內容簡介
Nahnu Login Shield 是一款專注於保護 WordPress 登入入口的安全外掛，能有效防止暴力破解攻擊，並提供多種安全功能，確保網站登入安全。此外掛完全免費，無需訂閱或授權金鑰。
【主要功能】
• 可配置的嘗試限制與鎖定時間
• 針對每個使用者名稱的鎖定機制
• 支援 CIDR 的 IP 黑名單與白名單
• 提供手動解鎖功能
• 可選擇早期阻擋插件
• CAPTCHA / 驗證提供者選擇
外掛標籤
開發者團隊
原文外掛簡介
Nahnu Login Shield does one thing and does it well: protect every WordPress login entry point. It is not a general security plugin. It is a login security plugin — hyperfocused on the login form, WooCommerce My Account, XML-RPC, the REST API, and all the form plugins your site might use.
No subscription. No license key. No upsell. Everything is included free.
Brute-force lockout
Configurable attempt limit, time window, and short lockout duration.
Escalating lockout — after N short lockouts the IP receives a long lockout (default 24 h).
Per-username lockout — if the same username is tried from many different IPs (a distributed botnet), the username itself is locked across all IPs after a configurable threshold.
Honeypot usernames — any attempt using a known-bad username (admin, root, administrator, test…) instantly locks the IP and the username globally. One attempt is enough.
CIDR-supported IP blocklist and IP whitelist (IPv4 and IPv6).
Manual unlock button next to any locked IP in the log.
Early blocking
An optional must-use plugin (mu-plugin) can fire before WordPress fully loads. It is off by default and never installed automatically: enable it from the General tab by clicking “Install early-block mu-plugin”, which copies nahnls-early-block.php into your must-use plugins directory (WPMU_PLUGIN_DIR). Once installed, locked-out IPs are turned away at the door — no PHP framework, no database writes, no WooCommerce — for a fraction of the normal request cost. Honeypot IPs receive a full static block page for all site pages during the lockout period. Clicking “Remove” (or deactivating/deleting the plugin) deletes the file again.
CAPTCHA / Verification providers
Choose one provider site-wide. The widget appears on every protected form automatically.
OOPSpam — checkbox widget powered by OOPSpam Anti-Spam. Adds login-specific overrides: block VPN/proxy, datacenter IPs, and disposable email addresses.
reCAPTCHA v2 — Google checkbox challenge.
reCAPTCHA v3 — Google invisible score-based. No user interaction required.
hCaptcha — privacy-first, free tier.
Cloudflare Turnstile (managed) — Cloudflare decides whether to show a challenge based on risk signals.
Cloudflare Turnstile (invisible) — entirely silent.
Friendly Captcha — EU-hosted, proof-of-work, no cookies. GDPR-ready.
None — disable the widget entirely. Geo-blocking, lockout, and honeypot still apply.
Two-factor authentication
When 2FA is on, every user in the roles you select (all roles by default) is asked for a one-time code after their password, on every login.
Email codes are always on as the baseline – nobody can skip the second step. Users can add an authenticator app (TOTP) or a passkey for stronger protection; the code is emailed automatically only when they have nothing stronger.
Users cannot turn 2FA off for themselves; administrators can reset another user’s methods (for example after a lost phone), which falls back to email codes.
Backup codes as a universal fallback.
Emergency recovery: define( 'NAHNLS_DISABLE_2FA', true ); in wp-config.php switches the 2FA check off.
Challenge happens on wp-login.php, or right inside WooCommerce My Account for customers.
Per-user setup on a dedicated Login & security page (wp-admin) or the My Account tab – codes are confirmed inline, with a scannable QR code and manual key.
Passwordless sign-in
Passkeys (WebAuthn) – sign in with Touch ID, Windows Hello, a phone or a security key. Browser autofill (conditional mediation) supported. Built-in verifier (ES256, RS256, Ed25519), no external service.
Magic links – one-time email login links; hashed at rest, rate-limited, go through lockout, geo and CAPTCHA checks. Per-user opt-out.
Both available on wp-login.php and the WooCommerce My Account form; role allow-lists.
White-label emails
Email branding (Settings tab) – the 2FA code, magic link and signup confirmation emails use your sender name and address, logo, accent and header colours and footer text. Subject, heading and intro of each email are editable with placeholders; preview in the browser and send yourself a test email. No plugin branding in emails unless you switch on the optional credit line.
Access control
Restrict roles to IP addresses / CIDR ranges (IPv4 + IPv6).
Login and logout redirects per role.
XML-RPC kill switch (403 before WordPress loads).
Signup email verification with automatic pruning of unconfirmed accounts.
Security checklist with a score and one-click fixes.
Geo-fencing
Reads the visitor country from CDN headers with zero latency and zero API quota. Supported headers: CF-IPCountry (Cloudflare), CDN-Country (Bunny.net), CloudFront-Viewer-Country (AWS CloudFront), X-Vercel-IP-Country (Vercel), X-Country-Code (Fastly/Akamai), X-Geo-Country (generic CDN).
Falls back to freeipapi.com or ipinfo.io (both free) with a configurable transient cache when no CDN header is present.
Edge WAF integration
Bunny.net WAF — push locked-out IPs to Bunny WAF with one click. Blocks them at the CDN edge before they reach your server.
Cloudflare WAF (IP Access Rules) — same for Cloudflare. Uses the IP Access Rules API (not the 5-rule WAF limit). Auto-expiry via WP-Cron.
Both integrations support triggering on honeypot hits, on brute-force lockout, or both.
Edge block log in the admin with IP, provider, reason, age, expiry, and one-click unblock.
JavaScript presence check
A hidden field filled by a small inline script gates every submission. Headless bots that skip JavaScript execution are blocked before CAPTCHA or lockout checks run — saving API quota.
Custom login URL
Optionally rename /wp-login.php to a secret path. Requests to the old URL return a configurable response: 404, redirect to home, or redirect to a custom URL.
REST API protection
Block unauthenticated access to /wp-json/wp/v2/users (username enumeration).
Apply lockout and IP block rules to REST API authentication.
Optionally disable Application Passwords.
Session security
Idle session timeout with configurable duration and a 2-minute warning dialog.
Force logout all sessions immediately with one button (useful during an incident).
Login notifications
Notify each user by email on account login with IP and device info.
Alert admin emails whenever any administrator logs in.
New-country alert: email the first time a user logs in from a previously unseen country.
Weekly security digest: failed attempts, lockouts, honeypot hits, top attacking IPs, top targeted usernames.
WooCommerce My Account
Extend all protections – geo-blocking, lockout, honeypot, CAPTCHA, JS check, passkeys, magic links – to the WooCommerce My Account login, registration, lost-password, checkout, and order-tracking forms. Each form has its own toggle. Customers get a Login & security tab in My Account to manage passkeys, two-factor authentication and sign-in options without ever seeing wp-admin, and complete the 2FA challenge on the My Account page itself. The same panel is available anywhere via the [nahnls_account_security] shortcode.
Form plugin integrations
Three form integrations are supported, each with its own toggle on the Integrations tab: Bricks Builder forms (enabled per form from the Bricks form element’s Spam Protection panel), SureForms (all forms, or only the forms you pick), and the native WordPress comment form. Each adds the JS marker check and the configured CAPTCHA widget to the form and validates it server-side on submit. Any other form, theme template or headless front end can integrate through the developer API: template tags, [nahnls_passkey_button] / [nahnls_magic_link_form] shortcodes, 20+ actions and filters, REST routes under nahnls/v1 and the window.NAHNLSAuth JavaScript API (see docs/API.md).
Full event log
Search by IP, username, or detail text.
Filter by event type (fail, lockout, honeypot, geo block, success, captcha fail…).
Date range picker.
CSV export.
Log detail column shows the source form or endpoint for every event (WooCommerce My Account, REST API, XML-RPC, Bricks Builder Form, WP Login form, etc.).
Configurable retention period and row cap.
Analytics
Daily activity chart (30-day view).
Attack time-of-day heatmap.
Event breakdown donut chart.
Top attacking IPs table.
Top targeted usernames table.
All data is local — no external analytics service.
MainWP extension
A companion extension (Nahnu Login Shield — MainWP Extension) is available separately and allows site managers to view login shield data — lockouts, edge WAF blocks, recent events, settings summary — across all connected child sites from the MainWP dashboard, with a widget on each site overview page and a per-site detail tab.
Privacy
Nahnu Login Shield stores IP addresses and usernames in a local WordPress database table for the event log. The retention period and row cap are configurable. No data is sent to any Nahnu server. Third-party CAPTCHA providers and IP lookup services receive only the data required for their function, per their own privacy policies. Deleting the plugin removes all stored data via the included uninstall.php.
External services
Nahnu Login Shield works fully offline by default. Each service below is contacted only when the site administrator explicitly selects or configures it in the plugin settings. No data is ever sent to a Nahnu server.
Google reCAPTCHA (v2 / v3) — Used as the CAPTCHA provider when selected on the Widget tab. The visitor’s browser loads the widget script from https://www.google.com/recaptcha/api.js on protected forms, and Google receives the visitor’s IP address and browser information per its own policy. On every form submit the plugin sends the reCAPTCHA response token together with your reCAPTCHA secret key server-to-server to https://www.google.com/recaptcha/api/siteverify. Terms of Service · Privacy Policy
hCaptcha — Used as the CAPTCHA provider when selected. The visitor’s browser loads the widget from https://js.hcaptcha.com/1/api.js on protected forms (hCaptcha receives the visitor’s IP and browser data). On form submit the plugin sends the hCaptcha response token and your secret key server-to-server to https://api.hcaptcha.com/siteverify. Terms of Service · Privacy Policy
Cloudflare Turnstile — Used as the CAPTCHA provider when selected (managed or invisible mode). The visitor’s browser loads the widget from https://challenges.cloudflare.com/turnstile/v0/api.js on protected forms (Cloudflare receives the visitor’s IP and browser data). On form submit the plugin sends the Turnstile token and your secret key server-to-server to https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms of Service · Privacy Policy
Friendly Captcha — Used as the CAPTCHA provider when selected. The widget script itself is bundled with the plugin (no CDN), but the visitor’s browser fetches a proof-of-work puzzle from api.friendlycaptcha.com while the form is displayed (Friendly Captcha receives the visitor’s IP address). On form submit the plugin sends the solved puzzle token (frc-captcha-solution) plus your site key and your Friendly Captcha API key server-to-server to https://global.frcapi.com/api/v2/captcha/siteverify. Terms of Service · Privacy Policy
OOPSpam Anti-Spam — Used as the verification provider when selected; requires the separate OOPSpam Anti-Spam plugin with its own API key. On login/registration submit (and optionally at widget render) the plugin calls the OOPSpam plugin, which sends the visitor’s IP address and the submitted username/email, together with your OOPSpam API key, to the OOPSpam API to obtain a spam/VPN/data-centre score. Terms of Service · Privacy Policy
Bunny.net API (https://api.bunny.net) — Used only when the Bunny WAF edge-blocking integration is enabled on the Edge Blocking tab. When a lockout or honeypot event fires, the plugin sends the blocked IP address, an expiry timestamp and a short note, authenticated with your Bunny API key, to the Bunny WAF IP-block endpoint for your pull zone. The “Test connection” button reads your pull zone details with the same key. Terms of Service · Privacy Policy
Cloudflare API (https://api.cloudflare.com/client/v4) — Used only when the Cloudflare WAF edge-blocking integration is enabled. When a lockout or honeypot event fires, the plugin creates an IP access rule containing the blocked IP address and a note, authenticated with your Cloudflare API token; a scheduled task later deletes that rule when the block expires, and the “Test connection” button verifies the token. Terms of Service · Privacy Policy
freeipapi.com — Geo-lookup fallback, used only when geo-blocking is enabled and “freeipapi” is selected as the API source and no CDN country header is present. On a login attempt the plugin sends the visitor’s IP address (and your optional API key as a bearer token) to https://free.freeipapi.com/api/json/{ip} to learn its country code; results are cached locally per IP. Terms of Use · Privacy Policy
ipinfo.io — Geo-lookup fallback, used only when geo-blocking is enabled and “ipinfo” is selected as the API source. On a login attempt the plugin sends the visitor’s IP address (and your optional API token) to https://api.ipinfo.io/lite/{ip} to learn its country code; results are cached locally per IP. Terms of Service · Privacy Policy
Self-hosted Cap and mCaptcha instances — If you select the Cap or mCaptcha provider you must enter the URL of an instance you host. The visitor’s browser loads that instance’s widget script, and on form submit the plugin sends the challenge token and your secret key server-to-server to {your-instance}/siteverify (Cap) or {your-instance}/api/v1/pow/siteverify (mCaptcha). No third party is involved unless you point the URL at one; see the Cap and mCaptcha documentation for their respective terms.
ALTCHA — If selected, verification is handled locally by the separately installed ALTCHA plugin; this plugin makes no external request for it.
Country flags shown in the admin log are SVG files bundled with the plugin (assets/img/flags/); no flag CDN or other external image service is used.
Bundled third-party libraries
No scripts are loaded from a CDN. These libraries ship inside the plugin (assets/vendor/ unless noted otherwise):
Chart.js 4.4.1 — MIT License, https://www.chartjs.org. Used on the Analytics admin tab.
Friendly Captcha widget (friendly-challenge 0.9.18) — MIT License, https://github.com/FriendlyCaptcha/friendly-challenge. Used only when Friendly Captcha is the selected CAPTCHA provider.
flag-icons (country flag SVGs in assets/img/flags/) — MIT License, https://github.com/lipis/flag-icons. Displayed in the admin event log; loaded from the plugin folder, never from a CDN.
