內容簡介
Hard Guard Security 是一款免費的 WordPress 安全外掛，提供惡意程式掃描、漏洞掃描、雙重身份驗證（2FA）、暴力登入保護等功能，幫助用戶加強網站安全，無需支付費用或使用授權金鑰。
【主要功能】
• 惡意程式與漏洞掃描
• 雙重身份驗證（2FA）
• 暴力登入保護
• 審計日誌與即時流量監控
• 文件完整性監控
• 安全強化與資料庫掃描
外掛標籤
開發者團隊
② 後台搜尋「Hard Guard Security – Malware Scanner, 2FA & Login Protection」→ 直接安裝（推薦）
原文外掛簡介
Hard Guard Security is a free WordPress security plugin with malware scanning, vulnerability scanning, two-factor authentication (2FA), brute force login protection, audit logs, file integrity monitoring, security hardening, and database malware scanning.
The plugin does not lock features behind payment, require a license key, or send telemetry, scan results, or website files to its author. A voluntary PayPal donation link appears only on Hard Guard Security screens and in the plugin row.
Login Security & Brute Force Protection
Progressive login lockouts by IP address, username, or both.
IPv4 and IPv6 whitelist, blacklist, CIDR, and hardened trusted-proxy client-IP resolution with explicit header selection.
Optional custom login URL with safety checks, rollback, and emergency recovery.
Two-Factor Authentication (2FA)
Email-code and RFC 6238 TOTP two-factor authentication.
Per-user methods, role policies, setup grace periods, recovery codes, and administrator reset.
Application Password policies, inventory, revocation, inactivity cleanup, and security alerts.
Audit Log & Live Traffic
Searchable Audit Log with severity, category, action, result, retention, alert rules, CSV/JSON export, redaction, and Multisite aggregation.
Read-only Active Sessions view loaded only when opened, plus on-demand Live Traffic that runs only while an administrator is watching the tab and keeps no traffic history.
Malware Scanner & Vulnerability Scanner
Quick and Full malware scans performed locally with scan history, SHA-256 ignore rules, quarantine, and restoration.
Optional read-only Database Malware Scanner for manual Quick/Full scans with separate SQL findings and context-aware behavioural heuristics.
Full and Automatic scans include a separate Vulnerabilities & updates stage for WordPress Core, plugins, and themes.
Known-vulnerability matching is performed locally against a signed Hard Guard threat-intelligence database; plugin/theme inventory and scan results are not sent to Hard Guard.
Outdated components are identified separately from known vulnerabilities using WordPress’ existing local update cache, without Hard Guard forcing an additional inventory request.
WordPress Core integrity checks using official WordPress.org checksums.
File-permission diagnostics and checks for unexpected executable files.
Antispam & Country Blocking
Local antispam for native comments, WooCommerce reviews using the comment system, native registration, WooCommerce My Account registration, and WooCommerce lost-password requests.
Optional Math CAPTCHA for protected interactive forms with Off, Always, and Only for suspicious visitors modes.
Separate per-IP rate limiting for WooCommerce lost-password requests; WooCommerce checkout and Store API registration are not intercepted.
Optional country allow/block rules using country.is, with IP/CIDR recovery exceptions and fail-open handling.
SSL Security & WordPress Hardening
SSL certificate, HTTPS redirect, mixed-content, and live security-header diagnostics.
HSTS, upgrade-insecure-requests, MIME-sniffing, Referrer-Policy, frame protection, Permissions-Policy, and X-Powered-By controls.
XML-RPC, REST user listing, author enumeration, user sitemap, directory indexing, sensitive-file, uploads PHP, and file-editor hardening.
Daily Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks, with safety-check rollback.
Upload Directory Shield adds a second managed .htaccess layer directly in WordPress uploads on Apache/LiteSpeed.
Suspicious .htaccess detection identifies dangerous PHP/CGI execution directives during daily checks and manual malware scans.
Dedicated SMTP settings used only for Hard Guard Security messages.
Settings export/import and optional complete data cleanup during uninstall.
Personal-data exporter and eraser integration under WordPress Tools.
The administration interface follows each user’s WordPress dashboard language. Translations are supplied through WordPress.org language packs when available and are not bundled in the plugin ZIP.
Important: Hard Guard Security reduces selected risks but cannot guarantee that a website is secure or malware-free. Keep verified backups, install updates, use secure hosting, and test high-risk changes on a staging site.
External services
Hard Guard Security operates primarily on the local site. The following connections occur only when the related feature is enabled or manually run.
country.is IP-to-country API
When GeoIP or Antispam country rules require a lookup, the visitor IP is sent to https://api.country.is/{ip}. Country results are cached for 24 hours, failures for 10 minutes, and unknown countries fail open.
Service: https://country.is/
Terms of use / usage conditions and rate limits: https://country.is/
Privacy / request logging information: https://country.is/
Source and self-hosting information: https://github.com/lineofflight/country
Cloudflare Turnstile
Turnstile is optional and disabled by default. When enabled, the browser loads JavaScript from Cloudflare and the plugin sends the challenge token, client IP address, configured secret, and verification metadata to Cloudflare Siteverify.
Service documentation: https://developers.cloudflare.com/turnstile/
Privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
WordPress.org checksum services
When an administrator runs the WordPress Core integrity check, the plugin requests official checksum data for the installed WordPress version and locale. Website file contents are not sent to WordPress.org.
WordPress.org privacy policy: https://wordpress.org/about/privacy/
Core checksum reference: https://developer.wordpress.org/reference/functions/get_core_checksums/
Hard Guard vulnerability intelligence database
Vulnerability Monitoring can use a signed compressed database downloaded from the Hard Guard website. Automatic database downloads are disabled by default and start only after an administrator explicitly enables automatic updates; an administrator can also request a one-time manual refresh. The request uses a neutral Hard-Guard-Security/
Default feed: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz
Detached signature: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.sig.txt
Data sent and when: only a normal HTTPS GET is made when automatic database updates run or an administrator requests a manual refresh. No site URL, software inventory, installed versions, scan results, file paths, or file contents are added to the request. As with ordinary web hosting, the feed server can receive connection metadata such as the requesting IP address, request time, requested URL, HTTP headers, and the Hard-Guard-Security User-Agent. The downloaded database is public security data and matching is performed locally.
Service endpoint: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz
Service privacy information: https://github.com/endriu7777/WP-Hard-Guard#privacy-conscious-operation
Service implementation/source project: https://github.com/endriu7777/WP-Hard-Guard
The Hard Guard database is built from public vulnerability sources and retains source attribution. The 1.13.0 feed format supports CVE Program / CVE List V5, optional NIST NVD enrichment, GitHub Advisory Database (CC BY 4.0), and CISA Known Exploited Vulnerabilities (CC0). Ambiguous WordPress component mappings should be reviewed before publication rather than guessed. The ZIP does not bundle a vulnerability database. Known-vulnerability coverage becomes active after an administrator enables automatic database updates or requests a manual refresh and a valid signed production feed is downloaded. Hard Guard clearly warns when production coverage is unavailable and never treats a missing database as a clean result.
PayPal donations
After an administrator clicks Donate, the browser submits the hosted-button identifier to PayPal in a new tab. No PayPal scripts, images, or tracking pixels load before the click. PayPal processes the visit and payment under its own terms.
PayPal privacy statement: https://www.paypal.com/privacy
PayPal user agreement: https://www.paypal.com/legalhub/paypal/useragreement-full
Administrator-configured SMTP server
When custom SMTP is enabled, Hard Guard Security connects to the configured server to deliver alerts and email 2FA codes. The provider receives message content and delivery metadata under its own terms.
The administrator’s own website
SSL certificate checks, live security-header scans, mixed-content front-end scans, redirect tests, and server-rule safety checks make HTTP or TLS requests only to the current website configured in WordPress. These requests are initiated by an administrator or by a safety check connected to a setting change.
Privacy
Hard Guard Security stores security data locally. Depending on enabled modules, this can include IP addresses, usernames, login results, event times, administrative actions, request paths without query strings, antispam incident details, file paths, checksums, database table/record identifiers, matched scanner rules, and short escaped excerpts. Database content is inspected only when an administrator explicitly enables Database Malware Scanner for a manual scan and is not uploaded to Hard Guard.
Known password, token, nonce, cookie, authorization, and API-key fields are redacted before Audit Log storage. Plaintext Application Passwords and their hashes are not written to Hard Guard Security logs. TOTP secrets and SMTP passwords are encrypted when Sodium or OpenSSL is available; recovery codes are stored as one-way hashes.
Active Sessions reads existing WordPress login-session metadata only when an authorized administrator opens that tab. Live Traffic is temporary and on-demand: while the tab is open, short browser heartbeats can contain the resolved IP address, logged-in WordPress identity when applicable, current page path, user agent, and last-seen time. This temporary state is not added to Audit Log history and expires shortly after monitoring stops. Sensitive query parameters are redacted.
Retention controls are available for Audit Log, Antispam, scanner history, and other records. WordPress privacy-policy suggestions are added under Settings > Privacy. Personal-data export and erasure callbacks are registered under Tools > Export Personal Data and Tools > Erase Personal Data. Erasure removes user-specific plugin metadata and matching antispam and lockout records, while matching Audit Log events are anonymized so non-personal security metadata can be retained.
Quarantined files remain on the server until restored, manually deleted, or removed during uninstall when complete cleanup is enabled. Scanner file contents and Database Malware Scanner content are not uploaded to an external malware-scanning service. Vulnerability matching also remains local: Hard Guard downloads a signed public database but does not upload installed plugin/theme inventory, versions, scan results, file names, or file contents.
