內容簡介
Takumi Private Gate 將 WordPress 安裝轉變為完全私密的網站，未經登入的訪客無法訪問任何內容。此外掛特別適合用於日記、筆記或內部工具，確保資訊不被公開或爬蟲索引。
【主要功能】
• 全站鎖定，未登入訪客自動重定向至登入頁面
• 阻擋未授權的 REST API 請求，回傳 401 錯誤
• 關閉 XML-RPC，拒絕所有需要認證的請求
• 設定失敗登入嘗試後鎖定 IP 地址
• 提供 IP 白名單功能，繞過鎖定和阻擋
• 支援每位使用者的 TOTP 雙重身份驗證
外掛標籤
開發者團隊
原文外掛簡介
Takumi Private Gate turns a WordPress install into a fully private site: nothing is reachable without logging in first. It’s built for people running a diary, notes site, or internal tool on WordPress that should never be publicly visible or crawlable.
Unlike most “force login” or “password protect” plugins, Takumi Private Gate combines four protections in a single, dependency-free plugin:
Site-wide lockdown: every page, post, and feed redirects unauthenticated visitors to the standard WordPress login screen.
REST API blocking: unauthenticated requests to /wp-json/ receive a 401 Unauthorized response.
XML-RPC turned off: every XML-RPC method that requires authentication is refused, so /xmlrpc.php cannot be used to log in, post, or brute-force credentials.
Failed-login lockout: an IP address is locked out for a configurable amount of time after too many failed login attempts, and by default the plugin says nothing that would tell an attacker they’re locked out.
Developed and maintained by Yoshiro Moriyama, founder of Takumi Web Services, a WordPress development studio based in Toronto, Canada.
Features
Redirects every unauthenticated front-end request to wp-login.php.
Returns 401 Unauthorized for unauthenticated REST API requests.
Turns off XML-RPC by refusing every authenticated XML-RPC method (xmlrpc_enabled), which closes the login, publishing, and brute-force paths. WordPress still answers /xmlrpc.php for its own unauthenticated introspection methods such as system.listMethods; blocking the file outright is a job for the web server.
Locks out an IP address after a configurable number of failed login attempts (default: 5 attempts / 30 minutes).
Counts failed Application Password attempts (REST and XML-RPC) toward the same per-IP limit, and refuses Application Password authentication while an IP is locked out.
Lockout state is stored per IP address, not per username.
Lists every currently locked-out IP with a one-click unlock button.
Keeps a rolling log (most recent 1000 attempts) of login attempts with date, IP, username, and result.
Emails the site admin address whenever an IP gets locked out (can be turned off).
IP whitelist (single IPs or CIDR ranges) that bypasses the lockdown, the API blocking, and the lockout entirely.
Optional per-user TOTP two-factor authentication (compatible with Google Authenticator, Authy, 1Password, etc.) enrolled from each user’s own profile screen.
Network-activation aware: sets up per-site defaults and its login-log table on every site of a multisite network.
Single screen of its own in the admin sidebar.
Uninstalling the plugin removes its options, its login-log table, and any 2FA secrets.
