About this plugin
Init Content Protector is a powerful yet lightweight plugin that safeguards your post content from unauthorized copying, scraping tools, and inspection via browser developer tools.
This plugin is part of the Init Plugin Suite — a collection of minimalist, fast, and developer-focused tools for WordPress.
com/brokensmile2103/init-content-protector
Features:
– JavaScript-based copy protection (blocks selection, right-click, print, DevTools access)
– Advanced DevTools blocking (optional, powered by the third-party disable-devtool library) — detects DevTools being opened through multiple methods, not just keyboard shortcuts, and closes or redirects away from the tab
0”) — recognizes the evenly spaced, step-by-step scrolling of scroll-and-stitch capture tools and DevTools full-size captures, and briefly blurs the page with a warning
– Full AES-256 content encryption with client-side decryption via the browser’s built-in Web Crypto API (CryptoJS is only loaded on sites not served over HTTPS, or on demand as a fallback)
– Inline delivery (default, simple) or Enhanced delivery (fetches the key via a REST API endpoint after page load — keeps it out of cached/static HTML, cache-plugin friendly)
– Encryption is done fresh on every request (about a third of a millisecond), so members-only or per-user content can never be served to the wrong visitor from a cache
– Fails open gracefully on hosts missing OpenSSL/PBKDF2 support, instead of breaking the page
– Optional Headless Browser Detection: withholds decryption from sessions that look like Puppeteer/Playwright/Selenium, scored across several client-side automation signals so no single false-positive blocks a real visitor
– Keyword cloaking using CSS pseudo-elements (whole words only, Unicode aware, never inside HTML attributes or code blocks)
– Invisible noise injection to confuse crawlers — only ever injected into plain text, never inside HTML tags or inside <script>, <style>, <pre>, <select>, <svg>, and similar elements; injection rate is configurable (1–50%)
– Automatic AMP detection — protection is skipped on AMP endpoints instead of producing invalid markup
– Per-post type configuration
– Excluded user roles (protection never applies to selected roles)
– Custom encryption key per site
– Custom content selector support, with an Auto-detect button in settings
Use this plugin to harden your site’s content visibility while maintaining a smooth reading experience for real users. Its goal is to deter casual bots and crawlers — not to stop a determined human, since anyone who can see content can always screenshot or retype it.
Source Code
This plugin decrypts content with the browser’s built-in Web Crypto API. CryptoJS is bundled only as a fallback for sites not served over HTTPS or browsers without Web Crypto.
js
– Source version: GitHub Repo
This plugin optionally uses disable-devtool (MIT licensed) for the “Enable Advanced DevTools Blocking” setting.
js
– Source version: GitHub Repo
0” by Init HTML (MIT licensed) for the “Enable Anti-Screenshot Protection” setting.
js
License
This plugin is licensed under the GPLv2 or later.
You are free to use, modify, and distribute it under the same license.