內容簡介
SMEPlan Security Shield 是一款免費的開源安全外掛，專為 WordPress 設計，能有效監控常見攻擊面，檢測問題並安全修復，確保網站的安全性與穩定性。
【主要功能】
• 批次檢查檔案，優先處理重要檔案
• 安全的資料庫掃描，避免不必要的資料損失
• 配置檢查，確保網站設定的安全性
• 基線完整性檢查，與官方檢查碼比對
• 隔離與回滾功能，安全處理可疑檔案
• 維護模式，自動啟用以保護網站
外掛標籤
開發者團隊
原文外掛簡介
SMEPlan Security Shield is a free, open-source security plugin built around a practical WordPress operations checklist: it watches the 3 most common attack surfaces (OWASP-class attacks plus WordPress-specific ones, persistence mechanisms, and entry vectors), detects issues with baseline/checksum + signature + thresholded heuristics, and remediates safely (quarantine instead of outright deletion; 1-click rollback).
Key features
Batched, checkpointed file scanning: prioritizes mu-plugins, drop-ins, the active theme/plugins, and uploads; never loads the whole file tree into RAM at once.
Safe database scanning: keyset pagination (no OFFSET) over options/posts/postmeta; only flags a row when it decodes into an actually executable PHP/JS token, skipping image data URIs.
Configuration checks: .htaccess/.user.ini rules that map media extensions to PHP, auto_prepend_file, file/directory permissions, weak salts/keys, unusual cron entries.
Baseline/integrity: compares core files against WordPress.org’s official checksums; automatically builds a SHA-256 baseline for every plugin/theme on install/update; 1-click restore of any mismatched core file from a signature-verified WordPress.org package, with the current file quarantined first.
Quarantine & rollback: moves suspicious files aside (never deletes), with a full transaction log and 1-click rollback.
Per-component backups: a “last confirmed good” snapshot of each plugin/theme, refreshed on every trusted update, checksum-verified before every restore, with a best-effort local tamper-resistance layer.
Maintenance mode with a TTL that turns on automatically when remediation touches a hot path or a large batch, and turns itself off once a health-check passes.
Hardening: login rate-limit/lockout by IP + IP/username (real IP behind a CDN via trusted proxies), disables XML-RPC pingback + caps system.multicall, security headers (HSTS/X-Frame-Options/CSP Report-Only), controlled auto-updates (low-traffic time window, skips VCS-managed sites, health-check after updating).
Multi-layer scan scheduling: WP-Cron + an internal watchdog + an HMAC-signed REST endpoint (for system cron/remote pings) + a WP-CLI command — the schedule keeps running even when WP-Cron is unreliable.
Multisite: enumerates every site by blog_id, scanning each site’s own uploads folder and tables.
Two hardening behaviours worth knowing about before you enable them, because they change how the site answers requests that are not this plugin’s own:
User-enumeration blocking is on by default. For visitors who are not signed in, the core wp/v2/users REST routes stop being served and ?author=
wp smeplan-ss scan run exits 75 when a scan is already running. 75 is EX_TEMPFAIL — “temporary failure, try again” — rather than 0, so a wrapper running under set -e will treat a busy lock as a failed command. Handle 75 explicitly if you schedule the command that way. (rc-49)
Not yet in this release (planned for later versions)
2FA (TOTP) and CAPTCHA for the login page.
Anonymous telemetry (opt-in).
Translations (every string is already wrapped in __(), ready for translators via translate.wordpress.org — no translation is bundled with the plugin itself).
Action Scheduler integration for enterprise-grade durable queuing.
Privacy Policy
By default, this plugin does not send any data outside of the site it is installed on. Everything it collects (scan findings, logs, baseline data) stays in the local WordPress database and in a protected local storage folder inside the uploads directory (wp-content/uploads/smeplan-security-shield/, blocked from direct web access).
Two features send data off-site, and both are entirely opt-in — off unless the site admin explicitly sets them up:
Alert email: if enabled, a summary of new findings is emailed to the site’s configured admin email address (admin_email) using WordPress’s own wp_mail().
Alert webhook: if the admin enters a Webhook URL in Policies, a summary (site URL, alert subject, malicious/suspicious counts, timestamp — no personal or visitor data) is sent as JSON to that admin-provided URL whenever new findings are detected. Nothing is sent anywhere unless the admin fills in this field themselves.
That storage folder outlives the plugin on purpose: deleting the plugin removes its options, cron events and capabilities, but leaves the folder in place so a quarantined file is never destroyed by an uninstall performed mid-incident. See the FAQ entry “What is removed when I delete the plugin?” for the reasoning and for how to remove it yourself.
The plugin does not phone home to any SMEPlan-operated server, does not track usage/analytics, and does not include any third-party tracking or advertising code.
