內容簡介
Yard | Warden 外掛強化 WordPress 的密碼與登入流程，透過 zxcvbn-php 提供密碼強度評分，並執行多項安全措施，確保使用者登入過程的安全性。
【主要功能】
• 密碼強度評分，範圍 0-4
• 強制最低密碼長度（預設 16 字元）
• 通用登入錯誤訊息，防止用戶名枚舉
• 安全的多站點註冊流程
• 登入限制，防止暴力破解
外掛標籤
開發者團隊
原文外掛簡介
Yard Warden hardens core WordPress password and login flows:
Password strength via zxcvbn-php. Scores passwords 0-4 (default 4) based on real guessability, not arbitrary character-class rules. User inputs (login, email, display name) are fed to zxcvbn so passwords containing them score lower.
Minimum length enforcement (default 16) on top of the zxcvbn score.
Generic login errors to prevent username enumeration on the wp-login form. Always on, no toggle. Only applies to authentication failures; password-reset and profile-update validation errors remain verbose so users can correct their input.
Safer multisite onboarding. Auto-activates new signups server-side so no activation link is emailed and the wp-activate.php landing page (which would print username + plaintext password) is never reached. The welcome email is rewritten to contain a one-time password-reset link instead of a generated password.
Login limiting via transient-based counters across three dimensions (IP+Username, IP, Username). Locks out brute-force attempts. Admin can clear all counters via Settings > Yard Warden.
Filters
yard::warden/password/min-length (default 16) – Minimum character count.
yard::warden/password/min-score (default 4) – Minimum zxcvbn score (0-4).
yard::warden/login/generic-error (default Invalid credentials.) – Replacement login error message.
yard::warden/login/leaky-error-codes (default ['invalid_username', 'invalid_email', 'incorrect_password']) – WP_Error codes to rewrite.
yard::warden/onboarding/welcome-subject (default Welcome to
yard::warden/onboarding/welcome-body (default reset-link body) – Full welcome email body. Receives $user, $resetUrl, original body.
yard::warden/limit-login/enabled (default true) – Set to false to disable login limiting entirely.
yard::warden/limit-login/client-ip (default REMOTE_ADDR) – Override IP detection (e.g. for reverse proxies).
yard::warden/limit-login/error-message (default Too many failed login attempts...) – Lockout error shown to the user.
yard::warden/limit-login/skip-error-codes (default ['expired_session']) – WP_Error codes that do not count as failed attempts.
yard::warden/limit-login/threshold/{dimension} (default 5 / 50 / 3) – Attempts before lockout per dimension (ip_user / ip / username).
yard::warden/limit-login/window/{dimension} (default 300 / 3600 / 1500) – Counting window in seconds per dimension.
yard::warden/limit-login/lockout/{dimension} (default 300 / 3600 / 1500) – Lockout duration in seconds per dimension.
Policy override example
add_filter('yard::warden/password/min-score', function (int $score) {
return max($score, 4);
});
