RACKSET

ReqLock — also written RequestLock or Request Lock — is an outbound (egress) 
firewall for WordPress. It controls every call your site makes out to the internet, on 
both sides of the request: the server (PHP / WP HTTP API) and the browser (the HTML 
your pages render). One master switch puts your site fully in control of its own outbound 
traffic.
Modern WordPress sites are noisy: update checks, license pings, analytics, tag managers, 
external fonts, embedded widgets, AI APIs, and assorted “phone-home” calls all reach out to 
servers you don’t control. When those servers are slow, blocked, or down, your pages and your 
dashboard pay the price — and every one of them is a place your visitors’ data leaks out. 
ReqLock lets you shut that traffic off at will, instantly and reversibly, without editing 
theme files or hunting down plugins.
One switch, four jobs:
<ul>
<li>Resilience — keep the site working when the external internet is cut or restricted 
(outages, regional shutdowns, upstream failures). Pages serve from local assets and 
wp-admin stops hanging on dead requests.</li>
<li>Performance — slow or unreachable third-party calls fail instantly instead of 
stalling front-end and back-end page loads on long timeouts.</li>
<li>Privacy — strip analytics, trackers, external fonts, and phone-home requests so nothing 
about your visitors leaves the server.</li>
<li>Development — turn any install into a self-contained, offline-capable environment: 
no external calls, no tracking from a staging copy, no waiting on remote APIs while you work.</li>
</ul>
<h4>Use cases</h4>
<ul>
<li>Outage / shutdown resilience. When upstream connectivity is throttled or blocked, a 
normal WordPress site stalls on every external call. Flip ReqLock on and the site keeps 
serving from local resources — admin included.</li>
<li>Speeding up a sluggish site. A single slow analytics or font host can add seconds to 
every page load. ReqLock makes those calls fail fast instead of blocking the render.</li>
<li>Privacy / no-tracking deployments. Run a site that provably makes no third-party 
requests — useful for privacy-first projects, internal tools, and compliance-sensitive setups.</li>
<li>Local & staging development. Clone production to a laptop or staging box and ReqLock 
keeps it from phoning home: no analytics fired from a test copy, no license pings, no 
WordPress.org update checks slowing down <code>wp-admin</code> while you build. The site behaves the 
same with the network unplugged — ideal for offline coding, demos, and air-gapped boxes.</li>
<li>Auditing what a site talks to. The Detected-hosts panel logs every external host the 
site reaches, so you can see exactly who your themes and plugins contact — then decide what 
to allow and what to cut.</li>
</ul>
<h4>What it blocks</h4>
Server-side (PHP / WP HTTP API)
<ul>
<li>Outbound <code>wp_remote_*</code> requests to external hosts: WordPress.org update/version checks, 
analytics, AI APIs (OpenAI, Gemini), remote fonts, license/phone-home pings, etc. They fail 
instantly instead of timing out.</li>
</ul>
Browser-side (rendered HTML)
<ul>
<li>External <code><script src></code> and external <code><link rel="stylesheet"></code> (e.g. Google Fonts)</li>
<li>Resource hints: <code>preconnect</code> / <code>dns-prefetch</code> / <code>preload</code> / <code>prefetch</code></li>
<li>External <code><iframe></code> (replaced with a clean local placeholder)</li>
<li>Inline analytics snippets: Google Analytics / Tag Manager, Microsoft Clarity, Ahrefs, 
Meta Pixel, Hotjar, Yandex, TikTok, Pinterest, LinkedIn, Twitter/X, Snap, Segment, Plausible</li>
<li>Optional: external <code><img></code> (transparent placeholder)</li>
</ul>
<h4>Key behavior</h4>
<ul>
<li>Your own domain and all its subdomains are always allowed.</li>
<li>Allow-list for any other hosts that must stay reachable.</li>
<li>Detected-hosts panel logs every external host seen, so you can build the allow-list fast.</li>
<li>Per-category toggles — turn each blocking layer on/off independently.</li>
<li>wp-config conflict control — detects a hard-coded <code>WP_HTTP_BLOCK_EXTERNAL</code> constant and 
lets you disarm it (comment it out) or re-arm it (restore it) in one click, so ReqLock is the 
single switch for external blocking. Edits are reversible, integrity-checked, and atomic.</li>
<li>Inert when OFF — with the master switch off, the plugin does nothing, so it is safe to 
keep installed and flip on only when needed.</li>
<li>Works over full-page caches — the output filter runs as the outermost buffer, so it 
covers cached page views too.</li>
</ul>
<h3>Credits</h3>
Developed and maintained by the Rackset DevOps Team — https://rackset.com

ReqLock

Block external & slow third-party requests in WordPress — for resilience, performance, privacy, and offline development. One master switch.

ingobaab

Block External Requests is a WordPress plugin designed to speed up your WordPress administration by blocking unwanted external HTTP requests.
Features: 
* Block external requests by host, domain, or URL fragment. 
* Hosts list is fully editable via Settings → Blocked Requests. 
* Supports regular expressions for flexible host matching.
<h3>License</h3>
GPLv2 or later. See <a href="https://www.gnu.org/licenses/gpl-2.0.html" rel="nofollow ugc">https://www.gnu.org/licenses/gpl-2.0.html</a>

Block External Requests

Speed up WordPress admin by blocking slow or unwanted external HTTP requests. Manage hosts in Settings → Blocked Requests.

ReqLock vs Block External Requests