https://preview.redd.it/rqvqhjqmxvkh1.png?width=2548&format=png&auto=webp&s=070804d56a907afaf4e8537399f8c0bd68efad94

Hey everyone,

With WordPress vulnerabilities being reported left and right, I wrote a simple solution called Camouflage. It disables WordPress/PHP access for public users and serves static HTML through the Apache web server using .htaccess rules.

The philosophy is simple, bad actors exploit vulnerable code in WordPress themes, plugins and even WordPress core. If we restrict public access to PHP, it becomes extremely challenging to exploit a website.

I noticed many people export static versions of their sites and host them on another server or CDN but that comes with maintenance issues.

Camouflage keeps things simple. It creates static versions of your pages, serves them directly through the web server (which also makes them fast) and disables public access to PHP. It automatically refreshes static pages whenever content is updated.

Logged in admins get a secret token installed in their browser. They can also download the token because it's what allows them to access the login page while PHP is blocked for public access.

Ajax and other dynamic requests are disabled by default. The plugin offers a Request Tracker that lets you track dynamic requests such as form submissions and Ajax calls. You can then allow specific requests and only those requests will be allowed to pass through.

I think this approach is pretty solid and offers a real solution instead of simply reporting vulnerabilities like other security plugins do.

The project is open source and available on github https://github.com/hamza-mairaj/camouflage. Feel free to report issues, and contributions are welcome.