Linux 软件免费装

在这里免费安装WordPress以及其他软件

Traffic Origin Guard

开发者 jasond727
更新时间 2026年6月19日 12:53
PHP版本: 8.3 及以上
WordPress版本: 7.0
版权: GPLv2 or later
版权网址: 版权信息

标签

security headers apache cloudflare hardening

下载

1.0.0

详情介绍:

Traffic Origin Guard helps protect your origin server from direct traffic by requiring a secret header value on every request. Use case:

安装:

  1. Upload the plugin folder to /wp-content/plugins/traffic-origin-guard/.
  2. Activate Traffic Origin Guard from Plugins in WordPress admin.
  3. Go to Settings -> Traffic Origin Guard.
  4. Generate a token using the generator on the settings page.
  5. In Cloudflare, go to Rules -> Transform Rules -> Modify Request Header and add a rule setting X-Origin-Secret to your token on all requests. Do this BEFORE saving the token to avoid locking yourself out.
  6. Paste the token into the token field and click Save Token. Confirm the Active server rules block appears on the page.
  7. Verify direct origin access without the header returns 403.

常见问题:

Will this lock me out of wp-admin?

Yes, it can if misconfigured. This plugin enforces access at Apache level, so a wrong token/header setup can block wp-admin access. To recover: connect to your server via FTP, SFTP, or your host's file manager and open .htaccess in your WordPress root. Find and delete the entire block between (and including) the lines "# BEGIN Traffic Origin Guard" and "# END Traffic Origin Guard". Save the file — your site will be accessible immediately. Then set up your Cloudflare Transform Rule first before re-entering the token.

Which servers are supported?

This plugin manages Apache .htaccess rules directly.

What if .htaccess is not writable?

The plugin cannot enforce protection until .htaccess is writable. Fix permissions/ownership and save settings again.

What header name does the plugin check?

X-Origin-Secret