內容簡介
Securyn 是一款專注於 WordPress 安全的外掛，能夠監控網站安全問題並以簡單易懂的語言解釋每個問題。它提供詳細的風險評估和修正步驟，幫助使用者掌握網站安全狀況。
【主要功能】
• 防火牆：具備 OWASP 前五大規則集的請求時間防火牆
• 漏洞掃描器：檢查已安裝外掛和佈景主題的已知漏洞
• 身份檢查：登錄風險檢查和會話監控
• 文件完整性：核心和外掛文件的基準檢查
• 強化檢查：配置檢查和逐步指導
• 審計日誌：安全事件的不可篡改記錄
外掛標籤
開發者團隊
原文外掛簡介
Most WordPress security plugins report a problem. They do not explain it. You get an alert that a file changed, a login failed, or a plugin is vulnerable. You do not get the reason, the risk, or the next step.
Securyn is different. Securyn watches your site, finds the security problems, and explains each one in plain language. For each finding, Securyn tells you three things: what happened, why it is a risk, and the WordPress screen to open to correct it.
Securyn is a detect-and-guide plugin. Securyn does not change your plugins, themes, core files, or configuration for you. You stay in control of every change. Securyn shows you the problem and the correct screen. You decide when to act.
Securyn combines six security tools in one dashboard:
Firewall — a request-time firewall with an OWASP Top 5 ruleset, rate limits, and an automatic blocklist for repeat attackers.
Vulnerability scanner — a check of your installed plugins and themes against a known-vulnerability feed. Securyn uses wpvulnerability.net by default. Securyn uses the Wordfence Intelligence v3 feed when you add a free Wordfence key.
Identity — login risk checks, session monitors, and privilege-drift alerts.
File integrity — a baseline and a drift check for core and plugin files, verified against official WordPress.org checksums.
Hardening — configuration checks with step-by-step guidance and an optional AI advisor.
Audit log — a tamper-evident record of security events, with automatic retention cleanup.
Plain-language alerts
Each finding includes a short, human-readable explanation. You do not need to be a developer to understand what happened or what to do next. Securyn writes the alert in plain English and links you to the correct WordPress screen, such as Plugins or Updates.
AI features are optional
AI narratives use a Bring-Your-Own-Key model. You supply your own key from OpenAI, Anthropic, or Google Gemini. No request goes through a Securyn server. If you add no key, every non-AI tool continues to work. Only the AI narratives and the AI triage turn off.
Third-Party Services
This plugin connects to the following external services under specific conditions. No data is sent unless the described trigger occurs.
WordPress.org APIs
The file-integrity module fetches official checksums and package metadata from WordPress.org to verify that core files, plugins, and themes have not been tampered with. Only the component slug and version are transmitted; no site or user data is sent.
Data sent: WordPress version and locale (core checksums), plugin slug and version (plugin checksums), theme slug (theme info).
When: during a file-integrity scan, or when a component is checked against its official checksums.
The vulnerability module also queries api.wordpress.org/plugins/info/1.2/ (via the WordPress core plugins_api() function) to check whether each installed plugin slug is still listed in the official plugin directory. Only the plugin slug is transmitted.
Data sent: plugin slug.
When: on the scheduled vulnerability sync (every 4 days by default) and when manually triggered.
Service: WordPress.org
License: https://wordpress.org/about/license/
Privacy Policy: https://wordpress.org/about/privacy/
Wordfence Intelligence v3
The vulnerability scanner fetches CVE data from the Wordfence Intelligence v3 feed to check installed plugins and themes against known vulnerabilities. Requests are made on a scheduled basis (daily by default) and cached locally. A free Wordfence API key is required; you can obtain one at wordfence.com.
Data sent: an HTTP GET request containing the plugin’s user-agent string and the Wordfence API key (as a Bearer token in the Authorization header). No site URLs, user data, or other site-specific information is transmitted.
When: on the scheduled vulnerability sync and when manually triggered from the Securyn dashboard.
Service: Wordfence Intelligence
Terms and Conditions: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Privacy Policy: https://www.wordfence.com/privacy-policy/
WPVulnerability
The vulnerability scanner queries the wpvulnerability.net API for CVE data. This is the default vulnerability source when no Wordfence API key is configured, and serves as a fallback if the Wordfence feed is unreachable.
Data sent: plugin/theme slug or WordPress version in the URL path. No site-specific or user-specific data is transmitted.
When: during a scheduled or manual vulnerability sync, whenever wpvulnerability.net is the active source.
Note: the project runs its API on the wpvulnerability.net domain (the endpoint this plugin queries), while its website, documentation, Terms of Use, and Privacy Policy are hosted on wpvulnerability.com.
Service: WPVulnerability
Terms of Use: https://www.wpvulnerability.com/license/
Privacy Policy: https://www.wpvulnerability.com/privacy
OpenAI API (optional)
If you configure an OpenAI API key under Securyn > Settings, the plugin sends security finding summaries to the OpenAI API for AI-assisted narratives and triage.
Data sent: security finding summaries (vulnerability descriptions, hardening check results). No credentials, user data, or site URLs are included in the payload.
When: only when an API key is configured and a user views a finding detail or triggers AI triage.
Service: OpenAI
Terms of Use: https://openai.com/policies/terms-of-use/
Privacy Policy: https://openai.com/policies/privacy-policy/
Anthropic API (optional)
If you configure an Anthropic API key under Securyn > Settings, the plugin sends security finding summaries to the Anthropic API for AI-assisted narratives and triage.
Data sent: security finding summaries (vulnerability descriptions, hardening check results). No credentials, user data, or site URLs are included in the payload.
When: only when an API key is configured and a user views a finding detail or triggers AI triage.
Service: Anthropic
Terms of Service: https://www.anthropic.com/legal/commercial-terms
Privacy Policy: https://www.anthropic.com/legal/privacy
Google Gemini API (optional)
If you configure a Google Gemini API key under Securyn > Settings, the plugin sends security finding summaries to the Google Generative Language API for AI-assisted narratives and triage.
Data sent: security finding summaries (vulnerability descriptions, hardening check results). No credentials, user data, or site URLs are included in the payload.
When: only when an API key is configured and a user views a finding detail or triggers AI triage.
Service: Google Gemini
Terms of Use: https://ai.google.dev/gemini-api/terms
Privacy Policy: https://policies.google.com/privacy
WordPress Core AI Client (WordPress 7.0+, optional)
On WordPress 7.0 and later, Securyn can delegate AI requests to the built-in WordPress AI Client via the Connectors API. The external provider contacted depends on the connector the site administrator has configured in WordPress settings. Securyn sends the same security finding summaries described above; no additional data is transmitted.
When: only when WordPress 7.0+ is detected, the core AI Client connector is active, and no BYOK API key is configured for another provider.
Service: Determined by the site’s WordPress Connectors configuration
Terms of Use: Depend on the configured connector provider
Privacy Policy: Depend on the configured connector provider
