RACKSET

ReqLock — also written RequestLock or Request Lock — is an outbound (egress) 
firewall for WordPress. It controls every call your site makes out to the internet, on 
both sides of the request: the server (PHP / WP HTTP API) and the browser (the HTML 
your pages render). One master switch puts your site fully in control of its own outbound 
traffic.
Modern WordPress sites are noisy: update checks, license pings, analytics, tag managers, 
external fonts, embedded widgets, AI APIs, and assorted “phone-home” calls all reach out to 
servers you don’t control. When those servers are slow, blocked, or down, your pages and your 
dashboard pay the price — and every one of them is a place your visitors’ data leaks out. 
ReqLock lets you shut that traffic off at will, instantly and reversibly, without editing 
theme files or hunting down plugins.
One switch, four jobs:
<ul>
<li>Resilience — keep the site working when the external internet is cut or restricted 
(outages, regional shutdowns, upstream failures). Pages serve from local assets and 
wp-admin stops hanging on dead requests.</li>
<li>Performance — slow or unreachable third-party calls fail instantly instead of 
stalling front-end and back-end page loads on long timeouts.</li>
<li>Privacy — strip analytics, trackers, external fonts, and phone-home requests so nothing 
about your visitors leaves the server.</li>
<li>Development — turn any install into a self-contained, offline-capable environment: 
no external calls, no tracking from a staging copy, no waiting on remote APIs while you work.</li>
</ul>
<h4>Use cases</h4>
<ul>
<li>Outage / shutdown resilience. When upstream connectivity is throttled or blocked, a 
normal WordPress site stalls on every external call. Flip ReqLock on and the site keeps 
serving from local resources — admin included.</li>
<li>Speeding up a sluggish site. A single slow analytics or font host can add seconds to 
every page load. ReqLock makes those calls fail fast instead of blocking the render.</li>
<li>Privacy / no-tracking deployments. Run a site that provably makes no third-party 
requests — useful for privacy-first projects, internal tools, and compliance-sensitive setups.</li>
<li>Local & staging development. Clone production to a laptop or staging box and ReqLock 
keeps it from phoning home: no analytics fired from a test copy, no license pings, no 
WordPress.org update checks slowing down <code>wp-admin</code> while you build. The site behaves the 
same with the network unplugged — ideal for offline coding, demos, and air-gapped boxes.</li>
<li>Auditing what a site talks to. The Detected-hosts panel logs every external host the 
site reaches, so you can see exactly who your themes and plugins contact — then decide what 
to allow and what to cut.</li>
</ul>
<h4>What it blocks</h4>
Server-side (PHP / WP HTTP API)
<ul>
<li>Outbound <code>wp_remote_*</code> requests to external hosts: WordPress.org update/version checks, 
analytics, AI APIs (OpenAI, Gemini), remote fonts, license/phone-home pings, etc. They fail 
instantly instead of timing out.</li>
</ul>
Browser-side (rendered HTML)
<ul>
<li>External <code><script src></code> and external <code><link rel="stylesheet"></code> (e.g. Google Fonts)</li>
<li>Resource hints: <code>preconnect</code> / <code>dns-prefetch</code> / <code>preload</code> / <code>prefetch</code></li>
<li>External <code><iframe></code> (replaced with a clean local placeholder)</li>
<li>Inline analytics snippets: Google Analytics / Tag Manager, Microsoft Clarity, Ahrefs, 
Meta Pixel, Hotjar, Yandex, TikTok, Pinterest, LinkedIn, Twitter/X, Snap, Segment, Plausible</li>
<li>Optional: external <code><img></code> (transparent placeholder)</li>
</ul>
<h4>Key behavior</h4>
<ul>
<li>Your own domain and all its subdomains are always allowed.</li>
<li>Allow-list for any other hosts that must stay reachable.</li>
<li>Detected-hosts panel logs every external host seen, so you can build the allow-list fast.</li>
<li>Per-category toggles — turn each blocking layer on/off independently.</li>
<li>wp-config conflict control — detects a hard-coded <code>WP_HTTP_BLOCK_EXTERNAL</code> constant and 
lets you disarm it (comment it out) or re-arm it (restore it) in one click, so ReqLock is the 
single switch for external blocking. Edits are reversible, integrity-checked, and atomic.</li>
<li>Inert when OFF — with the master switch off, the plugin does nothing, so it is safe to 
keep installed and flip on only when needed.</li>
<li>Works over full-page caches — the output filter runs as the outermost buffer, so it 
covers cached page views too.</li>
</ul>
<h3>Credits</h3>
Developed and maintained by the Rackset DevOps Team — https://rackset.com

ReqLock

Block external & slow third-party requests in WordPress — for resilience, performance, privacy, and offline development. One master switch.

Amirhossein Hosseinpour

BlackSwanDev

BlackSwan Block External Request gives you granular control over every outgoing connection your WordPress site makes — both server-side PHP requests and browser-loaded JS/CSS resources.
WordPress, plugins, and themes constantly send background HTTP requests: update checks, license pings, analytics, font downloads, CDN calls, and more. On slow servers or restricted hosting environments, these requests can add seconds to every admin page load.
This plugin lets you block what you don’t need and keep what you do.
<h4>What it does</h4>
Server-side HTTP Blocking (PHP) 
Intercepts outgoing <code>wp_remote_get</code> / <code>wp_remote_post</code> calls via the <code>pre_http_request</code> filter. Add domains to the blacklist and they’ll be blocked before the request is even made. Whitelist specific URL patterns to let essential requests through (e.g. plugin update API).
Browser-side Resource Blocking (JS/CSS by Domain) 
Deregisters enqueued JavaScript and CSS files loaded from blacklisted external domains. Toggle separately for admin panel and public frontend. Your own site’s assets are never touched.
Block Specific Resources (by URL) 
Block individual JS or CSS files by full URL, partial path, or even just a filename — works for both local and external resources. Per-item backend/frontend toggle. Perfect for removing unwanted plugin assets without editing code.
<h4>Features</h4>
<ul>
<li>Blacklist & whitelist with inline edit, delete, and delete-all</li>
<li>Block external JS/CSS by domain (backend, frontend, or both)</li>
<li>Block specific resources by URL pattern (local or external)</li>
<li>One-click pause/resume — instantly disable all blocking</li>
<li>Safe mode via <code>?bswan-safe=1</code> — emergency bypass for any admin page</li>
<li>Settings page auto-bypasses resource blocking so you never lock yourself out</li>
<li>Export/import all settings as a single JSON file</li>
<li>AJAX-powered save — no page reloads</li>
<li>Query Monitor integration — detect, activate, or install from settings</li>
<li>All settings stored as a single JSON option with <code>autoload=no</code> for performance</li>
<li>Fully standalone — zero external dependencies (inline Lucide SVG icons)</li>
<li>Modern liquid glass UI with dot-grid background</li>
<li>WordPress native postbox layout with collapsible sections</li>
<li>Translation-ready with full text domain support</li>
</ul>
<h4>Who is this for?</h4>
<ul>
<li>Sites on slow or restricted hosting where external calls cause timeouts</li>
<li>Developers debugging performance issues</li>
<li>Agencies managing client sites that don’t need update checks</li>
<li>Anyone who wants a faster wp-admin experience</li>
</ul>
<h4>Developer Hooks</h4>
Four filters are available for developers to customize blocking behavior programmatically. These run on every page load and merge with the values from the settings page.
<code>BlackSwan\block_external_request\block_url_list</code>
Filter the array of blocked domain strings. Each entry is matched via <code>strpos()</code> against the full request URL.
<pre><code>add_filter( 'BlackSwan\block_external_request\block_url_list', function( $domains ) {
 $domains[] = 'analytics.example.com';
 return $domains;
});
</code></pre>
<code>BlackSwan\block_external_request\whitelist_urls</code>
Filter the array of whitelisted URL patterns. If a blocked URL also matches a whitelist pattern (via <code>strpos()</code>), the request is allowed through.
<pre><code>add_filter( 'BlackSwan\block_external_request\whitelist_urls', function( $patterns ) {
 $patterns[] = '//api.example.com/v2/license';
 return $patterns;
});
</code></pre>
Whitelist patterns take priority over blacklist domains. Both filters accept and return a flat array of strings.
<code>BlackSwan\block_external_request\blocked_resources</code>
Filter the array of specific JS/CSS resources to block. Each entry is an associative array with <code>url</code>, <code>backend</code>, and <code>frontend</code> keys. The <code>url</code> is matched via <code>strpos()</code> against each registered script/style source.
<pre><code>add_filter( 'BlackSwan\block_external_request\blocked_resources', function( $resources ) {
 $resources[] = array( 'url' => 'some-plugin/tracking.js', 'backend' => false, 'frontend' => true );
 return $resources;
});
</code></pre>
<code>BlackSwan\block_external_request\cdn_replacements</code>
Filter the array of CDN replacement rules. Each entry is an associative array with <code>pattern</code>, <code>cdn</code>, <code>backend</code>, and <code>frontend</code> keys. When an enqueued asset source contains the <code>pattern</code>, it is replaced with the <code>cdn</code> URL.
<pre><code>add_filter( 'BlackSwan\block_external_request\cdn_replacements', function( $replacements ) {
 $replacements[] = array( 'pattern' => '/wp-includes/js/jquery/jquery.min.js', 'cdn' => 'https://cdn.example.com/jquery/3.7.1/jquery.min.js', 'backend' => false, 'frontend' => true );
 return $replacements;
});
</code></pre>
<h4>Links</h4>
<ul>
<li><a href="https://amirhp.com/" rel="nofollow ugc">Developer — AmirhpCom</a></li>
<li><a href="https://blackswandev.com/" rel="nofollow ugc">BlackSwan</a></li>
<li><a href="https://github.com/blackswandevcom/blackswan-block-external-request/" rel="nofollow ugc">Plugin GitHub Page</a></li>
<li><a href="https://wordpress.org/support/plugin/blackswan-block-external-request/reviews/#new-post" rel="ugc">Rate 5-Star</a></li>
<li><a href="https://wordpress.org/support/plugin/blackswan-block-external-request/" rel="ugc">Support & Issues</a></li>
</ul>
<h3>Copyright</h3>
BlackSwan Block External Request is free software distributed under the terms of the GNU General Public License v2 or later.
Copyright (c) AmirhpCom — <a href="https://amirhp.com/" rel="nofollow ugc">amirhp.com</a>
This plugin is developed and maintained by <a href="https://blackswandev.com/" rel="nofollow ugc">BlackSwan Lab</a>.
You are free to use, modify, and distribute this plugin under the GPLv2 license. The developers are not responsible for any issues caused by misconfigured blocking rules. Always maintain proper backups before making changes to your site’s HTTP request behavior.

BlackSwan | Block External Request

Block unwanted external HTTP requests in WordPress. Blacklist/whitelist management, resource blocking, and one-click pause.

ReqLock vs BlackSwan | Block External Request