內容簡介
Nexura Security 是一款全方位的免費 WordPress 安全外掛，旨在保護網站免受惡意軟體、駭客攻擊及暴力破解等威脅，提供企業級的網路防護，且不影響網站效能。
【主要功能】
• 完整的惡意軟體掃描器與防火牆
• 專屬的再感染防護與根本原因分析器
• 智能微批次技術，減少伺服器負擔
• 一鍵即時鎖定功能，快速保護網站
• 零資料庫膨脹，優化日誌保留與自動清理
外掛標籤
開發者團隊
② 後台搜尋「Nexura Security — Malware Scanner, Firewall, 2FA & WordPress Security」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
Nexura Security is the ultimate, all-in-one free WordPress security plugin engineered to protect your website from malware, hackers, brute-force attacks, and recurring infections — 100% free, forever.
Whether you run an eCommerce WooCommerce store, business site, blog, or agency network, Nexura Security delivers enterprise-grade cyber defense with zero performance bloat, no database clutter, and no paywalls on essential security features.
⚡ Why Nexura Security is the #1 Free Alternative to Wordfence & Sucuri
Most WordPress security plugins slow down your server, fill your database with millions of log rows, and lock their best features behind expensive subscriptions. Nexura Security is built differently:
100% Free Core Engine — Complete malware scanner, firewall, 2FA, brute-force defense, and reinfection root-cause analyzer included at zero cost.
Stop Malware from Returning (Reinfection Guard) — The only free WordPress security plugin with a dedicated persistence analyzer to find and destroy hidden backdoors that regenerate malware.
Engineered for Speed & Low Server Load — Smart micro-batching technology processes scans smoothly in the background without CPU spikes or slowing down your visitors.
Zero Database Bloat — Optimized log retention and automated cleanup prevent your database from ballooning in size.
One-Click Instant Lockdown — Protect your website in under 60 seconds with no complex configuration required.
🛡️ 100% Free Features (Everything Included at Zero Cost)
Every website deserves enterprise-grade protection. Here is what you get in the free version of Nexura Security:
🛡️ Reinfection Guard & Root Cause Analyzer (NEW)
Tired of cleaning malware only for it to return hours or days later? Nexura’s revolutionary Reinfection Guard scans all persistence vectors used by sophisticated hackers to automatically regenerate malware:
* Hidden MU-Plugins: Uncovers hidden Must-Use scripts planted to reinstall backdoors.
* Rogue Drop-ins: Inspects advanced-cache.php, db.php, and object-cache.php for malicious hijackers.
* Uploads Directory PHP Execution: Detects and flags unauthorized executable PHP scripts hidden inside media folders.
* Malicious WP-Cron Persistence: Dynamically inspects scheduled cron tasks and callbacks to identify hidden persistence triggers.
* Database Options Injections: Scans wp_options for base64 payloads, rogue admin creation scripts, and cron injection strings.
* Configuration File Tampering: Audits .htaccess, .user.ini, and wp-config.php for unauthorized directives, auto-prepend injections, or malicious redirects.
* Interactive Attack Vector Graph: Visualizes how malware connects across your filesystem and database so you can eliminate it at the root.
🔍 Deep WordPress Malware Scanner & Cleaner
* Scans all core files, plugins, themes, and uploads for backdoors, web shells (WSO, B374k), trojans, eval-base64 obfuscation, phishing scripts, and spam injectors (Balada Injector, Sign1, ClearFake, WP-VCD).
* Displays severity ratings (Critical, High, Medium, Low) with exact file locations and single-click cleanup.
* Lightweight micro-batch scanner prevents PHP timeouts and server crashes on shared hosting.
🔥 Web Application Firewall (WAF)
* Intercepts and blocks OWASP Top 10 web vulnerabilities before WordPress boots, including SQL Injection (SQLi), Cross-Site Scripting (XSS), Remote File Inclusion (RFI), and Local File Inclusion (LFI).
* Loads via auto_prepend_file for early-stage protection before malicious requests can touch your database.
* Features automatic attack signature updates to protect against zero-day exploits.
🔐 Two-Factor Authentication (2FA) & Login Security
* Protect your administrator and user accounts with standard RFC 6238 TOTP Two-Factor Authentication.
* Works seamlessly with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and any TOTP app.
* Includes a full-screen QR code onboarding wizard and emergency backup recovery codes.
🔗 Passwordless Magic Link Login
* Log in securely with a one-time, time-limited magic link sent directly to your verified email address.
* Eliminates the risk of password theft, keystroke loggers, and credential stuffing attacks entirely.
🚫 Brute-Force Attack Protection & IP Lockout
* Stops automated botnets and password-guessing attacks with intelligent IP lockout.
* Customizable failed login thresholds, lockout durations, and IP whitelisting/blacklisting.
* Real-time blocked IP table with geolocation country flags.
🔑 Pwned Password Checker (HaveIBeenPwned Integration)
* Checks user passwords against billions of leaked credentials using the secure mathematical k-Anonymity model.
* Your real password is never transmitted across the internet. Alerts users instantly if their password is compromised.
📂 WordPress Core File Integrity Monitor
* Continuously verifies your WordPress core files against official, clean checksums from WordPress.org.
* Instantly alerts you if critical files like wp-login.php, wp-config.php, or index.php have been tampered with or modified by attackers.
📁 Root Directory File Integrity Checker
* Detects unfamiliar and rogue PHP files dropped into your WordPress root directory — the primary location hackers use to plant web shells and stealth scripts.
🤖 Anti-Spam CAPTCHA & Bot Defense
* Block automated spam bots on login pages, user registration, lost password, and comment forms.
* Native integration with privacy-first Cloudflare Turnstile and Google reCAPTCHA v2/v3.
🚑 Fatal Error Auto-Heal (White Screen of Death Protection)
* Uses WordPress drop-in technology (wp-content/fatal-error-handler.php) to catch fatal PHP errors before your site goes down.
* Automatically detects crashing plugins or themes, safely isolates them, and prevents the dreaded “White Screen of Death” (WSOD).
🗄️ Database Security Scanner & One-Click Backup
* Scans database tables (wp_options, wp_users, wp_posts) for rogue admin users, SEO spam keywords, and malicious scripts.
* Includes a built-in one-click database backup tool so you can create a safe restore point before cleaning malware.
📊 Real-Time File Upload Scanner
* Automatically checks all media uploads, plugins, and theme ZIP files for malicious code before they are saved to your server.
🔍 Google Safe Browsing & Blacklist Monitor
* Check if your website has been flagged by Google as “Deceptive site ahead” or “Site contains harmful programs”.
* Monitor your domain reputation directly from your WordPress dashboard.
🛠️ One-Click Security Hardening
* Apply WordPress hardening standards instantly:
* Disable the built-in WordPress theme/plugin file editor.
* Block PHP execution in the /wp-content/uploads/ directory.
* Disable open directory browsing.
* Block XML-RPC pingback and brute-force vectors.
* Block REST API username enumeration (/wp-json/wp/v2/users).
⚠️ Automated Security Alert Emails
* Receive beautifully formatted HTML security alerts when malware or unauthorized file changes are detected.
* Built-in Anti-Email-Storm protection and hourly rate limiting prevents inbox spam during bot attacks.
🌟 Pro Features — Advanced Protection & Automation
Nexura Security Pro extends the free version with powerful automation, advanced scanning, and robust protection:
Tokenizer-Based Smart Scanner — Uses PHP’s token_get_all() AST engine to detect zero-day backdoors and polymorphic malware that regex-based scanners miss entirely.
Automated Malware Cleanup — One-click automated removal of detected malware without needing developer access.
WordPress Core Auto-Restore — Downloads clean copies of modified core files from WordPress.org and replaces them using atomic, crash-safe file writes.
File Quarantine System — Moves suspicious files to an isolated, execution-blocked quarantine zone where they cannot cause harm while you review them.
Custom Login URL (Hide wp-admin) — Rename wp-login.php and wp-admin to a secret URL, which helps reduce automated brute-force traffic before they even reach your login page.
HTTP Security Headers — Add Content-Security-Policy (CSP), HSTS, X-Frame-Options, Permissions-Policy, Referrer-Policy, and more. Includes Recommended, Strict, and Custom presets.
REST API Security — Block unauthenticated REST API access and prevent username enumeration via /wp-json/wp/v2/users.
Enterprise WooCommerce Security Mode — Comprehensive eCommerce protection including Fake Customer Registration Honeypot, Cart/Coupon Abuse Protection, Checkout Card Testing limits, and REST/AJAX limits, with payment gateway webhook whitelisting.
Vulnerability Audit — Automatically detects plugins, themes, and WordPress core versions with known CVEs (Common Vulnerabilities and Exposures).
Database Optimizer — Removes post revisions, expired transients, orphaned metadata, and spam comments to improve database performance.
Storage Cleanup Scanner — Safely identifies unused images, PDFs, and orphaned upload files to reclaim disk space.
Plugin Conflict Cleaner — Detects and safely removes database leftovers from conflicting or previously deleted security plugins.
Security Trust Badge — Display a dynamic “Protected by Nexura Security” seal on your website to build visitor confidence.
📡 Active Visitor Monitoring — Real-time visitor tracking dashboard with live stats, 4 interactive charts (Traffic Trend, Browser, Device, OS), auto-refreshing visitor table, and intelligent bot detection.
📌 Visitor Stats Shortcodes — 5 shortcodes ([nexura_visitors], [nexura_stats], [nexura_live], [nexura_popular], [nexura_page_views]) to display live security and visitor stats anywhere on your site.
Scheduled Automatic Scans — Set malware scans to run every 2 hours, daily, weekly, or monthly — fully automatic, no manual action required.
Advanced Audit Logs — A complete, tamper-evident log of every security event, user login, file change, settings modification, and admin action.
Priority Support — Direct access to the Nexura Security expert team for fast, personalized help.
Upgrade to Nexura Security Pro →
🔗 Third-Party Services & External API Connections
To provide comprehensive security, Nexura Security connects to several trusted third-party services. All connections are opt-in — nothing is sent automatically without your explicit action. Here is a complete and transparent list:
1. Cloudflare Turnstile
Used for: Privacy-friendly CAPTCHA on login, registration, and comment forms to stop spam bots.
Data sent: Browser fingerprint and interaction data (processed by Cloudflare, never stored by us).
When: Only when you enable Turnstile in the Anti-Spam settings.
Links: Cloudflare Privacy Policy | Cloudflare Terms
2. Google reCAPTCHA
Used for: Alternative CAPTCHA option for login and registration pages.
Data sent: Browser data and interaction signals (processed by Google).
When: Only when you enable Google reCAPTCHA in the Anti-Spam settings.
Links: Google Privacy Policy | Google Terms
3. HaveIBeenPwned API (Pwned Passwords)
Used for: Checking whether a user’s password has appeared in known data breaches.
Data sent: Only the first 5 characters of a SHA-1 hash of the password (k-Anonymity model). Your actual password is NEVER sent.
When: Only when a user sets or changes their password and the feature is enabled.
Links: HaveIBeenPwned Privacy Policy | API Terms
4. Google Safe Browsing API
Used for: Checking whether your website has been flagged by Google as containing malware or phishing.
Data sent: Your website’s URL.
When: Only when you manually trigger a Safe Browsing check from the dashboard.
Links: Google Privacy Policy | Safe Browsing Terms
5. VirusTotal API
Used for: Scanning file hashes against 70+ antivirus engines to detect malware.
Data sent: Only the SHA-256 cryptographic hash of the file. The actual file is NEVER uploaded.
When: Only during a manual malware scan when unknown files are detected and the feature is enabled.
Links: VirusTotal Privacy Policy | VirusTotal Terms
6. Nexura Threat Intel Cloud
Used for: Syncing the latest WAF rules, malicious IP blocklists, and malware detection signatures.
Data sent: Blocked attacker IP addresses and blocked payload patterns (anonymized). No personal user data is ever collected.
When: Only when Global Threat Intelligence is enabled in settings.
Links: Nexura Privacy Policy | Nexura Terms
7. WordPress.org API
Used for: Downloading official WordPress core file checksums for integrity scanning and official WordPress ZIP files for the Core Auto-Restore feature.
Data sent: Your WordPress version number.
When: During core file integrity checks or when Core Auto-Restore is triggered.
Links: WordPress Privacy Policy
8. FlagCDN (flagpedia.net)
Used for: Displaying country flags next to IP addresses in the Blocked IPs table.
Data sent: Country code (derived from IP). No personal data is sent.
When: Only when viewing the Blocked IPs admin page.
Links: FlagCDN Privacy Policy | FlagCDN Terms
9. Nexura GeoIP Service
Used for: Identifying the country of origin for blocked attacker IP addresses, and (in Pro) displaying real-time visitor locations on the live traffic dashboard.
Data sent: IP addresses (attacker IPs in the Free version; visitor IPs in the Pro version only if the Live Traffic GeoIP feature is explicitly enabled).
When: When viewing the Blocked IPs page or the Active Visitor Dashboard.
Retention: IPs are processed in memory at the edge and instantly discarded. Zero data retention. No tracking or profiling occurs.
Links: Nexura Privacy Policy
10. External AI Services (Pro Only)
Used for: Analyzing potentially malicious files and auto-generating cleaned code via AI (OpenAI, Anthropic, Google Gemini, or Cloudflare AI).
Data sent: When AI analysis is enabled, selected/redacted file content and site URL may be sent to the selected AI provider.
When: Only when you explicitly configure an AI provider and click “Fix with AI” during a malware scan.
Retention: Depends on your chosen AI provider and your API key configuration (enterprise API endpoints typically do not train on user data).
Links: OpenAI Privacy | Anthropic Privacy | Google Privacy | Cloudflare Privacy
📜 Privacy Policy
What We Collect:
Nexura Security does NOT collect any personal data from your website visitors. We do not track users, sell data, or place tracking cookies.
What We May Report:
When the WAF blocks a malicious attack, the attacker’s IP and the blocked payload pattern may be anonymously reported to the Nexura Threat Intel Cloud to help protect other WordPress sites. You can disable this at any time in Settings → Global Threat Intelligence.
Your Data, Your Control:
All scan results, logs, and settings are stored locally in your own WordPress database. Nothing is sent to any external server unless you explicitly enable a cloud feature.
Privacy Standards:
We are committed to respecting user privacy and designing our features with data protection in mind.
Full Policy: Privacy Policy | Terms & Conditions
Changelog (Full)
For a full structured changelog, see CHANGELOG.md on GitHub.
