內容簡介
Vokull Security Center 是一款專為 WordPress 設計的安全監控外掛，能夠即時追蹤網站的關鍵活動，並在發現異常時立即通知使用者，確保網站安全。
【主要功能】
• 監控外掛安裝、啟用、停用及更新狀態
• 追蹤使用者帳號的變更與登錄活動
• 檢查網站配置及關鍵檔案的變更
• 偵測檔案系統中的新檔案及變更
• 支援兩步驟驗證以增強安全性
外掛標籤
開發者團隊
原文外掛簡介
Vokull Security Center (“vökull” is Icelandic for “vigilant/watchful”) watches the things an attacker actually has to touch in order to keep a foothold in a WordPress site, records them in a searchable log, and e-mails you immediately when something matters.
It is built around two goals that pull against each other: miss as little as possible, and produce as few false alarms as possible. Every event type can be set individually to immediate e-mail, log only, or off. Login blocking always starts in monitor mode so you can see what a rule would have done before you arm it.
What is monitored
Plugins: installed, activated, deactivated, updated, deleted, plugins with an update waiting, and plugins that appear without a matching install (an SFTP drop).
Themes: installed, activated, updated, deleted.
Users and administrators: created, deleted, role changed, promoted to administrator, demoted, e-mail changed, password changed or reset — including changes an administrator makes to their own account.
User records altered directly in the database, outside WordPress, detected by a periodic reconciliation scan.
Configuration: critical options such as siteurl, home, admin_email, users_can_register and default_role; wp-config.php and .htaccess changes; WordPress core files verified against the official checksums; cron jobs; newly appearing must-use plugins; XML-RPC and file-editor state; application passwords.
Filesystem: new or changed files in wp-content/mu-plugins/, and any PHP file under wp-content/uploads/ — where one never belongs. New PHP files are additionally checked against common backdoor signatures.
Logins: failed attempts, successful logins, a login from a country outside your allow list, and logins refused by the IP deny list — with optional blocking. Repeated wrong passwords from one address are rate-limited: a configurable number of retries, then a lockout, then a much longer one for an address that keeps coming back.
Two-factor authentication: who switched it on or off, passkeys registered and removed, wrong codes submitted after a correct password, and every use of a recovery code or the e-mail fallback.
A separate Hardening screen reports the current posture — file editor, permissions, salts, updates, HTTPS, two-factor coverage and more — against the official WordPress hardening guide, linking to it at each point.
The plugin never modifies, quarantines or deletes a scanned file. It reports, and leaves recovery to you.
Hardening report
A read-only screen grading this installation against the official WordPress hardening guide, with a link to the relevant section of that guide on every check. Twenty-two checks covering the dashboard file editor and DISALLOW_FILE_MODS, file permissions, wp-config.php location and permissions, authentication salts, error output, core and extension updates, unused plugins and themes, administrator count, open registration, HTTPS, two-factor coverage, XML-RPC, alerting, file monitoring and backups.
Checks are graded Good, Fix this, Worth fixing — or “Your call”, for the ones that genuinely depend on how the site is run rather than having a right answer. Nothing on the page changes anything.
Two-factor authentication: passkeys or an authenticator app
Two independent second factors, and an account may hold either or both. Whichever is used, the session is issued only after the factor is proven — never before. Enrolment is per account and voluntary by default; a site setting can require a second factor for administrators, with a grace period whose clock starts when you switch the requirement on. Either factor satisfies it.
Username + password
│
▼
WordPress accepts the password
│
▼
Does the account have a second factor?
│
├── Passkey ────► Face ID / Touch ID / Hello ──┐
│ │
├── TOTP ───────► six digits from the app ─────┤
│ │
└── Recovery ───► one of ten single-use codes ─┤
│
▼
Login
Passkeys. A WebAuthn credential held by the phone, laptop, hardware key or password manager that created it. There is nothing to type, nothing to read out over the phone to someone claiming to be support, and the browser will only ever offer the passkey to your exact domain — so a convincing copy of your login page gets nothing. Only a public key is stored on the site; the private half never leaves the device. Users can register several and see when each was last used. If an authenticator that keeps a signature counter ever repeats a value — what a cloned key looks like — that is logged and mailed to you.
Passwordless sign-in. On an HTTPS site you can additionally allow a passkey to sign in on its own, with no password at all. It is off by default, because it is a second way into the site and that is a decision worth taking deliberately. The authenticator must verify the user (fingerprint, face or PIN), and country rules, the IP deny list and the kill switch all still apply.
Authenticator apps. The familiar six digits from any TOTP app. Shared secrets are encrypted with AES-256-GCM under a key derived from the site salts, so a database dump without wp-config.php is useless. Each code is accepted once, so a code read over your shoulder cannot be replayed. The QR code is drawn on your own server — the secret is never sent to an external QR service.
Recovery, in order: ten single-use recovery codes, issued the first time any factor is switched on and shown once; the other factor, if the account has both; optionally a one-time code mailed to the account address; and failing everything, a reset by another administrator.
No part of this contacts anything outside your own site. Passkeys are a conversation between the browser and this server; the WebAuthn library is bundled with the plugin.
Geo-aware login control
Country is resolved from your CDN or reverse proxy’s country header when the request demonstrably came through it, otherwise from a local MaxMind GeoLite2 database. No external API is called during login. X-Forwarded-For is only trusted when the connecting address is in your configured trusted-proxy list, so the client IP cannot be spoofed.
Because locking yourself out is the real risk, there are four independent ways back in: monitor mode is the default, an IP/CIDR allow list is exempt from blocking, a wp-config.php constant disables blocking outright, and every blocked login e-mails you a single-use, time-limited link that unblocks your current IP.
Administrator-only
The plugin adds no front-end output, no REST routes and no shortcodes. Its menu, notices, assets and actions all require the manage_options capability, and a blocked login is indistinguishable from an ordinary wrong password. The one exception is two-factor enrolment: that belongs to the account holder, so every signed-in user finds a Two-factor entry in their own profile menu and can set up a passkey or an authenticator app there. Nothing else about the plugin becomes visible to them.
About the name
“Vökull” is Icelandic for “vigilant”, “watchful”. Which is fairly close to the entire job description: watch, and say something the moment it matters.
External services
This plugin contacts two external services. Both are optional, neither is contacted from the front end or during a login, and no information about your site, your users or your visitors is sent to either.
MaxMind GeoLite2
Used to resolve the country a login came from. The lookup itself happens locally against a downloaded database file, which is why no API is called while anyone signs in — but the database has to be fetched in the first place, and refreshed as it is reissued.
What is sent: a download request to https://download.maxmind.com/app/geoip_download carrying the MaxMind licence key you configured and the edition name (GeoLite2-Country). MaxMind requires both to authorise the download. Nothing else is transmitted.
When: only after you enter a MaxMind licence key under Security Center → Settings → Login & Location. Until you do, the service is never contacted. After that, when you press “Download the GeoIP database now”, and weekly via a scheduled task.
Service provided by MaxMind, Inc. — GeoLite2 End User Licence Agreement, privacy policy.
Cloudflare IP ranges
Used to offer Cloudflare’s own address ranges as a ready-made option for the trusted-proxy list, so you do not have to find and paste them yourself.
What is sent: nothing beyond the HTTP request. The plugin performs a plain read of the public text files at https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6.
When: only when an administrator presses “Fetch Cloudflare’s address ranges” under Security Center → Settings → Login & Location. Nothing is requested by opening that screen, or by any other part of the plugin, and there is no scheduled task for it; the stored list is re-read only when you press the button again. Fetching alone changes nothing — the ranges are offered as a suggestion, every line is validated as CIDR notation, and nothing reaches your trusted-proxy list until you separately click to merge them.
Service provided by Cloudflare, Inc. — website terms of use, privacy policy.
