WP Masquerade FAQ

A WordPress plugin that changes what your site reveals to bots and detection tools: it presents your site as another platform (Joomla!, Drupal, PrestaShop…), removes WordPress-specific clues, moves the login page and spots bots probing for vulnerabilities. See all features.

No. Your theme, content and pages stay exactly the same. The only thing that changes is file URLs (images, stylesheets, scripts), and only if you turn on the aliases in WP Masquerade Pro. When you are logged in as an administrator, you see the site without the disguise, so check the result in a private browsing window.

Your page URLs do not change. With Pro aliases, your image URLs do change; at the level that blocks the old URLs, external links to your images stop working. Removing oEmbed discovery (Pro) removes rich previews of your posts on other sites. Hiding the author list (Pro) also removes the author sitemap, which has no effect on your pages and posts. Every setting with a side effect like this is flagged in the interface.

The free version hides WordPress, presents your site as Joomla!, Drupal, PrestaShop, TYPO3 or MediaWiki (or any name you choose), removes the basic technical links (RSD, Windows Live Writer, shortlinks), moves the login page and hides wp-login.php and wp-admin, blocks pingbacks and XML-RPC, and counts trapped bots. Pro adds everything else: 41 profiles and Wappalyzer markers, REST and oEmbed discovery removed, hidden author list, file URL aliases, unknown AJAX requests answered with 404, login attempt limiting, two-factor authentication, security headers, integrity check, email alerts, banning, signature feed, updates and priority support. Full comparison.

No, and no plugin can honestly promise that. WP Masquerade removes the clues automated tools rely on most and adds those of another platform. Some traces may remain: URLs inside CSS or JavaScript files, CSS classes or script names specific to certain plugins, responses from an upstream cache.

No. It reduces what bots learn about your site and closes known doors, which shrinks the surface exposed to automated attacks. It does not filter SQL injection or XSS, does not scan for malware and does not protect against denial-of-service attacks. It works very well alongside those tools.

No. It blocks pingbacks and XML-RPC and spots bots probing your site, but it doesn’t filter comments or forms. See what it blocks and which anti-spam plugin to pair it with.

A firewall and a malware scanner, which it doesn’t provide, while leaving login management to a single plugin. Our comparison of the best WordPress security plugins details the options.

• fully emulate Drupal, phpBB or any other software;
• remove every trace of WordPress or guarantee a given result in a detector;
• individually anonymize each plugin or theme;
• rewrite every URL found in CSS or JavaScript files, or in external responses;
• move the entire admin area, change the REST API URL or every PHP entry point;
• change WordPress mentions visible in your theme;
• provide a SQL/XSS firewall, an antivirus or DDoS protection;
• fix vulnerabilities in core, themes or plugins: keep them up to date;
• guarantee compatibility with every host, cache and plugin.

Yes, absolutely. Updates, backups, limited access rights and strong passwords are still essential. The disguise adds to these good practices; it does not replace them.

The vulnerabilities of an old Joomla! version don’t exist on your WordPress site: bots that try them fail, and may land in the traps. That said, the guide recommends not counting on this to deter a determined attacker.

Not with the free version: diagnostics stay local. With Pro, the site contacts the license server to activate the license, check it once a day, and fetch the signature feed and updates; the integrity check asks wordpress.org for the official file list, sending only your WordPress version and language. No visitor data is ever sent. The disguised plugins catalogue is updated during the same daily check. The security overview meant for an agency is only sent if the site administrator turns it on. Privacy policy.

The three headers enabled by default (X-Frame-Options, Referrer-Policy, Permissions-Policy) are safe for most sites, and a header already set elsewhere is never overwritten. The baseline CSP disables the embedded PDF previews of the File block. HSTS is the only setting that is hard to undo: browsers will require HTTPS for a year. Security headers in detail.

Not always: a page served straight from a server cache or a CDN, without going through WordPress, may not carry them. The “Check the home page” button shows what your visitors actually receive; if the headers are missing, add them to your cache or server configuration.

No. It compares WordPress core files (wp-admin, wp-includes and root files) against the official checksums from wordpress.org. Plugins, themes, uploads and wp-config.php are not checked. The integrity check in detail.

That’s expected: each administrator’s first login only records their browser. After that, an alert goes out whenever the account is used from an unknown browser. If the test report doesn’t arrive either, your site probably can’t send email: an SMTP plugin usually fixes that. Email alerts in detail.

Yes, with Pro: the AI crawlers tab sorts 37 known crawlers (GPTBot, ClaudeBot, Google-Extended, CCBot…) into families and adds the rules to your robots.txt. The quick choice “Allow search and AI answers, block training” keeps you cited by AI engines without becoming training material. robots.txt is only a request: optional strict blocking also refuses blocked crawlers that identify themselves, but not those posing as a browser. Googlebot and Bingbot are never affected, and what has already been collected stays collected. AI crawler control in detail.

Yes. The Agency tab of the member area groups your sites by client, shows a security score from 0 to 100 per site, sends settings profiles, builds a printable client report and sets up white-label. Nothing happens without the site: its administrator ticks, in the Pro License tab, what they agree to share or receive; everything is off by default. The agency dashboard in detail.

The free version works without any server rule. For Pro file aliases, rules are generated for Apache, LiteSpeed, o2switch (PowerBoost), OpenLiteSpeed, Nginx, IIS and Caddy; on managed hosting, send the block to your server administrator. Details for each server.

Cache purging is built in for LiteSpeed Cache, WP Rocket and WP Super Cache. Remember to exclude the new login URL from the cache before testing it. For any other cache or CDN, purge it with its own tool.

No. Only single-site WordPress (one site per install) is supported.

Not for the same features: two disguises will contradict each other. Turn off the other plugin’s path or login changes before you continue. The diagnostics flag them.

Pro features stop, along with updates, the signature feed and support. The free features keep working, with nothing to reinstall. Two safeguards prevent anything from breaking: an alias plan that has already been verified stays in effect (your file URLs don’t change), and accounts already using two-factor authentication keep it. A new license turns Pro back on with your existing settings.

1, 10, 100 or unlimited, depending on your plan. Each activated domain name uses one slot, and you can release a slot at any time. Each site is activated with its own activation code, generated in your member area. On every plan, a license accepts at most 5 new site activations per 24 hours; re-activating a site that is already activated or moving the license does not count. See pricing.

After buying, install WP Masquerade Pro (a single plugin: the free version is included), generate an activation code for the address of the site in your member area, and paste it in WP Masquerade → Pro license. You never type the license key into a site. The Install WP Masquerade tab of your member area guides you step by step.

From your member area, which gives you access to the Stripe billing portal. Your license stays active until the end of the paid period; after that, Pro features stop and the free features keep working, with the two safeguards described above.

Yes. All prices are shown excluding tax. The publisher is exempt from VAT under the French small-business scheme: “TVA non applicable, art. 293 B du CGI” (VAT not applicable, Article 293 B of the French General Tax Code). No VAT is added at checkout, so the amount you pay equals the price shown excl. tax.

Add define('CMS_MASQUERADE_DISABLE', true); to wp-config.php: all transformations stop and wp-login.php works again. All recovery procedures.

Log in with a backup code. If you don’t have one, another administrator can turn off two-factor authentication from your user profile. As a last resort: define('CMP_DISABLE_2FA', true); in wp-config.php.

Deactivating a plugin does not remove the rules added to .htaccess, and the URL rewriting lives in WP Masquerade Pro. Reactivate Pro, or restore your previous server rules, then purge your caches.