Balui Security Suite
| 开发者 | baluidigital |
|---|---|
| 更新时间 | 2026年11月3日 04:40 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Balui Security Suite, by Balui Digital, protects WordPress sites without dozens of screens. Everything is configured from one modern dashboard with light and dark themes, ready to be translated. It is designed for site owners without technical knowledge: the defaults are safe and every option explains what it does.
- Two-step verification: authenticator app (TOTP, RFC 6238) or one-time email codes, recovery codes and remembered devices. Each user turns it on from their profile. Works on wp-login.php, WooCommerce "My account" and any form that uses the WordPress login.
- Login attempt limit: per account and per IP, progressive lockouts, notifications and generic error messages that never disclose whether a user exists. Also protects the WooCommerce login.
- Password policy: minimum length, character mix, no username or email inside the password, and breached-password detection with Have I Been Pwned (k-anonymity).
- CAPTCHA with ALTCHA (proof of work solved in the browser and checked on your own server: no keys, no cookies and no third parties) on login, registration, lost password, comments and WooCommerce.
- Custom login URL: wp-login.php and /wp-admin/ stop answering for visitors.
- Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP and a Content-Security-Policy you write (Report-Only first, then enforced). A checker shows the headers your site really sends.
- Hardening: XML-RPC, application passwords, REST user listing, user enumeration, file editor, PHP in uploads, directory listing, sensitive files, version disclosure, pingbacks, forced HTTPS for the dashboard and more.
- Integrations: detects management panels, supplier syncs, payment gateways and AI assistants, and tells you before a protection would cut one of them off.
- Comments: disable everywhere or per content type, close existing threads, hide the UI and the feed, or strip links.
- Security score and one-click recommendations, activity log (you choose how many days it is kept), privacy tools integration, settings export and import, WP-CLI commands.
安装:
- Install and activate the plugin.
- When two-step verification is in use, the plugin asks you to add its encryption key to wp-config.php with one click (Settings › Encryption key). Nothing is written to wp-config.php without that click.
- Open Balui Security Suite in the admin menu and follow the recommendations.
BALUI_SECURITY_2FA_OFF (second step only), BALUI_SECURITY_LOGIN_URL_OFF (custom login URL) and BALUI_SECURITY_OFF (whole plugin).屏幕截图:
常见问题:
I locked myself out. What do I do?
Add define( 'BALUI_SECURITY_2FA_OFF', true ); to wp-config.php to skip the second step, or define( 'BALUI_SECURITY_OFF', true ); to turn the whole plugin off. You can also rename the plugin folder by FTP.
Does it work with WooCommerce?
Yes. Two-step verification, the login attempt limit, the password policy and the CAPTCHA also work on the WooCommerce "My account" login, registration and checkout.
Are there hooks for developers?
Filters: bsnt_capability (capability needed to manage the plugin, default manage_options), bsnt_allow_without_second_step (return true to let a given user sign in through XML-RPC or the REST API with the normal password, for example a service account), bsnt_totp_issuer (name shown in the authenticator app), bsnt_static_headers (security headers sent), bsnt_csp_skip and bsnt_csp_directives (pages without Content-Security-Policy, and the directives sent), bsnt_send_mail (send the plugin's emails with your own mailer). Actions: bsnt_event (every activity log event), bsnt_lockout, bsnt_tfa_reset and bsnt_settings_updated.
What happens to my settings if I move to Balui Security Suite Pro?
They are kept. Pro uses the same settings and turns this plugin off when it is activated.
更新日志:
1.8.2
- CAPTCHA uses ALTCHA only: the challenge is solved in the visitor's browser and checked on your own server. Nothing is loaded from or sent to third parties.
- The encryption key is only added to wp-config.php when you press the button.
- Multisite: the server rules (.htaccess) are written from the main site's settings, and the custom login URL is not offered (all the sites share the login page).
- The dashboard follows the WordPress language of each user.
- Activity log queries, privacy tools and uninstall use fully prepared SQL.
- Code clean-up: removed code and options that this plugin did not use.
- This plugin no longer contains any multisite network administration or code from Balui Security Suite Pro. On a multisite each site is configured on its own.
- Server files: the backups made before cleaning .htaccess or .user.ini are now kept in the database (the last 10) instead of as files in the uploads folder. Existing backups are moved automatically and the old folder is removed.
- Server files: the files are located with WordPress functions (get_home_path() and wp_upload_dir()).
- Paths to the plugins folder and to WordPress core are worked out with WordPress functions instead of constants.
- New: before writing its server rules, the plugin checks .htaccess and .user.ini for leftovers of security plugins that are no longer active (WP Cerber, Wordfence, Solid Security, All-In-One Security, NinjaFirewall), sections without a pair (a 500 error on Apache) and auto_prepend_file lines pointing to missing files. If something can break the site, its own rules wait and the administrator decides.
- New: Hardening › Server files explains each finding and offers to remove it after a backup. If the site answers worse afterwards, the backup is put back automatically. Undo for 24 hours.
- New: WP-CLI command wp balui-security-suite htaccess [check|clean|ignore|undo], which also works when the site shows a 500 error.
- Nothing is changed without an explicit action, and rules of plugins that are still active are never offered for removal.
- New name: Balui Security Suite (formerly Balui Sentinel).
- The activity log keeps as many days as you choose (7 to 730).
- The breached-password check (Have I Been Pwned) is now off by default and is only used if you turn it on.
- "Force HTTPS for login and dashboard" uses WordPress's own force_ssl_admin(); the plugin no longer changes automatic update settings.
- Two-step verification form protected with a WordPress nonce; stricter sanitising of request data and escaping of output.
- WP-CLI: wp balui-security-suite.
- Database queries use placeholders for table names.
- Translator notes for strings with placeholders.
- The Pro links now point to baluidigital.es/categoria/balui-security-suite/.
- First version on WordPress.org.
- New: Content-Security-Policy written by hand, with a starting template and Report-Only mode.
- The plugin cannot be active at the same time as Balui Security Suite Pro, which already includes it.