[WordPress] 外掛分享： MazeGuard Security

外掛標籤

開發者團隊

原文外掛簡介

MazeGuard Security protects the accounts that run your site and tells you, in plain terms, when its files or content change in ways worth a look.
Everything that runs on your own server is free and needs no account:

Two-factor authentication with any TOTP app, a QR code drawn on your own server (the secret is never sent to a third-party QR service), and single-use recovery codes.
Account security — an inventory of every account with risk flags (accounts without two-factor, dormant accounts, old passwords), a password policy that refuses recently used passwords, sign-in history with alerts for sign-ins from a network not seen before, and one-click session revocation.
Login protection — throttling per address and per username, with correct client addresses behind Cloudflare and configured proxies.
File malware scanning that separates where a file is from what it does. Each finding says whether the flagged code is the whole file or one part of a larger one, and what to do next: quarantine a payload file, reinstall an injected plugin or theme.
Comparison with WordPress.org — installed plugins and themes are compared file by file with the release WordPress.org distributes for the same version. Files identical to the release are not reported as malware; PHP and JavaScript files that differ, and PHP files the release does not contain, are listed for review.
Database malware scanning of posts and settings for stored scripts, hidden iframes and SEO spam, with the matched content shown on request and never copied into scan history.
File integrity — WordPress core checked against WordPress.org checksums, a baseline of every file, uploads monitoring, and detection of mass changes such as a site’s folders being reorganised at once.
Encrypted quarantine, an activity log, scan history and CSV exports.
Cloudflare — optionally, push blocks and Under Attack mode into your own Cloudflare zone with your own API token.

An optional MazeGuard Cloud licence adds what needs MazeGuard’s servers: alert delivery from outside your site (so an alert still arrives when the site’s own mail is broken), notice when the site stops checking in, and external vulnerability scans. Nothing is sent to MazeGuard Cloud unless you connect a licence and consent.
What MazeGuard Security is not
It is not a firewall and does not filter traffic. It does not remove malware automatically: findings are indicators for a person to review, not proof of infection, and nothing is changed or deleted without your say-so. Back up your site before quarantining or restoring files.
External services
MazeGuard Security connects to the services below. Only the WordPress.org connections are made by default; every other one runs only after you configure it.
WordPress.org (core checksums)
Used to check WordPress core files against the official release, once a day and when you run an integrity check. Sends the WordPress version and locale to api.wordpress.org, with a user agent naming this plugin and your site address, as WordPress itself does when checking for updates. Privacy
WordPress.org (plugin and theme releases)
Used to compare installed plugins and themes with their official releases, once a day, when a malware scan has findings inside a plugin or theme, and when you click Compare now. Sends the slug and version of each installed plugin and theme to downloads.wordpress.org, which is the same information WordPress sends when checking for updates. Can be turned off under MazeGuard > Settings. Privacy
MazeGuard Cloud
Used only after you enter a licence key under MazeGuard > Cloud & License and tick the consent box. On connecting, it sends the licence key, site address and site name. It then sends a periodic summary: plugin, WordPress and PHP versions, security score, plugin and theme counts, and finding counts. Relayed alerts carry an event type, a severity and counts; the alert wording, which can name an account or address, is included only if you turn on that setting. File contents, database values, passwords and customer records are never sent. External scans, if requested, probe your site’s public address from MazeGuard’s servers. Terms — Privacy
Cloudflare
Used only after you add a Cloudflare API token under MazeGuard > Settings. Sends requests to api.cloudflare.com to read your zone, create and remove IP blocks, purge the cache and change the security settings you choose. Blocks carry the address being blocked and a short note. Terms — Privacy

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)Really Simple Security 是一款輕量級且易於使用的 WordPress...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款功能強大的 WordPress 外掛，旨在提升網站內容...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 是一個讓您在 WordPress 中安全上傳 SVG 檔案的最佳...LoginizerLoginizer 是一款 WordPress 外掛，旨在防止暴力破解攻擊，當...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role EditorUser Role Editor 外掛允許用戶輕鬆變更使用者角色和權限。用...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionKadence Security 是一款專為 WordPress 網站設計的安全外掛...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP PluginSiteGuard WP Plugin 旨在加強 WordPress 網站的登入及管理區...