Ensomedia Security powered by shieldwave.io
| 开发者 | shieldwave |
|---|---|
| 更新时间 | 2026年9月30日 12:50 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Official checksums first. Every WordPress core file, every plugin from the WordPress.org directory and every directory theme is compared with the exact files WordPress.org published for your version. A file that matches is trusted and never "looks suspicious". A file that differs is reported with the reason.
- Malware detection that needs real evidence. One weak signal, such as base64 in a file, is never a finding. The scanner looks for code that runs what a visitor sends, decodes and executes hidden payloads, hides function names, fetches remote code or creates hidden administrators. Findings ShieldWave is not sure about are listed under "Ask your developer to check" and never send email.
- Change monitoring for everything WordPress.org cannot verify. Premium plugins, custom themes, must-use plugins and drop-ins are recorded as a baseline. Changes that come with an update are accepted on their own; a new PHP file that appears without one is reported.
- Alerts that do not cry wolf. One email per scan, only for problems that are new or got worse, never twice for the same one, at most four a day. A check that could not run (for example because WordPress.org did not answer) never sends an email and never marks anything as fixed.
- Locks out password guessers. Too many failed logins lock an address out for a while, and your user names stay private. New installs are protected out of the box, and the address that turns it on is never locked out.
- A stolen password is not enough. Turn on two-factor login and ShieldWave asks for a one-time code from your authenticator app after the password. It is opt-in and per person, with recovery codes and a shell rescue, so you can never lock yourself out.
- Two common ways in, closed with one switch each. Turn off the plugin and theme file editor and XML-RPC in ShieldWave's settings, without touching wp-config.php. The scan tells you when each one is worth it.
- Light on your server. Scans never run while a visitor's page loads: they run in the background in short steps that fit hosts with a 30-second limit, and files that did not change since the last scan are not analyzed again.
- Never rewrites your site. The plugin never edits, moves or deletes your files, users or settings. It explains each fix. The only things it ever refuses are a bad login, a stranger asking for your user list, and the file editor and XML-RPC if you switch them off.
- Malware and backdoors: analyzes every PHP, JavaScript and .htaccess file that WordPress.org cannot vouch for, with rules for web shells, request-to-execute code, decode-and-execute chains, obfuscated function names, remote code loaders, PHP hidden in images, spam mailers, hidden administrators, injected JavaScript and malicious redirects.
- WordPress core files: every core file against the WordPress.org checksums for your version and language, plus PHP files in wp-admin, wp-includes or the site root that are not part of WordPress.
- Plugin files: plugins from the WordPress.org directory against the checksums of the installed version, plus PHP files the release does not contain.
- Theme files: themes from the WordPress.org directory against their release package.
- File changes: new and changed files outside those releases (premium plugins, custom themes, must-use plugins, drop-ins, the site root) against the recorded baseline, and plugin or theme folders that appear without going through the WordPress installer.
- PHP files in uploads: web shells, PHP files and .htaccess or .user.ini rules that make the server run uploads as PHP.
- Known vulnerabilities (opt-in): plugins, themes and WordPress versions with published vulnerabilities, premium ones included, with the version that fixes each one. Uses the ShieldWave vulnerability lookup, which is free and needs no account; see External services.
- Closed and abandoned plugins: plugins closed on WordPress.org (a security reason is flagged high) and plugins without an update for two years.
- Unused plugins and themes: installed but switched off, so you can delete what you do not need.
- WordPress, plugin and theme updates, and PHP version support.
- Live threat feed: when ShieldWave publishes new malware rules or confirmed file signatures, your site picks them up within about three hours, verified by signature, so detection can improve between plugin updates. It sends nothing about your site.
- AI second opinion: for a file the local rules cannot judge, a redacted excerpt is sent for a language-model verdict in plain words. Site address, emails and anything key-like are removed first; wp-config.php is never sent. See External services.
- Injected content: scripts, hidden iframes and spam links that attackers add to posts, widgets and options. Ordinary embeds and tracking codes are recognised and left alone.
- Exposed files: readable copies of wp-config.php with the database password, database dumps, backup archives, .git folders, .env files and logs that your web server hands out to anyone, confirmed by requesting them from your own site; leftover migration installers and database tools; folder listings.
- Administrator accounts, user registration, wp-config.php, debug output, file editor, XML-RPC and HTTPS.
- User list exposure and suspicious scheduled tasks: whether the REST API hands your user names to anyone, and scheduled tasks that no plugin owns and carry code or a web address.
- Stops brute-force logins: after five failed logins from one address (you choose), that address waits a cooldown you set. The lock is always temporary, and trusted addresses, including the one that turned the feature on, are never locked.
- Keeps user names private: the login form stops confirming them, and visitors who are not logged in get none from the ?author=N trick, the REST API user list, embeds or the users sitemap. Logged-in requests work as before.
- Every lockout goes to History and can raise an alert. On by default for new installs, off after an upgrade until you turn it on. It uses only the connection's own address, never a header a request can fake.
- A second step at sign-in: a one-time code from any authenticator app (Google Authenticator, Authy, 1Password and others) after the password, for each administrator who turns it on.
- No lock-outs: the code is only required after you confirm your app makes the right one; ten single-use recovery codes cover a lost phone, and
wp shieldwave two-factor disable <user>rescues an account from the shell. - Every sign-in with the password asks for the code, from the login page or any other login form, such as a shop's account page. Apps and integrations sign in with an application password; the plain password is refused over XML-RPC and the REST API for an account with two-factor on. Codes cannot be replayed, and wrong codes are rate-limited.
- Turn off the file editor: the plugin and theme code editor leaves the dashboard, so a stolen administrator password cannot plant code through it. Updates keep working.
- Turn off XML-RPC: xmlrpc.php stops offering WordPress methods, which closes bulk password guessing and pingback floods. ShieldWave warns you first if a plugin you use, such as Jetpack, needs it.
- Both are off until you turn them on, and neither edits wp-config.php or any other file.
- After scheduled scans: new or more serious issues at or above your threshold (critical only, high and above, or medium and above).
- In real time: when an account becomes administrator, naming who did it, and flagging it as urgent when nobody was signed in.
- A weekly summary, if you want one.
assets/fonts/inter-license.txt). It is loaded from the plugin itself, only on the ShieldWave screens.
安装:
- Install the plugin from Plugins > Add New, or upload the
ensomedia-securityfolder to/wp-content/plugins/. - Activate it.
- Open ShieldWave and press Scan now. The first scan records the baseline and usually takes a few minutes; later scans are faster.
- Scheduled scans run daily at 03:00 (site time). Change that, the alerts and the options under ShieldWave > Settings.
- Optional: turn on the known-vulnerability lookup under ShieldWave > Settings > Live protection.
- Optional: to see the site in the ShieldWave dashboard, press Connect with shieldwave.io under ShieldWave > Settings > ShieldWave account.
屏幕截图:
常见问题:
Do I need a ShieldWave account?
No. All 23 checks, scheduled scans, email alerts and the vulnerability lookup work without one, with no limits.
Can I hide ShieldWave from the toolbar?
Yes. Under ShieldWave > Settings > Toolbar, turn off "Show ShieldWave in the toolbar". The choice is per administrator. Visitors never see it.
How is this different from other security scanners?
It trusts the files WordPress.org can vouch for, needs real evidence before it calls something malware, and emails only about problems that are new or got worse. The goal is that every alert you get is one you would want.
What does "Ask your developer to check" mean?
The scanner found something unusual that is often harmless: for example a new PHP file in a premium plugin without an update. It is listed so someone who knows the site can look at it, and it never sends an email on its own. Problems under "Fix now" are the ones with clear evidence.
A finding is about a file I changed on purpose.
Open the item and press "Ignore". It stays out of the score and the alerts, and an ignored file comes back by itself if it changes again. Ignored items stay under the "Ignored" link below the to-do list, where "Restore" brings one back.
Will it slow my site down?
No. Scans never run while a visitor's page loads: they work in the background in steps of a few seconds, and later scans skip files that were clean and did not change. On a busy shared host you can choose the low scan speed in Settings.
Which outside requests does it make?
Only when scans run: to WordPress.org for checksums, theme packages and plugin information, and to your own site. With the vulnerability lookup, live threat feed or AI second opinion on: to shieldwave.io. With an account connected: to shieldwave.io. Each of those is off until you turn it on, and the External services section below lists exactly what is sent.
Why does the plugin register a public AJAX action?
The AJAX action shieldwave_worker lets a running scan continue in the background; it does nothing without the random token of the running scan. The plugin's REST routes answer administrators only.
My headless front end reads authors from the REST API.
With login protection on, the REST API user list answers only logged-in requests, so an anonymous request for an author gets an error. To keep the list public, add add_filter( 'shieldwave_hide_user_list', '__return_false' ); to a small plugin or to your theme's functions.php. The same filter also brings back the author fields in embeds and the users sitemap.
Does it work on multisite?
Yes, network-wide. Scanning, the schedule, alerts, the settings screens and the optional ShieldWave account all live on the main site, in the Network Admin, for network administrators only. Every other site of the network enforces the same choice made there: when login protection, two-factor or a hardening switch is on, it is on for that site too, with no separate settings screen to set up. A lockout after failed logins is shared by the whole network, not counted per site, so an address cannot dodge the limit by trying a different site.
Does it work without WP-Cron?
Yes. If WP-Cron is disabled or loopback requests are blocked, scans still run while the ShieldWave screen is open, and scheduled scans run whenever your server cron calls wp-cron.php.
How is the score calculated?
It starts at 100. For each check, the most serious open issue takes off points: critical 30, high 15, medium 8, low 3. Ignored issues, hints and checks that could not run take nothing off.
Which languages does it speak?
English, Arabic, Chinese (Simplified), Dutch, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese (Brazil), Russian, Spanish, Swedish, Turkish and Vietnamese. The screens, the login protection and the alert emails follow the language of your WordPress admin, and Arabic gets a right-to-left layout. Regional variants such as Spanish (Mexico), German (Switzerland) or French (Canada) use the main language. A translation from translate.wordpress.org, once one is complete, takes precedence.
The old ShieldWave Security from shieldwave.io is installed too.
Builds downloaded from shieldwave.io before the directory listing were called ShieldWave Security, numbered up to 3.6.6, and live in the folder shieldwave-security. They cannot update themselves to this plugin. Keep Ensomedia Security active, deactivate ShieldWave Security, then delete it on the Plugins screen: the settings, results and two-factor set-ups carry over, because Ensomedia Security keeps them while the old copy's clean-up runs. The Plugins screen shows a notice while an old copy is installed.
What does connecting to shieldwave.io do?
It shows the site in your shieldwave.io dashboard with its score and open problems, next to the outside scan of shieldwave.io, and confirms that the domain is yours, which the full outside scan needs. A free account shows one site. Everything in the plugin works the same without it.
I think a finding is wrong.
Open a topic in this plugin's support forum with the check name and what you see. False positives are treated as bugs.
How do I report a security problem in the plugin?
Follow https://shieldwave.io/legal/en/vulnerability-disclosure. Please do not post it in the public support forum.
更新日志:
- Connect with shieldwave.io in one click, from Settings or the Overview: sign in or create a free account there, press "Connect this site" and you are back. Pasting an API key still works, under "Use an API key instead".
- A free shieldwave.io account shows one site in the dashboard, with its score and open problems.
- While connected, shieldwave.io confirms that the domain is yours from an invisible tag on the home page, so its full outside scan can run on the site.
- Disconnecting removes the site and its results from shieldwave.io, and a copy of the site at another address (a staging copy) shows as a site of its own.
- The dashboard shows the AI second opinion on a file, and problems you ignored as ignored.
- Known vulnerabilities: plugins whose folder name has capital letters are matched again, and one plugin the lookup cannot read no longer stops the check for all the others.
- The old ShieldWave Security from shieldwave.io and this plugin can be installed side by side without losing anything: deactivating or deleting one leaves the settings, results, schedule and two-factor set-ups of the other alone, and a notice says how to remove the old copy.
- Problems about administrator accounts are sent to the dashboard without the account names, and the texts about what is sent say exactly that.
- "Turn all of it on" beside Live protection on the Overview works without JavaScript too.
- A clearer Overview: every group of problems has its own heading above its list, a row shows the name of the problem, and everything else opens with a click.
- The tabs in the header are easier to see, and the Settings tab shows how many protections are still off.
- The look of shieldwave.io: its colours, and its planet beside the status of your site. The planet marks where your site is and shows a simulation of typical bot traffic; a button beside it stops the motion.
- The screens grow with the window on large monitors, and buttons are easier to hit on phones.
- "New" marks a problem only when some problems are new and others are not.
- When a problem has no WordPress screen to open, "Copy for your developer" is the main button.
- No request for a review while something urgent is open.
- "Turn on" beside Known vulnerabilities opens the right part of Settings, and the time of an AI second opinion no longer says "ago" twice.
- In the dark theme the hour of the automatic scan stays readable while its list is open, and switches that are off have a visible edge.
- Emails display correctly in Outlook on Windows: the button keeps its padding, the fonts stay the same in every part of the message, and a long file path wraps instead of widening the message.
- The ShieldWave mark in emails is in the brand colour, so it shows in Outlook's dark mode too.
- Translated into Arabic, Chinese (Simplified), Dutch, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese (Brazil), Russian, Spanish, Swedish, Turkish and Vietnamese.
- Right-to-left layout for Arabic and other right-to-left admin languages.
- The ShieldWave mark in the plugin's header and admin menu, the same as on shieldwave.io.
- Alert emails carry the ShieldWave mark (embedded in the email, nothing is loaded from outside), a clearer layout and a right-to-left layout for Arabic.
- After a few scans, the Overview asks once whether you would review the plugin on WordPress.org. "Later" and "Do not ask again" are remembered per administrator.
- First release in the WordPress.org directory.
- Builds downloaded earlier from shieldwave.io were numbered up to 3.6.6. To switch, deactivate and delete that copy, then install this one; the first scan starts the file history again.