Dwarpal
| 开发者 | dwarpal |
|---|---|
| 更新时间 | 2026年11月8日 01:11 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Dwarpal (Dwarpal WP Security Plugin) protects your WordPress site from common threats, including:
- Firewall Protection - Automatically blocks malicious requests containing SQL injection, XSS, code injection, and directory traversal attempts
- Login Security - Protects against brute force attacks by limiting login attempts and locking out suspicious IP addresses
- SEO Hack Protection - Detects Thai/gambling spam, wp-config injectors, and bot cloaking via local User-Agent comparison (no Google scraping)
- Bot View Scanner - Compares browser vs search-bot responses on your own site; scans wp-config.php and index.php for known malware signatures
- Critical Options Monitor - Alerts when key WordPress settings (site URL, admin email, registration) are changed—catches takeover and redirect hacks
- Outbound Request Monitor - Logs outbound HTTP requests from your site to detect backdoors and data exfiltration
- Security Logging - Comprehensive audit log of all security events for monitoring and analysis
- WordPress Hardening - Removes WordPress version information, disables XML-RPC, and implements other security best practices
- Malware Scanning - Scans files for malware and suspicious patterns
- File Integrity Monitoring - Monitors core files for unauthorized changes
- Two-Factor Authentication - Adds an extra layer of security to login
- IP Blocking & Whitelisting - Block malicious IPs and whitelist trusted ones
- Live Traffic Monitoring - Real-time monitoring of website traffic
- Vulnerability Scanner - Checks for known vulnerabilities in WordPress core, plugins, and themes
- Threat Defense - Opt-in signature feed, virtual patches, auto-block reputation, and security digests
- OWASP Coverage Report - Maps enabled controls to OWASP Top 10 categories
安装:
- Upload the
dwarpalfolder to the/wp-content/plugins/directory - Activate the plugin through the 'Plugins' menu in WordPress
- Navigate to 'Dwarpal' in the WordPress admin menu to configure settings
常见问题:
What security features does Dwarpal provide?
Dwarpal provides firewall protection, login security, security logging, and WordPress hardening features.
Does Dwarpal affect site performance?
Dwarpal is designed to be lightweight and efficient. Security checks are performed early in the WordPress loading process to minimize performance impact.
Can I customize the firewall rules?
Yes, firewall rules can be customized through the admin interface. Additional customization options may be available in future versions.
How does the login security work?
The login security system tracks failed login attempts by IP address. After a configurable number of failed attempts, the IP address is temporarily locked out.
更新日志:
1.2.19
- Requires WordPress 5.3+. Outbound allow-list no longer trips Plugin Check offloading
- Plugin Check: nonce and REQUEST_URI sanitization warnings cleared on firewall and traffic logging
- Live Traffic screen reads 30 short rows and stops logging once the table is full
- Live traffic no longer stores every bot 404, and the traffic screen reads only the latest rows
- Firewall no longer blocks a normal page that contains an embed. IP lookups and media previews are not security events
- Live traffic and security logs show the server clock
- Security log times follow the site clock. Viewing a page is not logged as an SEO hack
- Firewall matches SQL injection, XSS, code injection, and directory traversal in the raw URL and in public form posts
- Fix: viewing a normal page is no longer logged as an SEO hack attempt
- Fix: live traffic records the real HTTP status. Missing pages were stored as 200
- Fix: activation no longer alters existing log tables, which timed out and returned Internal Server Error on large sites
- Fix: dashboard and scans no longer run COUNT(*) on the log tables
- Fix: HTTP errors, traffic and security logs are trimmed on a schedule (7 or 30 days)
- Fix: admin pages, plugin update checks and image requests are not written to the logs
- Fix: malware, integrity, vulnerability and update checks no longer start during the first page view after activation
- Fix: log tables use InnoDB, and old traffic rows are deleted in small scheduled batches, so page views no longer lock the tables
- Activation: database tables created with dbDelta (versioned schema, multisite aware); no output or external requests on activation
- Admin CSS/JS load only on Dwarpal screens
- File and directory locations resolved with WordPress functions; the plugin no longer deletes core files (readme.html removal option replaced by a server block rule)
- Vulnerability scan uses WordPress core update data instead of contacting external servers
- Fix: file integrity baseline is built in time-limited batches (no timeout on large or slow sites)
- Fix: update alerts and other scheduled tasks load required WordPress admin functions before use
- Fix: uninstall now removes plugin tables, options and scheduled events
- Fix: PHP warnings on the dashboard and on Firewall / 2FA settings save; 404s no longer logged twice
- Fix: "404 Exploit Attempt" is logged only for real 404 responses (admin pages and admin-ajax requests were reported as attacks)
- Security: capability checks on all admin screens and pending-user approve/reject
- Security: nonce verification on 2FA profile save
- Fix: approving a pending user no longer triggers a fatal error
- Plugin Check cleanup: text domain set to
dwarpalto match plugin slug/folder - Removed Google hostname string patterns that falsely triggered Offloading checks
- Removed debug error_log(); hardened nonce/sanitize handling and DB query annotations
- readme: Tested up to 7.1; shortened short description
- Plugin display name set to Dwarpal; description set to Dwarpal WP Security Plugin
- WordPress.org review hardening: sanitization, escaping, opt-in external services, uploads-only storage
- Text domain remains
dwarpalto match the directory slug
- Threat Defense: opt-in updatable signature/rule feed (bundled or remote JSON)
- Virtual patches for known vulnerable plugin request patterns (no file overwrites)
- OWASP Top 10 coverage mapping and admin report
- Opt-in smarter auto-block with local reputation scoring and optional remote lookup
- Daily/weekly security alerting digests (email)
- Centralized backup storage under uploads/dwarpal/ via WP_Filesystem
- Removed wp-config.php copies and wp-content/.htaccess writes
- File editor disable uses capability filter only (no DISALLOW_FILE_EDIT constant)
- Hardening PHP-block options are recommendations with copy-paste Apache rules
- Backup protection uses firewall rules only (no .htaccess modification)
- Fixed remaining text domain strings for plugin slug compliance
- Bot View Scanner: local cloaking detection (browser vs bot User-Agent) — replaces non-compliant Google search scraping
- SEO signatures from real incidents: eval/base64, web shells, Thai SEO APIs, mass-injection markers
- Daily core file scan (wp-config.php, index.php) with admin alerts
- Blocklist monitoring remains opt-in (disabled by default)
- Initial release
- Firewall protection
- Login security features
- Security logging
- WordPress hardening
- Admin interface