Deskripsyon
Traffic Origin Guard helps protect your origin server from direct traffic by requiring a secret header value on every request.
Use case:
– Your site is behind Cloudflare or another reverse proxy.
– You want only proxy-originated requests to reach WordPress.
– You want automatic Apache rule management.
How it works:
– You set one token in plugin settings.
– The plugin writes Apache rules into .htaccess using a managed block.
– Requests missing the expected X-Origin-Secret header are blocked with HTTP 403.
Features:
– Apache .htaccess rule writer with managed BEGIN/END markers.
– Header validation status visibility on the settings page.
– One-click token utilities in admin (generate, copy, and “Use as token”).
– In-page Cloudflare setup guide with step-by-step instructions.
– Lockout recovery instructions displayed directly in the settings page.
– View details link on the Plugins list page.
– Automatic cleanup on plugin deactivation and uninstall.
Pag-install
- Upload the plugin folder to /wp-content/plugins/traffic-origin-guard/.
- Activate Traffic Origin Guard from Plugins in WordPress admin.
- Go to Settings -> Traffic Origin Guard.
- Generate a token using the generator on the settings page.
- In Cloudflare, go to Rules -> Transform Rules -> Modify Request Header and add a rule setting X-Origin-Secret to your token on all requests. Do this BEFORE saving the token to avoid locking yourself out.
- Paste the token into the token field and click Save Token. Confirm the Active server rules block appears on the page.
- Verify direct origin access without the header returns 403.
FAQ
-
Will this lock me out of wp-admin?
-
Yes, it can if misconfigured. This plugin enforces access at Apache level, so a wrong token/header setup can block wp-admin access.
To recover: connect to your server via FTP, SFTP, or your host’s file manager and open .htaccess in your WordPress root. Find and delete the entire block between (and including) the lines “# BEGIN Traffic Origin Guard” and “# END Traffic Origin Guard”. Save the file — your site will be accessible immediately. Then set up your Cloudflare Transform Rule first before re-entering the token.
-
Which servers are supported?
-
This plugin manages Apache .htaccess rules directly.
-
What if .htaccess is not writable?
-
The plugin cannot enforce protection until .htaccess is writable. Fix permissions/ownership and save settings again.
-
What header name does the plugin check?
-
X-Origin-Secret
Mga Review
Wala pang reviews para sa plugin na ito.
Mga Contributor at Developer
Ang “Traffic Origin Guard” ay open source software. Ang mga sumusunod na tao ay nag-ambag sa plugin na ito.
Mga Contributor
Isalin ang “Traffic Origin Guard” sa iyong wika.
Interesado sa development?
Tingnan ang code, i-check ang SVN repository, o mag-subscribe sa development log sa pamamagitan ng RSS.