Traffic Origin Guard
Traffic Origin Guard helps protect your origin server from direct traffic by requiring a secret header value on every request. Use case: – Your site is behind Cloudflare or another reverse proxy. – You want only proxy-originated requests to reach WordPress. – You want automatic Apache rule managemen
About this tool.
Traffic Origin Guard helps protect your origin server from direct traffic by requiring a secret header value on every request.
Use case: – Your site is behind Cloudflare or another reverse proxy. – You want only proxy-originated requests to reach WordPress. – You want automatic Apache rule management.
How it works: – You set one token in plugin settings. – The plugin writes Apache rules into .htaccess using a managed block. – Requests missing the expected X-Origin-Secret header are blocked with HTTP 403.
Features: – Apache .htaccess rule writer with managed BEGIN/END markers. – Header validation status visibility on the settings page. – One-click token utilities in admin (generate, copy, and “Use as token”). – In-page Cloudflare setup guide with step-by-step instructions. – Lockout recovery instructions displayed directly in the settings page. – View details link on the Plugins list page. – Automatic cleanup on plugin deactivation and uninstall.
Getting started.
- 01Upload the plugin folder to /wp-content/plugins/traffic-origin-guard/.
- 02Activate Traffic Origin Guard from Plugins in WordPress admin.
- 03Go to Settings -> Traffic Origin Guard.
- 04Generate a token using the generator on the settings page.
- 05In Cloudflare, go to Rules -> Transform Rules -> Modify Request Header and add a rule setting X-Origin-Secret to your token on all requests. Do this BEFORE saving the token to avoid locking yourself out.
- 06Paste the token into the token field and click Save Token. Confirm the Active server rules block appears on the page.
- 07Verify direct origin access without the header returns 403.
Frequently asked questions.
Will this lock me out of wp-admin?
Yes, it can if misconfigured. This plugin enforces access at Apache level, so a wrong token/header setup can block wp-admin access.
To recover: connect to your server via FTP, SFTP, or your host’s file manager and open .htaccess in your WordPress root. Find and delete the entire block between (and including) the lines “# BEGIN Traffic Origin Guard” and “# END Traffic Origin Guard”. Save the file — your site will be accessible immediately. Then set up your Cloudflare Transform Rule first before re-entering the token.
