內容簡介
Korisec Security 是一款網站安全外掛，提供漏洞掃描、登入保護及備份功能。透過雲端檢查，確保網站安全，並提供加密備份至 Google Drive，讓使用者無後顧之憂。
【主要功能】
• 雲端安全檢查，提供網站安全評分
• 登入保護及選擇性暴露修正功能
• 免費加密備份至 Google Drive
• 每日或每週備份排程選擇
• 一鍵恢復功能，快速回復網站狀態
外掛標籤
開發者團隊
② 後台搜尋「Korisec Security – Vulnerability Scanner, Login Protection and Backup」→ 直接安裝（推薦）
原文外掛簡介
Korisec is a hosted website security service. This plugin is the official WordPress client: it does not run port scans, Nuclei, or other scanners inside WordPress.
After you paste a plugin key from your Korisec account, the plugin:
Verifies this site with Korisec and binds the key to this host
Sends WordPress core, plugin, and theme versions so cloud checks can include software that is not visible from the public internet
Lets you start a cloud check from wp-admin and show grade, findings, and history
Lets the billing owner who issued the key manage plan, team seats, PDF reports, and alerts (Telegram, Slack, WhatsApp, webhook)
Without a key, login protection and optional exposure remedies (XML-RPC, public usernames, install.php) still run locally. Those features do not send data to Korisec.
Free encrypted backups to Google Drive
Backups are free for every site and do not need a Korisec key.
Backs up the full database and wp-content (plugins, themes, uploads) plus wp-config.php
Everything is encrypted on your server before upload (XChaCha20-Poly1305). Google and Korisec never see your data
Daily or weekly schedule, or back up on demand. Choose how many restore points to keep
Each backup is verified after upload (size and checksum). A backup is only listed as restorable once it is verified
One-click restore. A safety backup of the current site is always taken first
Restores swap tables and folders atomically. If anything looks wrong you can undo the restore instantly
Download a recovery key so you can restore onto a fresh WordPress install after a total loss
Large sites are processed in small resumable steps, so it works on shared hosting
Paid plans, daily scan limits, and white-label PDFs are features of the Korisec service, not locked code inside this plugin. The plugin’s PHP is fully available under GPLv2 or later.
External services
Hosted security checks require a Korisec account and talk to https://api.korisec.com (unless you set KORISEC_API_BASE in wp-config.php).
Terms of Use: https://korisec.com/terms.html
Privacy Policy: https://korisec.com/privacy.html
Plugin page: https://korisec.com/wordpress/
Dashboard: https://app.korisec.com
Nothing is sent until a site administrator pastes a kr_live_… key and clicks Connect.
Data sent after Connect
Typical payloads include this site’s URL and host, WordPress and PHP versions, names and versions of installed plugins/themes (and whether they are active), heartbeat, scan start/status requests, and billing/team/alert settings for the Korisec account that issued the key.
Google Drive backups
Nothing is contacted until an administrator clicks Connect Google Drive on the Backups tab.
Google Drive API (https://www.googleapis.com, https://oauth2.googleapis.com) stores the encrypted backup files in a “Korisec Backups” folder in your own Drive. The plugin asks only for the drive.file permission, so it can see only the files it created. Google’s terms: https://policies.google.com/terms and privacy policy: https://policies.google.com/privacy
Korisec sign-in relay (https://api.korisec.com, the same service that runs Korisec’s own Sign in with Google) completes the Google sign-in and renews short-lived Google access tokens, because Google requires a client secret that cannot ship inside a plugin. The relay receives this site’s admin URL, a one-time public key, and (on each renewal) the Google refresh token. It returns the tokens encrypted to this site and stores nothing. It never receives backup contents or your encryption key.
Backups are encrypted before they leave your server. The encryption key is stored in this site’s database, wrapped with the salts in wp-config.php, and can be downloaded as a recovery key.
