內容簡介
INI Protector 是一款專注於 WordPress 的安全加固外掛，提供多項獨立的安全功能，幫助用戶監控檔案完整性、實施雙重身份驗證及加強 HTTP 安全標頭，確保網站的安全性與穩定性。
【主要功能】
• 檔案完整性監控，定期檢查檔案變更
• 支援雙重身份驗證，增強登入安全
• 限制登入嘗試，防止暴力破解
• 禁用 XML-RPC 和主題/外掛編輯器
• 監控流量，記錄可疑活動
• 自動封鎖可疑 IP，簡化管理流程
外掛標籤
開發者團隊
原文外掛簡介
INI Protector is a focused, no-bloat hardening plugin for WordPress. Every feature
is an independent toggle, grouped into three areas:
Security
File integrity monitoring — hashes every code file (.php, .php5, .phtml,
.phar, .js, .htaccess, .user.ini …), keeps a baseline, and re-checks on a
schedule. Any file that is added, changed, or deleted is emailed to you (and
optionally POSTed to a webhook) before the baseline is updated, so the
evidence has already left the server even if the site itself is compromised.
Media is never hashed, but uploads, caches and backup folders are still checked
for executable files — a .php among your images has no innocent explanation and
is reported as critical. Runs from WP-Cron or from system cron via
wp secwp integrity scan.
Two-factor authentication (TOTP) — a time-based one-time code from any
standard authenticator app, required per role. The password is verified first,
then the code, before any session cookie is issued. Recovery codes are issued
at setup, and wp secwp 2fa reset
Disable XML-RPC, disable the theme/plugin file editor, require login for the
REST API.
Limit login attempts (IP lockout), mask the login URL to a secret slug.
Password-protect the whole front-end.
Disable comments and pingbacks/trackbacks.
Prevent user enumeration and information disclosure (directory listing,
wp-config/.htaccess/backup/log access; Apache .htaccess rules or an Nginx
snippet).
Hardening HTTP security headers (X-Frame-Options, X-Content-Type-Options,
Referrer-Policy, Permissions-Policy).
ALTCHA proof-of-work login captcha (self-hosted, no third-party calls).
Traffic monitor — records incoming requests so suspicious activity is visible,
with a per-IP drill-down. Keeps the full history by default; you can cap it by
age, by number of requests, or both.
Auto-block escalation — a dedicated IP Block page that surfaces the
traffic monitor’s suggested blocks for one-click review (Block Suggestion
System), and an optional Auto-Block mode that blocks offending IPs
automatically on an escalating temporary schedule (1h → 4h → 8h → 5 days →
2 weeks). Never issues a permanent block automatically; an allowlist and
verified search-engine bots are always exempt; quiet IPs decay back down.
Vulnerability scan — a daily check of your installed plugins, themes, and
WordPress core against the free WPVulnerability database (CC0, no API key).
Findings appear on a dedicated page and on the dashboard, with an optional
email alert on new findings. No data about your site is sent — only the
public slug of each component is looked up.
Head cleanup
Remove the generator/RSD/WLW/shortlink tags, strip or mask asset version
query strings, drop front-end Dashicons.
Utilities
Rotate asset cache token — changes the version token on every CSS and JS
URL at once, so returning visitors re-fetch them. Use it after a deploy when
a file has changed but the version it declares has not. Available from
INI Protector → Utilities and from wp secwp asset-salt rotate, which is
where it belongs in a deploy script.
SEO & privacy
Disable feeds, disable author archives, obfuscate author slugs, and protect
email addresses from harvesting.
INI WP platform
Exposes a read-only, HMAC-signed REST endpoint (secwp/v1/state) so the
INI WP control panel can pull this site’s security posture and scan results.
The endpoint only activates when the INI WP connector is installed and
configured; auth reuses the connector’s signed channel.
Notes
Head cleanup lives here, not in SeoWP — SeoWP keeps pure SEO concerns
(titles, meta, schema, noindex directives).
Behind a reverse proxy or CDN, tell INI Protector which addresses your proxy
uses so it can read the real visitor IP safely:
define( ‘SECWP_TRUSTED_PROXIES’, ‘173.245.48.0/20, 2400:cb00::/32’ );
Forwarded headers (X-Forwarded-For, CF-Connecting-IP) are then read only when
the connection actually comes from one of those addresses — so a visitor who
reaches your origin directly cannot claim to be someone else, evade an IP
block, or get an innocent IP blocked. Without this, client IPs come from the
socket peer, which cannot be forged. Security → Scan reports which mode you
are in. The older SECWP_TRUST_PROXY constant still works but cannot check who
sent the header; replace it when you can.
External services
The optional vulnerability scanner contacts WPVulnerability (https://www.wpvulnerability.com/)
only when you enable Vulnerability Scan. It sends installed plugin/theme slugs
and the WordPress core version to https://www.wpvulnerability.net/ to retrieve
known vulnerabilities. The service also receives the server IP address as part
of the connection. No site URL is included in the plugin’s user agent.
Service and privacy information: https://www.wpvulnerability.com/privacy/
File integrity webhooks are optional. When you configure a webhook URL and enable
alerts, reports containing the site URL, changed file paths, hashes and scan
metadata are sent to that URL. Configure only a recipient you trust; its terms
and privacy policy apply. Email alerts use your site’s configured mail service.
The optional INI WP connector allows your configured control panel to retrieve
security settings and scan results through an authenticated REST endpoint.
INI Protector does not initiate control-panel requests. Service information:
https://iniwp.com
Source code
The bundled ALTCHA widget is version 2.3.0, licensed under MIT.
Source: https://github.com/altcha-org/altcha/tree/v2.3.0
Build instructions are in that project’s README and package.json.
The widget runs locally in the browser; no ALTCHA service account is required.
