=== Masquerade Security ===
Contributors: jedfolio
Tags: security, hide wordpress, hide login, hardening, bots
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.8.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Bots pick targets from the clues your site gives away. Hide WordPress, hide your login page and drop off their lists. No code, fully reversible.

== Description ==

Right now, a bot is reading your site. It does not know you and it does not care. In a few seconds it spots the clues every WordPress site gives away: a generator tag, a login page at a famous address, a comment signed by a plugin with its version number. Then it files your site on a list: WordPress, this plugin, this version.

You never see that moment. You see the next one: a flaw is published in that plugin, and every site on the list can be tried within hours.

**What if your site simply was not on those lists?**

Masquerade Security removes the clues bots read first, so your site stops looking like an easy WordPress target.

= In two minutes =

Activate the plugin, open Getting started, pick a mode, choose the software to imitate and turn masking on. From that moment, logged-out visitors and bots get a different site:

* The WordPress generator tag and version are gone from your pages and feeds.
* Your pages announce Joomla!, Drupal, TYPO3, PrestaShop or MediaWiki instead, with the exact tag that software prints.
* The signed comments and generator tags of plugins such as Yoast SEO, Elementor or LiteSpeed Cache disappear from the source code.
* The technical links WordPress adds to every page are removed, and pingbacks are switched off.
* The Bot traps tab starts counting the bots that come looking for flaws.

You keep working as usual: while you are logged in, you see the real site.

= Hide WordPress =

The generator tag and version disappear from pages and RSS or Atom feeds. So do the remote editing links (RSD, Windows Live Writer), shortlinks, the "X-Redirect-By: WordPress" header, the debugging comments recent WordPress versions add to inline scripts and styles, and their loading markers (data-wp-strategy). WordPress-specific body classes (wp-singular, page-id-12...) are removed only when no stylesheet or script of the page relies on them.

*Why it matters:* these are the first things detection tools read. Removing them costs nothing and breaks nothing.

= Look like another CMS =

Choose Joomla!, Drupal, TYPO3, PrestaShop or MediaWiki, with a version number if you wish, or type a name of your own. Your pages and feeds then carry the generator text exactly as that software prints it.

*Why it matters:* a bot that believes your site runs Joomla! tries Joomla! flaws, which your WordPress site does not have.

= Hidden login page =

Pick your own login address, such as /member-access/. First it works alongside wp-login.php. One step further, wp-login.php, wp-admin and the usual guesses (/login, /admin, /dashboard) answer "Not Found" to logged-out visitors. AJAX, forms and password-protected posts keep working. Addresses already used by a page, a post or a folder are refused, with free alternatives suggested.

*Why it matters:* password-guessing bots aim at wp-login.php. When it does not exist, they have nothing to try.

= Traces of the 50 most used plugins and themes =

For the 50 most installed plugins and themes on wordpress.org (Elementor, Yoast SEO, WooCommerce, Contact Form 7, LiteSpeed Cache, Site Kit, Rank Math, Jetpack, Astra and more), the generator tags, signed HTML comments and brand markers they add to your pages are removed. Each plugin's own setting is used first, so the pages your cache stores are clean too. The Identity tab lists your active plugins and theme and tells you, for each one, what is hidden and what stays visible, and why. An option removes all HTML comments from public pages.

*Why it matters:* "plugin X, version Y" is exactly what attack lists are built on.

= Fewer doors to knock on =

Pingbacks are disabled and their header removed. XML-RPC, an old entry point often used for password guessing, can be blocked in one click (it also cuts off Jetpack and the old WordPress mobile app, and the settings screen says so).

*Why it matters:* bots try the doors they know first. Closed doors mean less noise and fewer attempts.

= Bot traps =

Requests that only a bot makes are counted: the admin pages of the software you imitate (/administrator/ for Joomla!), probes for .env, .git, database dumps, phpMyAdmin or web shells, and visits to the WordPress addresses you closed. Your real pages never trigger a trap: only addresses that do not exist on your site are watched. You see the last 30 days and the most targeted addresses.

*Why it matters:* you see what bots are looking for, and you see your disguise at work.

= Safe by design =

* **Tested before applied.** A new login address stays inactive until you have opened it once while logged in. You cannot lock yourself out by mistake.
* **Emergency switch.** One line in wp-config.php turns every change off, even if you cannot reach your admin.
* **Nothing in WordPress core.** No core file is modified, and wp-config.php and the .htaccess file at the root of your site are never edited.
* **Admins see the real site.** Anyone who can edit posts sees the unmasked site, so the toolbar, the editor and previews keep working. Logged-in customers and members see the masked site, like visitors.
* **Fails safe.** The code of scripts, styles and structured data is never changed. If a page cannot be processed safely, it is sent unchanged.
* **Reversible.** Turn masking off or deactivate the plugin and your site is exactly as before. Your settings stay until you delete the plugin.
* **Private.** No account, no tracking, no external call. Everything stays on your site.

= Who it is for =

Bloggers who want peace of mind. Small businesses whose site has to stay up. Online shops that cannot afford a hacked checkout. Agencies and freelancers who look after many sites and want a simple, safe baseline for each one. No code, no server file to edit, and it runs on shared hosting.

= Honest limits =

* Masquerade Security reduces automated targeting. It does not fix vulnerabilities: keep WordPress, your plugins and your theme up to date, and keep backups.
* No tool makes a site undetectable. A person who studies your pages can still find clues, such as CSS classes and JavaScript variables that plugins need to work.
* In this plugin, file addresses (/wp-content/, /wp-includes/) are not changed. Detection tools that read them will still see WordPress.

= Free and Pro =

Everything above is complete in this plugin, with no licence key, quota or time limit. If you want to go further, WP Masquerade Pro is a separate paid plugin that includes this one and adds file address aliases that replace /wp-content/, a catalogue of 250 plugins and themes, 41 imitation profiles, two-step verification, login attempt limiting, AI crawler control and a member area to follow all your sites. Your settings carry over. Details on [wp-masquerade.com](https://www.wp-masquerade.com/).

== Installation ==

1. In your admin, go to Plugins > Add New Plugin, search for "Masquerade Security", then click Install Now and Activate. You can also upload the ZIP file in Plugins > Add New Plugin > Upload Plugin.
2. Open the Masquerade Security menu (mask icon in the admin sidebar).
3. Follow the Getting started screen. Nothing changes for visitors until you turn masking on.
4. If you use a cache, purge it after saving. The Diagnostics tab has a button that purges LiteSpeed Cache, WP Super Cache and WP Rocket; purge any other cache or CDN from its own screen.

== Frequently Asked Questions ==

= Will it break my site? =

It is designed not to. Masking only removes markers that nothing on your pages needs, a body class is only removed when no stylesheet or script uses it, and the code of scripts and styles is never changed. The new login address is only enabled after you have tested it. If something still looks wrong, turn masking off: the site is back to normal at once.

= Does it work with caching plugins? =

Yes. The plugin uses each cache plugin's own setting to remove its signature comment, so the pages stored in the cache are clean. After changing settings, purge the cache: one button in the Diagnostics tab does it for LiteSpeed Cache, WP Super Cache and WP Rocket; purge other caches from their own screen. The new login page is never cached.

= Does it work with Cloudflare? =

Yes. Cloudflare delivers the masked pages as they are. If Cloudflare caches your HTML pages, purge its cache after changing settings so visitors get the masked version.

= Does it work with my host? =

The plugin works inside WordPress with standard hooks. It needs no server rule, no .htaccess edit and no request from your server to itself, so it behaves the same on Apache, LiteSpeed and Nginx, on shared hosting (o2switch, OVHcloud, Hostinger, IONOS and others) as on a VPS. On Apache and LiteSpeed it writes one small .htaccess file inside its own folder, so scanners cannot read its readme and translation files; on Nginx those files stay readable. If your host has its own cache, purge it after changing settings.

= Does it support multisite? =

No. The plugin is for single-site installations. On a multisite network it changes nothing.

= Does it affect SEO? =

Search engines do not use the generator tag, the technical links or the comments it removes. Your content, titles, meta descriptions, canonical links, structured data and sitemaps are untouched. One trade-off: speculative loading (WordPress 6.8 and later) is turned off while WordPress is hidden, so browsers no longer prefetch the next page on hover.

= Does it work with WooCommerce? =

Yes. The WooCommerce generator tag and signed comments are removed. The cart, checkout and customer accounts keep working, and logged-in customers see the masked shop like any visitor. WooCommerce cookies and CSS classes stay, because the shop and cache plugins rely on them.

= Does it work with Polylang or WPML? =

Yes. The login address check looks at your pages in every language. The WPML generator tag and the redirect header that names Polylang are removed. Their language cookies and classes stay, because they are needed to switch languages.

= How do I undo everything? =

Turn off the master switch in the Getting started tab, or deactivate the plugin: your site is back as it was. If you cannot reach your admin, add `define('CMS_MASQUERADE_DISABLE', true);` to wp-config.php: every change stops and wp-login.php works again. Deleting the plugin removes its settings.

= How can I check the result? =

Logged in, you see the real site, so open it in a private window. View the source code, and run a detector such as the Wappalyzer browser extension. Compare with the Identity tab: it tells you which clues are hidden and which ones stay visible, and why. Detectors that read file addresses (/wp-content/) will still report WordPress in this plugin.

= Can visitors still find my new login address? =

wp-login.php and wp-admin do not lead to it. It can still appear in login links your own pages show: the comment form when users must be registered, "Log in to Reply" links, the Meta widget and your theme's login links. Remove those links to keep the address private.

= Does it slow down my site? =

It adds no script, no stylesheet and no external request to your pages. The work happens on the server, in one pass over the page before it is sent, and the files it reads to check body classes are cached. With a page cache, that pass happens once, when the page is stored.

== Screenshots ==

1. Getting started: master switch and step-by-step progress (protection mode, software to imitate, login page, result check).
2. Identity: choose the software your site announces (Joomla! here) and how much of WordPress stays visible.
3. Identity: plugins and theme detected on your site, what is already hidden and what detection tools can still see.
4. Protection: move or hide the login page and close the entry points bots try first, such as XML-RPC.
5. Bot traps: requests to addresses that do not exist on your site are counted, with the most targeted ones.
6. Troubleshooting: the one-line wp-config.php switch that turns every change off if you get locked out.

== Changelog ==

= 0.8.4 =
* Plugin catalogue checked against the code of each plugin: Elementor and Complianz generated folders limited to their public CSS and font files, Site Kit tag and SVG Support scripts recognised, Astra local fonts folder added.
* Brand comments of a very long HTML comment are still removed.

= 0.8.3 =
* Page caches are purged automatically after each settings save, so visitors never get a page cached before the change.
* Hidden login page: after "Lost password" and registration, the confirmation page opens at the new login address.
* Bot traps only count real page visits: images or scripts loaded by a browser for another page no longer count.
* Themes that print their own pingback link (Astra, Storefront, Sydney...): the link is removed once pingbacks are off.
* More robust cleaning of pages that use custom HTML elements.

= 0.8.2 =
* With Jetpack active, the protection modes keep hardening at level 1, so Jetpack keeps its connection to WordPress.com.
* "Purge caches" also purges W3 Total Cache, WP Fastest Cache, SiteGround Optimizer, Breeze, Hummingbird, Cache Enabler, Comet Cache, WP-Optimize, Autoptimize, FlyingPress, Super Page Cache and NitroPack.
* On a multisite network, a message explains that masking stays paused.
* "Current mode" is shown again on the mode in use, and applying a mode no longer reports a capped level by mistake.
* Drupal imitation: a visitor whose address contains a q= search parameter is no longer taken for a robot.

= 0.8.1 =
* Protection levels are now shown as a progressive scale: each level clearly adds to the previous ones, with what is included and what the next level would add.
* The login page settings now say where you are and the next step until the new address is tested.
* The WordPress version is no longer shown in the addresses of core styles and scripts (?ver=): while WordPress is hidden, it becomes a neutral code.
* New setting "Disable WordPress emoji", on by default: the emoji script and styles WordPress adds to every page are removed.

= 0.8.0 =
* Redesigned settings screens: clearer pages grouped by goal, switches and choice cards, risky options explained with how to undo them, and better mobile layout.

= 0.7.2 =
* WordPress-specific body classes are now hidden on public pages, with responsive videos keeping their shape.

= 0.7.1 =
* WordPress's script loading markers (data-wp-strategy) are now removed from public pages.
* Small code quality improvements for the wordpress.org directory.

= 0.7.0 =
* Security fixes for the hidden login page and the Customizer.
* Settings now save correctly from WP-Cron, the REST API and WP-CLI.

= 0.6.1 =
* Traces of the 50 most installed plugins and themes removed.
* Identity tab: what is hidden and what stays visible, plugin by plugin.
* Clearer messages when a login address is refused, with free alternatives.
* Logged-in customers see the masked site like visitors.
* New option to remove all HTML comments from public pages.
* Own admin menu with one entry per tab.

= 0.6.0 =
* New name: Masquerade Security.
* Admin available in 7 languages.

== Upgrade Notice ==

= 0.8.4 =
Plugin catalogue checked against the plugins' code. Your settings are kept.

= 0.8.3 =
Caches purged after each save, login and trap fixes. Your settings are kept.

= 0.8.2 =
Jetpack-friendly modes, more caches purged, small fixes. Your settings are kept.

= 0.8.1 =
Clearer protection level settings, WordPress version and emoji script hidden. Your settings are kept.

= 0.8.0 =
New, clearer settings screens. Your settings are kept.

= 0.7.2 =
Hides WordPress-specific body classes on public pages. Recommended for all users.

= 0.7.1 =
Removes one more WordPress marker from public pages. Recommended for all users.
