內容簡介
Defenora Secure Shield 是一款免費的 WordPress 安全外掛，專為網站管理員設計，提供全面的安全檢查與報告，幫助提升網站的安全性，並防止惡意攻擊。
【主要功能】
• 整體安全評分與狀態報告
• 登入安全與暴力破解保護
• 快速掃描與完整掃描功能
• 透明的安全檢查與建議行動
• 可配置的鎖定閾值與持續時間
外掛標籤
開發者團隊
原文外掛簡介
Defenora Secure Shield is a free WordPress security plugin for site administrators. It is designed for the WordPress.org Plugin Directory: no trialware lockouts of core features, no hidden tracking, and no automatic file or database deletion.
Scanning and scoring report only the checks this plugin can run. They do not mean a website is fully secure or free of malware.
Dashboard
Overall security score with clear bands (excellent through critical improvements recommended)
Counts of critical issues, warnings, and passed checks
Module status: login protection, hardening, file integrity, security headers, XML-RPC, REST API
Last scan time, last security event, blocked login count, stored event count
Quick Scan and Full Scan with live percentage progress
After each scan: full report, failed issues found, and fatal scan-step errors (if a step crashed)
The plugin never displays “your website is 100% secure”
Security score
Transparent weighted checks (HTTPS, file editor, XML-RPC, debug mode, login protection, administrators, REST API, headers, sensitive files, debug.log)
Each check explains what was tested, why it matters, the current result, and a recommended action
Hardening is never applied silently; administrators apply or revert it
Login security and brute-force protection
Tracks successful logins, failed logins, logouts, and password reset requests
Temporary lockouts by IP and by username (never permanent automatic blocks)
Configurable failed-attempt threshold and lockout duration
Login cooldown and rate limits for login and password-reset requests
Optional generic login errors (does not hide lockout or rate-limit messages)
Optional idle session timeout (off by default)
Force logout of another user’s sessions from the Users screen
Trusted IPs (never lock) and trusted proxies (X-Forwarded-For only if REMOTE_ADDR matches)
Usernames that should never be locked
Emergency bypass: define( 'SWSS_DISABLE_LOGIN_PROTECTION', true ); in wp-config.php
Rate limiting
Login and lost-password request limits (transients / object cache)
Unauthenticated REST write requests (GET/HEAD/OPTIONS are not limited, so public content and WooCommerce reads keep working)
XML-RPC is not hard-killed; login protection still applies to XML-RPC authentication
WordPress hardening (optional, reversible)
Disable the plugin and theme file editors
Hide the WordPress generator tag and core asset ver query args (plugin/theme cache-busting is left intact)
Disable XML-RPC, or leave it on and block system.multicall (default: multicall blocked, XML-RPC still enabled)
REST API: unchanged (default), require login for sensitive routes, or restrict most guest REST access (with public/WooCommerce allowlists)
Compatibility impact is explained on the Hardening screen before you enable a control
Plugin-managed values can be restored; .htaccess is not edited automatically
Security scanner
Quick Scan: high-impact configuration checks, with a progress percentage per step
Full Scan: configuration checks plus core/plugin/theme integrity, suspicious file patterns, user audit, database checks, and security headers
Report includes score, failed issues, fatal step errors, full check list, and suspicious-file findings
Scans are read-only: no automatic file deletion, plugin/theme deactivation, or database cleanup
Scheduled scans: off (manual only), daily, or weekly via WP-Cron (default weekly); overlapping scans are prevented
Official WordPress.org checksums are used when available; if the checksum service is down, that is not treated as a compromise
File integrity and suspicious code
Compares WordPress core (and WordPress.org plugins/themes when checksums exist) using official APIs over HTTPS
Flags PHP in uploads and conservative local patterns (for example dangerous PHP constructs). Terminology is “potentially suspicious,” not a confirmed malware verdict
Scanned PHP is never executed (eval is not used to test files)
Recommended action is review/quarantine, not automatic delete
User security
Lists usernames, roles, registration dates, and last login when this plugin has observed a login
Highlights administrator accounts, the default admin username, recently created administrators, and unusual capabilities
Never displays passwords, hashes, cookies, or other secrets
Database checks
Administrator capability rows, autoloaded options size, mixed site URL protocols, incomplete user rows
Does not display password hashes, API keys, salts, or tokens
Does not delete options or users automatically
Security headers and HTTPS
Checks Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, and X-Frame-Options (front-end request during full scan)
Optional sending of safe headers from WordPress (send_headers); skipped in wp-admin and skipped if a header is already present
Aggressive CSP is off unless you enable it; test thoroughly
HTTPS recommendations only; the plugin does not install certificates
Activity logs
Events such as login success/failure/block, logout, password reset/change, user create/delete, role changes, plugin/theme/core events, hardening and setting changes, scans
Fields: ID, time (UTC), type, severity (INFO–CRITICAL), user ID, optional IP and user agent, description
Search, event type, severity, date range, pagination
Passwords and secrets are never logged
Privacy
Optional IP and user-agent logging
Retention period and automatic log cleanup (WP-Cron)
WordPress personal data export and erase integration
Optional “delete all plugin data on uninstall” (off by default)
No telemetry and no phone-home. Full scans may contact WordPress.org checksum endpoints over HTTPS
Notifications
Optional emails: administrator login, repeated failed logins, scan completed, critical findings, setting changes
Cooldown to avoid email floods
Uses wp_mail() and the site admin email unless you set another address
Tools and diagnostics
Run scans, export logs (CSV), clear logs, reset plugin settings (confirmation required)
Diagnostics: WordPress/PHP/database versions, theme, plugin count, memory limit, WP-Cron, HTTPS, REST mode, XML-RPC, file permissions, object cache — no secrets
Copy or download a safe diagnostics text file
Requirements
WordPress 6.2 or later
PHP 8.0 or later
Capability manage_options (or network options in network admin on multisite)
The free plugin is meant to be useful on its own. It does not disable essential protection to force an upgrade.
