內容簡介
SecondGate 外掛提供永久免費的安全功能，包括密碼金鑰、雙重身份驗證、暴力破解保護及國家封鎖，無任何人工限制或時間限制的試用。此外掛確保用戶資料安全，並提升網站防護能力。
【主要功能】
• 密碼金鑰（WebAuthn）支援 Face ID、Touch ID 等
• 標準 TOTP 雙重身份驗證，兼容多種應用
• 受信裝置可跳過 2FA 提示 30 天
• 自動鎖定暴力登入的 IP 和用戶名
• 國家封鎖功能，支援 166 個國家
• 驗證爬蟲自動豁免，確保 SEO 不受影響
外掛標籤
開發者團隊
原文外掛簡介
This plugin’s free tier is permanent: passkeys, 2FA, brute-force protection, and country blocking are all included, with no artificial limitation and no time-limited trial.
At a glance
Passkeys (WebAuthn) — Face ID, Touch ID, Windows Hello, or a hardware key, bound to your exact domain so it can’t be phished
Standard TOTP two-factor authentication — works with Google Authenticator, Authy, 1Password, Bitwarden, and any other standard authenticator app
Trusted devices — skip the 2FA prompt on a recognised device for 30 days, one click to forget it
Brute-force login protection — automatic IP and username lockout after repeated failed attempts, never locking out the real account owner
Country blocking — blacklist or whitelist, 166 countries, IPv4 + IPv6, matched locally against downloaded range data, no third-party lookup at request time
Verified crawler exemption — Googlebot, Bingbot, and other real search crawlers are automatically exempt from every block, confirmed via reverse+forward DNS rather than a fakeable user-agent string, so a blocking rule doesn’t accidentally catch a genuine crawler
Why it works differently under the hood
Every check runs locally, on your own server. No API keys, no third-party accounts, no telemetry sent anywhere. Country IP range data is downloaded once a day from public sources and matched against visitors entirely on your own site — nothing about your traffic is ever sent to us or anyone else.
Two-factor authentication is generated and verified entirely on your own server too. TOTP codes and passkey credentials never leave your site.
The one thing worth knowing about crawler verification
Blocking traffic by country is only safe if it can’t accidentally catch Google. Most plugins check this by trusting whatever a visitor’s browser claims to be — but any visitor can set their User-Agent to say “Googlebot,” which means that check can be bypassed by anyone, and doesn’t actually protect your SEO the way it looks like it does.
This plugin verifies real crawlers properly instead: a reverse-DNS lookup on the connecting IP, confirming the hostname belongs to the crawler’s real network, then a forward-DNS lookup confirming that hostname resolves back to the same IP. That’s the method Google’s own documentation recommends for verifying a crawler is genuine — not a name anyone could fake.
External Services
This plugin connects to two external sources, both required for the plugin to function, both with no account or API key:
GitHub (raw.githubusercontent.com) — for downloading country IP range data used by country blocking. A plain GET request for a static public file, fetched once daily and matched locally afterward. No data about your site or its visitors is sent as part of this request.
DNS lookups (not an HTTP call to any specific company) — when a visitor’s browser claims to be a known search crawler (Googlebot, Bingbot, etc.), this plugin performs a standard reverse+forward DNS lookup on that visitor’s IP, using your server’s normal DNS resolver, to verify the claim is real before exempting it from blocking. This is the same kind of lookup any web server does routinely; no data about your site or its visitors is sent anywhere as part of it.
Two-factor authentication makes no external service calls whatsoever — TOTP codes and passkey verification happen entirely on your own server.
GitHub’s terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
