[WordPress] 外掛分享： Brachmelder

內容簡介

Brachmelder 是一款專為網站和線上商店擁有者設計的外掛，能夠檢查已關閉或不再維護的外掛，幫助使用者避免安全風險。它提供簡單易懂的報告，特別適合非開發者使用。

【主要功能】
• 檢查已關閉的外掛
• 檢查被放棄的外掛
• 檢查過期的外掛
• PHP 安全支援狀態檢查
• 提供替代外掛建議

外掛標籤

開發者團隊

原文外掛簡介

Plugins that are closed or no longer maintained are one of the most common reasons websites and online shops get hacked. WordPress itself does not tell you when a plugin you use has been closed on WordPress.org. Brachmelder does, in plain language and without technical jargon.
Brachmelder is made for website and shop owners who are not developers, especially WooCommerce shops.
What Brachmelder checks

Closed plugins: WordPress.org has closed the plugin, for example because of a security issue, a guideline violation or at the request of its developer. Plugins closed because of a security issue are marked as critical.
Abandoned plugins: the last update is more than two years ago.
Outdated plugins: the plugin has not been tested with any of the last three major WordPress versions.
PHP security support: Brachmelder compares your server’s PHP version with the official end of security support and tells you how much time is left. This check runs entirely on your server and works right after activation.

Plugins that are not listed on WordPress.org (premium plugins or plugins made for your site) are shown as “not checkable”, without a warning.
Nothing is sent without your consent
After activation Brachmelder does not contact any server. Tools > Brachmelder first explains which data the plugin check would send and only starts after an administrator clicks “Enable check”. You can disable the check at any time on the same page; the daily check is then removed and the stored results are deleted.
Where you see the results
Once the plugin check is enabled:

Tools > Brachmelder: a traffic light overview. For every finding Brachmelder explains what the status means, what the risk is and what you should do.
Plugin list: a status column next to each plugin.
Site Health: a test for closed plugins. The test for the end of PHP security support is available even without enabling the plugin check.
Admin notice: only when a plugin was closed because of a security issue. You can hide it; it comes back only if another critical finding appears.

Apart from that, Brachmelder shows a single quiet note after activation that points to its page; you can dismiss it.
Possible alternatives
For common closed WooCommerce plugins (for example EU VAT, EAN/GTIN, PDF invoices and wishlists) Brachmelder suggests actively maintained alternatives from WordPress.org. The list is shipped with the plugin; no request is made to fetch it.
How the check works
After you have enabled the check, Brachmelder checks your plugins right away and then once a day using WP-Cron, ten plugins at a time, and caches the results for 24 hours. You can start a check at any time with the “Check now” button. If WordPress.org cannot be reached, Brachmelder keeps the previous results and tries again later.
Privacy
Brachmelder contacts WordPress.org only after an administrator has enabled the plugin check. It then sends only the slugs (short names) of your installed plugins to the official WordPress.org API. No site URL, no personal data, no tracking, no telemetry, and no servers other than WordPress.org.
External services
Only after an administrator has enabled the plugin check on Tools > Brachmelder, this plugin connects to the WordPress.org Plugins API (https://api.wordpress.org/plugins/info/1.2/) to find out whether your installed plugins are still available, when they were last updated and which WordPress version they were tested with.

What is sent: the slug of each installed plugin (for example “woocommerce”), one request per plugin. The request does not include your site URL.
When: right after the check is enabled, then once a day via WP-Cron, and when an administrator clicks “Check now” on Tools > Brachmelder. Nothing is sent before the check is enabled or after it is disabled. Plugins that declare an update source other than WordPress.org (Update URI header) are not sent.

The service is provided by WordPress.org: Terms of Service, Privacy Policy.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)Really Simple Security 是一款輕量級且易於使用的 WordPress...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款功能強大的 WordPress 外掛，旨在提升網站內容...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 是一個讓您在 WordPress 中安全上傳 SVG 檔案的最佳...LoginizerLoginizer 是一款 WordPress 外掛，旨在防止暴力破解攻擊，當...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role EditorUser Role Editor 外掛允許用戶輕鬆變更使用者角色和權限。用...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionKadence Security 是一款專為 WordPress 網站設計的安全外掛...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP PluginSiteGuard WP Plugin 旨在加強 WordPress 網站的登入及管理區...