[WordPress] 外掛分享： Nivoli Edge: Login Security, WP Audit and Firewall

內容簡介

Nivoli Edge 是一款強化 WordPress 安全性的外掛，提供登入安全、網站審核及邊緣防火牆功能。它能有效防止攻擊，並在 Cloudflare 的邊緣層面上保護網站，確保即使管理後台被入侵，安全防護仍然有效。

【主要功能】
• 登入安全限制：每個地址每 10 分鐘最多 10 次嘗試
• 國家鎖定：限制特定國家登入 wp-login.php
• XML-RPC 阻擋：防止一次性猜測多個密碼
• 安全審核：19 項檢查網站暴露的資訊
• 邊緣防火牆：在 Cloudflare 邊緣層面阻擋攻擊
• 監控模式：查看防護措施將阻擋的內容

外掛標籤

開發者團隊

原文外掛簡介

Security one layer above WordPress. Audit what your site exposes, lock down logins, and stop attacks at Cloudflare’s edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on.
Login Security

Login rate limit: 10 attempts per 10 minutes per address, answered at the edge
Login country lock: wp-login.php only for the countries you list
wp-admin IP lock: only your addresses, with a self-lockout guard and email rescue
XML-RPC block: no guessing hundreds of passwords in one request
Hidden usernames: nothing to find at ?author=N or in the REST API
Code at login: every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves

WordPress Security Audit

Security check: 19 checks of what your site exposes, from inside WordPress and from its own front door
Hidden from itself: unlisted must-use plugins, administrators the Users screen does not show, suspicious login code
Hardening: 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable
Plain answers: every finding says what it means and how to fix it

Edge Firewall
Thirteen shields at Cloudflare’s edge: your server never runs PHP to turn an attack away.

Stray-PHP lock: every .php request except WordPress’s own entry points refused
Surface lock: user lists, readme.html, the installer and debug.log closed to visitors
Traversal guard: path tricks refused in any encoding
PHP parser guard: malformed or oversized uploads and other requests built to exploit PHP’s own request handling are refused before PHP reads them, and virtual patches for newly disclosed PHP flaws reach every site within minutes. It reduces exposure to flaws like PHP2Shell (October 2026) but does not replace updating PHP, and it only sees traffic that comes through Cloudflare, so your server should accept connections from Cloudflare only.
Scanner lockout: five refusals and the address is shut out for ten minutes
Flood limits: comment and search floods stopped per address
AI-crawler block and security headers on every response
Monitor mode: see what a shield would block before it blocks anything
Cloudflare’s managed WAF rulesets in front of every site on the edge

Protection that stays on after a takeover
A takeover of wp-admin owns every plugin’s settings. These are held at the edge.

Change lock: weakening protection waits for a click on a link mailed to you
Install lock: plugin and theme installs, updates and activations refused until you open a 15-minute window by email, whether they come from wp-admin or a remote-management key (UpdraftCentral, ManageWP, MainWP, Jetpack), and the wp-admin file editors closed. It cannot stop code already running on your server or files written to it directly
Origin lock: code changes that skip the edge are refused, so knowing your server’s address does not help
Activity log: every refused attempt on the Locks page, with what was tried and how it arrived

Speed and uptime

Edge page cache: full pages from Cloudflare’s network, with surgical purge so only the pages a change touches refresh
Origin Shield: your site keeps serving when your server is down
Right-sized images: WebP and AVIF through your own Cloudflare zone or the Managed Images add-on
Analytics without a tracking script: audience, attacks and top URLs from the edge

Free and with a plan
Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial.
Requirements

WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.
Image tools on your own zone: Cloudflare with Image Resizing (Images → Pipeline check verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.
Managed: an API key, plus the DNS records the setup pane shows.

External services
The free tier’s core image rewriting sends no data to any external service; it only rewrites URLs in your site’s HTML so browsers fetch through your own Cloudflare zone. Beyond that, the plugin contacts external services only for the specific, opt-in features listed below.
Nivoli managed edge (api at html-caching-admin.nivoli.workers.dev, dashboard at console.nivoli.com): used only if you enter an API key. On activation and on a daily background re-check it sends your API key, this site’s URL, the plugin version, and the list of broken-image file paths you have marked handled (so the monthly report can exclude them; these are addresses the CDN already sees in its own traffic) to validate the key and provision your managed CDN/page-cache tenant; it then reads back the aggregate usage statistics shown on the dashboard. When content changes it sends the cache tags of the affected pages, so only those pages are purged. After each security check it sends the titles of any findings the check marked exposed (no paths or values), so the monthly report can list them. The page cache, stats and purge endpoint lives under console.nivoli.com. When you look at a shield’s findings, it sends the IP address of your own browser (the administrator viewing the page) in a request header, so the edge can mark requests that came from you; that address is not stored. If you configure monthly reports or alerts, the recipient email address and optional report branding (a name and logo URL) are stored with your account. No data about your site’s visitors is ever sent. Terms: https://nivoli.com/terms · Privacy: https://nivoli.com/privacy
Cloudflare (api.cloudflare.com): used only if you configure the Cloudflare Enterprise page-cache backend with your own API token, to dispatch tag-based cache purges when your content changes. Terms: https://www.cloudflare.com/terms/ · Privacy: https://www.cloudflare.com/privacypolicy/
Fastly (api.fastly.com): used only if you configure the Fastly page-cache backend with your own API token, to dispatch surrogate-key purges on content change. Terms: https://www.fastly.com/terms/ · Privacy: https://www.fastly.com/privacy/
TinyPNG / Tinify (api.tinify.com): used only if you add your own Tinify API key and click “Shrink original” on an image, to compress that source file. Only the image you choose is sent. Terms & Privacy: https://tinify.com/terms

延伸相關外掛

NETSENSAI ShieldNETSENSAI Shield 是一款提供多項安全功能的外掛，旨在保護 W...CMS ADMINS Security Check ReportCMS ADMINS Security Check Report 外掛針對 WordPress 安裝...Lockora Security AuditLockora Security Audit 是一款幫助網站擁有者和代理商從管理...Security HardenerSecurity Hardener 是一款專注於提升 WordPress 安全性的外掛...SAR One Click Security有很多 WordPress 安全性外掛，有很多選項和頁面可以設置，如...BetterShield – Security Audit, 2FA, Passkeys & Login ProtectionBetterShield 是一款 WordPress 安全外掛，提供全面的安全審...Aipatch Security ScannerAipatch Security Scanner is a modular security audit engi...WP Guardian – Security Hardening Checklist & Lightweight FirewallWP Guardian 是一款簡單的 WordPress 外掛，提供實用的安全防...Secure HTTP HeadersSecure HTTP Headers 可自動分析網站並套用最佳安全 HTTP 標...Zen Site SecurityZen Site Security 外掛可安全地將您的 WordPress 網站遷移至...Dessky SecurityDessky Security 是一款超輕量的外掛，專為基本的安全加固設...EDZNET Security GuardEDZNET Security Guard stops the most common takeover tech...Bastora Security AuditBastora Security Audit 是一款專為 WordPress 設計的安全檢...Moatline Malware ScannerMoatline Malware Scanner 是一款專為清理被駭的 WordPress ...Wonderful Secure CleanupWonderful Secure Cleanup 是一款幫助您保持 WordPress 網站...