內容簡介
FPX Security Guard 是一款專為 WordPress 設計的安全防護外掛，能有效關閉攻擊者常用的漏洞，並且所有操作均在本地伺服器上進行，無需創建帳號或使用雲端儀表板。
【主要功能】
• 登入保護：限制每個 IP 的登入失敗次數
• 雙重身份驗證：支援標準 TOTP 認證
• 防火牆：阻擋 SQL 注入、XSS 等攻擊
• 請求速率限制：減緩單一地址的請求洪水
• 安全標頭：增強 HTTPS 安全性
• IP 許可與拒絕列表：管理信任或阻擋的地址
外掛標籤
開發者團隊
原文外掛簡介
FPX Security Guard closes the openings attackers actually use, and does it without sending your site’s data anywhere. There is no account to create and no cloud dashboard: everything runs on your own server.
What it does
Login protection — limits failed login attempts per IP with a configurable lockout, shows generic errors that leak no hint about which half of the login was wrong, and hides a honeypot field that silently blocks bots.
Two-factor authentication — standard TOTP (Google Authenticator, Authy, 1Password and the rest). Users turn it on from their own profile, scan a QR code, and get ten one-time recovery codes. Works entirely offline.
Firewall — blocks SQL injection, XSS, path traversal and RCE patterns in the URL, POST body and cookies, plus known scanner tools and direct requests for sensitive files like .env, .git and wp-config.php.
Rate limiting — slows down request floods from a single address.
Security headers — X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, and HSTS on HTTPS.
CAPTCHA — optional reCAPTCHA v2 or hCaptcha on the login and comment forms, using your own key pair.
Hardening — turns off XML-RPC and the built-in theme/plugin file editor, removes the WordPress version from your pages, and blocks ?author=N enumeration and the public REST users endpoint.
Comment protection — honeypot and link limits.
IP allow and deny lists — trust or block specific addresses and IPv4 ranges. Allowed addresses bypass every other rule.
Reverse-proxy support — if your site sits behind Cloudflare or a load balancer, tell the plugin, and per-IP blocking acts on the visitor’s real address instead of the proxy’s. The settings screen shows you the address it currently sees so you can confirm it.
Overview — a checklist where each gap explains what it costs you and, where possible, is fixed with one click, next to a running count of what was actually blocked over the last seven days.
On first use, one button switches on the settings suited to a typical site. It deliberately skips anything that could lock you out or interrupt publishing.
Upgrading to Pro
The free plugin keeps attackers out. Pro adds the tools for finding out whether anyone already got in, and for dealing with it: a malware scanner with one-click quarantine, core file integrity checking against WordPress.org’s own checksums, a vulnerability scanner, scheduled scans with email alerts, live traffic monitoring, behavioural threat scoring, country blocking, AbuseIPDB reputation checks, auto-ban, a session manager, an activity log, new-device login alerts, a custom login URL, and an emergency lockdown button that expires on a timer so it can never strand you.
Details at https://wp.freepdftxt.com/security-guard/
External Services
This plugin uses a few optional external services, all disabled unless you explicitly turn them on:
Geo Blocking (disabled by default) uses the free geo-location service ip-api.com to determine the country of a visitor’s IP address.
What is sent: Only the visitor’s IP address, and only when Geo Blocking is manually enabled and a visitor’s country isn’t already cached.
When: On the first request from a given IP; the result is cached locally for 24 hours.
Service provider: ip-api.com — Terms: https://ip-api.com/docs/legal — Privacy: https://ip-api.com/docs/legal
Cloud Threat Intelligence (disabled by default, and inactive until you supply your own API key) checks a visitor’s IP address against AbuseIPDB’s abuse-confidence database.
What is sent: Only the visitor’s IP address, sent together with your own AbuseIPDB API key, and only when you’ve entered a key and a visitor’s IP isn’t already cached.
When: On the first request from a given IP; the result is cached locally for 24 hours.
Service provider: AbuseIPDB — Terms: https://www.abuseipdb.com/legal — Privacy: https://www.abuseipdb.com/legal
Malware Scanner’s VirusTotal cross-check (disabled by default, and inactive until you supply your own API key) looks up a file’s SHA-256 hash on VirusTotal — a hash, not the file itself.
What is sent: Only a SHA-256 hash (a one-way fingerprint that cannot be reversed into the original file) of files already flagged by the local scanner, plus a small sample (up to 15) of recently-modified files, sent together with your own VirusTotal API key.
When: Only during a malware scan (manual or scheduled) with this feature enabled and a key configured.
Your actual file content is never uploaded or transmitted anywhere.
Service provider: VirusTotal (a Google subsidiary) — Terms: https://support.virustotal.com/hc/en-us/articles/115002145529-Terms-of-Service — Privacy: https://support.virustotal.com/hc/en-us/articles/115002168385-Privacy-Policy
Vulnerability Scanner and Core File Integrity Check read WordPress’s own built-in update-check data and, when you run a scan, query the same official api.wordpress.org endpoints WordPress core itself already uses (the same request the “Check Again” button on the Updates screen makes, and the public core-checksums endpoint). No plugin-specific data is sent beyond what WordPress core itself already sends for update checks.
CAPTCHA (disabled by default, and inactive until you choose a provider and enter both keys) shows a bot challenge on the login and/or comment form using either Google reCAPTCHA v2 or hCaptcha, and verifies the response server-side with that provider.
What is sent: The visitor’s CAPTCHA response token and IP address, sent to whichever provider (Google or hCaptcha) you’ve configured, only on form submission.
When: Only when a visitor submits the login or comment form with CAPTCHA enabled for that form.
Service providers: Google reCAPTCHA — Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy · hCaptcha — Terms: https://www.hcaptcha.com/terms — Privacy: https://www.hcaptcha.com/privacy
If none of the above features are enabled, the plugin makes no external requests whatsoever.
