內容簡介
WM Guard 是一款專為 WordPress 設計的安全檢查外掛，能夠直接在伺服器上評估網站狀況，提供清晰的報告，幫助使用者了解是否需要更新、備份狀態及潛在的安全問題。
【主要功能】
• 檢查 PHP 版本及安全支援結束日期
• 顯示 WordPress 版本及外掛、佈景主題的更新狀態
• 核心檔案完整性檢查（與 WordPress.org 比對）
• 檢查上傳資料夾中的程式檔案
• 備份狀態及最後備份的年齡
• 提供隱私友好的外掛推薦
外掛標籤
開發者團隊
原文外掛簡介
From the outside you can’t tell whether a plugin needs an important update, whether system files have been modified, or whether a backup even exists. WM Guard reads exactly these things – directly on your server – and shows them in plain language under Settings → WM Guard.
WM Guard’s site assessment works without an account or a connection to Witte Marketing. Optional Witte Marketing services are activated only by explicit user action. Optional online diagnostics use WordPress.org APIs only after an administrator actively enables them in Settings, as documented below. WM Guard turns technical WordPress checks into a clear overview of your site’s condition and the issues that deserve your attention.
What WM Guard checks
PHP version including end of security support
WordPress version and pending updates for plugins and themes
Unmodified core files (checksum comparison against WordPress.org)
Program files in the uploads folder – a typical hiding place for backdoors
Backup: detected solution and age of the last backup
Maintenance mode and search engine visibility
Default user role and open self-registration
The “admin” username, error display (debug), folder permissions
System email addresses, database version, memory limit
Email authentication of your domain: SPF record and DMARC policy (via DNS)
Further condition checks in the spirit of WordPress Site Health: recommended PHP extensions, autoload data size, object cache, database character set, automatic plugin updates, WordPress memory limit
Inactive plugins and themes, pretty permalinks
Recommended, privacy-friendly plugins per category (statistics, spam protection, SMTP, activity log, text-to-speech)
Principles
Never changes your files. The assessment only reads – it runs nothing and writes no files.
No automatic transfer to Witte Marketing. Site data is sent to Witte Marketing only after an explicit action (see “External services”).
Online diagnostics require consent. Core checksum and plugin-directory checks use official WordPress.org APIs only after an administrator enables optional online diagnostics in Settings. They use a neutral WM Guard user agent and send only the WordPress version/locale or plugin identifier required for the check – not your site’s URL, content, usernames, passwords, or customer data.
No personal content is transmitted. The assessment does not transmit site content, usernames, passwords, database credentials, orders, or customer data to Witte Marketing.
Protection only on request. The optional extra protection is off by default, works purely at runtime, and can be switched off again at any time – it too changes no file.
Switch off any time. WM Guard can be deactivated at any time, and its own stored data is removed on uninstall.
Extra protection (optional)
On request, WM Guard can switch on individual protections: make username enumeration harder (block the REST users list and the ?author query for anonymous visitors), disable XML-RPC, lock the backend file editor, and neutralize login messages. All are off by default, work purely at runtime through WordPress filters – no file is changed – and each can be switched off again at any time.
Optional: the free Web Check by Witte Marketing
On request – and only after an explicit action – you can additionally request a free external analysis of your site (loading time, findability, accessibility, legal notice requirements) and have the detailed report sent to you by email. Optionally you can also enable ongoing monitoring by Witte Marketing. Without these actions, no site data is sent to Witte Marketing. WordPress.org queries are separate optional online diagnostics requiring their own opt-in.
External services
WM Guard has optional WordPress.org online diagnostics and optional services by Witte Marketing (Werner Witte, Ampfing, Germany). It also offers an independently clickable vulnerability lookup and, if you enable online diagnostics, DNS and own-site HTTP checks. Witte Marketing is contacted only after the explicit actions described below.
1. Free external analysis
When you click “Get free external analysis”, the address and name of this site plus the installed WM Guard version are sent to https://witte.marketing/wp-json/wm-webcheck/v1/agent/analyze so the publicly reachable homepage can be checked from the outside and the result shown here.
2. Request the detailed report
When you submit the report form, the address of this site, the contact name and email address you entered, your consent flag, and the consent-text version are sent to https://witte.marketing/wp-json/wm-webcheck/v1/agent/report to deliver the report to you by email (with a confirmation link, double opt-in).
3. Enable ongoing monitoring
When you enable monitoring, the address and name of this site, the WM Guard endpoint, an access key, and the installed WM Guard version are sent to https://witte.marketing/wp-json/wm-webcheck/v1/agent/connect. After that, Witte Marketing may retrieve the technical overview shown above. The access key is accepted only through the X-WM-Agent-Key request header, not as a URL parameter. If an optional Witte Marketing workflow needs the current consent text and it is not already available from the previous response, WM Guard may read it from https://witte.marketing/wp-json/wm-webcheck/v1/agent/consent after that workflow has been initiated by the administrator.
4. Show external monitoring
If a connection exists, WM Guard retrieves the monitoring data (uptime, outages, server response time, page performance, SSL/domain expiry) from https://witte.marketing/wp-json/wm-webcheck/v1/agent/monitoring when you open its page, and displays it. Only the address of this site and the access key are sent. Without an existing connection, nothing is retrieved.
In no case are content, usernames, passwords, database credentials or full logs transmitted. You can end an activation again at any time.
Provider and legal information:
Privacy policy: https://witte.marketing/datenschutz/
Legal notice: https://witte.marketing/impressum/
Web Check service description: https://witte.marketing/web-check/
5. Official WordPress.org APIs (optional online diagnostics, off by default)
Only after you enable “Allow optional online diagnostics” under Settings → WM Guard → Settings, WM Guard may query WordPress.org when you open its page or during an enabled notification run. For core-file integrity, WM Guard queries https://api.wordpress.org/core/checksums/1.0/ and sends the installed WordPress version and package locale. For the removed/unmaintained-plugin check, WM Guard queries https://api.wordpress.org/plugins/info/1.2/ and sends the plugin identifier (slug). These checks are cached (core checksums: 12 hours; plugin-directory result: 24 hours) and use a neutral WM Guard/
Provider: WordPress.org – privacy policy: https://wordpress.org/about/privacy/
Additional online diagnostics under the same opt-in
With this setting enabled, WM Guard can query public SPF and DMARC DNS TXT records for the domain of the site, and send HTTP GET/POST requests to its own site URL for maintenance-mode, REST and loopback checks. DNS lookups necessarily reveal the queried domain to the configured DNS resolver. The self-requests contact the website server and can appear in its access logs. Results are cached. Without opt-in, these checks are unavailable rather than reported as successful. This option does not activate any Witte Marketing service.
6. Known-vulnerability check (wpvulnerability.net)
Independently of Witte Marketing, you can click “Check for security vulnerabilities now” in the “Known security vulnerabilities” area. WM Guard then queries the free, public vulnerability database wpvulnerability.net for each installed plugin (https://www.wpvulnerability.net/plugin/
Provider: wpvulnerability.net – website and terms of use: https://www.wpvulnerability.net/
