DawsonyWeb Spam Protection and API Hardening
| 开发者 | dawsonyweb |
|---|---|
| 更新时间 | 2026年10月24日 18:45 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Master switch to completely disable all comments (form, REST API, XML-RPC, feeds)
- Invisible honeypot field to trap bots
- Minimum comment length enforcement
- Block all links or cap links per comment
- Require login to comment
- Keyword/phrase blocklist
- Disable XML-RPC entirely (removes X-Pingback header too)
- Hide
/wp/v2/usersendpoints from guests while keeping them available to signed-in users - Require authentication for all REST API requests
- Optionally disable the REST API completely
- Block author enumeration via
/?author=N
- Per-IP comment rate limiting (configurable max and time window)
- IP address blocklist - blocked IPs receive a 403 on any front-end request
- Rolling activity log (last 200 events)
安装:
- Upload the
dawsonyweb-security-shieldfolder to/wp-content/plugins/. - Activate the plugin through the Plugins menu in WordPress.
- Go to Security Shield in the admin menu to configure.
屏幕截图:
常见问题:
Can API restrictions affect other plugins?
Yes. Requiring login for all REST requests can affect public forms, WooCommerce blocks and external integrations. Disabling REST completely also breaks the block editor. Start with the defaults and test the affected workflow after changing a restriction.
Do settings on other tabs stay unchanged when I save?
Yes. Each form changes only the settings included on that tab.
Does this use a cloud security service?
No. Rules run on your WordPress site. There is no external scanning or telemetry.
Which IP address does the plugin use?
The direct connection address supplied by the server (REMOTE_ADDR). It does not trust visitor-supplied forwarding headers. If you use a reverse proxy, configure real client IP handling with your host before relying on IP controls.
Does it work with WooCommerce?
Yes, but protection settings can affect store features. Disabling all comments also affects product reviews. Requiring login for REST requests can block guest WooCommerce blocks and integrations, and disabling REST completely can stop those requests. Use Integration Checks and test checkout, reviews and integrations on staging after changing restrictions.
Will it break my contact form plugin?
Comment rules apply to WordPress comment submissions, not every contact form. However, a form that submits through the REST API can fail if REST is disabled or guests must log in. Test your form as a signed-out visitor. The plugin does not supply contact-form-specific spam filtering.
I use Cloudflare or a proxy. Will IP blocking work?
IP controls use the server's REMOTE_ADDR value, not forwarded IP headers. Ask your host to restore the real visitor IP safely from trusted proxies. Otherwise the plugin may see the proxy IP and a block could affect many visitors. Do not block a shared proxy address.
更新日志:
- Updated the plugin display name with distinctive DawsonyWeb branding. No functionality changes.
- Improved plugin directory listing and documentation.
- Updated the public plugin name and listing text. No feature, settings or data changes.
- Read-only Integration Checks explain compatibility considerations for the block editor, public forms, XML-RPC applications and WooCommerce reviews.
- Run guest and signed-in REST probes without changing protection settings. Activity logs now include clearer explanations and links to the relevant settings, plus reasons for REST restrictions.
- Redesigned dashboard and settings to match Product & Shipping Label Designer for WooCommerce with horizontal navigation and accessible focus indicators.
- Includes REST comment validation and rate limits, authentication-aware REST restrictions and equivalent IPv6 address matching from 1.1.1.
- Apply comment content rules and rate limiting to REST submissions.
- Run guest REST restrictions after WordPress cookie authentication.
- Match equivalent IPv6 blocklist addresses.
- Preserves settings on other tabs when saving. Keeps user endpoints available to signed-in editors. Added validated IP entries, bounded limits and a fixed rate-limit window. Refreshed the DawsonyWeb workspace.
- Compatibility: tested up to WordPress 7.0.
- Initial release.