外掛標籤
開發者團隊
原文外掛簡介
Maasters Security Shield provides configurable baseline hardening controls for WordPress sites. It is not a replacement for updates, backups, strong authentication, or a professional security review.
Features
Baseline security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Optional HSTS on HTTPS responses, with configurable max-age and opt-in subdomain/preload directives.
Content Security Policy in Disabled, Report Only, or Enforce mode. Report Only is recommended for initial testing.
Failed-login rate limiting with configurable attempt count and lockout duration.
Option to disable XML-RPC authentication and remove the X-Pingback header.
Option to hide WordPress generator/version output.
Option to redirect public author-enumeration query requests.
Capability-protected administration and sanitized settings.
Important Notes
Back up your site and test on staging before enabling HSTS subdomains/preload or enforcing CSP.
CSP defaults are only a starting point; adapt directives for your theme, plugins, fonts, images, scripts, and third-party integrations.
Login attempts are grouped by the REMOTE_ADDR value. Visitors behind the same public IP can share a lockout. Forwarded proxy headers are intentionally not trusted automatically.
To disable the theme/plugin file editor, add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php above the stop-editing line. This plugin does not modify wp-config.php.
Failed-login protection uses the visitor IP address to group attempts and stores attempt counters under an IP-derived transient key in WordPress’s database or object cache. It does not send this information to an external service.
Security headers are emitted only when headers have not already been sent. Other server layers or plugins may also set or override headers.
