內容簡介
<!DOCTYPE html>
<html>
<body>
<h2>WordPress 外掛介紹</h2>
<p>WordPress 原始設定允許無限次登入嘗試。這給了攻擊者重複嘗試破解密碼的機會。這種攻擊稱為暴力攻擊，而 Protect Login 通過在一系列連續失敗嘗試後減緩登入速度來減輕這種情況。</p>
<p>但我們的努力並沒有止於此。我們也在努力提高您的 WordPress 密碼的安全性。目前，我們通過允許您強制實施一個密碼策略，確保您的用戶不使用弱密碼。</p>
<h3>問答</h3>
<ul>
<li>問：什麼是 Protect Login 的功能？</li>
<li>答：Protect Login 通過在連續失敗嘗試後減緩登入速度，減輕暴力攻擊。</li>
<li>問：Protect Login 還有哪些安全功能？</li>
<li>答：除了減緩登入速度，我們還提供密碼策略功能，確保用戶不使用弱密碼。</li>
</ul>
</body>
</html>
外掛標籤
開發者團隊
原文外掛簡介
Out of the box, WordPress will happily let anyone try to log in as often as they like. Type the wrong password a thousand times and it just shrugs and shows you the form again – which is exactly what someone running a brute-force script is counting on. Protect Login closes that door. It started life as a fork of Johan Eenfeldt‘s original Limit Login Attempts, a plugin a lot of us leaned on for years, and grew from there.
It slows brute-force attacks to a crawl
Protect Login watches failed logins per IP address. After a handful of wrong attempts that visitor has to wait before trying again, and if they keep guessing the wait grows. So a script built to try thousands of passwords ends up sitting on its hands.
You decide who gets in, and who doesn’t
Protect Login keeps a visible list of every address that’s currently locked out, right in the settings, and lets you release any of them with a single click. You can also keep an allowlist of addresses that skip the checks entirely (your office, your VPN’s exit node) and a blocklist of addresses that are turned away immediately.
One login list, shared across all your sites
If you look after more than one WordPress site – an agency, or just a small pile of your own projects — someone hammering one of them is often about to try the rest. Protect Login can link your sites together over its own Remote API: pick one site as the host, point the others at it with a URL and a key, and the block-, allow- and lockout-lists stay in sync across the lot. Block an address once and it’s blocked everywhere.
And a few more things
Gets the real client IP right when your site sits behind a reverse proxy or CDN — direct and proxy modes
Speaks IPv6, not only IPv4
Works on Multisite, applying settings and lists across the network.
Ships WP-CLI commands, so you can manage addresses and settings straight from the terminal.
Lets developers set everything in code via filters — and locks the matching field in the UI, so nobody ends up fighting their own filter.
Can enforce a minimum password strength for new passwords
