內容簡介
SRWorks ArmorPro 是一款全面的 WordPress 安全外掛，提供免費且無限制的安全防護功能，能在網站載入之前即阻擋攻擊，確保網站的安全性。
【主要功能】
• WAF 引擎：在 WordPress 載入前阻擋惡意請求
• 防火牆：超過 600 種內建模式防範各類攻擊
• 暴力破解保護：自動鎖定失敗登入的使用者
• 兩步驟驗證：支援多種驗證應用程式
• 密碼金鑰驗證：無密碼登入，增強安全性
• 機器人保護：防止機器人攻擊登入表單
外掛標籤
開發者團隊
原文外掛簡介
ArmorPro protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.
Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.
Features
WAF Engine — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click.
Firewall — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without .htaccess.
Brute Force Protection — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried.
Two-Factor Authentication — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period.
Passkey Authentication — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection.
Bot Protection — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password.
Access Control — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored MaxMind GeoLite2 database.
Custom Login URL — Move wp-login.php to any slug you choose. The default login returns a 404.
Security Headers — Seven managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions-Policy) delivered via PHP and optionally .htaccess, with a header probe that avoids duplicating what your server already sends.
Email Notifications — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins.
Privacy Hardening — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included.
Dashboard — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget.
Tools — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode.
Privacy by default
Visitor IP addresses never leave your server. Geolocation is resolved against a MaxMind GeoLite2 database stored locally on your own site, not by calling a third-party lookup API. Anonymous usage statistics default to off on the WordPress.org version and to on for the direct download from srworks.co, and can be turned off at any time either way. See External Services for the detail.
External Services
ArmorPro connects to srworks.co in the situations below. Visitor IP addresses are never sent to any external service.
GeoIP Database Download
To show the country for logged IPs and to power country blocking, ArmorPro downloads a MaxMind GeoLite2 country database and stores it on your server. All lookups then happen locally.
When: once when the database is missing, checked on an admin page load at most once per day, then weekly for updates
Data sent: your site URL and the plugin version
Service: https://api.srworks.co, which returns a link to the database file hosted on SRWorks infrastructure
Database: GeoLite2 Country by MaxMind, https://www.maxmind.com
Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy
Individual IP addresses are never sent to this or any other service. Only the database file is transferred, and every lookup runs locally against it.
Anonymous Usage Statistics
ArmorPro shares anonymous statistics about the installation to help guide development. The default depends on where you got the plugin:
WordPress.org version — off. Nothing is sent unless you click “Enable” on the opt-in notice. Choosing “No Thanks” is remembered.
Direct download from srworks.co — on by default. It can be turned off at any time, see below.
Either way, once you have made a choice it is remembered and the default no longer applies.
When: on activation, on deactivation, and once daily
Data sent: an anonymous site identifier; which SRWorks plugins are installed, their version numbers, and whether each has an active subscription; your WordPress version; and your PHP version
Not sent: your site address, visitor data, log contents, IP addresses, email addresses, or any other personal information
The site identifier is a one-way SHA-256 hash of your site address combined with a random value generated on your own server. It cannot be reversed to recover your address.
To turn it off: add define( 'SRWORKS_TELEMETRY', false ); to your wp-config.php, or use the srworks_telemetry_enabled filter
Service: https://api.srworks.co
Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy
No personal data, visitor data, or log contents are included.
License Validation (Unused in This Version)
ArmorPro contains a license client reserved for future AI-powered features, which will carry a per-request cost. No feature in this version is gated behind it, the admin interface has no field for entering a license key, and the AJAX endpoints that would trigger validation are not registered. This client makes no network requests.
When: never, in this version
Service: https://api.srworks.co
Terms: https://srworks.co/terms — Privacy: https://srworks.co/privacy
Privacy Policy
ArmorPro stores the following in your WordPress database:
IP addresses of visitors who trigger a security rule or attempt to log in
Timestamps of security events
Usernames used in login attempts
Country codes resolved locally from the GeoLite2 database
Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added.
Visitor IP addresses are never transmitted off your server.
Support
Questions, bug reports, and feature requests: https://srworks.co/contact
Credits
Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com), used under GPLv2.
Charts by Chart.js (https://www.chartjs.org), MIT License.
Tooltips by Tippy.js (https://atomiks.github.io/tippyjs) and Popper (https://popper.js.org), MIT License.
QR codes by jquery-qrcode (https://larsjung.de/jquery-qrcode/), MIT License.
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
