內容簡介
Ensomedia Security 是一款由 shieldwave.io 提供的安全外掛，能夠深入掃描您的網站，並以簡單明瞭的語言告訴您存在的問題及修復方法。它的設計理念是確保每個警報都值得您關注，並且所有檢查、定期掃描及電子郵件警報均免費且無需帳號。
【主要功能】
• 官方檢查碼比對核心、外掛及佈景主題
• 真實證據的惡意程式檢測
• 變更監控以驗證未經 WordPress.org 驗證的內容
• 精準的警報系統，避免誤報
• 輕量級伺服器運行，背景掃描不影響性能
• 不會自行更改網站設定
外掛標籤
開發者團隊
② 後台搜尋「Ensomedia Security powered by shieldwave.io」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
shieldwave.io by ensomedia.dev
Ensomedia Security, powered by shieldwave.io, scans your site from the inside and tells you in plain language what is wrong and how to fix it. It is built around one idea: an alert has to be worth your attention. Every check, the scheduled scans and the email alerts are free, work without an account and have no limits.
Why owners switch to it
Official checksums first. Core, directory plugins and directory themes are compared with the files WordPress.org published for your version.
Malware detection that needs real evidence. One weak signal, such as base64 in a file, is never a finding. Findings the scanner is not sure about go under “Ask your developer to check” and never send email.
Change monitoring for what WordPress.org cannot verify. Premium plugins, custom themes, must-use plugins and drop-ins get a baseline; a new PHP file that appears without an update is reported.
Alerts that do not cry wolf. One email per scan, only for problems that are new or got worse at or above your threshold, at most four a day; at once when an account becomes administrator or the user name of an administrator gets locked; a weekly summary if you want one. A check that could not run never sends email and never marks anything as fixed.
Light on your server. Scans run in the background in short steps, and unchanged files are not analyzed again.
Never rewrites your site on its own. Files, users and settings change only when you press a button or turn on a switch.
The checks
Malware and backdoors in files WordPress.org cannot vouch for: web shells, decode-and-execute chains, obfuscated code, remote code loaders, PHP hidden in images, spam mailers, hidden administrators, injected JavaScript and malicious redirects.
Core, plugin and theme files against the WordPress.org checksums or release packages of your versions, plus PHP files those releases do not contain.
File changes against the recorded baseline, and plugin or theme folders that appear without the WordPress installer.
PHP files in uploads, and .htaccess or .user.ini rules that make the server run uploads as PHP.
Known vulnerabilities (opt-in) in plugins, themes and WordPress, premium ones included, with the version that fixes each one.
Closed, abandoned and unused plugins and themes, updates and PHP version support.
Injected content: scripts, hidden iframes and spam links in posts, widgets and options. Ordinary embeds and tracking codes are left alone.
Exposed files that your web server hands out to anyone (copies of wp-config.php, database dumps, backups, .git folders, .env files, logs), confirmed by requesting them from your own site; leftover installers and database tools; folder listings.
Accounts and configuration: administrators, user registration, wp-config.php, debug output, file editor, XML-RPC, HTTPS, user list exposure and suspicious scheduled tasks.
Each issue has a severity, what it means, how to fix it and the files, plugins or settings involved. Problems of the same kind are grouped. An ignored file comes back if it changes again.
Live protection (three features, all opt-in):
Known vulnerabilities: the lookup above.
Live threat feed: new malware rules and file signatures from ShieldWave reach your site within about an hour, verified by signature. It sends nothing about your site.
AI second opinion: for a file the local rules cannot judge, a redacted excerpt gets a verdict in plain words.
All three are off until you turn them on and run from WP-Cron once an hour, whether or not a scan is running. See External services.
Login protection
Failed logins are limited per address (five by default, then a cooldown you set) and per user name across all addresses (20 an hour by default, any number from 1 to 500, 0 turns it off). Password reset requests are limited per address, 5 an hour by default. A lock is always temporary, and trusted addresses are never locked.
Only the connection’s own address counts, never a header a request can fake. Behind a proxy or CDN, list its addresses or CIDR ranges (/8 or narrower, up to 20 entries) under trusted proxies and choose the header that carries the visitor’s address.
User names stay private: the login form, ?author=N, the REST API user list, embeds and the users sitemap stop giving them to visitors who are not logged in.
On by default for new installs, off after an upgrade until you turn it on.
Two-factor login, passkeys and sessions
Two-factor login with an authenticator app, ten recovery codes and wp shieldwave two-factor disable
Required for the roles you choose, with 0 to 30 days (7 by default) to set it up.
Passkeys (WebAuthn) as the second step after the password, on HTTPS with the OpenSSL extension in PHP.
See where your account is signed in, sign out everywhere else or sign out every user, and set how long an administrator’s session lasts.
Hardening
One switch each, all off until you turn them on:
The plugin and theme file editor and XML-RPC, without editing wp-config.php. ShieldWave warns you first if a plugin you use, such as Jetpack, needs XML-RPC.
PHP in uploads: a block in the uploads .htaccess file on Apache and LiteSpeed, the rule to add on nginx and IIS, and Check now to test it.
Security headers: nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, framing protection and, over HTTPS only, Strict-Transport-Security. A header already sent by your server, CDN or another plugin is left as it is.
Virtual patches. With the live threat feed on, a small must-use file stops a request that exploits a known vulnerability of an installed plugin, for as long as the installed version is affected. Each patch only records matching requests until you let it block them.
Security updates (WordPress 6.6 or newer), chosen per plugin: WordPress’s own automatic updates install a release as soon as it fixes a known vulnerability of the installed version, and put the previous version back if the update fails.
A file with a finding of medium severity or higher can be moved into quarantine with one button, and Restore puts it back. The FAQ explains what is never moved.
Activity log and privacy
History is kept in its own database table. Each entry carries a keyed hash that includes the hash of the entry before it, so Check history integrity tells whether an entry was edited or deleted outside ShieldWave. Entries are kept for 7 to 730 days (90 by default) and can be exported as CSV. The plugin adds a suggested text to Settings > Privacy and takes part in the WordPress personal data export and erasure tools. The FAQ lists what it stores about logins.
ShieldWave dashboard (optional)
Press Connect with shieldwave.io under ShieldWave > Settings and the site shows up in your dashboard at shieldwave.io with its score and open issues, next to ShieldWave’s outside scan. A free account shows one site; Pro and Enterprise show every site. The dashboard cannot change anything on the site. See External services.
What this plugin does not do
It is not a full web application firewall and it does not clean malware out of files for you. You, your developer or your host make the change it explains. Ensomedia Security is built by ENSOMEDIA (Radosław Fedorczuk, Wrocław, Poland), which also runs shieldwave.io.
Credits
The admin screens use the Inter typeface by The Inter Project Authors, licensed under the SIL Open Font License 1.1 (assets/fonts/inter-license.txt). It is loaded from the plugin itself, only on the ShieldWave screens.
External services
No outside requests are made on activation or when admin pages load, only when a scan runs, when you use the account actions, and once an hour from WP-Cron for the live protection features you turned on and a connected account. Requests to your own site are listed in the FAQ. Requests to WordPress.org and your own site use the WordPress HTTP API’s default user agent (WordPress version and site address), as WordPress’s update checks do. Requests to ShieldWave send a neutral user agent (ShieldWave-Security and the plugin version) and never your site address in their headers. Each request comes from your server’s IP address.
WordPress.org core checksums (api.wordpress.org/core/checksums/1.0/)
Used by the “WordPress core files” check. Sent: your WordPress version and package language. Cached for a day.
WordPress.org release list (api.wordpress.org/core/stable-check/1.0/)
Used by the same check to know which older releases to compare with. Sent: nothing about your site. Cached for a day.
WordPress.org plugin checksums (downloads.wordpress.org/plugin-checksums/)
Used by the “Plugin files” check. Sent: the folder name and version of each installed plugin. Cached for a week, or for a day when no list was available.
WordPress.org theme packages (downloads.wordpress.org/theme/)
Used by the “Theme files” check: the release package of each directory theme is downloaded to a temporary file, hashed and deleted. Sent: the theme’s folder name and version. Cached for a week.
WordPress.org plugin information (api.wordpress.org/plugins/info/1.2/)
Used by the “Closed and abandoned plugins” check. Sent: the folder name of each installed plugin. Cached for a day.
WordPress.org theme information (api.wordpress.org/themes/info/1.2/)
Used by the “Theme files” check to learn which installed themes come from the directory. Sent: the folder name of each installed theme. Cached for a day.
All six are provided by WordPress.org: privacy policy.
ShieldWave vulnerability lookup (shieldwave.io, endpoint /api/plugin/vulnerabilities), off until you turn it on
Used by the “Known vulnerabilities” check. Sent: your WordPress version and the folder name and version of each installed plugin and theme, premium ones included. A premium plugin’s product name is compared on your site, never sent. No site address, no account, no personal data. The data comes from Wordfence Intelligence, and each result links to its record with its copyright notice; links go only to Wordfence, NVD, CVE.org, WPScan, Patchstack, shieldwave.io, WordPress.org and the GitHub advisory database. Runs with the scan and once an hour from WP-Cron; cached for a few hours.
ShieldWave threat feed (shieldwave.io, endpoint /api/plugin/intel), off until you turn it on
Used by the “Live threat feed” option and by virtual patches. The plugin downloads a signed file of extra malware rules, file signatures and virtual patch rules once an hour from WP-Cron and verifies its signature before use. Sent: nothing about your site; only the plugin version, which every request carries.
ShieldWave AI second opinion (shieldwave.io, endpoint /api/plugin/ai/review), off until you turn it on
For a file the local rules cannot judge. Sent: an excerpt of up to 6,000 characters around the suspicious code; the file’s SHA-256 and MD5 fingerprints and size; its kind and where it sits (plugin or theme folder name, uploads and so on); the local verdict and the matched rule identifiers; the site language, the plugin version and a salted hash of the site. Removed before sending: your site address, email addresses, IPv4 and IPv6 addresses, the server paths of WordPress and of home folders (replaced by a neutral path), every DB_ constant and the arguments of database connections, values named like a password, key, salt, secret or token (from 6 characters) and long random tokens. Other web addresses stay. For PHP inside an image, the excerpt starts at the first PHP tag. Never read: wp-config*, .env*, .htpasswd, .user.ini, php.ini, auth.json, backup copies (.bak, .old, .orig, .save, .swp, names ending in ~), .sql dumps, logs and .ini files. If the redaction fails, nothing is sent. shieldwave.io passes the excerpt to an AI provider of shieldwave.io, described in the ShieldWave privacy policy; the verdict is kept by the file’s fingerprint and shared across sites. Runs after a scan and once an hour from WP-Cron.
Link to the outside check (shieldwave.io)
The Overview links to the free outside check. Nothing is sent until you click; then your browser opens shieldwave.io/?check=yourdomain.com. Links to shieldwave.io carry utm_source=wordpress, utm_medium=plugin and utm_campaign=(the screen).
ShieldWave account (shieldwave.io), only after an administrator connects the site under ShieldWave > Settings
Connecting opens shieldwave.io/connect in your browser with this site’s address, the address to come back to and a random value. Back on the site, the plugin sends the single-use code, this site’s id and address, and the plugin, WordPress and PHP versions to /api/plugin/connect/exchange and receives a key for this site. With a pasted API key, /api/license/verify receives the key and /api/plugin/connect the same site facts.
While connected, the home page carries a meta tag named shieldwave-verify with a code of your account, and /api/plugin/verify-domain asks shieldwave.io to read it, after connecting and every few hours until the domain is confirmed.
Hourly and after each scan: /api/plugin/heartbeat receives the site id, the site address and language, the versions of the plugin, WordPress and PHP, the scan status, the score and grade, the issue counts and the times of the last and next scan.
After each scan (if sending is on): /api/plugin/sync receives the scan summary (counters, score, active theme, number of active plugins, site language and the language of the administrator who started the sync), the open and ignored issues (severity, confidence, title, message, fix, when first seen, the file, plugin or setting involved, rule identifiers, line, the plugin or theme and its version, the vulnerability identifier, score and record link, and the AI second opinion when there is one) and the installed plugins and themes with their names, versions and source.
Never sent: posts, pages, comments, user names, email addresses or passwords. Issues about administrator accounts go with their title and fix only.
For a site beyond the one site of a free account, ShieldWave stores no results and the plugin pauses these calls for 12 hours.
“Disconnect” calls /api/plugin/disconnect, which removes this site and its results from shieldwave.io. Deleting the plugin from the Plugins screen makes the same call once, with a 5 second limit, before the key is removed.
The key is kept in the database encrypted with a key derived from your wp-config.php salts, where the server has libsodium, and sent only in a request header.
The data above is processed by shieldwave.io, run by ENSOMEDIA in Poland, and for the AI second opinion by an AI provider of shieldwave.io. ShieldWave terms of service and privacy policy.
