內容簡介
Nimble Security 是一款專為 WordPress 網站設計的安全防護外掛，提供全面的保護措施，從登入畫面到伺服器檔案，確保網站安全無虞，且所有數據均保留在本地伺服器上。
【主要功能】
• 防止暴力破解攻擊，提供二次驗證功能
• 檔案變更監控，確保核心檔案完整性
• 網路應用防火牆，支援多種模式
• 本地惡意程式掃描，無需上傳檔案
• 安全評分系統，評估網站安全狀態
外掛標籤
開發者團隊
原文外掛簡介
Nimble Security protects a WordPress site from the login screen down to the files on disk, and it does all of it on your own server.
There is no account to create, no cloud service to connect and no data leaving your site. The only outbound request the free version ever makes is to the official WordPress.org checksum API, and only when an integrity scan runs.
Everything listed below is in the free version. It is not a trial, nothing here is time-limited, and no engine is held back.
Stop attackers at the door
Brute-force lockouts with generic login errors, so an attacker cannot tell a wrong username from a wrong password.
Two-factor authentication with encrypted secrets, local QR enrolment, ten single-use recovery codes and replay protection.
Session control, Application Password auditing and revocation, and optional XML-RPC authentication protection.
Author-enumeration blocking.
Know when your files change
WordPress core verified against the official checksums.
SHA-256 baselines for plugins, themes, must-use plugins, drop-ins and selected configuration files.
Plugin and theme updates are recognised as maintenance, so a routine update does not turn into a false alarm.
Optional permission auditing reports paths writable by group or others and tightens them only when you ask. It never loosens a permission, never acts on its own and never touches anything outside the WordPress installation.
Block bad requests
A web application firewall with Protect, Learning and Off modes.
Rate limiting, plus correct client-IP handling behind a proxy or CDN.
Optional Smart 404 blocking, disabled by default.
Find and contain what got in
A local malware scanner that streams files in the background and resumes after a timeout. Nothing is uploaded for analysis.
An inventory of installed components, ready to be matched against advisory data.
Incidents, encrypted quarantine and restore, plugin component containment, privileged-session containment and Emergency Lockdown.
Know where you stand
Security Score rates your posture out of 100 across hardening, identity, integrity, firewall, malware detection, software updates and recovery readiness. An open high or critical incident caps the score, so a site with an active serious problem cannot display a healthy number.
What it deliberately does not do
Nimble Security does not upload your files, does not phone home, does not write executable code anywhere and does not replace backups. It protects, detects and responds; recovery comes from a backup. That is why recovery readiness counts towards the score, because remediation is far safer when a verified restore point exists.
External services
Nimble Security relies on exactly one external service, and on nothing else.
WordPress.org Core Checksums API
What it is: the official checksum service operated by WordPress.org at https://api.wordpress.org/core/checksums/1.0/. It returns the authoritative MD5 checksum set for a given WordPress release.
What it is used for: verifying that the WordPress core files on your server match the files that were published for your version. Without it, core integrity cannot be established, because the reference checksums only exist on WordPress.org.
What is sent, and when: the installed WordPress core version and the site locale, over HTTPS. Nothing else. The request is made only when a core integrity scan runs: manually when an administrator starts one, or on the daily schedule if an administrator has enabled automatic scans. Automatic scans are off by default. No request is made if integrity scanning is never used.
What is never sent: plugin or theme file contents, local file hashes, file paths, credentials, cookies, request bodies, user or customer data, security findings and quarantine payloads.
Terms of Service: https://wordpress.org/about/terms/
Privacy Policy: https://wordpress.org/about/privacy/
Nimble Security does not contact NimblePlugins, sends no telemetry and has no account, licence or activation requirement of any kind.
Privacy
Security events are minimized. Raw request bodies, cookies and credentials are not stored by the event engine, and network actors are represented with keyed hashes rather than raw IP addresses in Security events.
TOTP secrets are encrypted at rest and recovery codes are stored as one-way hashes in WordPress user metadata. Authentication secrets are never included in the WordPress personal-data export. The privacy eraser anonymizes Security event references and removes the per-user appearance preference; active 2FA material is retained while the account remains active because it is required for authentication.
Quarantine payloads stay local and are encrypted with AES-256-GCM. Operations receives aggregate technical status only, not file contents, raw IP addresses, credentials, request bodies or quarantine data.
