內容簡介
SR WORKS ArmorPro 是一款全面的 WordPress 安全外掛，能在網站啟動之前提供強大的保護。所有功能均免費且無限制，無需升級提示，確保網站安全無虞。
【主要功能】
• WAF 引擎：在 WordPress 加載前阻擋惡意請求
• 防火牆：600+ 內建模式防範各類攻擊
• 暴力破解保護：自動鎖定失敗登入的帳號
• 雙因素認證：支援多種驗證應用程式
• 密碼金鑰認證：無密碼登入，支援生物識別
• 機器人保護：防止機器人攻擊登入表單
外掛標籤
開發者團隊
原文外掛簡介
ArmorPro protects WordPress with a full security stack that runs before your site does. Every feature is free and unlimited. There is no premium tier, no locked panels, and no upgrade prompts.
Attacks get blocked at the PHP engine level, roughly a millisecond into the request, before WordPress loads a single file.
Features
WAF Engine — Runs before WordPress loads via PHP’s auto_prepend_file, adding roughly 1ms of overhead. Blocks malicious requests at the PHP engine level before any WordPress code executes. Detects and configures Apache, NGINX, and LiteSpeed automatically, and falls back to the standard firewall when enhanced mode is unavailable. Enable it from the Firewall tab with one click.
Firewall — 600+ built-in patterns covering SQL injection, XSS, path traversal, and shell access, matched across five categories (Request URI, Query String, User Agent, Referrer, IP Address) in three modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggles, hit counts, and your own custom patterns. Pure PHP, so it works on any server without .htaccess.
Brute Force Protection — Session-based login tracking with automatic lockouts after a configurable number of failures. Repeat offenders can be auto-blacklisted with an optional expiry. Login activity log records IP, country, status, and the usernames tried.
Two-Factor Authentication — TOTP for Google Authenticator, Authy, 1Password, and any compatible app. QR code setup, ten backup recovery codes, and role-based enforcement with a grace period.
Passkey Authentication — Passwordless login with Face ID, Touch ID, Windows Hello, or a hardware security key (WebAuthn/FIDO2). Multiple passkeys per user with friendly names and clone detection.
Bot Protection — Honeypot fields, timestamp validation, and JavaScript token verification on login, registration, and password reset forms. Bots are stopped before they can attempt a single password.
Access Control — IP whitelist and blacklist with inline notes. Country blocking in allow or block mode, backed by a locally stored DB-IP country database.
Custom Login URL — Move wp-login.php to any slug you choose. The default login returns a 404.
Security Headers — Seven managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, HSTS, Content-Security-Policy, Permissions-Policy) delivered via PHP and optionally .htaccess, with a header probe that avoids duplicating what your server already sends.
Email Notifications — Daily and weekly security digests, plus event alerts for lockouts, blacklistings, and administrator logins.
Privacy Hardening — Author slug randomization to stop user enumeration, and email obfuscation to keep addresses away from scrapers. XML-RPC and REST API protection included.
Dashboard — Real-time stats, a blocks-over-time chart, protection status cards, and a WordPress dashboard widget.
Tools — Health checks with database integrity verification, one-click table repair, settings export and import, CSV log export, and debug mode.
Privacy by default
Visitor IP addresses never leave your server. Geolocation is resolved against a DB-IP country database stored locally on your own site, not by calling a third-party lookup API. ArmorPro collects no usage statistics and has no license key. See External Services for the detail.
External Services
ArmorPro makes the outbound requests below. Visitor IP addresses are never sent to any external service.
Country Database Download (DB-IP)
To show the country for logged IPs and to power country blocking, ArmorPro downloads DB-IP’s free “IP to Country Lite” database straight from DB-IP and stores it on your server. All lookups then happen locally.
When: once shortly after activation, via WP-Cron, then checked weekly and downloaded again when DB-IP publishes its monthly update
Data sent: nothing beyond a standard file download request
Service: https://download.db-ip.com, run by DB-IP (https://db-ip.com)
Database license: Creative Commons Attribution 4.0 (https://creativecommons.org/licenses/by/4.0/)
DB-IP terms: https://db-ip.com/db/lite.php
Individual IP addresses are never sent to this or any other service.
Update Checks (direct download from srworks.co only)
The copy downloaded from srworks.co checks for new versions itself. The WordPress.org version does not; WordPress.org handles its updates.
When: whenever WordPress checks for plugin updates
Data sent: nothing beyond a standard request for the update information and, when you update, the plugin file
Service: https://api.srworks.co
Terms: https://srworks.co/terms, Privacy: https://srworks.co/privacy
ArmorPro sends no usage statistics and has no license check.
Privacy Policy
ArmorPro stores the following in your WordPress database:
IP addresses of visitors who trigger a security rule or attempt to log in
Timestamps of security events
Usernames used in login attempts
Country codes resolved locally from the DB-IP country database
Clear all logs at any time from the Tools tab. Log retention is 90 days and old entries are pruned daily. Uninstalling the plugin deletes all of it, along with the WAF bootstrap file and any .htaccess or .user.ini directives ArmorPro added.
Visitor IP addresses are never transmitted off your server.
Support
Questions, bug reports, and feature requests: https://srworks.co/contact
Credits
Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com), used under GPLv2.
Charts by Chart.js (https://www.chartjs.org), MIT License.
Tooltips by Tippy.js (https://atomiks.github.io/tippyjs) and Popper (https://popper.js.org), MIT License.
QR codes by jquery-qrcode (https://larsjung.de/jquery-qrcode/), MIT License.
IP geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0.
