內容簡介
CodeCanvas Guard 是一款以本地為主的 WordPress 安全套件，專注於可檢視的變更與安全恢復，提供多層次的保護和恢復功能，確保網站安全。
【主要功能】
• 安全、平衡及嚴格的保護配置
• 自訂登錄路徑，啟用前需瀏覽器驗證
• TOTP 雙因素認證及一次性恢復碼
• 登錄速率限制及登錄蜜罐功能
• 定期掃描及優先級文件監控
• 管理員審核的發現與受保護的 CSV/JSON 匯出
外掛標籤
開發者團隊
原文外掛簡介
CodeCanvas Guard is a local-first WordPress security suite built around reviewable changes and safe recovery.
Core features include:
Safe, Balanced, and Strict protection profiles.
A recovery-first custom login route with browser verification before activation.
Username-and-IP rate limiting, CIDR allow/block rules, a login honeypot, and generic login errors.
TOTP two-factor authentication with encrypted secrets and one-use recovery codes.
Optional role-based 2FA enforcement and optional Cloudflare Turnstile.
REST user protection, author-enumeration blocking, XML-RPC and pingback controls, security headers, and file-editor protection.
WordPress core and eligible WordPress.org plugin checksum checks.
Local suspicious-PHP patterns, executable uploads, unsafe permissions, recent sensitive-file changes, and known-vulnerability matching.
Critical, High, Medium, Informational, and Unavailable findings with exact reasons and evidence.
Administrator-reviewed findings, exact-file hash approvals, filters, and protected CSV/JSON exports.
Scheduled scans and priority-aware file monitoring with explicit coverage reporting.
Administrator-approved trusted repairs, protected recovery points, quarantine, restore, and rollback.
Security activity logs, update awareness, session review, and optional email alerts.
Scheduled scans do not modify files. Repair, quarantine, restore, and rollback actions require an authenticated administrator action and nonce. Guard does not send telemetry to CodeCanvas.
Emergency Recovery
The dashboard can create a one-time emergency login link. The link expires after 30 minutes and opens a 15-minute recovery session.
For hosting-level recovery, add the following above the stop-editing comment in wp-config.php:
define( 'CODECANVAS_GUARD_DISABLE', true );
Remove the line after access is restored and the configuration is corrected.
External Services
CodeCanvas Guard uses external services only for the features described below.
WordPress.org services
Integrity scans, native update awareness, and approved trusted repairs use official WordPress.org services. Depending on the action, WordPress sends the installed WordPress version and locale, or plugin/theme identifiers and versions, and receives checksum data, update metadata, or an official package. Guard uses the native WordPress HTTP and updater APIs. These requests occur during manual or scheduled scans, update checks, and an administrator-approved repair.
Service: https://wordpress.org/
Privacy policy: https://wordpress.org/about/privacy/
Terms: https://wordpress.org/about/terms/
Wordfence Intelligence
Known-vulnerability matching is optional. When enabled with an API key, the server sends the API key and normal HTTP request metadata to Wordfence Intelligence and downloads its V3 production vulnerability feed. Guard compares the feed with the installed inventory locally; website files and the installed inventory are not uploaded to Wordfence. The service requires a Wordfence Intelligence API key.
Service and setup: https://www.wordfence.com/help/wordfence-intelligence/v3-accessing-and-consuming-the-vulnerability-data-feed/
Terms and privacy: https://www.wordfence.com/terms-of-use-and-privacy-policy/
Cloudflare Turnstile
Turnstile is optional and disabled by default. When configured, Cloudflare’s challenge script loads on interactive login pages. Cloudflare can process browser and device information under its policy. During login, Guard sends the challenge response, configured secret, and visitor IP address to Cloudflare for verification.
Service: https://www.cloudflare.com/products/turnstile/
Privacy policy: https://www.cloudflare.com/privacypolicy/
Terms: https://www.cloudflare.com/website-terms/
Privacy
Guard can store WordPress user IDs, IP addresses, event times, action summaries, limited technical context, user agents, and hashed device fingerprints for security and accountability. Administrators choose log retention from 7 to 365 days; the default is 30 days.
The plugin also stores security settings, encrypted 2FA and optional service credentials, recovery-code hashes, protected-login state, scan evidence, file hashes, approvals, and repair/quarantine metadata. Repair and quarantine files remain on the same server in a protected local directory.
Guard adds suggested text to Settings > Privacy and integrates with WordPress personal-data export and erasure tools. Erasure anonymizes user-linked audit events and removes device fingerprints and unfinished 2FA setup data. Active 2FA credentials are retained while the WordPress account exists to avoid weakening account security.
Source Code and Licenses
CodeCanvas Guard is licensed GPLv2 or later. The bundled QR generator is MIT licensed. Its human-readable upstream source is available at:
https://github.com/kazuhikoarase/qrcode-generator/tree/js2.0.4/js
See THIRD-PARTY-NOTICES.txt for the complete notice.
