內容簡介
Site Security Auditor 提供 WordPress 管理員一個實用的安全審核儀表板，幫助檢查外掛更新資訊、比較檔案變更，並了解哪些設定需要注意。此外掛設計用於例行維護及調查意外檔案變更，並不會自動編輯網站。
【主要功能】
• 檢查外掛更新：查看可用更新及不活躍的外掛
• 檔案比較：保存可信的 SHA-256 基準，識別變更檔案
• 下載報告：將最新結果匯出為 JSON 格式
• 使用清單檢查：檢查 HTTPS 配置及 WordPress 調試顯示
• 響應式儀表板：適合小螢幕的清晰區塊和可鍵盤操作的控制項
外掛標籤
開發者團隊
② 後台搜尋「Site Security Auditor – Plugin & File Checks」→ 直接安裝（推薦）
原文外掛簡介
Site Security Auditor gives WordPress administrators a practical security review dashboard. See plugin update information, compare plugin and theme files against a trusted snapshot, and understand which settings deserve attention.
Open Tools → Security Audit to start. Each section explains what it checks, what the result means, and what to do next. It is designed for routine maintenance and investigating unexpected file changes, without automatically editing your site.
What you can do
Review plugin updates: see available updates, inactive plugins and missing or stale update information. Open the familiar WordPress update screen to take action.
Compare files: save a trusted SHA-256 baseline, then identify added, modified and removed code files in plugin and theme directories.
Return to your latest report: the most recent file check stays visible with its timestamp and file count. Simply opening the dashboard does not start another scan.
Download a file report: export the latest result as JSON to review with your developer or host.
Follow a plain-language checklist: review HTTPS configuration, dashboard code editing and WordPress debug display, with links to Site Health and official guidance.
Use a responsive dashboard: clear sections, keyboard-accessible controls and a scrollable plugin table on small screens.
A useful maintenance routine
Review available updates and take a backup.
Confirm your files are trustworthy before saving the first baseline.
Run a comparison after maintenance or when investigating changes.
Match changed files to intentional updates or edits.
Replace the baseline only after reviewing and trusting the current files.
A baseline records the current state; it does not prove that state is clean. Keep independent backups and ask a trusted professional about unexplained changes.
Scope and limitations
New baselines cover PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files inside the configured plugin directory and registered theme directories. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and cause an incomplete result.
Each run is bounded to 20,000 directory entries, 100 MiB of file data, 8 MiB per file and an approximately 8-second processing budget. Unreadable files or exceeded limits produce an incomplete report. Incomplete scans never replace a baseline or present a partial comparison as complete. Large sites may need a host-level integrity tool. Avoid editing files or running updates during a scan.
This plugin is not a malware scanner, firewall or vulnerability database. It does not repair files, guarantee security, or certify a plugin as safe. An update or legitimate edit can change a file; unchanged files can still contain problems.
Privacy and performance
No account, API key, telemetry or additional remote metadata requests are required. The dashboard uses the update information already maintained by WordPress; WordPress itself may contact its normal update services.
File hashes, relative paths, baseline time and the latest file report are stored in the site’s options, without autoloading them. Reports are restricted to administrators; on multisite they require a network administrator. Downloaded reports contain relative file paths, so share them only with trusted people. Deactivation and deletion preserve these records to avoid silently discarding your trusted reference.
