by Gabor Angyal 1 (0 reviews)

Bypass Guard for Cloudflare

Name: Bypass Guard for Cloudflare
Author: Gabor Angyal

Blocks requests that bypass Cloudflare by requiring a secret token header. For hosts that offer no stronger origin protection.

Bypass Guard for Cloudflare ranks #62,372 among WordPress.org plugins with 1+ active installations, is #2,854 of 5,058 in the Security category, a 1/5 rating from 0 reviews, and was last updated Oct 5, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.0.0 Current Version v1.0.0

Updated 1 month ago Last Update on 05 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#2,854 of 5,058 in Security

View on WordPress.org

Rank

#62,372

— No change

Active Installs

— No change

KW Avg Position

N/A

— No change

Downloads

403

+2 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

49,435

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #62,372

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.0
Last Updated: Oct 05, 2026
Requires WP: 6.2+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: Gabor Angyal

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Origin cloudflare firewall header security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Bypass Guard for Cloudflare

No. It is an independent open source plugin with no connection to Cloudflare, Inc. Please do not contact Cloudflare support about it; use the GitHub issue tracker instead.

Using FTP, SFTP or your hosting file manager, rename the folder /wp-content/plugins/bypass-guard-for-cloudflare to something else, such as bypass-guard-for-cloudflare-disabled. WordPress deactivates the plugin automatically, which also switches the filter off. Fix your Cloudflare rule, rename the folder back and reactivate the plugin. With WP-CLI you can simply run wp plugin deactivate bypass-guard-for-cloudflare. WP-CLI is never filtered.

Check that: The Transform Rule is deployed and matches all incoming requests. The header name is exactly BYPASS-GUARD-TOKEN and the value matches the token in the plugin, with no extra spaces. You are visiting the site through its domain name, not the server's IP address. The site's DNS records are proxied (orange cloud). Some hosts run their own proxy in front of WordPress that strips unfamiliar headers. If the header never arrives even though the Cloudflare rule is correct, ask your host whether custom request headers are passed through.

It means the plugin has received at least one request with the correct token since the token was generated. It is not a live check: if you later delete or change the Cloudflare rule, the status still shows Detected. Regenerating the token resets it.

Disable the filter, then select Regenerate Token. The plugin creates a new token and resets the status to Not detected. Update the value in your Cloudflare rule, reload the settings page until the header is detected again, then re-enable the filter. The Regenerate Token button is only shown while the filter is disabled. Changing the token while the filter is on would immediately block every request, including your own, because Cloudflare would still be sending the old value.

The filter is switched off. Your token, detection status and log are kept. When you activate the plugin again, the filter stays off until you enable it. If you changed your Cloudflare rule in the meantime, regenerate the token so that detection is checked again before you enable the filter.

Usually not. When WordPress calls itself through your domain, the request normally goes through Cloudflare and carries the header. On some hosts, however, the server resolves its own domain to a local address and skips Cloudflare. If scheduled tasks or Site Health checks start failing after you enable the filter, this is the likely cause. Switching to a real server cron job that runs WP-Cron without an HTTP request solves it.

Only if they connect to your server's IP address directly. Uptime monitors, payment gateway callbacks and webhooks normally use your domain and pass through Cloudflare. Check any integration that is configured with your server's IP address.

Yes. IP addresses and user agents may count as personal data under laws such as the GDPR. The data stays in your own WordPress database and is never sent anywhere. Only the 500 most recent entries are kept and you can clear the log at any time. Depending on your jurisdiction, you may need to mention this in your privacy policy, typically as security logging based on legitimate interest.

It is 24 hexadecimal characters (96 bits) generated with a cryptographically secure random number generator, and it is compared in constant time to prevent timing attacks. Guessing it is not practical. The realistic risk is leaking it, so treat it like a password, keep SSL/TLS set to Full (strict) and regenerate it if you think it has been exposed.