Computernørden's Security Panel -- WordPress 插件

开发者	albertvanharten
更新时间	2026年7月20日 04:22
PHP版本:	7.0 及以上
WordPress版本:	7.0
版权:	GPLv2 or later
版权网址:	版权信息

Computernørden's Security Panel helps you secure your WordPress site with clear, guided tools — no deep technical knowledge required. Its Security Center shows how well your site is protected and what to do next, in plain language. What it does

HTTPS & HSTS — makes sure visitors always reach your site over an encrypted connection.
Security headers — switches on browser protections against framing, content-sniffing and referrer leaks.
Content Security Policy builder — a visual, per-directive editor with a safe Test mode, per-request nonces, hash allowlisting, and a violation log that helps you tighten the policy from real traffic without breaking your site.
security.txt — publishes and maintains a valid /.well-known/security.txt (RFC 9116), keeping the expiry date fresh automatically, with optional PGP-signed content.
Readiness scanner — checks common hardening settings (debug output, file editing, upload execution and more) and offers one-click fixes where it's safe to apply them.
Infrastructure checks — detects findings that live below WordPress (CAA DNS records, certificate key strength, HTTP compression, DANE) and explains exactly how to fix each in your own hosting environment.

The plugin aims for a clean result on public security scanners and gives self-contained, environment-aware guidance for anything it cannot change directly.

安装:

Upload the plugin files to the /wp-content/plugins/computernoerdens-security-panel directory, or install the plugin through the WordPress Plugins screen directly.
Activate the plugin through the 'Plugins' screen in WordPress.
Open the "Security" menu to see your Security Center and configure each module.

常见问题:

更新日志:

1.0.7

Replaced the direct curl calls in the TLS probe with the WordPress HTTP API (wp_remote_get + the http_api_curl hook for TLS-version pinning).
Documented the plugin's self-directed diagnostic connections in a new "External services" readme section.
Made the security.txt web-root path filterable (cno_security_web_root) and documented why the web root is the correct location per RFC 9116.

1.0.6

Set a distinct Plugin URI (plugin page) separate from the Author URI.

1.0.5

Removed the duplicate Plugin URI header (kept the Author URI) to satisfy WordPress.org submission requirements.

1.0.4

Made the nonce verification in the settings-reading helper visible to static analysis as well. Resolves the last code-standards warnings.

1.0.3

Made AJAX nonce verification visible to static analysis (inline check_ajax_referer in each handler) and added full input sanitization for the settings payload. No functional change; resolves the remaining code-standards warnings.

1.0.2

WordPress.org compliance pass. Renamed to remove the restricted word "plugin" from the name and slug. Replaced unlink() with wp_delete_file(); added wp_unslash()/sanitize_text_field() to all $_SERVER/$_POST reads; documented the deliberate direct-curl (TLS-version probing), direct-filesystem (wp-config editing) and central-nonce (authorize()) patterns with justified phpcs:ignore annotations; marked template-scoped variables. Bumped "Tested up to" to 7.0.

1.0.1

Fixed a fatal error on activation caused by relying on a Composer autoloader that isn't shipped. The plugin now uses a self-contained PSR-4 autoloader and bundles no external dependencies.

1.0.0

First public release: HTTPS/HSTS, security headers, Content Security Policy builder with Test mode, nonces, hashes and violation logging, security.txt with auto-renewing expiry and optional PGP signing, readiness scanner with one-click fixes, infrastructure checks with environment-aware guidance, and a plain-language Security Center dashboard.

Computernørden's Security Panel

标签

下载

详情介绍:

安装:

升级注意事项:

常见问题:

更新日志: