[WordPress] 外掛分享： SiteGuard Scanner

內容簡介

SiteGuard Scanner 是一款與 EG Secure Solutions 提供的漏洞診斷服務配合使用的外掛，旨在驗證網站所有權並提供安裝清單，確保網站安全性。

【主要功能】
• 驗證網站所有權，確保診斷服務的準確性
• 提供安裝的外掛與佈景主題清單
• 支援 REST API 和自訂端點的請求處理

外掛標籤

開發者團隊

原文外掛簡介

SiteGuard Scanner is a companion plugin for the vulnerability diagnostic service provided by EG Secure Solutions. Installing it on a site that is under a diagnostic contract enables the following two features.

Site ownership verification (authentication) — Lets the diagnostic service confirm that the target site is the one that is actually under a diagnostic contract.
Installation inventory — Provides the diagnostic service with a list of the plugins and themes installed on the target site (name, version, and activation status).

How it communicates
The plugin only responds to signed requests sent by the diagnostic service. It never sends data to any external server on its own (it does not “phone home”).

Authentication uses an HMAC-SHA256 signature based on a shared token. Each request includes a timestamp and a nonce (a single-use random value) to prevent replay attacks.
Requests are received through the WordPress REST API endpoints /wp-json/siteguard-scanner/v1/verify and /wp-json/siteguard-scanner/v1/collect.
For environments where the REST API is disabled, a custom endpoint (/?siteguard-scanner-request=verify and /?siteguard-scanner-request=collect) is provided as a fallback.

Every endpoint responds only to requests carrying a valid signature. When signature verification fails, the plugin returns HTTP 401 and no information at all.
Data provided
When responding to collect, the plugin returns the following information to the diagnostic service:

Site URL
WordPress core version
List of installed plugins (slug, name, version, activation status, network-activation status)
List of installed themes (slug, name, version, activation status, network-enabled status)

No personal data, post content, or any other data beyond the above is collected or transmitted.
Multisite
On a multisite network, diagnostics are performed against the main (parent) site. Because plugin and theme files are shared across the entire network, collect returns the network-wide inventory of installed assets and correctly reports network-activated plugins via the network_active flag.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)Really Simple Security 是一款輕量級且易於使用的 WordPress...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款功能強大的 WordPress 外掛，旨在提升網站內容...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 是一個讓您在 WordPress 中安全上傳 SVG 檔案的最佳...LoginizerLoginizer 是一款 WordPress 外掛，旨在防止暴力破解攻擊，當...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role EditorUser Role Editor 外掛允許用戶輕鬆變更使用者角色和權限。用...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionKadence Security 是一款專為 WordPress 網站設計的安全外掛...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP PluginSiteGuard WP Plugin 旨在加強 WordPress 網站的登入及管理區...