內容簡介
PB4Host Security 是一款針對 WordPress 設計的企業級全方位安全與保護套件，旨在保護網站免受網路威脅、暴力破解攻擊、惡意載荷和後門的侵害，並對網站性能影響最小。
【主要功能】
• 高效能的網路應用防火牆（WAF）
• 主動的惡意程式與啟發式掃描器
• 原生雙重身份驗證（2FA/TOTP）
• 智能暴力破解登入防禦
• 全面的系統強化功能
• 隱私優先架構，無外部追蹤
外掛標籤
開發者團隊
原文外掛簡介
PB4Host Security is an enterprise-grade, all-in-one Security & Protection suite engineered specifically for WordPress. Built to safeguard your website from cyber threats, brute force attacks, malicious payloads, and backdoors with minimal performance impact.
Featuring an early Web Application Firewall (WAF), active heuristic malware scanner, native Two-Factor Authentication (2FA/TOTP), intelligent brute-force lockout defense, system hardening, and zero-day virtual patching.
Key Highlights:
* High-Performance Web Application Firewall (WAF) running at early priority before plugins execute.
* Active Malware & Heuristic Scanner with quarantined vault isolation and 1-click restoration.
* Native Two-Factor Authentication (2FA / TOTP) compatible with Google Authenticator, Authy, and Microsoft Authenticator.
* Intelligent Brute-Force Login Defense with honeypot traps and custom login slugs.
* Comprehensive System Hardening (XML-RPC disabler, user enumeration guard, uploads PHP execution blocker).
* Privacy-first architecture: Threat intelligence feeds, disposable email lists, and trackback verification run 100% offline with zero external tracking.
Features
🛡️ Complete Enterprise Security Engines:
Web Application Firewall (WAF):
Early Packet Inspection: Runs before theme and plugin execution to intercept malicious requests.
Deep Threat Detection: Protects against SQL Injection (SQLi), Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Remote Code Execution (RCE).
Scanner & Bot Defense: Blocks automated vulnerability scanners (sqlmap, nikto, wpscan, nmap).
Rate Limiting & IP Set: Protects against velocity surges and supports full CIDR IP white/blacklisting.
Active Malware & File Integrity Scanner:
Heuristic Signature Engine: Detects webshells, obfuscated base64 execution, and dynamic backdoors.
Uploads Directory Guard: Flags and prevents executable scripts inside uploads directories.
Quarantine Vault: Safely isolates infected files with 1-click restore and permanent delete options.
Login Security & Brute-Force Defense:
Intelligent IP Lockout: Automatically locks out IP addresses exceeding maximum failed login attempts.
Honeypot Traps: Immediate lockout upon login attempts with reserved usernames (admin, root).
Custom Login Slug: Conceals wp-login.php behind a custom URL with 403 Forbidden on direct requests.
Masked Errors: Neutralizes login hints to prevent username enumeration.
Native Two-Factor Authentication (2FA / TOTP):
RFC 6238 Standard: Fully compatible with Google Authenticator, Authy, Microsoft Authenticator, and 1Password.
Offline & Privacy-First: Zero external tracking or third-party API dependencies.
Role Enforcement & Backup Codes: Enforce mandatory 2FA on admin/editor roles, with emergency recovery codes.
WordPress & System Hardening:
Surface Reduction: Disables XML-RPC and unauthenticated REST API user enumeration.
File Protection: Disables administrative file editing and secures uploads folder via .htaccess.
HTTP Security Headers: Enforces X-Frame-Options, X-Content-Type-Options: nosniff, and Referrer-Policy.
Live Security Audit Log:
Real-time stream of security events: WAF blocks, failed logins, lockouts, 2FA, and file changes.
Filterable by severity with automated 30-day log rotation and 1-click CSV export.
Frictionless Bot Defense (Turnstile & reCAPTCHA):
Protects login, registration, lost password, and comment forms against automated abuse.
Fail-open network resilience prevents user lockouts during upstream API hiccups.
Known CVE Vulnerability Scanner:
Audits core, plugins, and themes against known CVE vulnerabilities and CVSS scores.
1-click direct update links to patch vulnerable extensions quickly.
Compromised Password Checking & Password Policy:
Optional HaveIBeenPwned check using privacy-preserving k-anonymity (5-char SHA-1 prefix only).
Enforces configurable password strength, mixed case, and personal data restrictions.
GeoIP & Country Access Control:
Granular country allowlisting and denylisting for the whole site or login screens.
Uses fast edge server headers (Cloudflare CF-IPCountry) or cached fallback lookups.
User Session Manager:
Real-time visibility into all active user sessions and device fingerprints.
Enforces idle auto-logout and concurrent session caps with 1-click remote session revocation.
Curated Threat Intelligence & IP Set:
Bundled local threat intelligence and suspicious IP rules block bad actors before execution.
100% offline local processing ensures zero external latency or privacy leaks.
Official WordPress.org Checksum Verifier:
Verifies core and plugin files against official WordPress.org cryptographic hashes.
Detects rogue or extraneous files within core directories.
File Integrity Monitoring (FIM):
Takes cryptographic SHA-256 baselines of site files and detects additions, alterations, or deletions.
Smart exclusion filters ignore cache files and media uploads.
Targeted Virtual Patching (vPatch):
Intercepts critical exploit vectors for known high-impact WordPress vulnerabilities before plugin code runs.
Proactive micro-rules protect sites even before vendor security updates are installed.
Real-Time Multi-Channel Security Alerts:
Dispatches instant security incident notifications via Slack, Discord, Email, or SIEM webhooks.
Anti-flood rate limiting prevents alert fatigue while ensuring critical alerts pass through.
Security Fleet Profile Export & Import:
Standardize security policies across client and staging sites using portable JSON profiles.
Automatic pre-import rollback snapshots protect against configuration errors.
Database Security Hardening & Hygiene:
Audits user accounts for rogue administrators and disposable email domains.
Scans database tables for obfuscated payloads, script injections, and unhygienic transient overhead.
Shortcodes
[pb4host_security_2fa_status] – Optional shortcode to display current 2FA activation status to logged-in users.
WP-CLI Commands
wp pb4host-security scan [--scope=
wp pb4host-security waf-status [--mode=
wp pb4host-security block-ip
wp pb4host-security unblock-ip
wp pb4host-security lockouts [--clear] – List or clear active login lockouts.
wp pb4host-security audit-log [--limit=20] [--event=
wp pb4host-security vuln-scan [--format=
wp pb4host-security sessions
wp pb4host-security checksums
wp pb4host-security fim
wp pb4host-security vpatch
wp pb4host-security alerts
wp pb4host-security config
wp pb4host-security db
External Services
PB4Host Security may optionally connect to third-party external services only when explicitly enabled and configured by the website administrator. Under WordPress.org Privacy Guidelines 7 & 9, all remote service calls are strictly optional, turned OFF by default, and never phone home without explicit administrator opt-in consent:
Offline Privacy Notice:
The Community Threat Intelligence IP list, Disposable Email Domain blocker, and Pingback/Trackback verification operate 100% offline using locally bundled curated databases. They make zero external HTTP requests, phone home to no remote servers, and transmit no data whatsoever.
WPVulnerability API
Service URL: https://www.wpvulnerability.net
Purpose: Checks installed WordPress core, plugins, and themes against known CVE security advisories and CVSS vulnerability scores.
What Data is Sent and When: Transmits only plugin and theme directory slugs and installed version numbers (e.g. plugin/woocommerce, 9.0.0). No site URLs, visitor data, IP addresses, or personal information are ever transmitted.
Opt-In Requirement: 100% optional and disabled by default (vuln_scanner_remote_api = 0). Only executes when an administrator explicitly opts in via settings or manually triggers a vulnerability scan.
Terms of Service: https://www.wpvulnerability.com/license/
Legal Notice: https://www.robotstxt.es/legal/
Privacy Policy: https://www.wpvulnerability.com/privacy/
Country.is Geolocation API
Service URL: https://api.country.is
Purpose: Resolves client IP addresses to 2-letter ISO country codes for GeoIP and country-based firewall blocking when native web server / reverse-proxy headers (such as Cloudflare CF-IPCountry, Cloudfront, or Fastly) are unavailable.
What Data is Sent and When: Transmits the client IP address to resolve country code. Results are cached locally in WordPress transients for 7 days to eliminate redundant lookups.
Opt-In Requirement: 100% optional and disabled by default (geoip_enabled = 0). Only queries Country.is if the administrator enables GeoIP blocking in settings.
Terms of Service & Privacy Policy: https://country.is/
Cloudflare Turnstile
Service URL: https://challenges.cloudflare.com
Purpose: Frictionless bot mitigation and human verification for login, registration, lost password, and comment forms.
What Data is Sent and When: Client IP address, browser User-Agent, and the client-side challenge token are sent to Cloudflare during form submission for cryptographic token verification.
Opt-In Requirement: 100% optional and disabled by default. Requires the site administrator to obtain and configure Turnstile API Site Key and Secret Key.
Terms of Service: https://www.cloudflare.com/terms/
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Google reCAPTCHA (v2 / v3)
Service URL: https://www.google.com/recaptcha/api/siteverify
Purpose: Bot defense and human verification on public forms.
What Data is Sent and When: Client IP address, browser User-Agent, and response token are transmitted to Google upon form submission for verification.
Opt-In Requirement: 100% optional and disabled by default. Requires the site administrator to configure reCAPTCHA Site Key and Secret Key.
Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy
HaveIBeenPwned API (Troy Hunt)
Service URL: https://haveibeenpwned.com
Purpose: Checking candidate passwords during user registration or password reset against known breached credential dumps.
What Data is Sent and When: Utilizes a privacy-preserving k-Anonymity mathematical model. Transmits ONLY the first 5 characters of the SHA-1 hash of the candidate password. Raw passwords, usernames, site URLs, and user accounts are never sent over the network.
Opt-In Requirement: 100% optional and disabled by default (pw_check_hibp = 0). Only executed if an administrator explicitly enables “Check candidate passwords against HaveIBeenPwned” in Login Security settings.
Terms of Service: https://haveibeenpwned.com/API/v3#AcceptableUse
Privacy Policy: https://haveibeenpwned.com/Privacy
WordPress.org Checksums & SVN API
Service URL: https://api.wordpress.org/core/checksums/1.0/
Purpose: Compares local WordPress core and repository plugin files against official cryptographic hashes published by WordPress.org to detect altered files or backdoors.
What Data is Sent and When: WordPress core version and installed plugin slugs/versions. Runs only when an administrator manually triggers core or plugin checksum verification.
Privacy Policy: https://wordpress.org/about/privacy/
External Notification Webhooks (Slack, Discord, Custom SIEM)
Service URL: Configured by administrator (e.g., https://hooks.slack.com, https://discord.com, or custom SIEM HTTPS endpoint).
Purpose: Dispatches real-time security incident alerts to the administrator’s chosen notification channel.
What Data is Sent and When: Incident event title, severity level, timestamp, site URL, and incident description. Runs only when configured and enabled by the site administrator.
