內容簡介
Open24 Security 是一款針對 WordPress 和 WooCommerce 網站的安全性外掛，提供多項強化措施，讓使用者能夠輕鬆管理安全設定。所有選項預設為關閉，使用者可根據需求逐一啟用，確保網站安全。
【主要功能】
• 隱藏 REST API 使用者端點
• 自訂登入網址，限制登入嘗試
• 禁用 XML-RPC 和 wp-cron.php 外部存取
• 隱藏 WordPress 版本資訊
• 拒絕匿名請求至 WooCommerce REST 路徑
• 登出所有使用者，旋轉安全金鑰
外掛標籤
開發者團隊
原文外掛簡介
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.
Features
WordPress REST API
Hide the /wp-json/wp/v2/users endpoint
Require authentication on sensitive endpoints
Disable the /wp-json/ index
Login
Custom login URL (replace wp-login.php with your own slug)
Limit login attempts per IP address
Block common usernames such as admin or root
Hide error hints that reveal whether a username exists
Protocols
Disable XML-RPC
Block external access to wp-cron.php
Block user enumeration via ?author=N
Information disclosure
Hide the WordPress version from the generator meta tag and RSS feeds
HTTP security headers
X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Permissions-Policy, X-XSS-Protection
Optional HSTS
WooCommerce
Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
Hide WooCommerce headers on the storefront
Tools
Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
Change log: records which settings were changed and when.
Agency signature
Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.
About the security keys feature
Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.
If wp-config.php is not writable, the feature reports it and makes no changes.
