[WordPress] 外掛分享： YuraCode Security

內容簡介

YuraCode Security 是一款即刻保護您的網站的安全外掛，無需設置或控制台操作。它提供三個專注的模組，涵蓋網站加固、暴力破解登錄保護和 Apache 級防火牆，所有設定均可在單一畫面中管理。

【主要功能】
• 網站加固：禁用 XML-RPC 和 REST API 匿名請求
• 登錄保護：限制失敗登錄嘗試次數
• Apache 防火牆：在 .htaccess 中寫入防護規則
• 隱藏 WordPress 版本：移除生成者 meta 標籤
• 阻擋直接訪問 wp-config.php 和敏感文件
• 不收集用戶數據：完全在伺服器上運行

外掛標籤

開發者團隊

原文外掛簡介

YuraCode Security protects your site the moment you activate it: no setup, no dashboard clutter, no external calls. Three focused modules cover the essentials: hardening, brute-force login protection, and an Apache-level firewall, all controlled from a single settings screen. Settings are managed on the Settings → YuraCode Security screen.
Hardening

Disable XML-RPC – turns off the XML-RPC API and removes the pingback header, RSD link, and wlwmanifest link.
Restrict REST API to logged-in users – returns a 401 for anonymous REST requests.
Hide WordPress version – removes the generator meta tag, the ?ver= query string from enqueued scripts and styles, and the shortlink and REST output links.
Generic login error messages – stops username/email enumeration on the login form.
Disable emojis – removes the emoji detection script and styles from the front end and admin.
Disable self-pingbacks – prevents the site from pinging itself when linking to its own posts.
Disable application passwords – turns off Application Passwords for authenticated REST/API access.
Disable AI prompts – prevents WordPress or plugins from executing prompts through the AI Client API (WordPress 7.0).
Disable comments – removes comments everywhere: blocks new comments and trackbacks, hides existing comments and their counts, blanks the comment template, blocks comment feeds and the REST/XML-RPC comment APIs (block notes are preserved), and removes the Comments admin UI. Existing comments stay in the database.

Login Protection

Limit failed login attempts – tracks failures per IP address and locks the offender out for a configurable duration.
Maximum attempts – the number of failures allowed before lockout (default 5).
Lockout duration – the lockout length in minutes (default 15).

Firewall (.htaccess / 8G)
Writes a rules block to the .htaccess file in the WordPress root (and, optionally, wp-content/uploads/.htaccess). Rules run at the Apache level, before WordPress loads. The block is kept between its own markers so it never conflicts with WordPress’s own rewrite rules, and a backup of your original file is kept in wp-content/uploads/yuracode-security/ before every change (removed on uninstall).

8G Firewall – the built-in ruleset by Perishable Press, with independently toggleable categories:

Block malicious query strings
Block malicious request URIs
Block bad user agents
Block bad referrers
Block suspicious cookies
Block dangerous request methods

Protect wp-config.php and sensitive files – denies access to wp-config.php, php.ini, error_log, and .sql / .log backup files.
Block direct access to wp-includes – 403s direct requests to PHP files under wp-includes, wp-admin/includes, and wp-includes/theme-compat.
Block PHP execution in uploads – writes a wp-content/uploads/.htaccess that denies *.php, *.phtml, and *.phar files.

All firewall rules use Apache 2.4 syntax (Require all denied). On activation the .htaccess block is written immediately; on deactivation it is removed. Servers that don’t honor .htaccess (nginx, IIS) are detected automatically and the firewall is skipped with an admin notice. If the .htaccess file is not writable, an admin notice is shown and the firewall is skipped gracefully.
Privacy
YuraCode Security makes no external requests and collects no user data. It runs entirely on your server; the only files it writes are its own settings and the managed .htaccess rules (with a backup of your original kept in the uploads folder). Nothing is sent anywhere.
Credits
The built-in firewall ruleset is the 8G Firewall by Jeff Starr (Perishable Press), bundled under the GPL.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是一款專為 WordPress 設計的安全外掛，...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Security 是一款專為 WordPress 設計的...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security FirewallMalCare 是一款專為 WordPress 網站設計的安全外掛，提供即時...NinjaFirewall (WP Edition) – Advanced Security Plugin and FirewallNinjaFirewall (WP Edition) 是一款先進的網頁應用防火牆，專...Login Lockdown & ProtectionLogin Lockdown & Protection 外掛能夠記錄失敗登入嘗試...Hide My WP Ghost – Security & FirewallHide My WP Ghost 是一款專業的 WordPress 安全外掛，提供全...Anti-Malware Security and Brute-Force FirewallAnti-Malware Security and Brute-Force Firewall 外掛旨在保...BBQ Firewall – Fast & Powerful Firewall SecurityBBQ Firewall 是一款輕量級且快速的 WordPress 防火牆外掛，...Defender Security – Malware Scanner, Login Security & FirewallDefender Security 是一款易於設置的企業級安全外掛，能有效...Patchstack – WordPress & Plugins SecurityPatchstack 是一個強大的工具，可幫助您識別所有網站的外掛、...Security Plugin, Firewall & Malware Scanner with Auto Removal這款安全外掛專為 WordPress 設計，提供全面的安全防護，包括...Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File ScanningShield Security 是一款自動化的安全外掛，能夠有效阻擋威脅...