[WordPress] 外掛分享： 360 Orbit Login Guard

內容簡介

360 Orbit Login Guard 是一款專為 WordPress 設計的安全外掛，主要防範自動化密碼猜測攻擊，透過多種防護機制提升網站的登入安全性，確保使用者資料不被輕易竊取。

【主要功能】
• 限制登入嘗試次數，防止暴力破解
• 記錄登入歷史，提供安全性分析
• 隱藏錯誤訊息，保護使用者名稱
• 禁用 XML-RPC，防止已知的攻擊途徑
• 提供登入表單的隱藏陷阱欄位
• 支援設定的匯出與匯入功能

外掛標籤

開發者團隊

原文外掛簡介

Login Guard addresses the most common WordPress attack of all: automated password guessing against /wp-login.php.

Rate limiting: locks an IP address out after too many failed attempts, for a configurable duration.
Login history (7 days): every attempt with a pseudonymous fingerprint instead of the raw IP address, success or failure, and the user name tried (only readable if the account exists).
Generic error messages: never reveals whether a user name exists.
Safe allowlist behaviour: an IP address from which someone with administrator rights recently signed in successfully is only locked out after ten times the usual number of failed attempts, so a few typos never lock you out.
Disable XML-RPC: closes the known bypass of rate limiting via system.multicall.
Protection against user name enumeration (?author= parameter and the public REST user list).
Hidden trap field in the login form: bots that fill in every field are rejected, whatever the password is.
A notice if an account is called admin, administrator or test, because attackers try these names first.
Export and import of all settings as JSON, to set up several sites the same way.
WP-CLI: inspect the status and unlock IP addresses even when wp-admin itself is unreachable.

Free version vs. Pro
The free version is complete on its own: rate limiting, login history, generic error messages, XML-RPC and enumeration protection, and settings export/import.
Login Guard Pro adds:

Two-factor authentication (TOTP) for individual accounts or entire roles, compatible with common authenticator apps.
A custom login URL instead of /wp-login.php, with a 404 for the real address.
Notification when an account signs in from an unknown device.
A fixed allow/block list for IP addresses.
Automatic update notifications directly in the WordPress admin.

Login Guard Pro is a separate plugin available from the author; it is not required to use the free version.

延伸相關外掛

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...CloudSecure WP SecurityCloudSecure WP Securityは、管理画面とログインURLをサイバ...Hide My WP Ghost – Security & FirewallWP Ghost 是一款專業的 WordPress 安全解決方案，旨在防止駭...Anti-Malware Security and Brute-Force FirewallAnti-Malware Security and Brute-Force Firewall 外掛旨在保...WP fail2ban – Advanced SecurityWP fail2ban 是一款強大的安全外掛，能有效保護您的 WordPres...XO SecurityXO Security 是一款增強登入安全性的外掛，提供多項功能以防...User Login HistoryUser Login History 是一款使用者登入記錄追蹤外掛，可詳細記...Quttera ThreatSign – Web Malware Scanner for WordPressQuttera ThreatSign 是一款針對 WordPress 網站的多層次安全...IP Geo Block安裝越多主題和外掛，你的網站越容易受到攻擊，即使你對其進...Stop XML-RPC AttacksStop XML-RPC Attacks 外掛可有效保護您的 WordPress 網站免...HTTP Auth啟用此外掛可在您的網站上設置 HTTP 認證。您可以輕鬆地為 HT...BotBlocker Security – Complete security platformBotBlocker Security 是一個完整的安全平台，能在 WordPress ...Protection Against DDoS這個外掛能夠解決由 WordPress Codex 中描述的暴力破解攻擊引...Melapress Login SecurityMelapress Login Security 是一款全面的 WordPress 登入安全...WordPress Brute Force Protection – Stop Brute Force AttacksGuardGiant 是一款暴力破解防護外掛，透過信任裝置機制區分真...