內容簡介
Qevix Shield 是一款完整的 WordPress 安全外掛，專注於保護網站的登入表單、XML-RPC、檔案存取及潛在洩漏資訊的 URL。它能有效阻擋暴力破解攻擊，提供雙重驗證及 reCAPTCHA，並進行惡意程式掃描，所有阻擋的行為都會記錄在可搜尋的活動日誌中。
【主要功能】
• 阻擋暴力破解攻擊
• 提供雙重驗證及 reCAPTCHA
• 進行惡意程式掃描
• 記錄可搜尋的活動日誌
• 不影響網站性能
• 免費使用，無需帳號或授權金鑰
外掛標籤
開發者團隊
原文外掛簡介
Qevix Shield is a complete WordPress security plugin for the parts of the site attackers hit first — the login form, XML-RPC, file access, and the URLs that leak information about your install. It stops brute force attacks, adds two-factor authentication and reCAPTCHA, scans for malware, and writes everything it blocks to a searchable activity log that can email you the moment something matters.
It installs neutral: activating it changes nothing about your site. Every protection stays off until you switch it on, so you enable them one at a time and see the effect of each — no surprises, no lockouts on activation. (The audit log runs from the start; that is monitoring only.)
Why Qevix Shield
Turning it on breaks nothing. Every protection ships off. Enable them one at a time and watch what each does.
You can’t lock yourself out. A one-line safe mode in wp-config.php suspends everything without touching your settings. reCAPTCHA keys must pass a live test before they can be enabled, 2FA has recovery codes plus an admin reset, and lockouts are temporary.
One plugin, the whole checklist. Hide login URL, brute force lockouts, 2FA, reCAPTCHA, password rules, XML-RPC control, malware scanning, file and server hardening, a firewall, and an audit log — instead of five single-purpose plugins.
You hear about it. Every block, login, and admin action lands in a live, searchable log you can export to CSV. Critical events email you as one grouped summary — an attack wave is one message, not fifty.
No measurable slowdown. With everything enabled, response times match the deactivated site within measurement noise. Nothing waits on an external service.
It leaves your other plugins alone. No patching or overriding another plugin’s code — WooCommerce, membership, and front-end login pages keep working, even with the hidden login URL on.
Everything here is free. No account, no license key, no trial, no feature that expires, no greyed-out controls. The optional Pro add-on only adds capabilities of its own on top — it never unlocks something already in this plugin.
Login protection
Hide the login page: move it off /wp-login.php to a custom login URL of your choosing (off by default).
Choose what a blocked request sees: a 404, your homepage, or a custom redirect.
A honeypot field catches basic bots without affecting real visitors.
Limit login attempts: rate-limit failed logins and temporarily lock out an IP, so a brute force run stops after a handful of tries instead of millions.
Whitelist trusted IPs or whole CIDR ranges (IPv4 or IPv6) so they’re never rate-limited or locked out.
Two-factor authentication (2FA)
One-time codes from any authenticator app (Google Authenticator, Authy, 1Password, and similar). Setup is per-user: scan a QR code, confirm a code.
Recovery codes issued at setup with a one-click download, plus an admin reset — a lost phone is never a lockout.
Require 2FA for any role you choose: an enforced user who hasn’t enrolled sees only the setup screen until they do.
Closes the XML-RPC side door: require the code appended to the password over XML-RPC, or block XML-RPC password logins for 2FA accounts. Application passwords are unaffected.
reCAPTCHA
Google reCAPTCHA on your login, registration, and lost-password forms — the v2 “I’m not a robot” checkbox or invisible v3 scoring, your choice.
Covers WooCommerce’s my-account and checkout forms too, and a developer hook drops the same check into any other plugin’s form.
v3 adds a tunable score threshold and an optional email fallback: a real person the score misjudges gets a one-time sign-in link instead of a dead end.
A required “Test keys” step proves your keys work before the switch can be turned on — a wrong-type key would otherwise break login for everyone, including you. Fails open if Google is unreachable, so an outage never locks you out.
Password policy
Require a minimum length and character classes (upper, lower, number, symbol).
Block passwords that are just the account’s username or email.
XML-RPC protection
One switch to disable all XML-RPC methods, or disable pingbacks only.
Log every XML-RPC request with its method and whether it was allowed or blocked.
Malware scanner
Scan WordPress core, plugins, themes, and uploads — pick any combination.
Core files and plugins from WordPress.org are compared against their official per-file checksums, so tampering is spotted and untouched files are skipped instead of producing false alarms.
A pattern engine flags suspicious PHP, obfuscated JavaScript, and common malware signatures in everything that can’t be checksum-verified — themes, uploads, premium plugins, and any modified file.
Report-only: it shows what it found without changing any files.
File & server hardening
Block direct access to sensitive files (.env, .git, wp-config.php, and more).
Block backup and database dumps (.sql, .bak, .tar.gz, .wpress), plus your own filenames or *.extension patterns.
Disable directory listing and PHP execution in uploads. Writes the Apache .htaccess rules for you, and shows the nginx equivalent to paste.
Hide the WordPress version, REST API discovery links, and identifying server headers. Block author/user enumeration.
A lightweight firewall blocks common SQL-injection, XSS, file-inclusion, and command-injection patterns plus known scanner user agents.
Sessions, audit log & dashboard
Every user can see and end their own active login sessions; a password reset logs out that account’s other sessions.
The audit log (activity log) records every login, admin action, and block with the who/what/when/where — searchable, filterable, live-updating, CSV-exportable, with a configurable retention period.
Critical events email your administrators, grouped into one summary instead of fifty (opt-in).
A WordPress dashboard widget shows threats blocked in the last 24 hours and recommends the next protection to switch on.
Grant other roles manage or read-only access to Qevix Shield without full manage_options.
Qevix Shield Pro
Qevix Shield is complete on its own, and everything above is free and stays free. The optional Pro add-on (sold at qevixlabs.com, never required) adds what happens after detection:
Malware remediation and deeper detection — quarantine or delete infected files, dismiss reviewed findings, extra web-shell and backdoor signatures, cron-abuse and rogue-admin checks, a database scan for injected content, and scheduled daily/weekly scans.
Breached-password protection — a privacy-preserving check against the Have I Been Pwned database of a billion leaked passwords, plus a common-password blocklist, expiration, reuse prevention, and forced resets.
Advanced login blocking — permanent IP blacklists, user-agent filtering, and auto-blacklisting of repeat offenders.
Multi-channel alerts — SMS, WhatsApp, Slack, Discord, and webhooks, as grouped digests routed by category and severity.
Session & access control — an admin view of every user’s sessions with idle-timeout enforcement, plus WP-CLI commands.
Extras — trusted devices and an emailed backup code for 2FA, and granular XML-RPC (authenticated-only, allowlist, or trusted IPs).
External services
Qevix Shield makes no external requests by default. Two optional features each contact one service, and only after you set them up:
Google reCAPTCHA — used only if you enable reCAPTCHA and enter your own Google keys. The login page then loads Google’s reCAPTCHA script, and each protected attempt sends the reCAPTCHA token, your secret key, and the visitor’s IP to Google’s verification endpoint (https://www.google.com/recaptcha/api/siteverify). The “Test keys” button also contacts Google. Provided by Google: terms, privacy policy.
WordPress.org checksums API — when you run a malware scan, the plugin fetches official checksums so it can tell genuine files from modified ones. For the core scope it calls WordPress core’s own get_core_checksums(), which contacts api.wordpress.org and sends only your WordPress version and locale. For the plugins scope it fetches each installed plugin’s public per-file manifest from https://downloads.wordpress.org/plugin-checksums/
Built-in alerts are sent by email through your site’s own mail configuration — no third party is contacted. The other alert channels (Slack, Discord, webhooks, SMS, WhatsApp) and the Have I Been Pwned check belong to the separate Qevix Shield Pro add-on; this free plugin never contacts them. No other data leaves your site — audit logs, lockout records, 2FA secrets, and settings live only in your own database.
