內容簡介
Blog Cutter Smart Security Management 是一款本地的 WordPress 安全輔助外掛，專注於保護網站免受自動化攻擊，並提供多種安全功能，無需依賴外部服務或腳本。
【主要功能】
• 提供數學挑戰以防止可疑訪客
• 限制每個 IP 的唯一 URL 訪問次數
• 在登入表單中加入數學檢查與鎖定功能
• 隱藏 wp-login.php 並使用秘密標識（選擇性）
• 透過數學檢查和蜜罐保護評論及用戶註冊
• 提供選擇性的 TOTP 雙因素身份驗證
外掛標籤
開發者團隊
② 後台搜尋「Blog Cutter Smart Security Management」→ 直接安裝（推薦）
原文外掛簡介
Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.
The plugin can:
Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes
Rate-limit unique URLs per IP and log the event
Add a math check and lockout to the login form
Hide wp-login.php behind a secret slug (optional)
Protect comments and user registration with a math check and honeypot
Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)
Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers
Block common exploit probes in the request URI (local pattern list)
Store security events (IP, user agent, URL) in your database for a limited time
Run a local health checklist and let administrators revoke sessions
This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.
How to configure
After activation, open Blog Cutter Security in the admin menu.
Review Settings. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).
Optional: enable two-factor authentication on each administrator Profile.
Optional: Magic Login — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.
If you hide the login URL, bookmark the secret slug. Locked out? Add define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true ); to wp-config.php, or deactivate the plugin over FTP / file manager.
Privacy
When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools → Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.
Third-party services
None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only.
