內容簡介
Open24 Security 是一款專為 WordPress 和 WooCommerce 網站設計的安全外掛，提供一系列知名的強化措施，讓使用者能夠從單一設定畫面輕鬆管理安全性選項，並可根據需求選擇啟用或停用各項功能。
【主要功能】
• 隱藏 REST API 的敏感端點
• 自訂登入 URL 並限制登入嘗試次數
• 隱藏 WordPress 版本資訊
• 阻止匿名請求至 WooCommerce REST 路徑
• 登出所有使用者並旋轉安全金鑰
• 代理簽名功能以識別維護機構
外掛標籤
開發者團隊
原文外掛簡介
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.
Features
WordPress REST API
Hide the /wp-json/wp/v2/users endpoint
Require authentication on sensitive endpoints
Disable the /wp-json/ index
Login
Custom login URL (replace wp-login.php with your own slug)
Limit login attempts per IP address
Block common usernames such as admin or root
Hide error hints that reveal whether a username exists
Protocols
Disable XML-RPC
Block external access to wp-cron.php
Block user enumeration via ?author=N
Information disclosure
Hide the WordPress version from the generator meta tag, asset query strings and RSS feeds
HTTP security headers
X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Permissions-Policy, X-XSS-Protection
Optional HSTS
WooCommerce
Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
Hide WooCommerce headers on the storefront
Tools
Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
Change log: records which settings were changed and when.
Agency signature
Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.
About the security keys feature
Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.
If wp-config.php is not writable, the feature reports it and makes no changes.
