內容簡介
NeverLast Security Lite 是一款完整的獨立安全外掛，無需帳號或授權金鑰，提供多種安全功能以保護您的網站，確保不受常見攻擊威脅。
【主要功能】
• 防火牆：檢查 SQL 注入、XSS 等攻擊請求
• 上傳保護：拒絕可執行檔案及可疑上傳
• 登入安全：限制登入嘗試及鎖定功能
• 雙重驗證：提供 TOTP 驗證選項
• 健康檢查：提供優先級分數及建議
• 活動日誌：記錄活動並支持 CSV、JSON 匯出
外掛標籤
開發者團隊
原文外掛簡介
NeverLast Security Lite is a complete, standalone security plugin. It runs inside your site: no account, no licence key, no telemetry, and no feature locked behind an upgrade.
What it does
Firewall – inspects requests for common SQL injection, XSS, path traversal, file inclusion, command injection, Log4Shell and Shellshock shapes, in Monitor, Balanced or Strict mode.
Scanner trap – optional exact-path probes for missing configuration and plugin decoys. Monitor logs locally, Deceive serves inert text, and Block returns 404. No files are placed on disk.
Upload protection – rejects executable uploads, smuggled server-control files and images that carry code, and holds uploads it cannot fully inspect.
Login security – attempt limits and lockouts, generic login errors, author-enumeration and REST user protection, XML-RPC and Application Password controls.
Two-factor authentication – optional TOTP for administrators with encrypted secrets and one-use recovery codes.
Emergency controls – end every session or freeze logins, with an optional secret-protected emergency link in login alerts.
Health check – a prioritized score with plain-language recommendations.
Integrity monitoring – an approved local baseline of your files, resumable comparison for large sites, uploads review, and optional verification against WordPress.org checksums.
Quarantine you decide – a suspicious upload is held as an authenticated encrypted, non-executable copy until you download it as evidence or delete it. Nothing is deleted automatically.
Activity log – bounded retention, masked IP addresses, CSV and JSON export, and throttled email alerts.
Security headers – baseline browser headers and optional CSP Report-Only diagnostics.
What it does not do
Lite runs inside WordPress, so it cannot protect anything served before WordPress loads and it does not replace web-server, hosting, CDN or backup controls. It does not scan database content, it logs but does not block the creation of administrator accounts, and it never repairs files automatically. An integrity baseline shows what changed since you approved it; it does not prove the approved state was clean. Single-site installations only.
The optional scanner trap is off by default. It covers five exact, missing probe paths only after the request reaches WordPress. Existing files are never replaced, and authenticated or administrative requests are excluded. In Firewall Monitor mode, the trap also observes only. The ordinary firewall can still act on a suspicious request independently.
Lite and PRO
Lite is a standalone plugin; PRO is a separate product, not required to use any Lite feature. Both include a local firewall, login protection, administrator two-factor authentication, file-integrity monitoring, activity logs and an optional scanner trap. The scope differs:
Lite uses five exact, missing scanner-probe paths. Its local trap can observe, serve inert text or return 404; it does not score visitors or lock out an IP because of a trap hit.
PRO request protection adds custom WAF rules, virtual patches, request behavior contracts and broader scanner-trap correlation.
PRO investigation adds malware scanning, vulnerability intelligence, Safe Fuzzer diagnostics and Compatibility Autopilot.
PRO identity and recovery adds Identity Risk, Browser Integrity, Extreme Security Features and the independent Guardian integrity layer.
PRO feature availability and enforcement mode depend on the installed PRO release and its configuration. This comparison does not change Lite’s independent operation.
No security product can guarantee a site is free of vulnerabilities. Keep WordPress, PHP, plugins and themes updated, use least privilege, and keep tested off-site backups.
Support and security contact: [email protected]
External services
NeverLast Security Lite never sends site content, credentials, visitor records or telemetry, and never contacts NeverLast. Every connection to another service is off until you turn it on:
Official crawler IP lists – off by default
Only when you enable a provider under Protection, WP-Cron downloads its public IP list once a day so that provider’s genuine crawler is not counted against the optional anonymous rate limit. The request carries your server’s IP address and a plugin user agent that does not include your site’s address; nothing else is sent.
DuckDuckGo: https://duckduckgo.com/duckduckbot.json – privacy https://duckduckgo.com/privacy/
Ahrefs: https://api.ahrefs.com/v3/public/crawler-ip-ranges – terms https://ahrefs.com/legal/terms, privacy https://ahrefs.com/legal/privacy-policy
UptimeRobot: https://cdn.uptimerobot.com/api/IPv4andIPv6.txt – terms https://uptimerobot.com/terms/, privacy https://uptimerobot.com/privacy/
WordPress.org checksums – off by default
Only when you enable “Verify changed core and plugin files with WordPress.org checksums” under Protection, a comparison that finds changed, added or missing WordPress core or plugin files downloads the official checksums for that release, to tell a genuine update apart from tampering. Core checksums come from https://api.wordpress.org/core/checksums/1.0/ with the WordPress version and locale; plugin checksums come from https://downloads.wordpress.org/plugin-checksums/ with the plugin slug and version. Requests carry your server’s IP address and a plugin user agent without your site’s address, and results are cached for six hours. While this is off, files are compared with your approved baseline only. WordPress.org privacy policy: https://wordpress.org/about/privacy/
Your own site
The Directory listing health check requests your own uploads address to see whether the server returns a file index. Optional crawler verification uses your server’s DNS resolver; no verification API is contacted.
Privacy
Security events are stored in your WordPress database with a masked IP address, a salted one-way IP hash, the request method and path, and bounded redacted context. Passwords, cookies, authorization headers, nonces, secrets and recovery codes are never logged. The activity log keeps seven days by default. Email alerts use your site’s own mail configuration and go to the WordPress administration email unless you set another address. Throttled critical alerts are on by default; administrator-login alerts and the weekly summary are sent only when enabled.
A quarantined file is held under an access-restricted neverlast-security-lite/quarantine directory in your configured uploads folder with authenticated AES-256-GCM encryption and its original SHA-256. Apache/IIS access-control files are included; nginx and other web servers should still explicitly deny direct HTTP access. Decryption uses the WordPress authentication salts, so export retained evidence before rotating or replacing those salts. On upgrade, previous Base64 evidence is checked and re-encrypted when migrated from wp-content/.nlssl-quarantine; originals are kept if migration fails. Direct restoration of executable evidence is disabled; download it for offline analysis or permanently delete it. Evidence survives ordinary uninstall; enabling “Delete Lite data on uninstall” removes held data along with settings and tables.
