內容簡介
BaseCloud Shield 是一款輕量且強大的安全外掛，專注於在 WordPress 登入頁面上強制執行雙重身份驗證（2FA）。它提供可靠且靈活的 OTP 傳遞方式，確保網站安全。
【主要功能】
• 即插即用：使用標準 WordPress 郵件傳遞立即生效
• 多收件人系統：可將 OTP 發送至多個用戶
• 多通道傳遞：同時選擇多種傳遞方式（郵件、WhatsApp、SMS 等）
• WhatsApp 整合：透過 Twilio API 直接發送 OTP
• SMS 整合：使用 Twilio API 發送 OTP 短信
• 高可交付性郵件：內建 SendGrid API V3 整合
外掛標籤
開發者團隊
📦 歷史版本下載
原文外掛簡介
BaseCloud Shield is a lightweight yet powerful security plugin that enforces Two-Factor Authentication (2FA) on your WordPress login page. Unlike other bloat-heavy plugins, BaseCloud Shield focuses on reliability and flexibility in OTP delivery.
Key Features:
Plug & Play: Works immediately using standard WordPress email delivery.
Multi-Recipient System: Send OTPs to the logging-in user, a manager email, or selected users.
Multi-Channel Delivery: Choose multiple delivery methods simultaneously (Email, SendGrid, WhatsApp, SMS, Webhook).
WhatsApp Integration: Send OTPs directly via WhatsApp using Twilio API.
SMS Integration: Deliver OTPs via SMS using Twilio API.
SendGrid API V3: Native integration for high-deliverability emails.
Webhook Support: Connect to custom webhooks for advanced automation flows.
Secure OTPs: 6-digit one-time passwords that expire automatically.
Browser Trust: “Remember this device” functionality to reduce friction for authorized users.
Advanced Attack Protection (v1.4.2): Credential stuffing detection, progressive delays, username enumeration protection.
External Services
This plugin may connect to external third-party services depending on your configuration. Below is a detailed explanation of what services are used, what data is sent, and when:
SendGrid Email API (Optional)
If you select “SendGrid API” as your delivery method in the plugin settings, this plugin will send data to SendGrid’s email service to deliver one-time password (OTP) codes.
Service: SendGrid by Twilio
What it’s used for: Sending two-factor authentication codes via email with improved deliverability
When data is sent: Every time a user attempts to log in and 2FA is enabled
Data sent:
Recipient email address (user’s email or manager email if configured)
Sender email address (configured in plugin settings)
Site name
Username attempting to log in
6-digit one-time password code
Email subject and HTML body
API Endpoint: https://api.sendgrid.com/v3/mail/send
Terms of Service: https://www.twilio.com/legal/tos
Privacy Policy: https://www.twilio.com/legal/privacy
Important: You must have a SendGrid account and API key to use this feature. You are responsible for complying with SendGrid’s terms of service and ensuring proper data handling practices.
Twilio API for WhatsApp & SMS (Optional)
If you select “WhatsApp” or “SMS” as delivery methods, the plugin will send data to Twilio’s API to deliver one-time password codes.
Service: Twilio
What it’s used for: Sending two-factor authentication codes via WhatsApp and/or SMS
When data is sent: Every time a user attempts to log in and 2FA is enabled with WhatsApp/SMS selected
Data sent:
Recipient phone number (from user meta field ‘billing_phone’)
Sender phone number (WhatsApp number or SMS number configured in settings)
Site name
Username attempting to log in
6-digit one-time password code
Message body
API Endpoint: https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json
Terms of Service: https://www.twilio.com/legal/tos
Privacy Policy: https://www.twilio.com/legal/privacy
Important: You must have a Twilio account with WhatsApp and/or SMS capabilities enabled. Phone numbers must be stored in user meta (field: ‘billing_phone’). You are responsible for complying with Twilio’s terms of service.
Custom Webhook (Optional)
If you select “Webhook” as a delivery method, the plugin will send login notification data to a webhook URL you configure.
Service: Custom webhook endpoint (configured by you)
What it’s used for: Sending login notifications to external systems for custom processing
When data is sent: Every time a user attempts to log in and 2FA is enabled
Data sent:
Site name
Username attempting to log in
User email address
6-digit one-time password code
Recipient information array
Timestamp of login attempt
Endpoint: User-configured webhook URL
Important: When using the webhook option, you are responsible for the security and privacy compliance of the endpoint you configure. Ensure your webhook endpoint uses HTTPS and follows proper data protection practices.
Standard WordPress Email (Default)
By default, this plugin uses WordPress’s built-in wp_mail() function, which does not involve any external services unless your WordPress installation is configured to use a third-party SMTP service.
