內容簡介
Cybexsoft Shield 是一款全面的安全外掛，旨在保護 WordPress 登入表單、監控網站檔案及設定，並在單一控制台中顯示所有安全狀態，確保網站的安全性與穩定性。
【主要功能】
• 登入保護：限制登入嘗試及使用 CAPTCHA
• 會話與密碼管理：檢查密碼安全性及會話控制
• 網站掃描：檢查檔案完整性及外掛健康狀態
• 強化安全性：啟用多項安全開關及一次性行動
• IP 黑名單與白名單：管理訪客的存取權限
外掛標籤
開發者團隊
原文外掛簡介
Cybexsoft Shield protects the login form, watches your files and settings, and shows you what it found in one dashboard.
Login protection
Limit login attempts, with per-account lockout for distributed attacks
CAPTCHA — Google reCAPTCHA v2/v3, Cloudflare Turnstile or a built-in challenge — on login, registration, lost password, comments, WooCommerce and Contact Form 7, plus a [cybex_shield_captcha] shortcode
An invisible honeypot field that stops bots with no puzzle for people
IP block and allow lists, temporary and permanent bans, and rules that ban 404 scanners, known attack tools and XML-RPC abuse
A blocked page with a reference code, and a way for real people to unblock themselves by email
Custom login URL, with an emergency recovery link
Sessions & passwords
Password rules, including a Have I Been Pwned check that never sends the password and blocking the last five passwords
See and end every signed-in session; limit sessions per user; idle timeout and maximum session length
Email alert when an account signs in from a new device
A Security section on each user’s profile with their sessions and devices
Site scanning
File integrity: WordPress core and WordPress.org plugins against official checksums, themes against their first scan, and code hidden in uploads
Restore the official copy, quarantine, or view a line-by-line diff
Plugin and theme health: updates, auto-update policy, and plugins closed or abandoned on WordPress.org
Optional Google Safe Browsing check
Hardening, server & SSL
Hardening switches: file editor, PHP in uploads, directory listing, wp-config.php permissions, XML-RPC, pingbacks, user enumeration, REST API for visitors, version number, the “admin” username, application passwords. Nothing is switched on until you choose, and one button turns on the safe set.
One-time actions: rotate security keys, change the table prefix, force a password reset. Shield’s settings are snapshotted first, and wp-config.php is backed up before it is edited.
Server audit of PHP settings, file permissions and ownership, with the exact line or command to fix each problem
SSL certificate check with expiry emails, force HTTPS once HTTPS works, security headers, and a mixed-content check
Activity log & overview
An activity log of sign-ins, account and role changes, application passwords, plugin, theme and WordPress installs and updates, changes to key site settings and to Shield’s own settings, and everything Shield refused
Filter by type, user, severity and period, search by name or IP address, and export exactly what is shown as CSV
A security score built from checks you can see — each recommendation says what it is worth and links to the fix
Fourteen days of threat activity, figures for blocked addresses, altered core files, waiting updates and failed sign-ins, and one-click switches for each protection
A Dashboard widget, and a Shield item in the admin bar with your security score and a count when something needs your attention
Country for every logged address, from Cloudflare or a free MaxMind GeoLite2 database on your own server
Privacy
Shield’s records are included in WordPress’s Export Personal Data and Erase Personal Data tools
Suggested wording for your privacy policy, reflecting your own retention settings
Optionally shorten IP addresses (203.0.113.0) and drop browser strings once events are older than a few days
No address is sent to any outside service to find its country
Recovery
If a protection ever locks you out:
Add define( 'CYBEX_SHIELD_SAFE_MODE', true ); to wp-config.php. Every protection that can stand between you and your site is suspended; logging and the settings screens keep working so you can fix the cause.
Or, with shell access, use WP-CLI: wp shield disable
WP-CLI
wp shield status — version, licence, safe mode and every module’s state
wp shield modules, wp shield enable
wp shield unblock
Pro (sold separately, delivered as an add-on plugin)
Two-factor authentication with passkeys, a firewall that can start before WordPress loads, rate limiting and crawler control, geo-blocking, server rules for Apache and nginx, a malware scanner, and governance tools: a tamper-evident audit trail of Shield’s settings, access levels and two-administrator approval, alerts to Slack, Teams, PagerDuty, syslog and webhooks, PDF reports, configuration profiles and a compliance map. The free plugin never needs Pro, and nothing in it is disabled or time-limited. See https://cybexsoft.com/products/cybexsoft-shield for plans.
External services
Cybexsoft Shield contacts the services below only for the features that need them. Every one is optional; the default CAPTCHA is Shield’s own built-in challenge, which contacts nobody, and country lookups use a database on your own server. No visitor data is sent anywhere unless you switch on one of these features.
Google reCAPTCHA
Used only if you choose “Google reCAPTCHA” as the CAPTCHA provider under Shield → CAPTCHA and enter your own keys.
The forms you protect then load a script from google.com, and Google receives each visitor’s IP address, browser and device information, and their interaction with the challenge — including visitors who never submit the form. When a form is submitted, Shield sends the challenge token, your secret key and the visitor’s IP address to Google to check the answer.
Service provided by Google: terms of service, privacy policy.
Cloudflare Turnstile
Used only if you choose “Cloudflare Turnstile” as the CAPTCHA provider under Shield → CAPTCHA and enter your own keys.
The forms you protect then load a script from challenges.cloudflare.com, and Cloudflare receives each visitor’s IP address, browser and device information, and their interaction with the challenge. When a form is submitted, Shield sends the challenge token, your secret key and the visitor’s IP address to Cloudflare to check the answer.
Service provided by Cloudflare: terms of service, privacy policy.
Have I Been Pwned (Pwned Passwords)
Used only if password rules are switched on under Shield → Sessions & passwords with “Not found in known data breaches” selected.
When a password is set or changed, and at most once a month when someone signs in, Shield hashes the password with SHA-1 on your server and sends only the first five characters of that hash to https://api.pwnedpasswords.com. The password itself never leaves your server, and the answer is compared locally. If the service cannot be reached, the check is skipped.
Service provided by Have I Been Pwned: acceptable use, privacy policy.
Google Safe Browsing
Used only if you enter a Google Safe Browsing API key under Shield → Settings.
Once a day, Shield sends your site’s home address and your API key to https://safebrowsing.googleapis.com to ask whether Google is warning visitors away from the site. No visitor data is sent.
Service provided by Google: terms of service, privacy policy.
WordPress.org
Used by the file integrity scan and Plugin & theme health, which are on by default.
Shield asks api.wordpress.org and downloads.wordpress.org for the official checksums of your WordPress version and of plugins hosted on WordPress.org, and for public information about those plugins (whether they are still listed, when they were last updated). When you choose to restore a file, its official copy is downloaded from core.svn.wordpress.org or plugins.svn.wordpress.org. Each request names only the WordPress version, locale, plugin slug and version concerned.
Service provided by WordPress.org: privacy policy.
Cybexsoft licence server
Used only if you have bought the Pro add-on and enter a licence key under Shield → Licence.
Your licence key and your site’s home address are sent to https://cybexsoft.com/api/licenses when you activate or deactivate the key, and once a day afterwards to confirm it is still valid. Nothing is sent while no licence key is stored, which is the case on every free install.
Service provided by Cybexsoft: terms of service, privacy policy.
Third-party code
The plugin is distributed under the GNU General Public License, version 3 or later. Version 3 rather than 2, because it includes code under the Apache License 2.0, which is compatible with GPLv3 but not with GPLv2.
MaxMind-DB-Reader-php — Copyright (c) MaxMind, Inc., Apache License 2.0. Portions of the .mmdb reader in includes/class-cybex-shield-mmdb-reader.php are derived from it, in modified form. No MaxMind database is bundled; you supply your own, and it stays subject to MaxMind’s terms. MaxMind and GeoLite are trademarks of MaxMind, Inc.; this plugin is not affiliated with or endorsed by them.
Public Sans and Space Grotesk — SIL Open Font License 1.1, served from this plugin rather than a font CDN, so no administrator’s IP address is handed to a third party when the dashboard loads.
Full notices are in the NOTICE file, and the licence itself in LICENSE.txt.
