Onionify is an independent plugin that enables WordPress websites to operate seamlessly through onion services (.onion). This plugin is not affiliated with or endorsed by the Tor Project. Onionify adds safe and standards-compliant integration for onion access – rewriting runtime URLs when requests a
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.0 and PHP 7.4.
SourceWordPress plugins · Nov 4, 2026
01 / Source details
Aboutthistool.
Onionify is an independent plugin that enables WordPress websites to operate seamlessly through onion services (.onion).
This plugin is not affiliated with or endorsed by the Tor Project.
Onionify adds safe and standards-compliant integration for onion access – rewriting runtime URLs when requests arrive via .onion, preventing canonical redirects that might expose onion visitors to the clearnet, optionally adding the official Onion-Location HTTP header, and applying additional privacy-hardening measures (CSP, COEP, oEmbed and resource hints control) specifically for onion traffic.
Documentation: Onionify Technical Documentation
The plugin follows WordPress.org guidelines and is designed for secure public distribution:
No modifications to WordPress core.
Uses WordPress filters and actions only.
Fully compatible with multisite environments (per-site mappings and network defaults).
Optional WP-CLI integration for advanced administration.
⚠ IMPORTANT WARNING
⚠ Warning: This plugin does not provide hosting-level anonymity or concealment of infrastructure. Onionify helps WordPress handle requests that arrive via onion service addresses, but it does not change or hide server configuration, hosting provider information, or other infrastructure-level metadata. If you require infrastructure-level protections or specialized operational procedures, consult authoritative technical documentation and qualified operational security professionals. Do not rely on this plugin for legal compliance or for anonymizing hosting details.
Features
Detects .onion requests and safely rewrites generated WordPress URLs to the configured onion host at runtime.
Does not modify database home or siteurl values – all rewrites occur at runtime only.
Optional privacy enhancements for onion visitors (CSP, COEP, X-Frame-Options, disable oEmbed, and tighten resource hints).
Optional verification feature using a public list of known Tor exit addresses (opt-in only).
Includes WP-CLI commands to list, map, and manage onion host configurations.
Provides filter hooks for extensibility (including onion_is_onion_request and onion_verify_exit_list ).
Carefully validated, defensive code compatible with PHP 7.4 – 8.x.
Quick usage (WP-CLI)
wp tor-onion list – show mapping table (multisite) or single-site status.
wp tor-onion map <blog_id|0> <example.onion> – map blog_id (or 0 for single-site) to an onion host.
wp tor-onion set --hardening=on|off --oembed=on|off --csp=strict|relaxed|off – quick toggles.
For command arguments, usage examples, and implementation details, see the Onionify WP-CLI Documentation .
Settings explained (concise + clear)
.onion domain – Host only, no protocol. Example: abcd1234xyz.onion . Leave empty to use Network Default (multisite).
Send Onion-Location from clearnet – When enabled, the plugin adds an Onion-Location: http://<your-onion><path> header to requests on the clearnet site. This is useful to advertise your onion mirror to Tor Browser or other clients.
Enable onion hardening – When enabled, headers and filters designed to reduce external resource loading (and privacy leakage) are applied to requests only when served via .onion.
Disable oEmbed/embeds on .onion – Blocks automatic fetching of oEmbed content (YouTube, Twitter, etc.) and discovery links to avoid loading third-party resources for onion visitors.
CSP mode – Strict , Relaxed , Off , Custom . Strict – safest. No inline scripts. Best for privacy; may break themes/plugins that rely on inline JS.
3) If you must use an external CDN – add only the exact host(s): img-src 'self' https://cdn.example.com data:; font-src 'self' https://cdn.example.com data:;
Tips & cautions: – Start with Strict ; if things break (admin bar, theme JS), switch to Relaxed . – Use Custom only if you know CSP; incorrect CSP can break admin, media, or login. – Avoid including public CDNs in onion mode where possible – best privacy practice is to host assets locally.
For multisite mapping, Sunrise integration, network configuration, and operational limitations, see the Onionify Multisite and Sunrise Documentation .
Filters & constants (developer)
apply_filters('onion_is_onion_request', bool $is_tor, array $server) Allows other plugins/themes to override detection. $server is a copy of $_SERVER .
apply_filters('onion_verify_exit_list', bool $default) Controls whether the plugin will verify IPs against the Tor exit list. Disabled by default.
define('TOS_VERIFY_TOR_EXIT', true); – alternative to enable exit-list verification in wp-config.php .
onion_support_* option names used by the plugin: see Settings page. The plugin cleans up these options on uninstall.
For available hooks, filters, configuration options, and integration details, see the Onionify Developer Reference .
If you do not want automatic cleanup, do not use the admin “Delete” action; deactivate only.
Privacy, security, and limitations (be explicit)
This plugin only adjusts WordPress behavior (URL outputs, selected headers, CSP, and resource hint handling) based on how visitors access the site (clearnet vs .onion).
It does not anonymize or conceal server infrastructure details. Information such as hosting provider IP addresses, DNS records for clearnet domains, or other infrastructure-level metadata remains unchanged. Onionify is not designed or intended to provide anonymity or infrastructure concealment.
Enabling the optional exit-address verification feature performs external HTTP requests to a trusted public source (only when explicitly opted in). If your hosting environment restricts outbound HTTP requests, use the WP-CLI interface or wp-config.php configuration after verifying your allowed hosts.
The plugin operates with a privacy-first design: external requests are disabled by default, and its default configuration aims to reduce unnecessary third-party requests for onion visitors.
For known implementation limitations, troubleshooting procedures, and deployment considerations, see the Onionify Troubleshooting and Limitations Guide .
External services
This plugin can optionally fetch the official Tor exit relay list to verify requests against Tor exits.
Service: Tor Project – Exit addresses list Endpoint: https://check.torproject.org/exit-addresses
What it is used for: When exit verification is enabled, the plugin downloads the public list of Tor exit relays to check inbound requests.
What data is sent and when: The plugin performs a normal HTTP GET request from the server to the Tor Project endpoint. No user PII is sent; the request includes a generic User-Agent header and, as with any HTTP request, the server’s IP address is visible to the Tor Project. This request happens at most once per 24 hours due to caching and only if exit verification is enabled by the site owner.
How to enable/disable: Exit verification is opt-in. It is disabled by default. It can be enabled via the plugin settings or by adding define(‘TOS_VERIFY_TOR_EXIT’, true) in wp-config.php. If your environment blocks external HTTP requests (WP_HTTP_BLOCK_EXTERNAL), the plugin will respect that unless the host is whitelisted in WP_ACCESSIBLE_HOSTS.
Provider policies: See the Tor Project privacy policy and terms on their official website.
Support
Use the WordPress.org support forum for the plugin. For commercial help or customizations contact https://infinitumform.com/.
See it in action
A closer look.
Onionify Settings
02 / Source details
Gettingstarted.
01Upload the onionify folder to the /wp-content/plugins/ directory.
02Activate the plugin through the ‘Plugins’ screen in WordPress.
03(Single-site) Go to Settings → Onionify and enter your .onion host (host only, e.g. abcd1234xyz.onion ) and optional hardening settings.
04(Multisite) Network Admin → Onionify → use the Mapping page to map each site to its onion host, and optionally set Network Defaults on the Defaults submenu.
05(Optional) To verify IPs against the official Tor exit list enable verification: Add define('TOS_VERIFY_TOR_EXIT', true); to wp-config.php , or
06Add add_filter('onion_verify_exit_list', '__return_true'); in a mu-plugin or theme functions file. Note: verification is opt-in and cached for 24 hours. If your environment disables external HTTP calls, keep verification disabled.
For detailed installation instructions, configuration requirements, and initial verification, see the Onionify Installation and Configuration Guide .
03 / Source details
Frequently asked questions.
How to set up a WordPress site with a .onion address?
First, you need to configure a Tor hidden service on your server. This is done outside of WordPress, by editing the Tor configuration file (usually /etc/tor/torrc ) and adding lines such as:
After restarting the Tor service, Tor will generate a hostname file (for example /var/lib/tor/hidden_service/hostname ) that contains your new .onion address.
Once you have the .onion address, open your WordPress admin panel and go to: * Settings → Onionify (single-site) * or Network Admin → Onionify (multisite)
Enter your .onion host (for example abcd1234xyz.onion ) in the provided field. Onionify will automatically handle URL rewriting and privacy adjustments when visitors access your site through the onion address.
If you want browsers to automatically discover your onion mirror from the clearnet site, enable Send Onion-Location from clearnet in the plugin settings.
Note: Onionify does not create or manage the Tor hidden service itself; it only configures WordPress to correctly respond to requests coming from your .onion address.
Will this make my site available only through an onion address?
No. The plugin does not modify hosting, DNS, or server-level routing. It simply adjusts WordPress behavior when incoming requests originate from an onion address. If you want a site that is accessible exclusively via onion services with no clearnet presence, that requires additional server and network configuration beyond this plugin.
I use a CDN like Cloudflare – will this work?
The plugin inspects common headers (for example, CF-Connecting-IP and X-Forwarded-For ) to help detect onion-origin requests behind CDNs. It also provides the onion_is_onion_request filter for integrations with other plugins. If your CDN modifies or removes headers, adjust your CDN or proxy settings so that the real client IP headers are passed through to WordPress.
What happens if I enable Custom CSP but make a mistake?
If the Custom CSP is invalid or overly restrictive, some parts of your site (including the admin area) may stop functioning properly. The plugin will send exactly the CSP string you provide. Use this feature only if you understand Content Security Policy rules, and test changes on a staging or development site first.
Does the plugin change database `home` or `siteurl` values?
No. The plugin returns rewritten URLs dynamically at runtime. Database values remain unchanged.
How do I enable or disable the exit-address verification check?
The feature is disabled by default. No action is required to keep it off. To enable it, add define('ONS_VERIFY_EXIT_ADDRESSES', true); to your wp-config.php file or use the filter add_filter('onion_verify_exit_list', '__return_true'); .
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
