage`, or clone this repository directly into that directory. 2. Activate it from the Plugins screen in wp-admin. 3. The plugin requires Apache with `mod_rewrite` enabled. It writes its own rules directly into `.htaccess`. It does not support nginx, since nginx does not read`. htaccess` files. ## ЧПП ### What happens to normal content pages? Regular content pages are never blocked, only cached. Blocking only ever applies to requests WordPress itself could not resolve, AJAX calls, and POST submissions such as forms and comments. ### Will it work on nginx? No. The plugin relies on Apache’s `.htaccess` files, which nginx does not read. An equivalent server block would need to be configured manually. ### Does disabling tracking stop requests from being blocked? No. Blocking is never affected by the tracking setting. Tracking only controls whether blocked requests are also logged to the Tracked Requests tab. ### Does this replace a WAF or a security plugin like Wordfence? It addresses a different layer. A WAF filters requests that reach PHP. Camouflage ensures most public requests never reach PHP at all. The two can coexist, but for many sites Camouflage makes a WAF redundant for the public-facing surface. ### What is the performance impact? Cache hits are served entirely by Apache from disk, with no PHP or database involved. Response times are typically faster than even a cached WordPress response. The only overhead is the initial cache build, which runs once and rebuilds automatically when content changes. ## Прегледи Нема рецензија за овај додатак. ## Сарадници и градитељи „Camouflage Security – Static WordPress Firewall and PHP Isolation“ је софтвер отвореног кода. Следећи људи су допринели овом додатку. Сарадници * [ Hamza Mairaj ](https://profiles.wordpress.org/thevisionofhamza/) [Преведите „Camouflage Security – Static WordPress Firewall and PHP Isolation“ на свој језик.](https://translate.wordpress.org/projects/wp-plugins/camouflage) ### Заинтересовани сте за градњу? [Прегледајте код](https://plugins.trac.wordpress.org/browser/camouflage/), проверите [SVN складиште](https://plugins.svn.wordpress.org/camouflage/) или се пријавите на [белешку градње](https://plugins.trac.wordpress.org/log/camouflage/) преко [RSS-а](https://plugins.trac.wordpress.org/log/camouflage/?limit=100&mode=stop_on_copy&format=rss). ## Белешка о изменама #### 1.0.2 * Show an admin notice when mod_rewrite is not available, so administrators know the .htaccess security rules are not active. #### 1.0.1 * Resolve the AJAX endpoint and cache directory dynamically (admin_url() and wp_upload_dir()) so the plugin works in non-standard WordPress setups. * Store the static cache in a plugin-slug folder inside the uploads directory. * Renamed the plugin display name to Camouflage Security. #### 1.0.0 * Initial release. ## Мета * Version **1.0.2** * Last updated **2 седмице раније** * Active installations **Мање од 10** * WordPress version ** 5.2 или новије ** * Tested up to **7.1.2** * PHP version ** 7.4 или новије ** * Language * [English (US)](https://wordpress.org/plugins/camouflage/) * Tags * [Brute Force](https://sr.wordpress.org/plugins/tags/brute-force/)[firewall](https://sr.wordpress.org/plugins/tags/firewall/) [hardening](https://sr.wordpress.org/plugins/tags/hardening/)[login protection](https://sr.wordpress.org/plugins/tags/login-protection/) [security](https://sr.wordpress.org/plugins/tags/security/) * [Напредни преглед](https://sr.wordpress.org/plugins/camouflage/advanced/) ## Оцене No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/camouflage/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/camouflage/reviews/) ## Сарадници * [ Hamza Mairaj ](https://profiles.wordpress.org/thevisionofhamza/) ## Подршка Имате нешто да кажете? Потребна вам је помоћ? [Види форум подршке](https://wordpress.org/support/plugin/camouflage/)