Carrero

<p>ES Football Bypass for Cloudflare is a WordPress plugin created by David Carrero Fernandez-Baillo to help Spanish website owners protect their legitimate sites from collateral damage caused by mass IP blocks ordered during football matches. The project is open source (GPLv2) and available on GitHub: https://github.com/dcarrero/cf-football-bypass</p>
<p>The plugin automatically monitors football events in Spain by querying hayahora.futbol and, based on the result, manages Cloudflare DNS records to toggle between Proxied and DNS Only modes. This prevents legitimate visitors from being affected by judicial blocks targeting pirate football streaming.</p>
<h4>The Problem</h4>
<p>In Spain, during football matches, mass IP blocks are enforced by judicial orders to combat pirate streaming. These blocks also affect legitimate websites that have nothing to do with football, causing traffic and revenue losses.</p>
<h4>The Solution</h4>
<p>When football is detected:<br />
– Automatically disables the Cloudflare proxy for selected DNS records<br />
– Your website switches to DNS Only mode, avoiding potentially blocked Cloudflare IPs<br />
– After the configured cooldown period, automatically re-enables the Cloudflare proxy</p>
<h4>Key Features</h4>
<p>Full Automation<br />
– Automatic monitoring every X minutes (configurable 5-60 min)<br />
– Automatic bypass activation/deactivation<br />
– Integrated WordPress cron system</p>
<p>Dual Cloudflare Authentication Support<br />
– Global API Key (traditional)<br />
– API Token with specific permissions (more secure)</p>
<p>Granular Control<br />
– Specific DNS record selection (A, AAAA, and CNAME)<br />
– Configurable bypass duration (60-600 minutes)<br />
– Customizable cooldown interval after disabling Cloudflare<br />
– Manual control for special cases</p>
<p>Informative Dashboard<br />
– Real-time football status<br />
– Last check performed<br />
– Bypass status (active/inactive)</p>
<p>Additional Tools<br />
– Cloudflare connection test button<br />
– Manual football status check<br />
– Manual activation/deactivation buttons<br />
– Detailed logging for debugging and auditing<br />
– Protected endpoint for external cron</p>
<h3>External Services</h3>
<p>This plugin connects to the following external services:</p>
<h4>hayahora.futbol</h4>
<p>The plugin periodically queries the endpoint https://hayahora.futbol/estado/data.json to check whether there are active IP blocks during football events in Spain. This query runs automatically based on the configured cron interval (default: every 15 minutes) and can also be triggered manually from the admin panel.<br />
– Data sent: An HTTP GET request with the site’s home URL in the User-Agent header. No personal or visitor data is transmitted.<br />
– URL: https://hayahora.futbol/<br />
– About the service and privacy: https://hayahora.futbol/#sobre-los-bloqueos<br />
– Terms of use: The service is free, open source, and does not collect personal data from plugin users or their visitors.</p>
<h4>Cloudflare API</h4>
<p>The plugin uses the official Cloudflare API (https://api.cloudflare.com/client/v4/) to read DNS records and toggle the proxy status (Proxied/DNS Only) for selected records. It requires API credentials that you provide in the plugin settings. Credentials are stored in the WordPress database and sent via HTTPS headers to Cloudflare.<br />
– Data sent: API credentials (in headers), DNS record modifications (record ID, type, name, content, proxied status).<br />
– URL: https://api.cloudflare.com/<br />
– Terms of Service: https://www.cloudflare.com/terms/<br />
– Privacy Policy: https://www.cloudflare.com/privacypolicy/</p>
<h4>Server IP Detection Services</h4>
<p>The plugin detects your server’s outgoing IP address (displayed in the Settings page) by querying three public services. Only the server’s own IP is returned; no personal or visitor data is transmitted. Results are cached for 1 hour.<br />
– https://api.ipify.org/ – Provided by ipify. Privacy Policy: https://www.ipify.org/<br />
– https://checkip.amazonaws.com/ – Provided by Amazon Web Services. Privacy Policy: https://aws.amazon.com/privacy/<br />
– https://icanhazip.com/ – Provided by Cloudflare. Privacy Policy: https://www.cloudflare.com/privacypolicy/</p>
<h4>Affiliate Links</h4>
<p>The plugin’s operation page includes affiliate links clearly marked with “(aff)” to VPN services and security tools. These links are optional and do not affect the plugin’s functionality.</p>
<h3>Cron and Automation</h3>
<h4>How does the cron system work?</h4>
<p>The plugin uses WordPress internal cron (wp_cron) which runs when there are visits to the website. This is usually sufficient for most sites.</p>
<h4>What if my site has low traffic and cron doesn’t run regularly?</h4>
<p>Go to Settings > ES Football Bypass for Cloudflare and copy the token from the “External cron” section. With that token you can set up a real server cron:</p>
<p>*/15 * * * * curl -s “https://yourdomain.com/wp-cron.php?cfbcolorvivo_cron=1&token=YOUR_TOKEN_HERE” > /dev/null 2>&1</p>
<p>You can regenerate the token by clearing the field and saving settings (a new one is generated). This endpoint only runs the plugin check, without depending on visits.</p>
<h4>What is the “Cooldown after disabling Cloudflare”?</h4>
<p>This is the waiting time (default 60 minutes) that the plugin respects before checking if Cloudflare can be re-enabled after detecting a block. During this period, the proxy remains in “DNS Only” mode even if the JSON stops marking the domain, avoiding rapid activation/deactivation cycles.</p>
<h4>How do I verify that cron is working correctly?</h4>
<p>In the Operation tab, click “WP-Cron Diagnostics” to see the next execution and the result of the last check. You can also review the integrated logs.</p>
<h3>Logs and Auditing</h3>
<h4>Where can I see the action history?</h4>
<p>In the ES Football Bypass for Cloudflare > Logs menu. It shows the latest automatic executions (internal or external cron) and manual actions with date, detail, and user.</p>
<h4>Can I disable logging?</h4>
<p>Yes. In Settings > ES Football Bypass for Cloudflare you can disable logging or adjust retention days (minimum 1). Logs are stored in the uploads directory under <code>es-football-bypass-for-cloudflare/logs/</code> protected with .htaccess.</p>
<h4>How do I verify that cron is working correctly?</h4>
<p>You can check if it’s scheduled in Tools > Site Health > Info > Scheduled Events, looking for the ‘cfbcolorvivo_check_football_status’ event. You can also review WordPress error logs where the plugin records all its actions.</p>
<h3>Server Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>PHP Extensions: curl, json</li>
<li>Permissions: Ability to make outbound HTTP requests</li>
<li>Cron: Functional WordPress cron system</li>
</ul>
<h3>Support</h3>
<ul>
<li>Author: David Carrero Fernandez-Baillo</li>
<li>Website: https://carrero.es</li>
<li>Contact: https://carrero.es/contacto/</li>
</ul>
<p>If you need help, send a direct message on X or use the contact form. Issues and improvements are also welcome in the repository: https://github.com/dcarrero/cf-football-bypass</p>
<p>This plugin was born from the real need to protect legitimate websites from the mass blocks affecting the Spanish digital industry during sporting events.</p>
<h3>Specific Use Cases</h3>
<p>High Traffic Sites<br />
– Allows selecting only critical records (www, root domain)<br />
– Keeps other services (mail, ftp, etc.) always proxied<br />
– Minimizes impact on CDN and cache</p>
<p>Sites with Multiple Subdomains<br />
– Granular control per subdomain<br />
– Different strategies for different services<br />
– Total configuration flexibility</p>
<p>Emergencies and Manual Override<br />
– Manual control buttons for special situations<br />
– Does not depend solely on automatic detection<br />
– Allows quick reaction to failures</p>
<h3>License</h3>
<p>GPLv2 or later. You are free to use, modify, and distribute this plugin under the terms of the GPL.</p>


ES Football Bypass for Cloudflare

Automatically manages Cloudflare configuration during football matches to avoid mass IP blocks affecting legitimate websites in Spain.

Dan LaManna

<p>Advanced Post Privacy takes advantage of the current underdeveloped functionality of private posts. It<br />
allows you to make exceptions to any content types that have been marked as private.</p>
<p><strong>Possible Future Features:</strong><br />
* Allowing exceptions on a per page/post basis.<br />
* Allowing protected posts/pages to be bypassed.<br />
* Integration with popular Member Plugins.<br />
* Integration with Pods CMS.<br />
* Anything else requested.</p>
<h3>Usage</h3>
<p>The usage of this plugin varies, I created it after having to do something very simple for a<br />
project that wasn’t built in, allowing a search engine to crawl private posts while remaining<br />
private. I was able to do it using IP address, and this made the process much easier.</p>
<p>Other uses could include:<br />
   * Allowing certain roles (such as authors) to see private media.<br />
   * Allowing certain users to see all private posts based on their IP address.</p>
<h3>Extending</h3>
<p><strong>Note: At this point all additional folders that are added to the plugin will be deleted upon upgrade.<br />
  Until I figure out how I want to work around that, if you develop any modules you want to keep, they will<br />
  have to be moved out of the plugin folder before upgrade and then moved back in.</strong></p>
<p>Advanced Post Privacy (APP) is built in a very modular way, that allows for extending upon<br />
via hooks/filters, or in the way of adding your own exclusion module. Each type of exclusion<br />
is within it’s own code, so all code related to the role exclusion is found within the /code/role<br />
directory.</p>
<p><strong>Available Actions</strong>:<br />
* adv_pp_add_ip_address_exclusion (1 arg, the IP address being added)<br />
* adv_pp_remove_ip_address_exclusion (2 args, the IP address, and the post type slug being removed)<br />
* adv_pp_uninstall (No arguments, runs on uninstall)</p>
<p><strong>Available Filters</strong>:<br />
* adv_pp_applicable_post_types (Array of slug => label post types that APP can access.)<br />
* adv_pp_post_type_labels (Array of labels for Post Types)<br />
* adv_pp_bypassed_post_ids (Array of Post Ids the current user can bypass)</p>
<p><strong>Adding a type of Exclusion</strong><br />
By default, Advanced Post Privacy (APP) has two types of exclusions, IP Address, and Role. It’s built in a mostly modular fashion, and is a configuration based plugin, meaning after adding your functionality, you need to explicitly tell the system about your new functionality, via the config.json file.</p>
<p>If you wanted to add a new type of exclusion, for example IP Address Range, you would have to do the following –<br />
  * Create a new directory inside the code folder, naming doesn’t matter much here, it could be called “ip-range”.<br />
  * Create a file called exclusion.php, this will be a class which could be called “ipRangeExclusions”, this class must implement the “appExclusions” interface, and should (for posterity) extend the primary “advancedPostPrivacy” class. This will force the class to have 5 static methods, broken down as:<br />
  * optionName() – Takes no arguments, and returns the name of the option in which all the exclusions will be stored in the database. This should be prefixed with the “APP_PREFIX” constant for uniqueness. This option will be completely removed on the uninstall (deletion) of the plugin.<br />
  * getExclusion() – Takes an optional $identifier argument, without that argument it should contain the code that gets all exclusions of the IP Range type, with it, it will return exclusions for that specific IP Range.<br />
  * setExclusion() – Takes an array of data that will set a single exclusion of that type. To comply with the other types, your code should contain a similar snippet on a successful added exclusion:<br />
         do_action(APP_PREFIX .<br />
                               ‘add_’ .<br />
                               self::getExclusionModuleData(<strong>CLASS</strong>, ‘singular’) .<br />
                               ‘_exclusion’, $exclusionData[‘excluded_ip’]);<br />
  This will create a hook for when an exclusion of your type is created. This method should also ignore any entries that already exist, just for good practice.<br />
  * removeExclusion() – This takes two arguments, the exclusions unique identifier (in this case it would be the IP Range), and the post type slug (“post”, “page”, etc). This code should remove the exclusion, and create an identical hook to the one in setExclusion(), only with the term remove instead of add.<br />
  * getExcludedPostIds() – This is the function that makes your exclusion type work, you do whatever checking you would need to here, in this case it would be checking if the users IP address (constant “VIEWER_IP_ADDRESS”) falls within any of the ranges in the database. It should return an array of private post Ids, that can be obtained by using:<br />
               self::getPrivatePostIdsFromPostTypes($arrayOfPostTypes)<br />
  Ideally the array of post types would be obtained by calling self::getExclusion() with the IP range passed.<br />
  * Now, ajax files for the interface must be created, create a folder called ajax within the code folder, and create files called action.php, and js.php.<br />
  * With action.php, this will store the functionality of your ajax calls, the class should extend appAjaxAction, and actions should be added to the wp_ajax_action_name method, refer to the WordPress Ajax API for more information.<br />
  * With js.php, this will store the javascript that triggers your ajax calls, the class should extend appAjaxJs, and all methods should be added to the admin_head hook. Again, following the practices of the WordPress Ajax API.<br />
  * Now you can create the user interface “widget” (in the non-WP sense) to your exclusion type, this will be a php file in your directory named settings.php. This will be included on the settings page.<br />
  * Finally, all of this is done, but the system still doesn’t know your exclusion module exists, but once you tell it it’s there, it will function seamlessly with the rest of the system (configuration based ftw). We do this by modifying the config.json in the root directory, you may want to back it up since it’s easy to mess up the syntax. You’ll want to add 3 lines of json under the “exclusionModules” array item, this would be an example:<br />
               “ipAddressExclusions”: {<br />
                       “singular”:  “ip_address”,<br />
                       “directory”: “code/ip-address”<br />
                        }</p>
<p>ipAddressExclusions must match the class name used in your exclusions.php file, the singular name is what will be used in hooks (and probably other places later), the directory is simply where your code lives from the plugin path, in this example it would be “code/ip-range”.</p>
<p>Refresh your settings page, and you should see your system in effect!</p>
<p><strong>Data available to your Exclusion Module</strong><br />
If you followed the conventions, all of your classes will ultimately extend the core advancedPostPrivacy class,<br />
meaning you have access to all the methods within the class, however most of them may be made private in the<br />
future as they are really for the core. The protected static property of $_json_config is stored here,<br />
and has the complete array of the loaded json configuration file.</p>
<p><strong>Assets Available</strong><br />
jQuery chosen js, and css,  is enqueued via APP, and can be called on any pages as it is normally called.</p>
<p><strong>Constants</strong><br />
APP_PREFIX (adv_pp_)<br />
APP_PATH<br />
APP_CODE_PATH<br />
APP_DESIGN_PATH<br />
APP_PLUGIN_URL<br />
APP_DESIGN_URL<br />
APP_CONFIG_FILE (path to the config.json file)<br />
VIEWER_IP_ADDRESS (users REMOTE_ADDR from $_SERVER)</p>


Advanced Post Privacy

Allows an administrator to make special exceptions to their private posts/pages (any content type), based on user role (or Guests), or IP address.

ES Football Bypass for Cloudflare vs Advanced Post Privacy