WordPress outbound firewall · open source

One switch that silences every external call your WordPress site makes.

ReqLock disarms outbound internet requests from WordPress core, your theme, and plugins — on both the server and the browser. Keep working when the internet is cut, kill slow third-party calls, and stop phoning home.

Also written RequestLock or Request Lock.

GPL-2.0 · 100% free No account, no telemetry Inert when off
https://your-site.com/wp-admin
ReqLock master switchOff — site reaches the internet freely
  • api.openai.com/v1/chatsent
  • fonts.googleapis.com/csssent
  • www.google-analytics.comsent
  • api.wordpress.org/updatesent
  • your-site.com/wp-jsonALLOWED
Calls leaving the server 0 blocked
One switch, four jobs

Built for resilience — useful every day

The same kill-switch that keeps you online through an outage also makes a noisy WordPress install faster, more private, and easy to run offline.

Resilience

Keep the site working when international internet is cut or restricted. Pages serve from local assets and wp-admin stops hanging on dead requests.

Performance

Slow or dead third-party calls fail instantly instead of stalling front-end and back-end page loads on long network timeouts.

Privacy

Strip analytics, trackers, external fonts and phone-home requests, so nothing about your visitors quietly leaves the server.

Development

Turn any install into a self-contained, offline-capable environment — no external calls or tracking from a staging copy.

Total coverage

Both sides of every request

ReqLock works where other plugins can't — intercepting calls before they leave the server and scrubbing what the browser would otherwise fetch.

Server-side

PHP · WP HTTP API

Hooks pre_http_request and short-circuits external hosts before the request ever leaves your server.

  • Outbound wp_remote_* calls to external hosts
  • WordPress.org update & version checks
  • Analytics & AI APIs — OpenAI, Gemini, remote fonts
  • License / phone-home pings — fail fast, no timeouts
Browser-side

Rendered HTML

Buffers page output and strips external resource tags and known inline trackers — leaving a traceable comment, never a request.

  • External <script> & <link> stylesheets (Google Fonts)
  • Resource hints: preconnect / dns-prefetch / preload
  • External iframes → clean local placeholder
  • Inline analytics: GA/GTM, Clarity, Meta Pixel, Hotjar…
Up in 60 seconds

Install, activate, flip the switch

No theme edits, no build step, no configuration required to start. Safe to keep installed permanently.

Drop it in

Copy the reqlock folder into wp-content/plugins/ and activate it from the Plugins screen.

Tune the layers

Open Settings → ReqLock. Every blocking layer has its own toggle; your domain and subdomains are always allowed.

Arm it

Flip the master switch on when the internet is cut — or leave it on for good as a privacy & performance baseline.

1
Master switch
2
Sides intercepted
7
Languages bundled
0ms
Wait on blocked calls
Built right

Precise, reversible, and safe

Conservative, well-anchored matching that leaves SEO links and internal URLs untouched.

  • Your own domain & all subdomains are always allowed
  • Allow-list for any host that must stay reachable
  • Detected-hosts panel audits what your site contacts
  • Per-category toggles — each layer independent
  • Controls WP_HTTP_BLOCK_EXTERNAL conflicts
  • Inert when off — flip on only when needed
  • Works over full-page caches (outermost buffer)
  • Admin-bar indicator shows when ReqLock is active

Put your site in control of its own traffic.

Free and open source under GPL-2.0. Install from the WordPress directory or grab the source on GitHub.