內容簡介
INI Protector 是一款專注於安全性的 WordPress 硬化外掛，提供多項獨立的安全功能，幫助使用者保護網站免受攻擊。透過文件完整性監控、雙重身份驗證及流量監控等功能，確保網站的安全性與穩定性。
【主要功能】
• 文件完整性監控，檢查代碼檔案的變更
• 雙重身份驗證，增強登入安全性
• 限制登入嘗試，防止暴力破解
• 禁用 XML-RPC 和主題/外掛編輯器
• 流量監控，記錄可疑活動
• 自訂 HTTP 安全標頭，增強安全性
外掛標籤
開發者團隊
原文外掛簡介
INI Protector is a focused, no-bloat hardening plugin for WordPress. Every feature
is an independent toggle, grouped into three areas:
Security
File integrity monitoring — hashes every code file (.php, .php5, .phtml,
.phar, .js, .htaccess, .user.ini …), keeps a baseline, and re-checks on a
schedule. Any file that is added, changed, or deleted is emailed to you (and
optionally POSTed to a webhook) before the baseline is updated, so the
evidence has already left the server even if the site itself is compromised.
Media is never hashed, but uploads, caches and backup folders are still checked
for executable files — a .php among your images has no innocent explanation and
is reported as critical. Runs from WP-Cron or from system cron via
wp inipr integrity scan.
Two-factor authentication (TOTP) — a time-based one-time code from any
standard authenticator app, required per role. The password is verified first,
then the code, before any session cookie is issued. Recovery codes are issued
at setup, and wp inipr 2fa reset
Disable XML-RPC, disable the theme/plugin file editor, require login for the
REST API.
Limit login attempts (IP lockout), mask the login URL to a secret slug.
Password-protect the whole front-end.
Disable comments and pingbacks/trackbacks.
Prevent user enumeration and information disclosure (directory listing,
wp-config/.htaccess/backup/log access; Apache .htaccess rules or an Nginx
snippet).
Hardening HTTP security headers (X-Frame-Options, X-Content-Type-Options,
Referrer-Policy, Permissions-Policy).
ALTCHA proof-of-work login captcha (self-hosted, no third-party calls).
Traffic monitor — records incoming requests so suspicious activity is visible,
with a per-IP drill-down. Defaults to 90 days and 250,000 requests; saved limits
are preserved. Either limit can be disabled. The row cap preserves requests
inside the auto-block evaluation window, so the count can temporarily exceed it.
Auto-block escalation — a dedicated IP Block page that surfaces the
traffic monitor’s suggested blocks for one-click review (Block Suggestion
System), and an optional Auto-Block mode that blocks offending IPs
automatically on an escalating temporary schedule (1h → 4h → 8h → 5 days →
2 weeks). Never issues a permanent block automatically; an allowlist and
verified search-engine bots are always exempt; quiet IPs decay back down.
Vulnerability scan — a daily check of your installed plugins, themes, and
WordPress core against the free WPVulnerability database (CC0, no API key).
Findings appear on a dedicated page and on the dashboard, with an optional
email alert on new findings. No data about your site is sent — only the
public slug of each component is looked up.
Head cleanup
Remove the generator/RSD/WLW/shortlink tags, strip or mask asset version
query strings, drop front-end Dashicons.
Utilities
Rotate asset cache token — changes the version token on every CSS and JS
URL at once, so returning visitors re-fetch them. Use it after a deploy when
a file has changed but the version it declares has not. Available from
INI Protector → Utilities and from wp inipr asset-salt rotate, which is
where it belongs in a deploy script.
Export / import settings — download which protections are on and how they
are configured as a JSON file, and import it on another site. Every change is
shown before it is applied, the previous settings are kept for one-click undo,
and secrets (site password, webhook secret) are left out unless you opt in.
Also wp inipr settings export|import|undo.
SEO & privacy
Disable feeds, disable author archives, obfuscate author slugs, and protect
email addresses from harvesting.
INI WP platform
Exposes a read-only, HMAC-signed REST endpoint (secwp/v1/state) so the
INI WP control panel can pull this site’s security posture and scan results.
The endpoint only activates when the INI WP connector is installed and
configured; auth reuses the connector’s signed channel.
Notes
Head cleanup lives here, not in SeoWP — SeoWP keeps pure SEO concerns
(titles, meta, schema, noindex directives).
Behind a reverse proxy or CDN, tell INI Protector which addresses your proxy
uses so it can read the real visitor IP safely:
define( ‘SECWP_TRUSTED_PROXIES’, ‘173.245.48.0/20, 2400:cb00::/32’ );
X-Forwarded-For is then read only when the connection actually comes from
one of those addresses, from the trusted end — so a visitor who
reaches your origin directly cannot claim to be someone else, evade an IP
block, or get an innocent IP blocked. Without this, client IPs come from the
socket peer, which cannot be forged. Security → Scan reports which mode you
are in. The older SECWP_TRUST_PROXY constant still works but cannot check who
sent the header; replace it when you can. CF-Connecting-IP is read only if
you also define( ‘SECWP_TRUST_CF_CONNECTING_IP’, true ) — do that only when
every declared proxy is Cloudflare, since other proxies pass it through as
the visitor sent it.
External services
The optional vulnerability scanner contacts WPVulnerability (https://www.wpvulnerability.com/)
only when you enable Vulnerability Scan. It sends installed plugin/theme slugs
and the WordPress core version to https://www.wpvulnerability.net/ to retrieve
known vulnerabilities. The service also receives the server IP address as part
of the connection. No site URL is included in the plugin’s user agent.
Service and privacy information: https://www.wpvulnerability.com/privacy/
File integrity webhooks are optional. When you configure a webhook URL and enable
alerts, reports containing the site URL, changed file paths, hashes and scan
metadata are sent to that URL. Configure only a recipient you trust; its terms
and privacy policy apply. Email alerts use your site’s configured mail service.
The optional INI WP connector allows your configured control panel to retrieve
security settings and scan results through an authenticated REST endpoint.
INI Protector does not initiate control-panel requests. Service information:
https://iniwp.com
Source code
The bundled ALTCHA widget is version 2.3.0, licensed under MIT.
Source: https://github.com/altcha-org/altcha/tree/v2.3.0
Build instructions are in that project’s README and package.json.
The widget runs locally in the browser; no ALTCHA service account is required.
