內容簡介
Forge12 Security 是一款全方位的 WordPress 安全外掛，提供防火牆、惡意程式掃描、雙重身份驗證及登入保護等功能。它能根據網站需求靈活啟用各模組，確保訪客資料安全，並無需第三方聯繫。
【主要功能】
• 防火牆功能，檢查請求並拒絕可疑流量
• 惡意程式及檔案掃描，保護網站安全
• 雙重身份驗證，強化登入安全性
• 一鍵修復功能，輕鬆恢復檔案
• 國家封鎖及 IP 範圍管理
• 遠端監控及多站點管理功能
外掛標籤
開發者團隊
② 後台搜尋「Forge12 Security – Firewall, Malware Scanner, 2FA & Login Security」→ 直接安裝（推薦）
原文外掛簡介
Forge12 Security is an all-in-one WordPress security plugin built by Forge12 Interactive GmbH in Germany. Firewall, malware and file scanner, login protection with two-factor authentication, hardening and AI crawler control — every module can be switched on and off on its own, so a site runs only the parts it needs.
It is built for sites that have to answer for their visitors’ data: IP addresses are stored as hashes, the admin loads no fonts, scripts or images from anybody else, and nothing contacts a third party unless you switch the feature on.
Every feature described below is included and fully functional. Nothing here is
limited by a licence key, a trial period or a usage quota.
Forge12 Security Pro
For agencies and business sites, Forge12 Security Pro adds what the plugin directory does not allow a free plugin to do, and what saves time when you look after many sites:
Repair with one click — put the original back over a modified WordPress, plugin or theme file, one at a time or all at once, and restore files from quarantine
Firewall before WordPress — requests are checked before WordPress and every other plugin load
Same-day signatures — malware signatures and firewall rules the day they are published; the free plugin receives the same rule set 30 days later
Country blocking and IP ranges — allow or block by country, and by IPv4/IPv6 range
Tamper-proof audit trail, Slack and Telegram alerts, daily digest
Remote monitoring, WP-CLI and multisite network management for looking after many sites
Database snapshots with restore, Google Safe Browsing, and automatic repair and quarantine instead of a report
Pro is an add-on: it needs this plugin installed and active, and keeps all of its settings. Compare Free and Pro.
What it does
Web application firewall. Scores each request against a signature set and
refuses it when a category threshold is reached. A learning mode records what
matches without blocking, so the exceptions your own site needs can be created
from what actually happened.
Outbound traffic monitoring. Watches where this installation sends data
and to whom, learns which hosts are normal, and reports the new ones. Stolen
data has to leave the server somehow; this is where that shows.
Reinfection, not just infection. A file that was removed and came back is
proof of persistence. The scanner looks for what put it back — a scheduled
event, a must-use plugin, a drop-in — instead of deleting it again.
Behaviour rules. Judges a file by the sequence of things its code does
(create a user, hand it the administrator role, mark it to be found again),
not by how it is written. Obfuscation is free to change; the steps are not.
AI crawler detection with proof. Anyone can put “ClaudeBot” in a header.
Crawlers are checked against the address ranges their operators publish, so a
claim that cannot be verified is treated as unverified rather than as fact.
Each crawler, or each category of crawler, can be allowed, watched or refused.
Login protection and two-factor authentication. Rate limiting, lockouts,
TOTP with locally generated QR codes, and an optional custom login address.
Requirements
WordPress 6.2 or higher
PHP 8.1 or higher
MySQL 5.7 / MariaDB 10.3 or higher
External Services
Everything this plugin does happens on your own server, with the exceptions
below. None of them runs unless the feature that needs it is switched on; the
only one that is on out of the box talks to WordPress.org. The plugin’s Data
Protection screen (Security, Privacy) shows which of them are active on your
site.
WordPress.org — on by default
File integrity, malware and update checks compare your files with the official
checksums. Sent while a scan runs: plugin and theme slugs, version numbers and
file hashes. No personal data.
Terms: https://wordpress.org/about/license/
Privacy policy: https://wordpress.org/about/privacy/
WPVulnerability — off by default
Looks up whether an installed plugin or theme has a published vulnerability.
The setup wizard asks first. Sent once a day and during a full scan: the slug
and version of each installed plugin and theme. Nothing about your site or your
visitors.
Terms: https://www.wpvulnerability.com/license/
Privacy policy: https://www.wpvulnerability.com/privacy/
Have I Been Pwned (Pwned Passwords) — off by default
Checks whether a new password appears in a known breach. Only the first five
characters of the password’s SHA-1 hash are sent (k-anonymity), never the
password and never a username.
Terms: https://haveibeenpwned.com/API/v3
Privacy policy: https://haveibeenpwned.com/Privacy
SilentShield — off by default, needs an API key
A behaviour check on the login, registration and password reset forms, and the
only feature that loads a script into a visitor’s browser — on those three forms
only. The visitor’s IP address reaches the service. Operated by Forge12
Interactive GmbH from Germany.
Terms: https://silentshield.io/terms/
Privacy policy: https://silentshield.io/privacy/
Forge12 signature service — off by default
Fetches the current signed malware and firewall rule set twice a day and applies
it only after its signature checks out. The setup wizard asks first. Sent: the
plugin version and the number of the rule set already held. If you enter a
licence key, the key and this site’s domain are sent to validate it. Operated by
Forge12 Interactive GmbH from Germany.
Terms: https://www.forge12.com/agb/
Privacy policy: https://www.forge12.com/datenschutz/
Crawler operators’ published address lists — off by default
Switched on, the list each crawler operator publishes of its own addresses is
fetched once a day, so that a real crawler can be told from an impostor. The
lists come from the operators themselves: Google, Microsoft Bing, OpenAI,
Anthropic, Perplexity, DuckDuckGo, Apple, Cloudflare, UptimeRobot and Jetpack.
The request carries the plugin’s user agent, which names your site; nothing
else is sent. While it is off, the lists shipped with the plugin are used and
nothing is fetched. Each operator’s own terms and privacy policy apply.= Key Features =
Web Application Firewall (WAF)
Regex-based request filtering with customizable rules
IP blocking with automatic expiration
Bot detection with reverse DNS verification for Googlebot, Bingbot, Yandex, Baidu, DuckDuckBot
Request validation (method, URL length, null byte detection)
Predefined rule sets for common attack patterns (SQL injection, XSS, path traversal)
WAF Learning Mode that records what the firewall would have blocked
Automatic whitelist rule generation from learning mode results
Outbound Traffic Monitoring
Watches where this installation sends data, and to whom
Learns a baseline of the hosts your site normally talks to, then reports the ones that are new
Refuses an outbound call before the connection is opened, so exfiltration and callbacks to a command server are stopped rather than logged after the fact
The step every worthwhile attack has to take in the end — stolen data has to leave the server somehow
Vulnerability Shield
Holds a known-vulnerable plugin shut until its update arrives
The unauthenticated endpoints of a plugin with a published, unpatched vulnerability stop answering — the plugin’s own code is never touched
Closes the window between disclosure and update: the weighted median from publication to mass exploitation is five hours, and 46 % of vulnerabilities are still unpatched on the day they are published
AI Crawler Detection
Recognises crawlers operated by AI companies: OpenAI, Anthropic, Google, Perplexity, Meta, Apple, Amazon, Common Crawl, ByteDance and more
Sorts them by what they do with your content: model training, assistant fetches on behalf of a user, AI search indexing
Records which crawler requested what, and how often
Allow, watch or block each crawler or whole category
Matching robots.txt directives generated from your decisions
DDoS & Rate Limiting
Configurable request rate limits per IP
Separate rate limits for REST API endpoints
404 rate limiting to detect and block vulnerability scanners
Automatic IP blocking on limit exceeded
IP whitelist for trusted addresses
Login Protection
Brute force prevention with automatic lockout (5 attempts / 15 min)
Two-factor authentication (TOTP) with QR code setup
Recovery codes for 2FA
Login honeypot for bot detection
Custom login URL to hide wp-login.php
SilentShield bot check on the login, registration and password reset forms — Forge12’s own service, served from Germany, no Google script in your visitors’ browsers
Login activity logging (success, failure, lockout)
Password Security
Configurable strong password policy (minimum length, uppercase, numbers, special characters)
Breached password detection via Have I Been Pwned API (k-Anonymity)
2FA enforcement per role, with a grace period for gradual rollout
File Integrity Monitoring
SHA-256 checksum baseline of all WordPress core, plugin, and theme files
Automatic scheduled scans with configurable intervals
Repository verification against WordPress.org originals
Automatic scheduled malware and integrity scans
Quarantine and delete suspicious files
Excluded paths: a page for the directories no file check should judge — a template cache a plugin fills with generated PHP, a staging clone, code you trust. It records which places your scans keep reporting and how many scans in a row, so excluding one is a button rather than a path typed from memory; entries can be switched off instead of deleted, and known candidates are offered as ticks, never applied on their own
Malware Signature Scanner
Pattern-based malware detection with 283 built-in signatures
Detects eval/base64 backdoors, shell uploads, code obfuscation, and remote includes
Heuristic detection via entropy and structure analysis, beyond signature matching
Three sensitivity levels: critical signatures only, critical and high, or everything including heuristics
Files that still match the checksum their author published on WordPress.org are never flagged
Mark a reviewed file as allowed — pinned to its content, so a later change brings it back into scope
File Guard: an unexpected PHP file is reported the moment it is executed, not on the next scheduled scan. On its own this covers files that load WordPress, which is most of them, because a shell usually wants the database.
Suspicious file flagging with threat identification
Extensible signature database (JSON format)
Reinfection, Attack Surface and Supply Chain
Persistence check: finds what puts a removed file back — a scheduled event, a must-use plugin, a drop-in — starting with the evidence that actually proves reinfection, a file that was taken away and is back
Attack surface: records which REST routes and AJAX actions are reachable without logging in and which of those change something, and reports the door that newly appeared
Update guard: verifies an installed update against the per-file checksum manifest WordPress.org publishes, so a package that is not what the author shipped is caught on arrival
Known hashes: covers premium plugins, bespoke themes and this plugin itself, where wordpress.org publishes no original to compare against
File inventory instead of modification times: a dropped file cannot make itself old with touch, and a plugin update no longer resets what counts as new
Behaviour rules: judges a file by the sequence of things its code does — create a user, hand it the administrator role, mark it to be found again — not by how it is written
Every finding says in plain words what it means and what to do about it, instead of naming the rule that fired
Database Integrity Monitoring
Monitors wp_options, wp_posts, wp_postmeta, wp_users, wp_usermeta
Detects unauthorized modifications, injected scripts and phishing URLs in posts, comments and options
WordPress Hardening
Disable XML-RPC and pingbacks
Disable file editor
Force SSL for admin area
Block PHP execution in uploads directory
Prevent user enumeration
Restrict REST API to authenticated users
Disable application passwords
Remove WordPress version info
Configurable Content-Security-Policy header
Full suite of security headers (HSTS, X-Frame-Options, X-Content-Type-Options, etc.)
Limit post revisions
Shorter session lifetimes
Limit concurrent sessions per user
Auto-update WordPress core
Comment spam honeypot protection
Strong password enforcement with configurable rules
SilentShield bot protection for login, registration and password reset forms
Email Notifications
Alerts for critical and high severity events
Findings collected and sent as one message, grouped and counted, instead of one email per finding
Anything critical sent immediately, with whatever else has collected
Unsubscribe link in every message, for people who no longer have an account on the site
Weekly summary of what was blocked, attempted and found — sent whether or not anything went wrong
Optional notifications for IP blocks
Scan summary emails when changes are detected
Configurable notification email address
A test button to check delivery
Slack and Telegram alerts and a daily digest are part of Forge12 Security Pro
Live Traffic
Watch requests as they arrive, with response code, request type and bot classification
Block an IP straight from a traffic entry
Records security-relevant requests (errors, blocks, login attempts) and keeps 24 hours
Security Logging
Comprehensive event logging for all security actions
Filterable by event type and severity
Quick-filter for login activity
CSV export
Block IPs directly from log entries
Configurable log retention (default: 90 days)
Data Protection
IP anonymization via HMAC-SHA256 (no plain IPs stored)
Optional AES-256-CBC encrypted IP storage
WordPress privacy exporter integration
WordPress privacy eraser integration
Settings Management
Import/export settings as JSON
Security score with detailed breakdown
Modern React-based admin interface
