內容簡介
Vortix Web Security 是一款專為 WordPress 提供實用安全加固的外掛，無需帳號、授權金鑰或遠端遙測。它設計保守，預設關閉新兼容性敏感的保護措施，並確保 .htaccess 的變更經過驗證。
【主要功能】
• 基本加固：防止登入錯誤和用戶名枚舉
• 登入保護：重複失敗登入後暫時鎖定 IP 和用戶名
• 禁用 XML-RPC：關閉 XML-RPC 接口及相關連結
• 壞機器人阻擋：阻擋已知掃描器的請求
• 上傳保護：阻擋上傳目錄中的常見腳本執行
• 強密碼強制：要求使用者使用更強的密碼
外掛標籤
開發者團隊
原文外掛簡介
Vortix Web Security provides practical WordPress hardening without accounts, license keys, remote telemetry or a license server. The plugin is designed to be conservative: new compatibility-sensitive protections are off by default, and .htaccess changes are verified and reverted if the site’s own loopback probe reports an HTTP 500.
Free protection modules
Basic Hardening – generic login errors, public username-enumeration protection and MIME-sniffing protection.
Login Protection – temporary IP and username lockouts after repeated failed logins.
Disable XML-RPC – disables the XML-RPC interface and related discovery links.
Bad Bot Blocker – blocks requests from a small list of known scanner/exploit User-Agents.
Upload Protection – blocks execution of common script files in the uploads directory on Apache/LiteSpeed.
Disable File Editor – disables the WordPress plugin and theme code editors.
Hide WP Version – removes common WordPress version disclosures.
Disable Directory Browsing – adds a verified Options -Indexes rule on Apache/LiteSpeed.
Strong Password Enforcement – requires stronger passwords for users who can publish content.
Automatic Plugin Updates – allows automatic updates for packages served by WordPress.org over HTTPS.
Automatic Theme Updates – allows automatic theme updates for packages served by WordPress.org over HTTPS.
Pingback & Trackback Control – disables legacy pingback/trackback publishing paths.
Safe Security Headers – adds conservative X-Content-Type-Options and Referrer-Policy headers.
Sensitive File Protection – blocks direct access to common deployment/configuration filenames and Git metadata directories.
Malicious Query Blocking – blocks a small set of high-confidence XSS, traversal, null-byte, webshell and SQL injection signatures in the query string.
A 20-point Security Scan provides local checks for HTTPS, XML-RPC state, debug mode, file permissions, upload protection, version exposure, administrator username, login protection, directory listing, user enumeration, REST user exposure, file editors, RSD/WLW links, outdated plugins, pingback/trackback control, security headers, sensitive-file protection and malicious-query protection. Checks that cannot be verified are reported as unknown and excluded from the score.
Compatibility-sensitive modules remain off by default, including XML-RPC blocking, bot blocking, .htaccess protections, automatic updates, pingback/trackback control and malicious-query blocking. Existing installations keep their current choices when updating; newly introduced 2.2.0 modules are not enabled automatically.
Login recovery
If Vortix Login Protection ever locks out an administrator, add this temporary line to wp-config.php:
define( 'VORTIX_DISABLE_LOGIN_PROTECTION', true );
Log in, remove the line, and then review the Login Protection settings. This bypass affects only Vortix’s lockout module.
Privacy
Blocked requests are logged locally in the site’s own database. The log contains the client IP address, request path without the query string, event type and time. Entries are automatically removed according to the configured retention period. Login-attempt counters use keyed hashes and expire automatically.
The plugin does not send telemetry, security logs, license data or scan results to the author or another server.
External services
Vortix Web Security does not contact an external service.
Security Scan and .htaccess safety checks may make loopback requests to the site’s own URL.
Cloudflare mode only reads the CF-Connecting-IP request header and uses address ranges bundled with the plugin; it does not contact Cloudflare.
The optional Premium link is an ordinary user-initiated external link. No request is made by the plugin merely because the link is displayed.
