內容簡介
Assist Security 外掛提供自動化的安全金鑰旋轉功能，確保 WordPress 登入安全性。透過簡單的操作介面，使用者可以輕鬆更新安全金鑰，防止未經授權的存取，並提供詳細的審計記錄。
【主要功能】
• 一鍵旋轉安全金鑰
• 本地生成安全金鑰，無需外部 API
• 審計日誌記錄所有旋轉嘗試
• 失敗警報即時通知網站管理員
• 支援自訂配置位置
• 完全可翻譯，附帶 POT 檔案
外掛標籤
開發者團隊
原文外掛簡介
WordPress signs every login cookie and nonce with eight secret keys and salts stored in wp-config.php (AUTH_KEY through NONCE_SALT). If those secrets leak — through an old backup, a stolen config file, or a contractor who still has access — an attacker can forge valid authentication cookies for as long as the keys stay unchanged. Rotating them invalidates every existing session immediately.
Assist Security makes that rotation safe, automatic, and auditable.
🔑 Rotate Security Keys
One-click rotation from a clean, colorful settings screen
Locally generated keys using PHP’s cryptographically secure random number generator. No calls to any external API, no network dependency
Verified atomic writes. The new configuration is built in memory, written to a temporary file with restricted permissions, verified, atomically swapped in, then verified again — with automatic rollback if any step fails. The writer refuses to touch your file unless all eight keys are found, so a partial rotation is impossible
Key health checks for missing, weak, duplicated, or placeholder keys. Only the verdict is ever shown; your key values never leave the server
Audit log recording every attempt: timestamp, result, trigger, user, optional IP, duration, and how many sessions were signed out — with filtering, pagination, and CSV export
Failure alerts emailed to the site administrator if a rotation ever fails
Site Health test that flags key problems and keys older than 180 days
WP-CLI commands — wp assist-security rotate and wp assist-security status
Custom config locations supported: wp-salt.php, a wp-config.php above the web root, or any path you choose with a filter
Built the right way
Beautiful, responsive settings screen with no page reloads and no build step
REST API under assist-security/v1; no admin-ajax
No bundled SDKs, no Composer dependencies, no external HTTP requests, no telemetry
Every input sanitized, every output escaped, every query prepared
Multisite aware: management is restricted to network administrators
Privacy-conscious: IP logging is optional and data removal on uninstall is opt-in
Settings import and export as JSON
Fully translatable, with a bundled POT file
Assist Security is built on a module architecture, so further protections can be added as self-contained modules in future releases.
