外掛標籤
開發者團隊
原文外掛簡介
Ironfang Security reviews a WordPress site’s configuration, update information and privileged accounts for common security risks. It explains each finding, shows the evidence it observed and suggests a practical next step.
It checks:
whether WordPress, plugin and theme updates are available, using the update information WordPress has already stored, and how old that information is;
whether the server’s PHP version still receives security fixes, and how the site is set to update;
whether WordPress is set up for HTTPS;
whether PHP errors are shown to visitors, and whether a debug log is kept inside the site’s files;
whether the dashboard file editors are on, and who on the server can read or change wp-config.php;
what public registration grants, and which accounts have administrator-level access.
It also lists the installed software. An available update is maintenance information; this plugin does not report known vulnerabilities.
Findings are listed by priority, each with its evidence and practical guidance. You can recheck a finding after fixing it, or ignore one you have reviewed; an ignored finding is still reported by its check and is never counted as passed.
You can download a report of the results as readable text or JSON. It leaves out server paths and account details.
One hardening change is available, and only if you ask for it: turning off the dashboard’s theme and plugin file editors. It has the same effect as DISALLOW_FILE_EDIT, without editing wp-config.php. The check confirms the change, you can undo it, and each change is logged. It works only while the plugin is active.
What the plugin does not do:
It does not change your site’s settings, unless you turn off the file editors with it.
It does not contact Ironfang or any other service.
It is not a firewall or malware scanner, and it does not block attacks.
It does not give your site a security score or certify that it is safe.
The plugin supports single-site WordPress installations. It does not load on multisite networks.
Privacy
This plugin does not send data to Ironfang or any third party, does not collect analytics and does not set cookies.
Check results store counts and settings, not account details. The list of administrator accounts is read when an administrator opens it and is not stored. If you turn the file editors off or back on with the plugin, it logs when, and the ID of the account that did it.
Reports are made only when an administrator asks for one and are sent straight to the browser; no copy is kept on the server. Reports leave out server paths and account details. The site address is included unless you untick it, and the reasons given for ignoring findings only if you choose them.
Ironfang Security › Settings lists everything the plugin stores.
