CenterShield – Site Security: Login Protection, 2FA, File Protection & Malware Scan
| 开发者 | wpcenterjp |
|---|---|
| 更新时间 | 2026年10月3日 04:19 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
CenterShield is a WordPress security plugin built for Japanese site owners and the
agencies that maintain their sites.
It brings login protection, two-factor authentication, hardening, file protection and
malware scanning together in one place. Every setting explains what it protects and
what changes when you turn it on, so you can choose the measures your site needs
without security expertise.
The admin interface and all messages are in Japanese only.
Activating the plugin changes nothing on your site. Press "apply recommended settings"
to enable the recommended set in one step, or turn on each feature yourself.
Account and login protection
- Login attempt limiting (brute force protection)
- Username disclosure prevention
- Custom login URL
- HTTP Basic authentication on the login screen (written to .htaccess on Apache)
- reCAPTCHA v2 / v3
- Two-factor authentication (authenticator app, email, backup codes), with an optional grace period and an option to skip the code for 30 days on trusted devices
- XML-RPC disabling (signed Jetpack requests are still allowed)
- IP address restriction for the admin area
- Pingback
- REST API restriction (well known plugins such as Contact Form 7, Jetpack and WooCommerce stay allowed)
- Author archive pages
- Theme and plugin file editor, application passwords
- Unneeded tags in wp_head, such as the WordPress version, the RSD link and emoji scripts
- Blocking direct access to wp-includes, wp-config.php, configuration and backup files
- Blocking PHP execution in the uploads folder
- Disabling directory listing
- Security headers such as X-Frame-Options
- Removing publicly readable files such as readme.html
- Permission review and correction
- Input filtering (lightweight WAF)
- Comment spam blocking (honeypot, rate limit, previous spam history)
- Detection of plugins and themes that have gone two years without an update or are not tested with your version of WordPress
- Comparison against official checksums for WordPress core and plugins hosted on WordPress.org. Differences limited to comments or line endings are reported as informational
- Matching against a known vulnerability database
- Pattern matching against malware signatures bundled with the plugin and updated from the author's server
- Change detection against the previous scan, for themes and plugins that are not on WordPress.org
- Database inspection of posts, widgets and administrator accounts
- Quarantine, restore from the official original, and difference display
安装:
- Upload the plugin and activate it. Nothing is changed on your site at this point.
- Open the "CenterShield" menu and press "apply recommended settings" on the dashboard, or enable individual settings yourself.
- Run a malware scan.
屏幕截图:
常见问题:
I forgot my custom login URL
Rename this plugin's folder under wp-content/plugins/ using FTP or your hosting file manager. The plugin stops loading and /wp-login.php works again. Your settings are preserved. The exact folder name is shown on the Settings tab of the plugin.
I am locked out of the admin area
Add define( 'WPCS_DISABLE', true ); to wp-config.php. Every feature of the plugin
pauses while that line is present.
I forgot the HTTP Basic authentication password
Basic authentication is applied by .htaccess, so renaming the plugin folder does not remove it. Open the .htaccess file in your site root and delete the block that starts with the Basic authentication comment inside the "CenterShield" markers. Full instructions are on the Settings tab of the plugin.
Does the plugin change my site when I activate it?
No. Every setting is off after activation. Nothing is written to .htaccess and no scan is scheduled until you choose to enable it.
更新日志:
1.0.6
- CenterShield notices (malware scan results and .htaccess status) now appear only on the CenterShield screens instead of on every admin page. The .htaccess notices can be dismissed with the close button and come back only when the situation changes.
- Dashboard: the malware scan card now has separate "View results" and "Start a new scan" buttons, and the scan button starts the scan right away instead of only opening the scan screen.
- Malware scan: when several files of one plugin differ from the official release, the official zip of that version is downloaded once and compared file by file, so differences that are only line endings or comments are reported as minor instead of critical. Plugin findings now offer "Reinstall the plugin from the official release", which replaces the whole plugin folder with the official files of the same version and resolves all findings of that plugin at once.
- Malware scan: PHP files that only stop at the first line and contain plain text after it (such as plugin log files), or that only return a list of values (such as plugin settings files), are now reported as reference information instead of critical or warning.
- Settings: new "Clear scan results" section with a button that clears the last malware scan result. Quarantined files, the ignore list and settings are kept, and the action is recorded in the log with the user name.
- Notices on the CenterShield screens now appear between the header and the tabs instead of inside the header.
- "Apply recommended settings" now checks whether the site links to author pages (menus, the front page, the latest post, or the theme) and leaves author pages visible on sites that use them, explaining why in the notice.
- The header and the dashboard now show how many security measures exist in total and how many of them are recommended, alongside how many are enabled.
- When the server rejects part of the .htaccess rules, CenterShield now identifies which setting the server does not support, keeps the other rules in place, and names that setting and the required AllowOverride permission in the notice instead of removing all rules. Settings that are on but not in effect are marked on the settings screen and no longer count as applied.
- Two-factor authentication: the list of roles that can be required now shows how many users each role has.
- Settings screens now keep the save button visible with an "unsaved changes" message after you change a setting, and warn you before leaving the page without saving.
- Malware scan: image files (JPEG, PNG, GIF, WebP, BMP) are now checked for hidden PHP code.
- Malware scan: translation files (.l10n.php) that contain only translated text are no longer reported as changed when WordPress updates translations.
- The Japanese interface now uses the term used in the WordPress Japanese glossary for two-factor authentication.
- Fixed vulnerability results continuing to show the old version for up to 12 hours after updating WordPress, a plugin or a theme from the WordPress update screen.
- Two-factor authentication: the grace period setting can now be changed only after at least one role is set to require two-factor authentication.
- Clearer notice for plugins and themes distributed outside WordPress.org, so it no longer reads as if CenterShield itself were missing from the directory.
- Fixed the icon position and size of the admin buttons on WordPress 6.x.
- Fixed malware scan false positives for security plugin files inside another WordPress installed in a subfolder.
- Scan results are now grouped by type (suspected malware, suspected tampering, accounts and database, vulnerabilities) so the nature of each finding is clear at a glance.
- WordPress core vulnerability results now show an "Update WordPress" button at the top of the result.
- Two-factor authentication: added a grace period that lets users in required roles log in for a set number of days before they must set up two-factor authentication.
- Two-factor authentication: added an option to skip the code for 30 days on devices the user chooses to remember.
- Fixed the QR code on the two-factor authentication setup screen being stretched vertically.
- Two-factor authentication: when you choose email codes on the profile screen, a confirmation code is now sent first, and the method is turned on only after you enter it.
- First release.