內容簡介
Defen.so Connector 是一款專為開發者設計的 WordPress 外掛，提供即時的網站安全防護，並可選擇性連接 Defen.so 雲端服務，無需 API 金鑰或配置檔案，讓使用者輕鬆保護網站。
【主要功能】
• 上傳掃描：檢查上傳檔案的危險擴展名
• 登入強化：IP 限制暴力破解嘗試
• 地理封鎖：拒絕來自特定國家的請求
• 本地惡意程式掃描：檢查 PHP/JS 檔案的常見模式
• 檔案完整性基準：快照檔案並比較變更
• 活動日誌：記錄最近 100 個高價值管理動作
外掛標籤
開發者團隊
原文外掛簡介
Defen.so is a developer-first web application security SaaS. This plugin gives your WordPress site real, local protection out of the box, and connects to Defen.so in one click for a managed cloud layer on top — no API key to paste, no config file.
Works standalone — no account required
You do not need a Defen.so account to use the plugin. These features run entirely on your own server, for free, with no sign-up and no limits:
Upload scanning — every uploaded file is checked for dangerous extensions and polyglots (magic bytes that disagree with the declared type). Runs on every upload for everyone.
Login hardening — per-IP brute-force rate limiting with adjustable attempt count + window, optional reCAPTCHA v3, optional TOTP 2FA.
Geo-block — reject requests from any list of countries.
Local malware scan — heuristic sweep of your PHP/JS files for common webshell / obfuscation patterns.
File-integrity baseline — snapshot your files and compare for changes.
Activity log — records the last 100 high-value admin actions locally.
Better when connected (optional)
Connecting a free Defen.so account adds the managed cloud layer — none of it takes anything away from the standalone features above:
Managed WAF — blocks SQL injection, XSS, path traversal, bot scanners, mass assignment, using the rule set + custom rules from your Defen.so dashboard.
Attack log + uptime monitor — blocked events (including upload blocks) streamed to your dashboard; edge uptime checks.
CVE vulnerability lookup — checks your installed plugins/themes against the live CVE feed.
Paid plans (Pro $29/mo, Business $69/mo per site) increase the server-side quotas — monitor interval, log retention, custom-rule count, scan frequency — all of which run on Defen.so infrastructure, not by unlocking code in this plugin.
One-click connect
Click “Connect to Defen.so”. A popup opens at app.defen.so, you sign in (or sign up), authorize the connection, and the popup postMessages a scoped API key back — origin-locked to app.defen.so so no third party can intercept.
Fails-open: if Defen.so is unreachable at request time, the plugin allows the request and ships the log later.
External services
This plugin connects to external services. Here is exactly what is sent, when, and to whom.
1. Defen.so API (app.defen.so) — the plugin’s core service.
What it is: the managed WAF, uptime monitoring, and attack-log backend the plugin connects your site to.
When data is sent: when you connect your site (one-time OAuth handshake), when the plugin refreshes its cached rule policy, and when a request is blocked/challenged/deceived (attack-log events are batched and sent on shutdown).
What is sent: your scoped API token, your site URL, and per-event metadata — HTTP method, URL path, visitor IP, User-Agent, matched rule ID, and the action taken. No request bodies, no cookies, no personal content.
Terms: https://defen.so/tos — Privacy: https://defen.so/privacy
2. Google reCAPTCHA (google.com/recaptcha) — optional, only if you enable login hardening with a reCAPTCHA site key.
What it is: Google’s bot-detection service, used to score login attempts on wp-login.php.
When data is sent: only on the login page, and only if you have entered a reCAPTCHA site key in the plugin settings. If you leave it blank, no request is ever made to Google.
What is sent: the reCAPTCHA token and the data Google’s script collects from the login page (per Google’s terms).
Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
3. ip-api.com — optional, only if you enable the geo-block feature.
What it is: a free IP-to-country geolocation lookup, used to find the country of a visitor so the geo-block rule can allow or deny it.
When data is sent: only when geo-block is enabled and a visitor’s country is not already supplied by your host (e.g. Cloudflare’s country header). The visitor’s IP address is sent for the lookup.
What is sent: the visitor’s IP address only.
Terms: https://ip-api.com/docs/legal — Privacy: https://ip-api.com/docs/legal
