內容簡介
Steel Security & Hardening – Site Audit Tools 是一款專為 WordPress 管理員設計的安全性外掛，提供實用的安全檢查與強化工具，幫助用戶識別風險並採取預防措施，確保網站安全。
【主要功能】
• 按需安全掃描
• 清晰的手動工作流程
• 風險摘要按嚴重性分組
• 儀表板風險摘要面板
• 檢查常見的 WordPress 強化漏洞
• 隔離檔案的檢疫保險庫
外掛標籤
開發者團隊
② 後台搜尋「Steel Security & Hardening – Site Audit Tools」→ 直接安裝（推薦）
原文外掛簡介
Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.
The free plugin provides:
on-demand security scans
a clear manual workflow: run a scan, review findings, take action, and run again
risk summaries grouped by severity and category
dashboard summary panels for scan risk, hardening posture, last scan state, and Recommended Actions
dashboard Recommended Actions that point administrators to the highest-value next step
checks for common WordPress hardening gaps
checks for exposed root-level artifacts such as .env, SQL dumps, phpinfo files, and backup archives
a quarantine vault for operator-reviewed file isolation, restore, and permanent deletion
server protection checks for Fail2Ban and cPHulk relevance without requiring elevated server privileges
uploads PHP execution blocking on supported server environments
manual guidance when automatic server hardening is not safely supported
This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.
Included checks
The scan currently looks for items such as:
PHP error display exposure
WP_DEBUG and debug.log exposure
default admin administrator username
open public registration with dangerous default role configuration
XML-RPC availability
author and REST user enumeration exposure
theme/plugin file editor availability
WordPress generator meta output
comments enabled by default
uploads PHP execution hardening status
public readme and license files in the website root
root-level sensitive files and archives
recursive SQL dump and backup archive discovery
Dashboard and Recommended Actions
The Dashboard is meant to answer two questions quickly:
what is the current scan risk posture?
what should I deal with next?
It summarizes:
the most recent scan state, including never-scanned, failed, and stale results
current scan risk score and grouped finding counts
current hardening posture and recent hardening activity
Recommended Actions that point administrators to the most useful next page or task
When no urgent action is needed, Steel Security shows a reassuring empty state instead of leaving the area blank.
Hardening controls
The Hardening page is organized into focused groups:
Access & Authentication: rename default admin, disable XML-RPC, disable public user registration, hide login error detail, hide the default login URL, advisory FORCE_SSL_ADMIN
Public Exposure: restrict author enumeration, restrict REST user endpoints, hide WordPress generator output
Content & Editing: disable theme/plugin file editor, disable comments by default, advisory DISALLOW_FILE_MODS
Uploads & Execution: block PHP execution in uploads with supported Apache/IIS handling and Nginx manual guidance
Login path hardening
Steel Security can hide the default public WordPress login entry by moving it to a custom path that you choose.
no default slug is suggested
the path must be unique and valid for WordPress
collisions with public content and important internal routes are blocked
direct wp-login.php access is hidden while signed-in administration continues to work normally
logout, lost-password, and related login flows continue to use the configured login path
rollback is available from the Hardening page
Server protection checks
The Server Protection page reports safe, non-privileged environment signals for:
Fail2Ban
cPanel / cPHulk
These checks are intended to help administrators understand whether host-level protection appears present, healthy, unavailable, or unsupported. Steel Security does not attempt to manage those systems from inside WordPress.
For Fail2Ban, Steel Security can also validate whether an expected read-only JSON reporter appears current, stale, unreadable, or malformed before treating it as trustworthy visibility.
For cPanel / cPHulk, Steel Security reports conservative visibility states such as detected, possible, not detected, or unable to determine based on safe non-privileged indicators only.
Server-aware behavior
This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.
Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked .htaccess block
IIS: uploads PHP blocking is managed through a Steel Security-marked web.config section
Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection
Pro companion
This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.
