內容簡介
Janric Shield 是一款獨特的 WordPress 安全外掛，透過建立合法用戶的行為模式來防範攻擊，而非僅依賴已知的攻擊者特徵。這種方法能有效識別並阻擋可疑的登入嘗試，提升網站安全性。
【主要功能】
• 行為模式學習階段，觀察用戶登入行為
• 實時評分系統，對登入嘗試進行評估
• 整合數學安全問題，增加登入安全性
• 本地數據儲存，保障用戶隱私
• 可視化報告，讓用戶檢視可疑登入
外掛標籤
開發者團隊
原文外掛簡介
Most WordPress security plugins protect sites by modelling attackers — maintaining lists of known bad IPs, known attack signatures, and known malicious patterns. Janric Shield takes the opposite approach.
Janric Shield models your legitimate users, not the attackers.
During a short learning phase it builds a behavioural profile of how your admins actually log in — when, where, from which networks, and how they interact with the login form. Once that profile is established, anything that deviates significantly from it is flagged as suspicious. A brand new attack tool, a previously unseen technique, a credential stuffing campaign — it doesn’t matter whether it appears on any blocklist. If it doesn’t look like you, it scores high.
How It Works
Learning Phase (Days 1–14)
The plugin silently observes every login attempt and builds a per-site, per-user baseline covering:
Login hour and day-of-week distribution
Countries and ISPs (ASNs) that have successfully authenticated
Form fill duration — your personal mean and variance
Keystroke timing rhythm — your natural typing coefficient of variation
Browser and device patterns
Which usernames actually exist on this site
No data leaves your server. Everything is stored locally in your WordPress database using Welford’s online algorithm — a compact statistical method that maintains running mean and variance without storing individual data points.
Advisory Phase (Days 7–14)
Once enough legitimate logins have been recorded, the plugin begins scoring attempts and showing you what would have been blocked — without actually blocking anything yet. This lets you verify the model is accurate before enabling enforcement.
Active Phase (Day 14+)
With blocking enabled, attempts are scored in real time against your learned baseline. Suspicious attempts are challenged with a math-based security question and a tarpitting delay. High-confidence attacks are blocked outright.
Scoring System
Every login attempt receives a suspicion score from 0 to 100:
0 — Clean, matches your normal profile
20–39 — Low anomaly, monitored
40–59 — Medium anomaly, monitored
50–79 — Suspicious, challenged (math question + delay)
80–100 — High confidence attack, blocked
What It Detects
Immediate (from day one, no learning required)
Honeypot field filled — hidden field invisible to real browsers
Canary username targeted — attempts on usernames like admin or root that don’t exist on your site
Known scripting tool user-agents — python-requests, curl, wget, sqlmap, nikto and others
Direct POST attacks — bots that bypass the login form entirely and POST credentials directly
XML-RPC brute force — including system.multicall batch attacks
Impossibly fast form submission — sub-500ms fills
After baseline established (7–14 days)
Login from a country never seen on this site
Login from a new ISP or network
Login attempt on a username that has never successfully authenticated here
Login at an unusual hour for this site
High velocity attempts from a single IP
After per-user profile established (20+ logins per user)
Form fill time significantly outside your personal normal
Keystroke rhythm significantly different from your established typing pattern
Site Hardening
Beyond login protection, Janric Shield also includes:
REST API username decoy — unauthenticated requests to /wp-json/wp/v2/users receive convincing fake usernames instead of your real ones. The probe is logged and scored.
XML-RPC control — monitor all XML-RPC calls (default) or disable the endpoint entirely
WordPress version hiding — removes the version number from page source, RSS feeds, asset URLs, HTTP headers, and the REST API index
Privacy
Janric Shield operates entirely on your own server. No data is transmitted to any external service except for optional IP geolocation lookups (country and network type) which use the public ip-api.com service. IP addresses are stored as SHA-256 hashes in the attempt log. No personally identifiable information is shared with Janric or any third party.
For Developers
The plugin is structured around five core classes:
JanricShield_Baseline — Welford online statistics engine, per-site and per-user profiles
JanricShield_Scorer — Scores attempts against the learned baseline
JanricShield_Capture — Hooks into WordPress authentication pipeline, captures behavioural signals
JanricShield_Enforcer — Acts on scores based on current mode and thresholds
JanricShield_DB — Database schema, migrations, and settings
