kryptonmediagroup

<p>Cyclone Static generates fully-rendered static HTML files for every page on your WordPress site and instructs Apache to serve them directly — bypassing PHP, WordPress, and the database for anonymous visitors.</p>
<p>When a static file exists for a requested URL, Apache reads it from disk and sends it without starting PHP or querying the database. The visitor receives a complete HTML page. Their browser runs your JavaScript, plays your audio, renders your animations — everything works as it did before, because the static file contains the same HTML WordPress would have generated.</p>
<p>Logged-in users, POST requests, query strings, and administrative paths bypass the static cache and receive live WordPress as normal.</p>
<h4>Key features</h4>
<ul>
<li><strong>Static file serving</strong> — Apache serves files directly from disk. PHP and the database are not involved in serving anonymous page requests.</li>
<li><strong>Automatic regeneration</strong> — When you publish or update a post or page, it is automatically queued for regeneration. You do not need to do anything.</li>
<li><strong>Reduced attack surface</strong> — Static HTML files do not execute PHP or query a database. Common WordPress-targeted attack vectors that require a live PHP process — such as SQL injection via PHP, PHP code execution, and xmlrpc.php abuse — do not apply to anonymous page requests served as static files.</li>
<li><strong>CDN integration</strong> — Works alongside W3 Total Cache. Direct integration with Bunny.net, Cloudflare, KeyCDN, and Amazon CloudFront is available in Cyclone Static Pro.</li>
<li><strong>W3 Total Cache compatible</strong> — Installs its .htaccess rules before W3TC rules. Works alongside or without W3TC.</li>
<li><strong>Non-destructive</strong> — Deactivating the plugin removes the .htaccess rules and WordPress resumes normal operation. Your cached files are not deleted without your explicit consent — a prompt appears when you deactivate, asking whether to keep or delete them.</li>
<li><strong>Free and open</strong> — No license required. Support via the WordPress.org community forums.</li>
</ul>
<h4>System requirements</h4>
<ul>
<li>WordPress 6.0 or later</li>
<li>PHP 8.0 or later</li>
<li><strong>Apache web server</strong> with mod_rewrite enabled</li>
<li>.htaccess support enabled (AllowOverride All or equivalent)</li>
<li>WordPress Multisite is not supported in this version — Multisite support is available in Cyclone Static Pro</li>
</ul>
<p><strong>Nginx users:</strong> Cyclone Static manages .htaccess automatically on Apache. If your server runs Nginx, the Settings page includes a ready-to-paste Nginx server block under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Nginx Configuration</strong>.</p>
<h4>CDN support</h4>
<p>The free version works automatically alongside W3 Total Cache — CDN purges are routed through W3TC when it is active.</p>
<p>Direct API integration with Bunny.net, Cloudflare, KeyCDN, and Amazon CloudFront is available in Cyclone Static Pro.</p>
<h4>Privacy</h4>
<p>Cyclone Static does not collect, transmit, or store any personal data. The queue table stores only URLs. No external service is contacted except the CDN purge APIs you explicitly configure.</p>
<h3>Support</h3>
<p>Support is provided via the WordPress.org community forums. Post your question there — answers are public, so search first as your question may already be answered. For private inquiries, you can reach us at support@kryptonmediagroup.com. Confirmed bugs are addressed through plugin updates. Private one-on-one support is not offered via the forums.</p>
<h3>External Services</h3>
<p>Cyclone Static can optionally connect to the following third-party services to purge cached content from your CDN. These connections are only made when you configure a CDN provider under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> CDN Integration</strong> and a purge is triggered. No data is sent to these services unless you explicitly configure them.</p>
<h4>Bunny.net</h4>
<p>Used for CDN cache purging. Your Bunny.net API key and Pull Zone ID are sent to the Bunny.net API.<br />
* Service: https://bunny.net/<br />
* API documentation: https://docs.bunny.net/reference/purgepublicpullzone<br />
* Privacy policy: https://bunny.net/privacy/</p>
<h4>Cloudflare</h4>
<p>Used for CDN cache purging. Your Cloudflare API token and Zone ID are sent to the Cloudflare API.<br />
* Service: https://www.cloudflare.com/<br />
* API documentation: https://developers.cloudflare.com/api/resources/cache/methods/purge/<br />
* Privacy policy: https://www.cloudflare.com/privacypolicy/</p>
<h4>KeyCDN</h4>
<p>Used for CDN cache purging. Your KeyCDN API key and Zone ID are sent to the KeyCDN API.<br />
* Service: https://www.keycdn.com/<br />
* API documentation: https://www.keycdn.com/api<br />
* Privacy policy: https://www.keycdn.com/privacy</p>
<h4>Amazon CloudFront</h4>
<p>Used for CDN cache invalidation. Your AWS Access Key, Secret Key, and CloudFront Distribution ID are sent to the Amazon CloudFront API.<br />
* Service: https://aws.amazon.com/cloudfront/<br />
* API documentation: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateInvalidation.html<br />
* Privacy policy: https://aws.amazon.com/privacy/</p>


Cyclone Static

Serve static HTML files directly from disk — no PHP, no database queries for anonymous visitors.

Faison

<p><a href="http://faisonz.com/" title="Faison Zutavern's Personal Blog" rel="nofollow ugc">Faison Zutavern</a>, <a href="https://profiles.wordpress.org/jvalcq" title="Jon's WordPress.org Profile" rel="nofollow ugc">Jon Valcq</a>, and <a href="https://profiles.wordpress.org/emmaee" title="Emma's WordPress.org profile" rel="nofollow ugc">Emma Edgar</a>, from <a href="http://www.orionweb.net/" title="Milwaukee Area Web Developers" rel="nofollow ugc">Orion Group LLC</a>, bring superior Brute Force Attack protection to WordPress with their new plugin, <em>Project Force Field</em>. By tracking failed login attempts and taking advantage of Apache’s mod_rewrite module, Project Force Field stops Brute Force Attacks from bogging down your sites and servers.</p>
<p><em>Special thanks to <a href="http://www.aykcreative.com/" title="Ayk Creative | Graphic Support for your Projects" rel="nofollow ugc">Chris Aykroid</a> for the plugin banner 😀</em></p>
<h4>Contributing</h4>
<p>If you would like to contribute or fork Project Force Field, we currently have a repo on Bitbucket. You can <a href="https://bitbucket.org/oriongroup/project-force-field/" rel="nofollow ugc">find it here</a></p>
<h4>Features!</h4>
<ul>
<li><strong>Sends a 403 error code to anyone visiting /wp-login.php</strong> – All brute force attacks we’ve seen target /wp-login.php. By responding with a 403 error, <strong>your WordPress files aren’t loaded, the Database isn’t queried</strong>, and the attacker doesn’t figure out your password.</li>
<li><strong>Changes the default login url</strong> – While a so-called hacker is being deflected by your new Force Field, you will log in with ease at /wp-admin/. When you do that, WordPress will redirect you to the new, proper login url.</li>
<li><strong>Automatically changes the login when a Brute Force Attack is detected</strong> – When too many login failures occur within a minute, Project Force Field shifts polarity! The new login you previously used now responds with a 403 error, and a large random number is now used as your login url! After some time, the login will return back to normal.</li>
<li><strong>Unlimited polarity shifts</strong> – If a Brute Force Attacker gets smart and writes a script to check for the new login url, Project Force Field will continue to detect the attack and change the login.</li>
<li><strong>Define the login yourself</strong> – By defining <code>OGFF_LOGIN</code> in your wp-config.php, you can set the login to be <em>almost</em> anything you want.</li>
<li><strong>Stops WordPress User Enumeration Exploit</strong> – Many brute force attacks use the WordPress User Enumeration exploit to easily figure out valid usernames. We stop that to protect your site, and respond with a 403 to save your server.</li>
</ul>
<h4>Future Features!</h4>
<ul>
<li><strong>Multisite Support</strong> – It’s not there yet, that’s pretty lame, so I’m going to fix that before anything else!</li>
<li><strong>Adjust the login failure threshold</strong> – Currently, Project Force Field assumes a brute force is underway when there have been 30 login failures within a minute. This might not be ideal for large websites, so we want to let you increase that amount to 300 if needed.</li>
<li><strong>Add optional email notification for brute force events</strong> – If you want to know when your website is under attack, we want to let you know. In a near future version, we will let you add email addresses to be notified of brute force attacks, and any other important related events that we add in the future.</li>
<li><strong>Add last resort .htaccess password lockdown</strong> – If a so-called hacker writes a script that continues to learn the new login url, Project Force Field won’t help much. In an upcoming version, we will check to see how many times the login url was changed, determine if the Brute Force Attack is smart, and lockdown the login with an .htaccess password.</li>
</ul>


Project Force Field

Save your WordPress sites and servers from certain death during brute force attacks with Project Force Field by Orion Group!

Cyclone Static vs Project Force Field