WordPress
An installable plugin (recommended) that adds a Cloaking X menu inside your WP admin, or a manual functions.php snippet if you'd rather not install a plugin.
Option A — Plugin (recommended)
- In your dashboard, go to Integration, select the stream you want to protect, choose the WordPress tab, and click Download Plugin ZIP — the file is pre-configured with that stream's ID and your app URL.
- In your WordPress admin go to Plugins → Add New → Upload Plugin.
- Choose the downloaded ZIP file and click Install Now.
- Activate the plugin, then go to Cloaking X → Settings.
- Your Stream ID is pre-filled. Add your API Key (optional — only needed for the stats dashboard inside WordPress) and save — done.
Option B — Manual (functions.php)
// functions.php
// Priority 1 = runs before any theme code so the hide fires first
function tracker_inject() {
echo '<style id="YOUR_PRE_HIDE_ID">html,body{visibility:hidden!important;background:#fff!important}</style>';
echo '<script>setTimeout(function(){var e=document.getElementById("YOUR_PRE_HIDE_ID");if(e&&e.parentNode)e.parentNode.removeChild(e);},10000);</script>';
echo '<script src="https://cloakingx.com/a/YOUR_ASSET_TOKEN.js" data-s="YOUR_STREAM_ID" onerror="var e=document.getElementById(\'YOUR_PRE_HIDE_ID\');if(e&&e.parentNode)e.parentNode.removeChild(e);"></script>';
}
add_action( 'wp_head', 'tracker_inject', 1 );YOUR_STREAM_ID, YOUR_ASSET_TOKEN, and YOUR_PRE_HIDE_ID are placeholders — get the real, pre-filled snippet from your dashboard's Integration page.
What the plugin adds to WP admin
Once activated, a Cloaking X menu appears in your WordPress admin sidebar with four screens:
Today's clicks/blocked/passed/block-rate, all-time clicks, monthly usage against your plan limit, and the 10 most recent clicks.
The last 20 clicks for this stream with IP, country/city, OS/browser, risk score, decision, block reason, and VPN/Tor/datacenter signal badges, plus a link out to the full Reports in your dashboard.
Stream ID, Cloaking X API URL, and optional API Key; an Enable Filtering toggle; and an optional cookie-consent banner shown to every front-end visitor — real visitors click the button and are redirected to your destination URL, while bots (which cannot click) simply stay on the page.
Live diagnostics: whether your Stream ID/API URL are set, a live test call to /api/check from your own server, a WordPress wp_footer()/script-injection check, and (with an API key) your plan and stream status.
How server-side cloaking works here
The plugin hooks into template_redirect before WordPress renders anything. It calls /api/check with the real visitor IP and UA; if the response includes a redirect, it fetches that destination's HTML directly (cached ~60 seconds) and serves it at your WordPress URL — no visible redirect, address bar unchanged. It automatically skips this for JS-framework destinations (Next.js, Nuxt, Angular, React) it detects via build markers, falling back to the client-side script instead, since those apps expect to control their own URL. A client-side script hooked at wp_head priority 1 always runs alongside this as a fallback — it's harmless for bots (which don't execute JS) and catches real visitors if the server-side call fails.