ES Football Bypass for Cloudflare

ES Football Bypass for Cloudflare is a WordPress plugin created by David Carrero Fernandez-Baillo to help Spanish website owners protect their legitimate sites from collateral damage caused by mass IP blocks ordered during football matches. The project is open source (GPLv2) and available on GitHub: https://github.com/dcarrero/cf-football-bypass

The plugin automatically monitors football events in Spain by querying hayahora.futbol and, based on the result, manages Cloudflare DNS records to toggle between Proxied and DNS Only modes. This prevents legitimate visitors from being affected by judicial blocks targeting pirate football streaming.

The Problem

In Spain, during football matches, mass IP blocks are enforced by judicial orders to combat pirate streaming. These blocks also affect legitimate websites that have nothing to do with football, causing traffic and revenue losses.

The Solution

When football is detected: – Automatically disables the Cloudflare proxy for selected DNS records – Your website switches to DNS Only mode, avoiding potentially blocked Cloudflare IPs – After the configured cooldown period, automatically re-enables the Cloudflare proxy

Two interface modes: Simple and Advanced

Since version 1.9.6 the plugin ships with two interface modes that you can switch from Settings → Interface mode:

• Simple (default on new installs, recommended for agency/client sites): shows only the essentials. Block status, manual proxy ON/OFF buttons, basic email notifications on state changes, Cloudflare credentials, bypass behavior and uninstall options. Logs, feed diagnostics panel, staleness threshold, log retention and external cron token are hidden to reduce noise for non-technical users. Logs are still written to disk — you can always switch to Advanced if you need to diagnose something.
• Advanced (default on upgrades from earlier versions): shows everything, including the full feed diagnostics panel, the logs tab, the technical console and the advanced options. Ideal for developers, power users, or when you need to diagnose behavior or configure a server-side cron.

There is also a standalone subpage “Is there football now?” that simply answers YES or NO based on the public feed, with a short note about the data source. Perfect to share the link with a final client that just wants to know if there are active blocks right now.

Key Features

Full Automation – Automatic monitoring every X minutes (configurable 5-60 min) – Automatic bypass activation/deactivation – Integrated WordPress cron system

Dual Cloudflare Authentication Support – Global API Key (traditional) – API Token with specific permissions (more secure)

Granular Control – Specific DNS record selection (A, AAAA, and CNAME) – Configurable bypass duration (60-600 minutes) – Customizable cooldown interval after disabling Cloudflare – Manual control for special cases

Informative Dashboard – Real-time football status – Last check performed – Bypass status (active/inactive)

Additional Tools – Cloudflare connection test button – Manual football status check – Manual activation/deactivation buttons – Detailed logging for debugging and auditing – Protected endpoint for external cron

External Services

This plugin connects to the following external services:

hayahora.futbol

The plugin periodically queries the endpoint https://hayahora.futbol/estado/data.json to check whether there are active IP blocks during football events in Spain. This query runs automatically based on the configured cron interval (default: every 15 minutes) and can also be triggered manually from the admin panel. – Data sent: An HTTP GET request with the site’s home URL in the User-Agent header. No personal or visitor data is transmitted. – URL: https://hayahora.futbol/ – About the service and privacy: https://hayahora.futbol/#sobre-los-bloqueos – Terms of use: The service is free, open source, and does not collect personal data from plugin users or their visitors. – Trust: the plugin acts on what this feed reports. If the feed reported blocks that do not exist, the selected records would switch to DNS Only and your origin IP would become visible in DNS while the bypass lasts. The plugin limits this with HTTPS, the minimum number of affected ISPs, the staleness threshold and the cooldown, and you can always force the proxy back on by hand.

Cloudflare API

The plugin uses the official Cloudflare API (https://api.cloudflare.com/client/v4/) to read DNS records and toggle the proxy status (Proxied/DNS Only) for selected records. It requires API credentials that you provide in the plugin settings. Credentials are stored in the WordPress database and sent via HTTPS headers to Cloudflare. – Data sent: API credentials (in headers), DNS record modifications (record ID, type, name, content, proxied status). – URL: https://api.cloudflare.com/ – Terms of Service: https://www.cloudflare.com/terms/ – Privacy Policy: https://www.cloudflare.com/privacypolicy/

Server IP Detection Services

The plugin detects your server’s outgoing IP address (displayed in the Settings page) by querying three public services. Only the server’s own IP is returned; no personal or visitor data is transmitted. Results are cached for 1 hour. – https://api.ipify.org/ – Provided by ipify. Privacy Policy: https://www.ipify.org/ – https://checkip.amazonaws.com/ – Provided by Amazon Web Services. Privacy Policy: https://aws.amazon.com/privacy/ – https://icanhazip.com/ – Provided by Cloudflare. Privacy Policy: https://www.cloudflare.com/privacypolicy/

Affiliate Links

The plugin’s operation page includes affiliate links clearly marked with “(aff)” to VPN services and security tools. These links are optional and do not affect the plugin’s functionality.

Cron and Automation

How does the cron system work?

The plugin uses WordPress internal cron (wp_cron) which runs when there are visits to the website. This is usually sufficient for most sites.

What if my site has low traffic and cron doesn’t run regularly?

Go to ES Football Bypass > Configuración (the plugin’s Settings page) and copy the token from the “External cron” section. With that token you can set up a real server cron:

*/15 * * * * curl -s “https://yourdomain.com/wp-cron.php?cfbcolorvivo_cron=1&token=YOUR_TOKEN_HERE” > /dev/null 2>&1

You can regenerate the token by clearing the field and saving settings (a new one is generated). This endpoint only runs the plugin check, without depending on visits. It is always available and answers only requests that carry the token, so it cannot be switched off: if you do not use it, simply never share the URL.

The token travels in the URL, so it can end up in your web server, proxy or Cloudflare access logs. Anyone who has it can only trigger the same check the cron job runs, not change settings or choose which records are switched. If you think it has leaked, regenerate it and update your crontab.

What is the “Cooldown after disabling Cloudflare”?

This is the waiting time (default 60 minutes) that the plugin respects before checking if Cloudflare can be re-enabled after detecting a block. During this period, the proxy remains in “DNS Only” mode even if the JSON stops marking the domain, avoiding rapid activation/deactivation cycles.

How do I verify that cron is working correctly?

In the Operation tab, click “WP-Cron Diagnostics” to see the next execution and the result of the last check. You can also review the integrated logs.

Abilities API

Since 2.0.0 the plugin registers five abilities through the WordPress Abilities API (WordPress 6.9 and newer), under the es-football-bypass category. This lets the REST API, MCP servers and AI agents read the block status and operate the bypass without going through the admin screens.

Every ability requires the manage_options capability, declares JSON Schemas for its input and output, and carries readonly/destructive/idempotent annotations so clients know what is safe to call.

HTTP methods over REST

WordPress derives the HTTP method from each ability’s annotations, so REST clients must use the right verb (MCP clients call abilities by name and are unaffected):

• get-status and list-dns-records are readonly , so they are served over GET , with input as query parameters ( ?input[type]=A ).
• set-managed-records and run-check are served over POST , with input in the JSON body ( {"input": {...}} ).
• set-proxy is annotated destructive , so it is served over DELETE . Pass its input as query parameters ( ?input[mode]=off ): a JSON body is not read on DELETE requests.

es-football-bypass/get-status

Read-only. Returns whether La Liga IP blocks are active right now, whether this site resolves to a blocked IP, whether the bypass is engaged, the resolved IPs, how many records are managed, and the last check and feed timestamps.

es-football-bypass/list-dns-records

Read-only. Returns the cached DNS records with their proxy state and whether the plugin manages each one. Optional input: type ( A , AAAA or CNAME ) and managed_only .

es-football-bypass/set-managed-records

Replaces the list of records the plugin is allowed to switch. Input: record_ids (array of Cloudflare record IDs). IDs that do not exist in the zone are returned in ignored_ids . Pass an empty array to stop the plugin from touching DNS at all.

es-football-bypass/run-check

Runs the same check as the cron job: fetches the hayahora.futbol feed and applies the bypass policy, which may switch the managed records.

es-football-bypass/set-proxy

Forces the managed records to Proxied (CDN) or DNS Only. Input: mode ( on or off ). Annotated as destructive, since it changes live DNS at Cloudflare. Returns an error when no records are managed or Cloudflare credentials are missing.

Forcing the proxy with set-proxy or the manual buttons is a one-off action: it does not change bypass_active , and the next check applies the automatic policy again. If blocks are active, a forced Proxy ON is switched back to DNS Only; if they are not, a forced Proxy OFF is switched back on.

Logs and Auditing

Where can I see the action history?

In the ES Footb

1. 01Download and Install Download the plugin zip file
2. 02Extract (or upload the resulting folder) to wp-content/plugins/es-football-bypass-for-cloudflare/
3. 03Go to your WordPress dashboard > Plugins > ES Football Bypass for Cloudflare > Activate
4. 04Cloudflare Configuration Go to ES Football Bypass > Configuración (the plugin’s Settings page)
5. 05Select your authentication type (Global API Key or API Token)
6. 06Enter your Cloudflare credentials
7. 07Add your domain’s Zone ID
8. 08Plugin Configuration Set the check interval (recommended: 15 minutes)
9. 09Adjust the cooldown interval after disabling Cloudflare (default: 60 minutes)
10. 10Click “Test connection and load DNS”
11. 11Select the DNS records you want to manage
12. 12Save the configuration

Getting Cloudflare Credentials

For Global API Key: 1. Go to Cloudflare > My Profile > API Tokens 2. In “API Keys”, copy your “Global API Key” 3. You will also need your account email

For API Token (recommended): 1. Go to Cloudflare > My Profile > API Tokens 2. Click “Create Token” 3. Use the “Custom” template 4. Required permissions: – Zone:Read (to read zone information) – DNS:Read (to list DNS records) – DNS:Edit (to modify proxy status)