內容簡介
Lockspire 是一款專注於 WordPress 登入安全的輕量級外掛，能有效防止暴力破解攻擊，透過鎖定超過失敗登入次數的 IP，並提供清晰的安全狀態報告，讓使用者無需面對複雜的設定。
【主要功能】
• 智能登入保護，自動鎖定過多失敗登入的 IP
• 一鍵緊急防護，快速啟動鎖定模式
• 自動封鎖針對禁止用戶名的機器人
• 防止用戶名枚舉，保護有效登入名稱
• 整合威脅情報，便於調查攻擊 IP
• 詳細活動日誌，記錄所有登入嘗試
外掛標籤
開發者團隊
② 後台搜尋「Lockspire – Limit Login and Smart Access Protection」→ 直接安裝（推薦）
原文外掛簡介
Lockspire is a focused, lightweight WordPress login security plugin. It stops brute-force attacks by locking out IPs that exceed your failed-login threshold, alerts you when it happens, and gives you a clear picture of your site’s security without unnecessary complexity.
What it does
Lockspire does a small number of things well, rather than doing many things poorly.
✅ Smart Login Protection
Automatically locks out IP addresses after too many failed login attempts. The lockout expires on its own – no manual intervention needed. The lockout threshold and duration are fully configurable.
✅ 🚨 One-Click Emergency Shield / Lockdown
Under active attack? Activate Emergency Lockdown with a single click to instantly tighten thresholds (2 attempts max, 60-minute lockdown) and defeat distributed bot attacks.
✅ 🍯 Bot Honeypot Auto-Ban
Instantly locks out automated bots targeting prohibited usernames (e.g. admin, root, administrator, test, system) on their very first attempt, saving database resources and thwarting brute-force dictionaries.
✅ 🛡️ Username Enumeration Shield
Stops attackers and tools like WPScan from discovering valid login usernames by shielding direct author queries (?author=1) and removing user lists from the WordPress REST API for unauthenticated visitors.
✅ 🔍 Threat Intelligence & Forensic Investigation
Integrated IP threat intelligence links (AbuseIPDB) directly in your activity logs and locked tables so you can investigate attacking IP reputations with one click.
✅ Trusted IP Allowlist
Add your own IP address (or CIDR range) to the allowlist so you are never accidentally locked out. Lockspire shows you your current IP on the management screen, and warns you if you are about to make a change that could affect your own access.
✅ Detailed Activity Log
Every failed and successful login attempt is logged to a dedicated database table with IP address, username, user-agent, and timestamp. Logs are filterable by event type and IP address, exportable to CSV, and automatically purged after a configurable retention period.
✅ Throttled Security Email Alerts
Receive an email when an IP is locked out. Alerts are automatically throttled (one per IP per configurable time window) so a sustained attack doesn’t fill your inbox. You can also receive optional alerts for successful logins.
✅ Security Health Check
A dedicated screen shows the real status of your site’s security configuration: login protection status, XML-RPC status, WordPress version, debug mode, wp-config.php permissions, default “admin” username detection, honeypot auto-ban, user enumeration shielding, and trusted IP setup. Each check links directly to the right settings to fix any issues found.
✅ XML-RPC & Pingback Shield
Completely disables XML-RPC and removes X-Pingback headers, eliminating common attack surfaces for brute-force and DDoS amplification attacks. Safe to disable for most sites.
Who is Lockspire for?
WordPress site owners who want reliable brute-force protection without installing a heavyweight all-in-one security suite
Developers managing client sites who need a simple, trustworthy plugin they can configure once and leave running
Anyone who has been locked out of their own site before and wants a lockout recovery path built in
What Lockspire does NOT do
Lockspire does not scan for malware, provide a web application firewall, or offer country blocking. These features belong in a different category of plugin. Lockspire focuses exclusively on login access protection and does it reliably.
Privacy
Lockspire logs IP addresses, usernames, and browser user-agents for login events. This data is stored in your WordPress database and is never transmitted to external servers. It is automatically purged after your configured retention period (default: 30 days). We recommend documenting this in your site’s privacy policy.
Developer Information
Hooks available to developers:
lockspire_after_failed_login — Runs after a failed login attempt is recorded.
Parameters: $username (string), $ip (string), $attempt_count (int)
lockspire_after_lockout — Runs when an IP is locked out.
Parameters: $username (string), $ip (string)
lockspire_lockout_message — Filter the lockout message shown to the user.
Parameters: $message (string), $minutes (int), $seconds (int)
Option keys:
– lockspire_options — Main plugin settings array
– lockspire_trusted_ips — Allowlisted IPs and CIDR ranges
– lockspire_notification_emails — Additional alert recipient emails
– lockspire_email_logs — Sent email log (capped at 100)
Table: {prefix}lockspire_log — Login event log
