內容簡介
Secured WP 外掛為您的 WordPress 網站提供多層安全防護，包含自訂登入頁面、雙重身份驗證（2FA）及登入嘗試計數等功能，能有效降低安全風險，保護您的網站不受攻擊。
【主要功能】
• 自訂登入頁面：將預設的 wp-login.php 更改為自訂的 slug
• 雙重身份驗證：啟用 2FA 增強登入安全性
• 登入嘗試計數：計算失敗登入次數並鎖定用戶
• 記住裝置：在指定天數內記住當前裝置
• 移除 XML-RPC：增強網站安全性
• 備份代碼：提供十個一次性使用的備份代碼
外掛標籤
開發者團隊
原文外掛簡介
Adds layer of security for your WordPress site. Adds custom login page slug, enables 2FA, removes security issues. Adds remember device, counts login attempts and lock usernames if the password is wrong. Out of band e-mail is also supported – instead of entering codes, your user can use simple login link from within their e-mail client.
WooCommerce
WooCommerce is also supported for 2FA, just enable the plugin and all your customers will be asked to enable two-factor authentication.
List with currently supported features:
Login redirection – redirects the default wp-login.php to a slug of your choice
Login attempts – counts the unsuccessful attempts, and locks user if there are too many
2FA settings – gives the ability to use two factor authentication and Out Of Band email link
Remember devices – current device could be remembered for given amount of days and user wont be asked for the 2FA code on it before that (the password is still required)
Removes XML-RPC from your WordPress site
Custom shortcode ([wps_custom_settings]) can be used to give the users without access to the dashboard to setup the 2FA
Backup codes – ten single-use codes per user, the way back in when the phone is lost
Signed-in sessions – see everywhere an account is signed in, and log sessions out one by one
Login Redirection
You can change the default wp-login.php to slug of your choice. That will prevent most common hacker attacks and will harden your WordPress installation. You can redirect the original wp-login.php to the slug of your choice.
2FA login
Enable two-factor authentication for your WordPress site, and to enforce your website users, or some of them to use 2FA. Next time user logins s/he will be asked to enable the 2FA using their favorite application. Once the process is completed, every time the user logs, s/he will be asked to provide the 2FA code.
Which second step users get after the password:
TOTP on – a code from the authenticator app. With Out of band e-mail also on, the email link is offered as an alternative.
TOTP off, Out of band e-mail on – a one-time sign-in link sent to the user’s email address.
both off – no second step; the password alone signs users in, even with 2FA enabled. Passkeys do not change that: they are a separate way to sign in, not a step after the password.
An emailed link is a weaker second step than TOTP: whoever controls the mailbox can also reset the password.
Setting up the authenticator (at the first login after 2FA is enabled, or on the profile page) shows a QR code, an “Open in authenticator app” button and the setup key with a Copy button. On a phone the QR code cannot be scanned from its own screen: the button opens the otpauth:// link, which iOS and Android hand to the installed authenticator or password app (Google Authenticator, Microsoft Authenticator, 1Password, iOS Passwords, …); the setup key can also be copied and pasted into the app. The code field is marked as a one-time code, so iOS / macOS Passwords and password managers that hold the secret offer the current code at later logins.
On the profile page everything Secured WP adds – remembered devices, the authenticator and passkeys – is grouped in one “Secured WP” panel; the same panel is used by the [wps_custom_settings] shortcode and on WooCommerce’s My Account page.
Login Attempts
This gives you the ability to prevent brute force attacks if the hacker knows the username and tries to guess the password. With this enabled, after the given amount of tries that username is locked for the given amount of time – from the address the tries came from. Somebody guessing from one place cannot lock the real user out everywhere. If the account fails ten times the allowed amount from many addresses, it is locked everywhere, except on devices the user asked to remember. Behind a reverse proxy or CDN, use the wpsec_client_ip filter to supply the visitor’s real address, otherwise every visitor shares the proxy’s address. Attempts are counted before the password or code is checked, with counters that cannot be outrun by sending many requests at once. An account locked by an administrator cannot be used with application passwords either.
Remember device setting
With that, user can use given device for the given amount of days without being asked for the 2FA code. The password is always required – a remembered device never signs anybody in on its own. The devices can be removed or checked from the default user settings page; changing the password or resetting the authenticator forgets them all.
That setting is based on current setting (global) for the current moment, which means that when the day value (in settings) is changed globally, that wont reflect the already set cookies and user devices.
Example: If you set that to 10 days and there is a user which decide to use Remember Device functionality, when you change that value to 15 days, that wont increase the time for that user. Same applies for decreasing the value.
Encryption key for 2FA secrets
Authenticator secrets are stored encrypted (XChaCha20-Poly1305), so a copy of the database alone – a leaked backup, an SQL injection – does not let anyone generate your users’ codes. That only holds if the key is kept somewhere other than the database. The plugin takes the key from the first of these that exists:
The WPSEC_ENCRYPTION_KEY environment variable. Best choice when your host lets you set environment variables (Docker, most managed hosts, or fastcgi_param WPSEC_ENCRYPTION_KEY "..."; in nginx). It always takes priority.
The WPSEC_ENCRYPTION_KEY constant in wp-config.php: define( 'WPSEC_ENCRYPTION_KEY', '...' );
A key stored in the database – only as a fallback. It keeps working when the WordPress salts are changed, but anyone holding a copy of the whole database also holds this key.
The key must be at least 32 random characters, for example the output of openssl rand -hex 32. A shorter value is ignored and reported as an error; users then cannot set up an authenticator until it is fixed.
When none of these exists, the plugin creates a key itself – on activation, the first time the plugin settings page is opened, or the first time one is needed – and tries to add it to the top of wp-config.php, right after the opening ' );
// END Secured WP
The top of the file is used because every wp-config.php starts with Site Health say so. To move it out of the database, do one of these:
Make wp-config.php writable, click “Move the key to wp-config.php” on the plugin settings page (or run wp wpsec move-key), then make the file read-only again. The same key is written to the top of the file and deleted from the database, so nothing needs re-encrypting.
Or copy the key yourself. After confirming your identity, the settings page shows the exact block to paste (wp wpsec move-key prints it too when it cannot write). Put it at the top of wp-config.php, right after --generate prints a fresh set to hand over.
Signed-in sessions
The Secured WP panel on the profile lists every place the account is signed in right now – browser, IP address, when it signed in and when the session expires – marks “this browser”, and logs sessions out one by one or all others at once. Administrators can do the same for users they may edit (“Log out everywhere”). Logging out single sessions needs WordPress’s own session storage; if a plugin replaces it, only “log out all other sessions” is offered.
Resetting a user’s authenticator
A reset removes the authenticator and its backup codes and forgets the user’s remembered devices; they set up a new one (with new backup codes) at their next login. It is needed when a phone is lost, or when an authenticator cannot be read (its encryption key was lost). The Users screen shows “UNREADABLE – reset required” in the Secured WP Status column for those.
Users screen: “Reset authenticator” under the user’s name, or select users and choose “Reset authenticator” from Bulk actions. Administrators are asked to confirm their identity first.
Multisite: the authenticator belongs to the user across the whole network, and WordPress lets only network administrators edit other users. The reset is offered on Network Admin > Users, and on a site’s Users screen only to network administrators – site administrators do not get it.
Profile page: another administrator can reset it there too.
The user themselves, with a backup code: sign in with one, confirm identity with another, then “Reset authenticator” on the profile.
WP-CLI: wp wpsec reset-authenticator
WP-CLI
All commands are under wp wpsec; wp help wpsec
wp wpsec key-status
Shows where the encryption key comes from (environment variable, wp-config.php constant, or database), how many keys are available for reading, how many authenticators are stored (and how many are still in the pre-2.5 format), and warns about a misconfigured key, a key kept in the database, or authenticators encrypted with a key that is no longer available. If the database still holds a copy of a key that is now also set in wp-config.php or the environment, the database copy is deleted and the command says so.
wp wpsec move-key
Moves the key stored in the database to the top of wp-config.php, between the “BEGIN Secured WP” and “END Secured WP” lines, then deletes the database copy. It is the same key, so nothing needs re-encrypting. wp-config.php must be writable while the command runs; it can be made read-only again afterwards. If the file cannot be written, the command …
