內容簡介
Karetaker 是一款專注於網站安全的外掛，透過監控關鍵變更來保護您的網站，並在必要時主動通知您，避免過度干擾。它提供清晰的記錄，讓您輕鬆掌握網站狀況。
【主要功能】
• 監控外部 JavaScript 網域變更
• 每日檢查搜尋引擎隱藏連結
• 核心與外掛檔案完整性檢查
• 追蹤設定變更與可疑選項
• 監控使用者角色與權限變更
• 檢查上傳檔案的安全性
外掛標籤
開發者團隊
原文外掛簡介
Karetaker is a watchtower, not a wall.
Most security plugins either shout at you all day or quietly lock you out of your own
site. Karetaker does neither. It watches the handful of changes that actually mean
something went wrong, keeps a readable record, and emails you only when a human needs
to act.
What it watches
Scripts: new external JavaScript domains after a local baseline (home, and cart/checkout when WooCommerce is active)
Search engine cloaking: once a day, compares your home page as a visitor and as Googlebot, and flags hidden spam links
Integrity: core and plugin file changes, checked against published WordPress.org checksums
Options: changes to the settings that matter, plus curated suspicious option names and unusual new autoload names
Privileges: role and capability changes, new administrators, user promotions
Uploads: files appearing in wp-content/uploads that do not belong there
Cron drift: scheduled tasks that vanish, stall, or appear from nowhere
Plugin risk: closed or abandoned plugins on WordPress.org, and plugins whose listed owner changed
Optional vulnerability lookup: when you enable it, active plugin versions are checked against public WPVulnerability data (off by default)
One-checkbox catastrophes
The quiet business killers that no scanner reports, because technically nothing is “hacked”:
Search engine visibility switched off
Site email failing to send
No administrators left on the site
Invalid or unreachable admin email
Opt-in hardening, with receipts
A small set of hardening toggles, every one of them off until you turn it on, and
every one reversible from Karetaker → Protection. Each toggle shows Desired next to
Live now, so you always see what is actually in effect rather than what was merely
requested.
How it reaches you
Visibility is pull: the Karetaker admin screen and WP-CLI
Notification is push: email to the site owner, on ACT-severity events only
Optional Slack / Telegram / Discord / Microsoft Teams: webhooks or Bot API, off until you turn them on
Optional weekly summary: one short email on Monday mornings, off until you turn it on
Pause alerts for an hour while you work on the site; one catch-up email afterwards if something needed you
Your data, your file: download the activity log as CSV at any time
Hardening is off until each toggle is switched on
Who it is for
Site owners who want to know their site is fine without reading a dashboard every morning
Freelancers and agencies handing a site over to a client, who still need to know if something breaks later
It is deliberately not
A WAF or request firewall
A malware signature scanner
A login lockout or hide-login product by default
A writer of wp-config.php, .htaccess, or server config
Kill switch
Define KARETAKER_DISABLE as true in wp-config.php, or place an empty file at
wp-content/karetaker-disable. The plugin then boots nothing. Uninstall removes the
plugin’s table, options, and scheduled hooks.
Open source
Karetaker is GPL, built by Team Krikir. It does not phone
home, load third-party scripts, or show ads. Issues and pull requests are welcome.
Credits
Karetaker ships no third-party code, fonts or images. It relies on these projects and services,
and thanks them:
WordPress and the WordPress.org APIs for core and plugin checksums, plugin directory information, and security keys
WPVulnerability for the optional public vulnerability database (vulnerability details shown in Karetaker come from WPVulnerability and the sources it links to)
Simple Icons for the destination logos shown in Settings (CC0 1.0)
Slack incoming webhooks, the Telegram Bot API, Discord webhooks and Microsoft Teams workflows for the optional alert channels
PHP_CodeSniffer, WordPress Coding Standards and PHPCompatibilityWP, used during development only
WordPress is a registered trademark of the WordPress Foundation. Microsoft and Microsoft Teams
are trademarks of the Microsoft group of companies. Slack is a trademark of Slack Technologies, LLC.
Discord is a trademark of Discord Inc.
Google and Googlebot are trademarks of Google LLC. Telegram and all other trademarks are the property of their
respective owners. Karetaker is an independent project by Team Krikir. It is not created,
endorsed, sponsored or certified by any of these companies; their names are used only to
describe the services Karetaker can connect to.
