Juliet Just Masks Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Juliet Just Masks is a high-performance URL masking and reverse proxy mask manager for WordPress. While Romeo Redirect Manager handles open redirects, Juliet provides seamless stealth routing and URL masking.
As a lightweight, native URL masker, Juliet lets WordPress act as a stealth reverse proxy. It intercepts specific incoming paths, keeps the visitor’s address bar unchanged, and fetches/renders dynamic HTML, React/Vue SPAs, or external landing pages behind the scenes.
Why use Juliet Mask Manager?
- Native URL Masking — Serve remote applications, microservices, and landing pages on your own custom domain without iframes or server configuration.
- Smart Mask Manager — Visual dashboard to create, manage, sort, search, and toggle active/inactive URL masks in real time.
- Fast Path Reverse Proxy — Zero-latency early route matching hooks before WP Query to proxy requests at top speed.
- SPA &
<base>Tag Injector — Keeps relative script chunks, assets, and API requests properly routed through the proxy. - Asset & Link Patcher — Rewrites root-relative URLs, internal CSS
url()assets, and external navigation links into your local mask namespace. - SSRF Protection & Security — Enterprise-grade IP and protocol validation protects your server from unsafe outbound requests.
- Companion to Romeo Redirect Manager — The complete routing suite: Romeo for redirection, Juliet for masking.
Features
- Stealth Routing Engine — Bypasses WP_Query to serve remote HTML without triggering a 404, supporting unlimited sub-paths.
- Mask Manager Dashboard — Intuitive card and list views with live search, custom dropdown filtering, and instant AJAX toggles.
- URL Masker & Link Masking — Automatically rewrites remote URLs and same-origin links into your local slug namespace.
- Asset Dependency Patcher — Rewrites root-relative asset paths (
/css/style.css,srcset, inlineurl(), data-src) on the fly. - Proxy Header Passthrough — Forwards visitor IP (
X-Forwarded-For), User-Agent, language, and protocol for accurate analytics. - SSRF Protection — Validates protocols, credentials, and DNS against private IP ranges.
- DOM
<base>Injector — Smart<base href>injection tailored for complex JavaScript/AJAX-heavy SPAs. - Asset Caching & MIME Typing — Built-in static asset caching headers and strict MIME type detection for scripts and styles.
- Graceful Failsafe — Theme-native 404 fallback if a remote server is unreachable.
- Method Pass-Through — Supports GET, POST, PUT, PATCH, DELETE, and CORS OPTIONS preflight requests.
Example
- Go to Juliet Just Masks in wp-admin.
- Click Create New Mask.
- Enter the Local Path:
marketing-hub. - Enter the Remote Target URL:
https://external-landing-page.com/promo-1. - Save.
Visiting yoursite.com/marketing-hub now renders the remote landing page while the address bar still shows yoursite.com/marketing-hub. Deeper paths work too: yoursite.com/marketing-hub/pricing proxies the remote app’s /pricing route.
Known limitations
- CORS — if the remote server sends strict CORS headers for its assets, browsers may block cross-origin subresources. The remote must allow your domain (or serve assets with permissive CORS).
- Remote sessions —
Set-Cookieresponses are not forwarded (cookies would be scoped incorrectly). Authenticated remote applications need additional cookie handling; forwarding the visitor’s cookies upstream is available via thejuliet_forward_cookiesfilter but leaks this site’s auth cookies, so only enable it for trusted targets. - DNS rebinding — SSRF validation resolves DNS separately from the fetch. A hostile target could rotate DNS between check and fetch. Only mask targets you control or trust.
- Lazy-loaded assets — attributes such as
data-srcset by JavaScript after load cannot be patched server-side; enable<base>injection for those apps.
Filters (developer reference)
juliet_target_url— filter the final outbound URL (args:$url,$mask,$subpath).juliet_timeout— remote fetch timeout in seconds (default 15).juliet_cache_ttl— response cache TTL in seconds (default 300, 0 disables).juliet_max_cache_bytes— max cacheable body size (default 2 MB).juliet_proxy_headers— outbound proxy headers (args:$headers,$mask,$url).juliet_forward_cookies— forward the visitor’s Cookie header upstream (default false).juliet_allow_private_targets— allow private/internal network targets (default false).juliet_apply_link_masking— rewrite same-origin remote links into the slug namespace (default true).juliet_reserved_slugs— slugs that may never be registered as masks.juliet_request_args— fullwp_remote_request()argument override.juliet_honor_loop_guard— block requests that already carry the proxy signature (default true).
Screenshots
Main Dashboard (Card View) — Overview of all active and inactive URL masks with instant toggles, quick copy actions, real-time search, and status filtering.
Create & Edit Mask Interface — Clean configuration form with custom local path prefixing, target URL routing, and dynamic tag injection.
Interactive Tag & SPA Guide Modal — Educational popup guide explaining Single Page Applications (React, Vue, Vite, Next.js, Angular, Svelte) and chunk proxy isolation.
One-Click Backup & JSON Import — Safe migration modal with automated duplicate slug conflict detection and smart merge options.
Fully Responsive Mobile Interface — Optimized layout and touch-friendly controls across smartphones, tablets, and desktop devices.
Live Permalink Conflict Detection — Real-time warning alert preventing collisions with existing WordPress Pages, Posts, and Romeo 301 redirects before saving.

