內容簡介
ncdLabs Assure 是一款專為 WordPress 網站擁有者設計的安全與合規掃描器，幫助用戶在 wp-admin 中進行 GDPR 準備工作，包括網站發現、控制評估、同意管理等功能，並提供審計報告。
【主要功能】
• 內建 GDPR 控制目錄，涵蓋 47 項技術控制
• 內建 OWASP Top 10 控制目錄，包含 24 項安全控制
• 內建 NIST CSF 2.0 控制目錄，提供 15 項網路安全準備控制
• 網站發現插件、腳本、表單及第三方服務
• 原生同意橫幅及偏好中心功能
• 一鍵修復支援的控制項
外掛標籤
開發者團隊
② 後台搜尋「ncdLabs Assure – Security & Compliance Scanner」→ 直接安裝（推薦）
原文外掛簡介
ncdLabs Assure helps WordPress site owners and operators run technical GDPR readiness work inside wp-admin: site discovery, control evaluation, consent management, script enforcement, evidence collection, remediation helpers, and audit reporting.
ncdLabs Assure verifies controls it can observe on your site, records evidence, and flags items that need manual review. It does not replace legal counsel and does not certify legal compliance.
Free frameworks (included)
Built-in GDPR control catalog (47 technical controls across consent, analytics, forms, embeds, and WordPress configuration)
Built-in OWASP Top 10 control catalog (24 WordPress-focused security controls mapped to OWASP Top 10 2021 categories)
Built-in NIST CSF 2.0 control catalog (15 WordPress-focused cybersecurity readiness controls)
Site discovery for plugins, scripts, iframes, forms, and third-party services
Native consent banner and preference center (defers to an active third-party CMP when one is detected)
Google Consent Mode v2 defaults, optional GA/GTM deferral, and script blocking before consent
YouTube embed gating until External Media consent is granted
Scheduled monitoring and configuration drift detection
Audit runs with scored results, findings, history, and exportable reports
Evidence log with JSON, CSV, and PDF export
One-click remediation helpers for supported controls
Optional compliance packs (sold separately, not included in this plugin)
HIPAA, SOC 2, CCPA, WCAG, and other framework catalogs are not bundled in the WordPress.org plugin. Purchase a yearly subscription through Stripe Checkout at ncdLabs Assure, download the encrypted .assure-pack file from your order confirmation, then import it from ncdLabs Assure → Controls → Install framework pack with your unlock key. Packs are not required for GDPR, OWASP, or NIST CSF functionality.
Who this is for
WordPress admins responsible for privacy-related technical controls
Agencies operating client sites who need repeatable evidence and audit history
Teams preparing for GDPR-related technical reviews (not a substitute for legal advice)
External services
ncdLabs Assure connects to external services only in the cases below. Hostnames such as js.stripe.com, connect.facebook.net, googletagmanager.com, and youtube.com that appear in plugin source are local detection / verification signature strings used to recognize scripts already present on your site. The plugin does not load those third-party scripts, call those vendors’ APIs, or send visitor data to them.
Pack activation (ncdlabs.com) — When you import a purchased compliance pack, ncdLabs Assure sends your pack unlock key, framework identifier, and this site’s URL to the ncdLabs activation API to verify the Stripe purchase and bind the license to one site:
Endpoint: https://ncdlabs.com/products/assure/api/activate
Data sent: unlock key, framework ID, site URL
When: only when you preview or install an encrypted pack you purchased and downloaded from Stripe Checkout
Terms of use: https://ncdlabs.com/products/assure/terms/
Privacy policy: https://ncdlabs.com/privacy/; product: https://ncdlabs.com/products/assure/privacy/
Browser verification (ncdlabs.com, optional) — When you import a purchased compliance pack, ncdLabs Assure may call the ncdLabs provisioning API to enable hosted browser verification for consent and analytics checks. If configured, audit and discovery may also send scan targets to your configured browser verification service:
Provision endpoint: https://ncdlabs.com/products/assure/api/browser-verification/provision
Default service: https://browser-verify.ncdlabs.com
Data sent: pack unlock key, site URL (provision); scan target URL and verification token (when the hosted service is enabled)
When: pack import provisioning; during audits/discovery when hosted browser verification is enabled in Manage → Integrations
Security: verification endpoints must use HTTPS. Self-hosted endpoint domains must be explicitly allowed with the assure_browser_verification_allowed_hosts filter.
Terms of use: https://ncdlabs.com/products/assure/terms/
Privacy policy: https://ncdlabs.com/privacy/; product: https://ncdlabs.com/products/assure/privacy/
Google Analytics / Google Tag Manager OAuth (Google + ncdlabs.com, optional) — When an administrator connects Google Analytics or Google Tag Manager from Manage → Integrations, ncdLabs Assure may use Google OAuth plus the Google Analytics Admin API and/or Google Tag Manager API. If you have not configured your own Google OAuth client credentials, ncdLabs Assure uses an ncdLabs OAuth proxy:
Proxy endpoints: https://ncdlabs.com/products/assure/api/google/oauth/start and .../exchange
Google endpoints: accounts.google.com, oauth2.googleapis.com, www.googleapis.com, analyticsadmin.googleapis.com, tagmanager.googleapis.com
Data sent: OAuth state, authorization code, and Google Analytics account/property or Tag Manager account/container metadata needed to verify configuration
When: only when an administrator starts or completes a Google Analytics or Google Tag Manager connection
Terms of use: https://ncdlabs.com/products/assure/terms/; Google: https://policies.google.com/terms
Privacy policy: https://ncdlabs.com/privacy/; Google: https://policies.google.com/privacy
Third-party script detection signatures (no outbound calls) — During discovery, audits, and optional browser verification, ncdLabs Assure matches HTML, network requests, and installed plugins against known vendor hostname patterns (examples: Google Analytics/Tag Manager, Meta Pixel / connect.facebook.net, LinkedIn Insight, Hotjar, Microsoft Clarity, YouTube, Vimeo, HubSpot, Mailchimp, Brevo, Stripe / js.stripe.com). Examples also include CDN hostnames such as gstatic.com, cloudflare.com, unpkg.com, and cdnjs.cloudflare.com that appear only as local classification signatures in discovery code. Matching is local string comparison against content already on your site or observed in a verification scan of your site. ncdLabs Assure does not call these vendors, load their scripts, or transmit data to them.
Site self-scan (your own WordPress site) — During discovery and audits, ncdLabs Assure may request your site’s public homepage and REST API to detect scripts, embeds, forms, and integrations. These requests stay on your site; ncdLabs Assure does not send discovery results to ncdLabs.
Optional deactivation feedback (wp_mail) — When an administrator deactivates the plugin, an optional survey may appear. Feedback is never required: Skip & deactivate, Close, Escape, or Cancel leave without sending anything. If the administrator submits feedback, the selected reason and optional comments are emailed to ncdLabs ([email protected]) using this site’s WordPress mail. A separate checkbox (unchecked by default) can include plugin, WordPress, and PHP versions only — never the site URL or admin email. Mail/API failure still proceeds to deactivate.
Terms of use: https://ncdlabs.com/products/assure/terms/
Privacy policy: https://ncdlabs.com/privacy/; product: https://ncdlabs.com/products/assure/privacy/
No usage telemetry or analytics are sent to ncdLabs by the plugin.
Source code for built assets
Admin, front-end, and plugins.php deactivation-feedback JavaScript and CSS are built with @wordpress/scripts (package.json and webpack.config.js). Human-readable sources ship in the plugin under assets/src/. Production builds ship in build/.
Third-party libraries
Composer production dependencies are MIT-licensed and GPL-compatible:
chrome-php/chrome, chrome-php/wrench
evenement/evenement
monolog/monolog
psr/log
symfony/filesystem, symfony/process, symfony/polyfill-ctype, symfony/polyfill-mbstring, symfony/polyfill-php80
See each package’s LICENSE file under vendor/ for copyright notices.
