內容簡介
Access Governance for WordPress (AAM) 是一個用於 WordPress 的存取治理平台，幫助使用者理解和控制用戶、角色、應用程式、API 及其他身份如何與網站互動，提升網站安全性。
【主要功能】
• 發現有效存取：了解角色、能力和存取規則的影響
• 強制最小權限：僅授予用戶所需的存取權限
• 定義和執行存取控制：設計和執行一致的存取策略
• 定期審核存取權限：檢查和更新用戶權限
• 支援多種身份驗證方式：整合不同的驗證方法
• 監控 API 存取：管理應用程式密碼和 API 端點
外掛標籤
開發者團隊
② 後台搜尋「Access Governance for WordPress (aka AAM)」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
Advanced Access Manager (AAM) is an Access Governance platform for WordPress. It helps you understand and control how users, roles, applications, APIs, and other identities interact with your website.
WordPress security is not only about stopping attackers at the perimeter. Security also depends on what authenticated users, applications, integrations, and automated systems are allowed to do once they have access.
A user may have more capabilities than their job requires. An old account may still have administrative privileges. An Application Password may expose unnecessary API access. A plugin may introduce new capabilities or endpoints. An AI agent may be connected through an account with far more authority than it needs.
These are access governance problems.
AAM provides the tools to discover, define, enforce, and audit access across WordPress so you can reduce excessive privileges, prevent broken access controls, and build a security model based on the principle of least privilege.
Security starts from within.
What is Access Governance?
Access Governance is the continuous practice of answering four fundamental questions:
Who has access?
What can they access?
Why do they have that access?
Should they still have it?
In WordPress, the answers are rarely determined by a user’s role alone.
Effective access can be influenced by roles, capabilities, direct user permissions, content-level rules, plugins, authentication methods, API endpoints, Application Passwords, integrations, and custom application logic.
AAM brings these controls together so that WordPress access can be intentionally designed, consistently enforced, and periodically reviewed.
Access Governance with AAM
Discover Effective Access – Understand how roles, capabilities, inherited permissions, and access rules determine what an identity can actually do.
Enforce Least Privilege – Give users, applications, and integrations only the access required to perform their legitimate responsibilities.
Mitigate Broken Access Controls – Reduce the risk of unauthorized actions caused by excessive permissions, misconfigured roles, exposed endpoints, or inconsistent access rules.
Govern Users & Roles – Manage WordPress roles, capabilities, user permissions, and access inheritance with greater precision.
Protect WordPress Resources – Control access to posts, pages, media, taxonomies, custom post types, administrative areas, and other WordPress resources.
Govern API Access – Control access to REST API endpoints, XML-RPC functionality, and other programmatic interfaces.
Audit Access Continuously – Identify excessive privileges, risky configurations, unnecessary credentials, and other access-related security concerns before they become incidents.
Define Access as Policy – Use JSON Access Policies to describe portable, auditable, and automation-friendly access rules.
Build Custom Access Controls – Use the AAM PHP Framework and developer APIs to implement application-specific authorization and governance requirements.
Key Features
Security Audit – Evaluate WordPress for access-related security risks, configuration problems, excessive privileges, and other potential weaknesses.
Role & Capability Management – Create and manage roles and control WordPress capabilities beyond the default role system.
User-Level Access Controls – Refine access for individual users without creating unnecessary roles.
Content Access Governance – Control who can view, edit, publish, delete, or otherwise interact with WordPress content.
Backend Access Control – Restrict administrative functionality and control access to WordPress backend menus and features.
Frontend Access Control – Define access rules for visitors, authenticated users, roles, and individual accounts.
API Access Control – Govern access to REST API endpoints, XML-RPC, and programmatic WordPress functionality.
Authentication & Identity Controls – Manage authentication-related functionality and additional mechanisms for securely accessing WordPress.
JSON Access Policies – Define complex access requirements as structured, reusable policies.
Developer Framework – Extend AAM or build custom authorization logic using its PHP APIs, hooks, and services.
Beyond Roles and Capabilities
WordPress roles and capabilities are an important part of authorization, but they are only part of the complete access model.
Modern WordPress websites may expose functionality through the admin dashboard, frontend requests, REST APIs, XML-RPC, Application Passwords, plugins, integrations, automation platforms, and AI agents.
That means securing WordPress requires looking beyond the question:
“What role does this user have?”
The more important question is:
“What can this identity actually do?”
AAM is designed around this broader view of effective access.
Built for Modern WordPress Security
AAM is built for site owners, developers, agencies, and security professionals who need more than basic role management.
Use AAM to establish a repeatable access governance process:
Discover → Evaluate → Define → Enforce → Verify → Audit
Whether you manage a single website or hundreds of client installations, the goal remains the same: maintain a clear, intentional, and defensible access model.
AAM is used on 150,000+ WordPress websites and has been developed specifically around WordPress authorization and access control for more than a decade.
Most core functionality is available for free, with advanced capabilities available through premium extensions.
No ads. No hidden tracking. No unnecessary data collection.
Just access controls you can understand, enforce, audit, and trust.
