=== Camouflage Security ===
Contributors: thevisionofhamza
Tags: security, cache, static, protection, performance
Requires at least: 5.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Disables WordPress for public users and serves a static snapshot instead, blocking every request that is not explicitly allowed.

== Description ==

WordPress's login page, admin AJAX endpoint, REST API, and core files are among the most commonly scanned and attacked surfaces on the web, simply because so many sites run WordPress. Most visitors to a typical site only ever read content. Camouflage Security takes the position that if a request is not something the site actually needs to serve dynamically, it should not reach WordPress at all, and if it is, it should only be reachable after an administrator has explicitly reviewed and allowed it.

Camouflage Security disables PHP for public visitors. Attackers routinely target PHP written by themes and plugins, and even by WordPress core itself. When public requests never reach PHP, most of those attacks simply cannot happen, which significantly improves your website's security.

= How it works =

* A built in crawler walks the site's sitemap and internal links and saves a static HTML snapshot of every page it finds.
* `.htaccess` serves those static files directly to visitors, so most requests never boot PHP or WordPress at all.
* Anything that cannot be served statically, such as an unrecognized path, an AJAX call, or a form submission, is blocked with a 404 by default until an administrator explicitly allows it.
* Logged in administrators automatically receive a signed bypass cookie, so they always see the live, editable site instead of the static cache.

== Features ==

= Static page caching =

Pages are crawled and saved as plain HTML, then served by `.htaccess` with no PHP execution for cache hits. Content updates automatically invalidate the relevant cached page.

= Login and core file lockdown =

`wp-login.php` and every other standalone WordPress core script at the site root are blocked for anyone without the admin bypass cookie or a one time login unlock link, closing off the most commonly targeted entry points.

= AJAX endpoint disguising =

`admin-ajax.php` is given a decoy public path (`/assets/sync` by default, configurable) that quietly proxies to the real endpoint, so cached pages never reveal the real WordPress AJAX URL.

= Optional asset and URL rewriting =

When enabled, theme, plugin, and core script, style, and image URLs are mirrored into the static cache under hashed filenames, so cached pages never reveal which theme or plugins are installed, or that the site runs WordPress at all.

= Dynamic request tracking and allow listing =

Every blocked request can be reviewed in the admin and explicitly allowed. Rules match on path, HTTP method, and the set of field names involved, not exact values, so a real form keeps working no matter what a visitor types into it.

= Admin access tools =

A signed bypass cookie is issued automatically on login. A backup login URL and a downloadable backup file are provided so an administrator can always get back in even if their browser cookie is lost.

== Installation ==

1. Upload the plugin to `wp-content/plugins/camouflage`, or clone this repository directly into that directory.
2. Activate it from the Plugins screen in wp-admin.
3. The plugin requires Apache with `mod_rewrite` enabled. It writes its own rules directly into `.htaccess`. It does not currently support nginx, since nginx does not read `.htaccess` files. An equivalent server block would need to be configured manually.

== Frequently Asked Questions ==

= What happens to normal content pages? =

Regular content pages are never blocked, only cached. Blocking only ever applies to requests WordPress itself could not resolve, AJAX calls, and POST submissions such as forms and comments.

= Will it work on nginx? =

No. The plugin relies on Apache's `.htaccess` files, which nginx does not read. An equivalent server block would need to be configured manually.

= Does disabling tracking stop requests from being blocked? =

No. Blocking is never affected by the tracking setting. Tracking only controls whether blocked requests are also logged to the Tracked Requests tab.

== Screenshots ==

1. The General settings tab, where the master switch, AJAX decoy path, and tracking options live.

== Open Source ==

Camouflage Security is open source and contributions are welcome. Visit the [GitHub repository](https://github.com/hamza-mairaj/camouflage) to report issues, suggest features, or submit a pull request.

== Changelog ==

= 1.0.1 =
* Resolve the AJAX endpoint and cache directory dynamically (admin_url() and wp_upload_dir()) so the plugin works in non-standard WordPress setups.
* Store the static cache in a plugin-slug folder inside the uploads directory.
* Renamed the plugin display name to Camouflage Security.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.1 =
* Improves compatibility with non-standard WordPress setups and renames the plugin to Camouflage Security.