[WordPress] 外掛分享： Destino Access Audit

內容簡介

Destino Access Audit 是一款專為 WordPress 設計的外掛，提供一個集中管理的管理頁面，讓使用者能夠輕鬆查看誰擁有網站的存取權限及其詳細資訊，並能夠撤銷應用程式密碼，增強網站的安全性。

【主要功能】
• 應用程式密碼管理：顯示所有活躍的應用程式密碼及其詳細資訊
• 管理員用戶列表：列出所有管理員角色的用戶，方便識別不明帳號
• 兼容性檢查：檢查 UpdraftPlus、MainWP Child、ManageWP Worker 等外掛的狀態
• CSV 匯出功能：可將應用程式密碼資訊匯出為 CSV 檔案
• 安全性保護：撤銷密鑰的操作具備多重安全檢查

外掛標籤

開發者團隊

原文外掛簡介

Destino Access Audit adds a single admin page (Tools → Destino Access Audit) that centralizes the answer to one question: who, and what, currently has access to this site?
The page is read-only audit information except for one deliberate action — revoking an Application Password — which delegates entirely to WordPress core’s own API. Destino Access Audit never creates, modifies, or stores any remote-management connection itself.
What it shows

Application Passwords — every active Application Password on the site (all users), with creation date, last used date, last IP, and a one-click Revoke button (AJAX, no page reload) plus a CSV export.
Administrator Users — a plain list of every user with the administrator role, with a direct link to edit each one. Useful for spotting an admin account you don’t recognize.
UpdraftPlus / UpdraftCentral — whether UpdraftPlus is installed/active, a direct link to its settings screen, whether it is connected to an UpdraftCentral dashboard (including which WordPress user made that connection), and whether UpdraftPlus’s own password-protected “Lock Settings” feature is currently hiding that screen.
MainWP Child — whether MainWP Child is installed/active, a direct link to its settings screen, whether it is paired with a MainWP Dashboard, and which WordPress user established that pairing.
ManageWP Worker — installed/active status, plus a direct link to its own “Connection Management” panel. ManageWP Worker pairs with its dashboard through an OpenSSL key exchange with no locally readable “connected” flag, so this block documents that limitation instead of guessing.
InfiniteWP Client — installed/active status, with the same honest limitation note as ManageWP Worker.
Wordfence Security — installed/active status. Wordfence Central’s connection state lives in Wordfence’s own proprietary database table, not a readable WordPress option, so this block documents that limitation instead of guessing, the same as ManageWP Worker and InfiniteWP Client.
Elementor Site Management — whether the “Manage” plugin by Elementor.com is installed/active, a direct link to its settings screen, and whether it is connected to my.elementor.com.

The connector blocks above lay out as a 2-column grid on desktop, installed plugins first, so they’re easier to scan at a glance; each box header shows its Installed/Active status inline, with longer explanations tucked behind a small “?” tooltip instead of always-visible paragraphs. Application Passwords and Administrator Users stay full-width since they contain data tables.
Security notes

Every write action (revoking a key) is protected by a nonce, a manage_options capability check, and a second capability check (edit_user) specific to the user who owns the key.
The CSV export is generated server-side and neutralizes fields that could be interpreted as spreadsheet formulas (CSV/Excel formula injection).
The dashboard itself requires the manage_options capability to view.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)Really Simple Security 是一款輕量級且易於使用的 WordPress...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款功能強大的 WordPress 外掛，旨在提升網站內容...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 是一個讓您在 WordPress 中安全上傳 SVG 檔案的最佳...LoginizerLoginizer 是一款 WordPress 外掛，旨在防止暴力破解攻擊，當...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role EditorUser Role Editor 外掛允許用戶輕鬆變更使用者角色和權限。用...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionKadence Security 是一款專為 WordPress 網站設計的安全外掛...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP PluginSiteGuard WP Plugin 旨在加強 WordPress 網站的登入及管理區...