Early access · Beta
Blind Pig WP™
Your WordPress MCP doors, hidden in plain sight.
A small WordPress plugin with a plain front and a private back room. Strangers who come looking for your WordPress MCP doors find a blank wall. The guests you invite walk straight through.
Members only
New film coming soon
Blind Pig WP · the picture show
Placeholder: the new Blind Pig WP video goes here.
The problem
Your site grew a back door. The whole street can see it.
WordPress sites now open MCP endpoints (Model Context Protocol): doors that let AI assistants like Claude and Grok Bot work with your site, through the WordPress MCP Adapter and the Abilities API.
Those doors are posted in your site’s public route list, so bots and scanners come calling. Even a locked door that answers “login required” has told them there’s something worth trying behind it.
“Login required.”
Courteous. Also a confession.
How it works
A plain front. A private back room.
I
A stranger knocks
A bot or scanner tries one of your site’s MCP doors.
II
Nothing to see here
Blind Pig WP answers with WordPress’s own ordinary 404, exactly like a route that never existed. The door also vanishes from your public /wp-json index.
III
Guests walk right in
Addresses on your guest list, and apps that send your secret header, get through as usual.
Three modes
Set the house rules for each WordPress MCP door.
Lights on
Open
Business as usual. The door is listed and works like it always has.
Lights low
Unlisted
Off the public list. It still answers at its exact address, for anyone with a login.
Pitch dark
Lights out
A flat “not found” for everyone except your guest list and apps that carry your secret key.
Out of the box it covers the WordPress MCP Adapter and the Abilities API, and it can hide other MCP doors too, such as the Astra theme’s.
The guest list
Only the names on the list.
- Claude (Anthropic). A one-click preset for Anthropic’s published range (160.79.104.0/21), covering connectors added on Claude.ai and through Claude’s API.
- Apps with your secret key. Your own connectors, Grok Bot among them, send a private key in a secret header with each request.
- Helpers by address. Any server or tool that connects from a fixed IP address or range.
- You, logged in. Your dashboard and the block editor keep working.
Behind Cloudflare? Blind Pig WP reads the real visitor address only when the request truly comes from Cloudflare’s published ranges, so nobody can fake their way onto the list.
A second lock, not a replacement
Blind Pig WP never removes a lock. Once a guest is through the door, WordPress still checks their Application Password.
It simply keeps strangers from finding the door in the first place.
Light on its feet
Small, quiet, and easy to leave.
- One small plugin. No extra server to run.
- No phoning home. The only outside request is an optional quick check, and it asks your own site.
- Nothing hidden until you say so. A three-step setup wizard comes first.
- One-click pause. Plus an emergency off switch for wp-config.php.
- Clean uninstall. Settings live in your WordPress database; deleting the plugin removes them.
- Works behind Cloudflare. No preset needed, and no faking the guest list.
The name
Why “Blind Pig”?
Long before Prohibition, America’s dry laws gave rise to the blind pig: an unlicensed bar hiding in plain sight. The story goes that the keeper charged admission to see a curious animal and threw in a drink, free of charge. It wasn’t only a story. In 1838, at a militia muster in Dedham, Massachusetts, one enterprising showman painted stripes on an ordinary pig, charged a few cents to see it, and poured every visitor a glass on the house.
By the Prohibition years, “blind pig” was everyday slang for any hidden bar. Nobody is quite sure where the “blind” came from. One theory points to the windowless fronts and the little peephole in the door.
Blind Pig WP keeps the same arrangement for your WordPress MCP doors. From the street there’s nothing to see. Those who know the word step inside.
Proof at the door
Try the door yourself.
This very site keeps its own WordPress MCP door hidden. Knock without the word and see who answers.
Expect a cold “No route was found.” That’s the door pretending it doesn’t exist.
Strangers get the blank wall. Invited guests, like Claude and Grok Bot, walk right in.
Questions at the door
Before you knock.
A few straight answers about Blind Pig WP and your WordPress MCP doors.
What does Blind Pig WP do?
It hides the WordPress MCP endpoints your site opens for AI assistants. Unless a request carries your secret key or comes from an address on your guest list, it gets a plain 404, as if the door were never there. Pick how strict each door is with the three modes.
How do invited guests get in?
Two ways. Your own connectors, Grok Bot among them, can send your secret key in a secret header with each request. Or you add their IP addresses to the guest list; a one-click preset covers Claude (Anthropic, 160.79.104.0/21). Cloudflare is not a preset; behind it, Blind Pig WP simply reads the real visitor address.
Does it work with the WordPress MCP Adapter?
Yes. It covers the endpoints opened by the WordPress MCP Adapter and the Abilities API, and it can hide other MCP doors too, such as the Astra theme’s.
Do I still need Application Passwords?
Yes. Blind Pig WP is a second lock, not a replacement. Once a guest is through the door, every request still has to log in with an Application Password.
Will it slow my site down?
No. It’s a lightweight plugin that makes no outside calls. It keeps its settings in your WordPress database, and a clean uninstall removes them.
Can I try it?
Blind Pig WP is in early access, in beta testing now. To join the beta, write to [email protected].
Early access
Coming soon to the WordPress plugin directory.
Blind Pig WP is in beta testing now on its maker’s own sites. Check back here for the release.
Until then, keep it under your hat.
Inquiries, or want a seat in the beta? [email protected]