內容簡介
GuardLMS 是一款持續監控 WordPress 安裝漏洞的外掛。它每日將網站的軟體清單發送至 GuardLMS 服務，並與已知的 CVE 資料庫比對，幫助使用者及時修補或移除潛在的漏洞元件。
【主要功能】
• 每日自動發送網站軟體清單
• 監控 WordPress 核心、外掛及佈景主題的漏洞
• 提供伺服器及 PHP 環境的基本資訊
• 一鍵連接 GuardLMS 服務進行驗證
• 支援手動立即推送快照
外掛標籤
開發者團隊
原文外掛簡介
GuardLMS keeps your WordPress installation under continuous vulnerability monitoring. Once
configured, the plugin sends a daily snapshot of your site’s software inventory to the GuardLMS
service (dashboard.guardlms.com), where it is matched against a database of known CVEs
affecting WordPress core, plugins, and themes. If a vulnerable component is detected, it is
surfaced in your GuardLMS dashboard so you can patch or remove it before it is exploited.
What the plugin does
Collects the installed WordPress core version, the full plugin inventory (including
must-use plugins and drop-ins) with slugs, names, versions and active state, and the active
theme inventory with slugs, names and versions.
Collects basic server and PHP environment details (operating system, hostname, web server
signature, PHP version, SAPI, memory/execution limits, and loaded extensions) to help GuardLMS
assess environment-specific risk.
Pushes this snapshot to GuardLMS once a day via a background (WP-Cron) task, and on demand
whenever you click “Push now” in the plugin settings.
Renders a tag in your site’s
verify that you own the site. The token is installed by the connect flow.
Optionally includes a small, non-secret set of configuration flags (WP_DEBUG,
force_ssl_admin, users_can_register, default_role, blog_public) when you explicitly
opt in, disabled by default.
Setup is one click: “Connect to GuardLMS” sends you to GuardLMS to confirm, then installs the
push key and verifies ownership automatically. No API key to copy.
Source code and issues
Development happens in the open on GitHub.
Report bugs, suggest improvements or send a pull request there.
Third Party Services
This plugin relies on a third-party service, GuardLMS (dashboard.guardlms.com), to
perform CVE and vulnerability monitoring for your site. This section discloses exactly what is
shared with that service, in line with the WordPress.org plugin guidelines.
What is sent to GuardLMS:
Your WordPress core version number.
Your installed plugin and theme slugs, versions, and active/inactive state (including
must-use plugins and drop-ins).
Basic server details: operating system, hostname, and web server software string.
Basic PHP environment details: PHP version, SAPI, memory limit, max execution time, upload
and post size limits, timezone, and the list of loaded PHP extensions.
Optionally, if you explicitly enable “Include configuration” in the plugin settings, a small
allowlist of non-secret configuration flags (WP_DEBUG, force_ssl_admin,
users_can_register, default_role, blog_public).
Your site URL, used by GuardLMS to identify which registered website the data belongs to.
What is never sent: no personal data, no user data, no post/page content, no database
contents, and no secrets or credentials of any kind. The GuardLMS API key you configure is used
only to authenticate the outgoing push request to GuardLMS and is never included in the
transmitted payload.
When data is sent: once daily via a scheduled background task, and immediately whenever you
click “Push now” on the plugin settings page.
Real-time monitoring (optional, off by default). If you switch on “Real-time monitoring” in
the plugin settings, the plugin additionally loads a GuardLMS JavaScript file on your public
pages, which reports JavaScript errors from your visitors’ browsers directly to GuardLMS. This
is a separate opt-in and nothing is loaded or sent while it is switched off.
What the script sends: the error message and stack trace, the page URL and referrer, the
browser user agent and viewport size, and an anonymous per-session identifier. If you also
switch on the optional analytics checkbox, it sends page-view events too.
What the script never sends: GuardLMS is never told which user is logged in — the plugin
never identifies a visitor to the service. The script does not record clicks, keystrokes or
form input, and does not collect the visitor’s IP address. Security tokens in URLs
(_wpnonce, sesskey, token, apiKey, authorization, password, secret) are replaced
with [REDACTED] before anything leaves the browser.
Where it is loaded: public front-end pages only. Never in wp-admin and never on the login
screen.
By installing and configuring this plugin, you agree to GuardLMS’s own Terms of Service and
Privacy Policy, which govern how GuardLMS itself handles the data described above:
Terms of Service
Privacy Policy
If you do not wish to use this third-party service, do not enter a GuardLMS API key, or
deactivate/uninstall the plugin — no data is sent to GuardLMS while the plugin is disabled or
unconfigured.
