Cyclone Static vs Disable Directory Listings

Cyclone Static generates fully-rendered static HTML files for every page on your WordPress site and instructs Apache to serve them directly — bypassing PHP, WordPress, and the database for anonymous visitors. When a static file exists for a requested URL, Apache reads it from disk and sends it without starting PHP or querying the database. The visitor receives a complete HTML page. Their browser runs your JavaScript, plays your audio, renders your animations — everything works as it did before, because the static file contains the same HTML WordPress would have generated. Logged-in users, POST requests, query strings, and administrative paths bypass the static cache and receive live WordPress as normal. Key features Static file serving — Apache serves files directly from disk. PHP and the database are not involved in serving anonymous page requests. Automatic regeneration — When you publish or update a post or page, it is automatically queued for regeneration. You do not need to do anything. Reduced attack surface — Static HTML files do not execute PHP or query a database. Common WordPress-targeted attack vectors that require a live PHP process — such as SQL injection via PHP, PHP code execution, and xmlrpc.php abuse — do not apply to anonymous page requests served as static files. CDN integration — Works alongside W3 Total Cache. Direct integration with Bunny.net, Cloudflare, KeyCDN, and Amazon CloudFront is available in Cyclone Static Pro. W3 Total Cache compatible — Installs its .htaccess rules before W3TC rules. Works alongside or without W3TC. Non-destructive — Deactivating the plugin removes the .htaccess rules and WordPress resumes normal operation. Your cached files are not deleted without your explicit consent — a prompt appears when you deactivate, asking whether to keep or delete them. Free and open — No license required. Support via the WordPress.org community forums. System requirements WordPress 6.0 or later PHP 8.0 or later Apache web server with mod_rewrite enabled .htaccess support enabled (AllowOverride All or equivalent) WordPress Multisite is not supported in this version — Multisite support is available in Cyclone Static Pro Nginx users: Cyclone Static manages .htaccess automatically on Apache. If your server runs Nginx, the Settings page includes a ready-to-paste Nginx server block under Settings → Nginx Configuration. CDN support The free version works automatically alongside W3 Total Cache — CDN purges are routed through W3TC when it is active. Direct API integration with Bunny.net, Cloudflare, KeyCDN, and Amazon CloudFront is available in Cyclone Static Pro. Privacy Cyclone Static does not collect, transmit, or store any personal data. The queue table stores only URLs. No external service is contacted except the CDN purge APIs you explicitly configure. Support Support is provided via the WordPress.org community forums. Post your question there — answers are public, so search first as your question may already be answered. For private inquiries, you can reach us at [email protected]. Confirmed bugs are addressed through plugin updates. Private one-on-one support is not offered via the forums. External Services Cyclone Static can optionally connect to the following third-party services to purge cached content from your CDN. These connections are only made when you configure a CDN provider under Settings → CDN Integration and a purge is triggered. No data is sent to these services unless you explicitly configure them. Bunny.net Used for CDN cache purging. Your Bunny.net API key and Pull Zone ID are sent to the Bunny.net API. * Service: https://bunny.net/ * API documentation: https://docs.bunny.net/reference/purgepublicpullzone * Privacy policy: https://bunny.net/privacy/ Cloudflare Used for CDN cache purging. Your Cloudflare API token and Zone ID are sent to the Cloudflare API. * Service: https://www.cloudflare.com/ * API documentation: https://developers.cloudflare.com/api/resources/cache/methods/purge/ * Privacy policy: https://www.cloudflare.com/privacypolicy/ KeyCDN Used for CDN cache purging. Your KeyCDN API key and Zone ID are sent to the KeyCDN API. * Service: https://www.keycdn.com/ * API documentation: https://www.keycdn.com/api * Privacy policy: https://www.keycdn.com/privacy Amazon CloudFront Used for CDN cache invalidation. Your AWS Access Key, Secret Key, and CloudFront Distribution ID are sent to the Amazon CloudFront API. * Service: https://aws.amazon.com/cloudfront/ * API documentation: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateInvalidation.html * Privacy policy: https://aws.amazon.com/privacy/

Prevent virtual directory listing services from listing the contents of directories, and/or show a page in place of a directory’s listing. The Apache web server can be configured to automatically display the listings of the contents of a web site’s file directory if no index file (i.e. index.html or index.php) is present. This can expose files and information to visitors. Of course the web server could be configured to not do this (the recommended approach), but sometimes you don’t have permission (you’re on a shared host), the know-how, or you want to selectively disallow virtual directory listings. That’s where this plugin can help. If you want to test if your site has virtual directory listings enabled, try visiting http://www.YOURSITE.com/wp-includes (obviously, change the domain to match your own). If you see a listing of PHP files then virtual directory listing is enabled for your site. This plugin can prevent visitors from seeing the contents of certain (or all) directories on your site (assuming your web server generates virtual directory listings). It also allows you to use a WordPress page as the index for a directory By default, the following directories are protected: wp-includes/ wp-content/ wp-content/plugins/ wp-content/themes/ It does NOT protect any other directory by default. You can change this via the plugin’s admin settings page. TIP: When this plugin is activated (and more specifically, ater the permalink structure is updated as per the instructions below), WordPress will generate the themed 404 – Not Found page. If you were to create a Page with the same name as one of the directories being disabled (i.e. ‘wp-includes’ or ‘wp-content’) then that page will be displayed instead of the 404 error message. If you want to display a page for the ‘plugins’ and ‘themes’ directory, you must create them as children pages of a ‘wp-content’ page. NOTE: This plugin only works for the Apache web server. Links: Plugin Homepage | Author Homepage