內容簡介
WebKernelAI Security 是一個專注於技術 SEO 和網站安全的外掛，提供安全的連接，讓 WordPress 用戶能夠集中管理安全政策、進行惡意程式掃描、外掛審核及用戶帳號管理，確保網站的安全性與穩定性。
【主要功能】
• 集中安全政策管理
• 惡意程式掃描
• 外掛審核
• 用戶帳號管理
• 文件完整性監控
• 網路應用防火牆 (WAF)
外掛標籤
開發者團隊
原文外掛簡介
WebKernelAI is a Technical SEO and Website Security platform. The WebKernelAI Security plugin is a highly secure connector that links WordPress to the WebKernelAI dashboard for centralized security policy management, malware scanning, plugin auditing, user account management, file integrity monitoring, Web Application Firewall (WAF), and advanced site controls.
This plugin is a read/execute connector only. It does not store or expose sensitive credentials. All communication is cryptographically signed using HMAC-SHA256 + Ed25519 asymmetric keys. Every request must pass multi-layer signature verification before any action is executed. There is no way for any third party to hijack the site token or impersonate the dashboard.
Official Website:
https://webkernelai.com
Security Plugin:
https://webkernelai.com/plugins/security/
Documentation:
https://webkernelai.com/docs/security/
WebKernelAI helps developers, businesses, and production websites improve:
Technical SEO
Website Security
Web Application Firewall (WAF) rule filters
Crawl Intelligence
JavaScript Vulnerability Detection
Website Malware Detection
Security Header Analysis
SEO Metadata Management
Content Security Policy (CSP) Management
Remote Plugin Update Management
WordPress User Account Auditing
Why This Plugin Is Highly Secure
WebKernelAI Security is engineered from the ground up with a zero-trust security model. Every REST API request received by this plugin must pass all of the following layers before any action is taken:
HMAC-SHA256 request signature — Each request is signed with a shared secret derived from the site pairing token. Any tampered or unsigned request is immediately rejected with 403 Forbidden.
Ed25519 asymmetric cryptography — Critical operations (like agent revocation) are additionally signed with Ed25519 asymmetric keys for cryptographic non-repudiation.
Nonce replay protection — Every signed request includes a one-time nonce. Replayed or reused nonces are rejected even if the signature is valid.
Timestamp freshness validation — Requests older than a configurable time window are rejected to prevent delayed replay attacks.
Trusted-origin enforcement — REST API calls are validated against known dashboard origins.
Pairing token architecture — The 64-character site pairing token is generated locally in WordPress and never leaves the site in plaintext. The WebKernelAI dashboard holds only its HMAC derivative.
Emergency revocation — The WebKernelAI dashboard can remotely revoke or suspend the plugin agent instantly using a cryptographically signed one-time token.
Permission-level callbacks — Every REST endpoint is individually gated by a strict permission_callback that verifies the signed token before the handler ever runs.
There is no possible way for any third party, attacker, or man-in-the-middle to hijack or impersonate the WebKernelAI dashboard connection without holding both the HMAC secret and a valid Ed25519 private key simultaneously.
Core Features
Secure token-authenticated REST API endpoints
Signed request validation using HMAC-SHA256 and Ed25519 asymmetric cryptography
WAF Rule Engine for SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI)
Dynamic security telemetry monitoring & database event logs
Brute force login lockout protections with auto-reset on successful auth
Custom login URL slug masking with hybrid cookie & query parameter bypass
Anonymous user enumeration blocks on user REST endpoints (403 Forbidden)
File integrity inventory generation with weighted overview security scoring (0–100)
Codebase Security Intelligence — SHA-256 file hashing with false-positive whitelisting for trusted plugin files
Remote plugin self-update trigger — WebKernelAI dashboard can push plugin updates without WordPress admin access
WordPress User Account Auditor — remotely list, audit, and delete WordPress user accounts from the dashboard
First-user and last-user deletion protection — primary admin and the only remaining user can never be deleted remotely
Plugin Ecosystem Auditor — detects outdated, vulnerable, official, and third-party plugins with real WordPress.org transient data
Centralized SEO metadata synchronization
Canonical URL synchronization
OpenGraph metadata synchronization
Robots.txt management and subdirectory-safe dynamic XML sitemap generation
llms.txt controls
Advanced Content Security Policy (CSP) management
Security header management
Production lock profile support
Security policy rollback history
Read-only security overview endpoint
Integration with WebKernelAI Technical SEO Audit and security analysis tools
Emergency agent revocation endpoint with Ed25519 + OTP verification
Official WebKernelAI Platform
WebKernelAI provides integrated Technical SEO and Website Security tools for WordPress websites and modern web applications.
Platform capabilities include:
Technical SEO Audit
Web Application Firewall (WAF)
Crawl Intelligence
JavaScript Vulnerability Scanner
Website Malware Scanner
Security Header Analysis
SEO Metadata Synchronization
Content Security Policy Management
Website Security Monitoring
Plugin Manager & Remote Updater
WordPress User Account Auditing
Official platform:
https://webkernelai.com
Security Architecture
WebKernelAI Security includes multiple protection layers:
HMAC-SHA256 and Ed25519 asymmetric request signature verification
WAF engine with customizable security rule drops
Login custom slug protection with 404 response blocks
Brute force lockout thresholds
REST API endpoint restrictions (anonymous user list blocks)
Nonce replay protection
Timestamp freshness validation
Trusted-origin enforcement
Endpoint-level permission controls
Rate limiting protections
Production lock profile
Rollback-safe policy management
Emergency remote revocation with cryptographic verification
False-positive whitelisting in codebase integrity engine
The plugin is designed for secure production environments and centralized security operations.
Remote Plugin Update Security
In version 1.0.5, the plugin supports secure remote self-updates triggered from the WebKernelAI dashboard.
The update process:
1. The WebKernelAI dashboard computes the latest version from the official WordPress.org Plugins API.
2. If an update is available, the dashboard sends a signed POST request to the plugin’s /plugin/update REST endpoint.
3. The plugin verifies the full HMAC-SHA256 signature before proceeding.
4. WordPress’s native Plugin_Upgrader is used with Automatic_Upgrader_Skin to perform the update silently.
5. The plugin is temporarily deactivated during the file swap to prevent file lock conflicts, then automatically reactivated upon success.
The download URL is passed as a signed parameter and validated with esc_url_raw() before use.
File Integrity Monitoring
The plugin supports secure integrity inventory generation for supported scan modes.
Supported integrity metadata includes:
File path
SHA-256/MD5 hash
File size
Modification timestamp
Computed security score indicators (0–100)
Own plugin files are automatically whitelisted to prevent false-positives in the malware scanner regardless of the scan directory (including wp-content/upgrade/ temporary update folders).
Raw file contents are not transmitted during standard integrity operations.
User Account Auditing
The plugin exposes a secure /users REST endpoint for the WebKernelAI dashboard to:
List all registered WordPress users, including their roles and registration dates
Delete a specific user account remotely
Deletion is protected by the following safety rules:
* The first registered user (primary site administrator/creator) can never be deleted.
* The last remaining user on the site can never be deleted.
* Self-deletion of the current API context user is blocked.
All deletion requests must pass the standard HMAC-SHA256 signature verification before any action is taken.
SEO & Technical Controls
The plugin supports centralized Technical SEO management from the WebKernelAI dashboard.
Supported controls include:
Meta title synchronization
Meta description synchronization
Canonical URL synchronization
OpenGraph metadata synchronization
Robots directives
Robots.txt management
llms.txt management
Dynamic XML sitemap generation
Archive indexing controls
External Services
This plugin connects to WebKernelAI cloud services.
Official platform:
https://webkernelai.com
Data may be transmitted to:
https://webkernelai.com
your configured WebKernelAI dashboard/backend endpoint
Data transmitted may include:
Authenticated API requests
Integrity inventory metadata
SEO synchronization payloads
Security policy payloads
Selected configuration settings
Data is transmitted:
When connecting a website to WebKernelAI
When administrators trigger dashboard operations
During scan, synchronization, or policy deployment operations
Terms of Service:
https://webkernelai.com/terms
Privacy Policy:
https://webkernelai.com/privacy
