| 开发者 | fazlebari |
|---|---|
| 更新时间 | 2026年10月31日 17:56 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
wp-admin or clash with existing caching layers. With FBS Secure Optimize, every engine has its own 1-Click Master Toggle in the Module Control Center:
loading="lazy" and decoding="async" to offscreen images while automatically prioritizing your first above-the-fold hero image with fetchpriority="high".defer to frontend scripts while automatically excluding jQuery core and sensitive checkout/account flows.<head> RSD, WLW, and shortlink tags.admin-ajax.php polling to 60 seconds to prevent CPU spikes and 502 timeouts on shared or VPS hosting.
2. Database & Autoload Cleaner
Keep MySQL lean for sub-200ms Server Time to First Byte (TTFB):
> 7 days), spam and trashed comments, expired transients, and orphaned postmeta rows.
OPTIMIZE TABLE across core tables manually or automatically via daily, weekly, or monthly WP-Cron schedules.wp_options size (in KB) alongside your Top 5 Heaviest Autoloaded Options so hidden database bottlenecks never go unnoticed.
3. HTTP Security Headers
Achieve a hardened browser security posture without breaking stylesheets, fonts, or payment gateways:
X-Content-Type-Options: nosniff (MIME-sniffing defense)
X-Frame-Options: SAMEORIGIN (clickjacking protection)Referrer-Policy: strict-origin-when-cross-originPermissions-Policy (restricts unauthorized camera, microphone, geolocation, and USB access)Strict-Transport-Security (HSTS) for HTTPS sites?ver=)
4. Unified Login Brute-Force Shield
Stop automated credential-stuffing and brute-force bots before they exhaust PHP workers:
wp-content/uploads/ PHP Execution Shield: Generates hardened .htaccess rules blocking direct execution of backdoor .php, .phtml, and .phar shells uploaded into media folders.
X-Pingback: Eliminates amplified system.multicall brute-force and pingback DDoS vectors.?author=1 archive scans and restricts unauthenticated REST API /wp/v2/users enumeration.wp-admin via capability mapping (map_meta_cap)..php drop-ins sitting in your site root (ABSPATH).
wp-admin/ and wp-includes/ against official api.wordpress.org cryptographic MD5 hashes.uploads/ Shell Scan: Detects disguised PHP webshells inside wp-content/uploads/.mu-plugins Persistence Audit: Inspects Must-Use plugins where stealth malware often hides from the standard Plugins screen.wp_options DB Scan: Scans plugins, themes, and database options for obfuscated eval(base64_decode(...)), gzinflate, shell execution, and injected script payloads, complete with a Safe Read-Only Code Snippet Preview modal.pre_user_query Hidden-Admin Detector: Compares high-level WP_User_Query results against raw database capabilities usermeta rows to expose rogue administrator accounts hidden by malicious hooks.0 (includes safe Learning Mode).HTTP 429 Too Many Requests) to prevent scraper floods from triggering 502 Bad Gateway crashes.Content-Security-Policy directives in Report-Only mode before enforcing Grade A+ headers, plus automated daily scan email alerts.wp-admin (or enables scheduled scans in Pro), the plugin connects to the official public WordPress.org Core Checksums API (https://api.wordpress.org/core/checksums/1.0/) to fetch official MD5 file hashes for your installed core version and locale.
version=7.1&locale=en_US), solely when a scan runs.fbs-secure-optimize folder to /wp-content/plugins/).wp-content/uploads/ to block PHP execution in media directories.No. Every engine is controlled by an Independent Module Toggle in the Module Control Center. If another plugin already handles script deferring or lazy loading, simply toggle Asset & Bloat Optimizer off—disabled modules are bypassed at boot and register zero frontend hooks, while you continue enjoying Database Cleanup, Autoload Inspection, Security Headers, Login Protection, Core Hardening, and the 6-Layer Malware Scanner.
Yes. Turning any module off in Module Control Center immediately hides its configuration panel (and hides the corresponding top navigation tab if all modules in that group are disabled) while safely preserving your saved preferences in case you re-enable it later.
Yes. Unlike aggressive lazy-loaders that delay your top hero banner and hurt Largest Contentful Paint (LCP), FBS Secure Optimize automatically skips lazy-loading on the first image in your content and adds fetchpriority="high". Likewise, JavaScript deferring automatically excludes jQuery core and sensitive cart/checkout pages.
No. The free HTTP Security Headers module ships with safe, standards-compliant defaults (X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, and Permissions-Policy) that never block third-party CSS, fonts, or payment scripts. Every header is individually toggleable.
Sophisticated malware often creates a backdoor administrator account and hooks pre_user_query or users_list_table_query_args so the rogue account is completely invisible on your Users → All Users screen. Layer 6 of our scanner cross-checks standard user queries against raw usermeta capability rows in MySQL to expose any hidden or stealth-elevated administrator immediately.
Never automatically. In the Free edition, the 6-Layer Scanner performs a 100% safe, read-only forensic audit and lets you inspect suspicious code inside the Safe File Snippet Preview modal so core or custom files are never accidentally deleted. One-click deletion and auto-disarming are optional tools available in Pro.
Uninstalling the plugin through the Plugins screen cleanly removes its saved options, clears scheduled cleanup cron hooks, and drops its custom fbsseop_login_attempts database table—leaving zero orphaned clutter behind.
pre_user_query) Scanner with safe code snippet preview modal.wp-content/uploads/.htaccess PHP Execution Shield, XML-RPC blocker, author/REST user enumeration defense, file editor lock, and High-Risk Plugin detector.wp_options Autoload Bloat Inspector displaying total autoloaded KB and Top 5 heaviest autoload rows.fetchpriority="high" on first hero image), iframe lazy loading, Emoji/Dashicons bloat removal, and 60s Heartbeat API throttling.