Linux 软件免费装

在这里免费安装WordPress以及其他软件

Banner图

Flex Website Security

开发者 flexfields
hovoqoch
更新时间 2026年9月2日 15:29
PHP版本: 7.4 及以上
WordPress版本: 7.1
版权: GPLv2 or later
版权网址: 版权信息

标签

recaptcha security login xml-rpc turnstile

下载

详情介绍:

Flex Website Security is a lightweight hardening toolkit — not a full WAF or malware scanner. It reduces common attack surfaces: brute-force logins, XML-RPC abuse, user enumeration, and loose admin defaults. Admin CSS and JavaScript ship with the plugin. Remote scripts and API calls run only when you enable captcha or the optional country lookup. Privacy IP lockouts and permanent blocks are stored in your WordPress database. Only administrators can view or change them on Flex Website Security → Access. Captcha (off by default): if you choose Cloudflare Turnstile or Google reCAPTCHA and save both keys, the login form loads that provider’s script and sends the visitor IP plus the captcha token to the provider for verification. Country lookup (off by default): country rules first use CDN headers (Cloudflare, CloudFront, and similar). If you enable the optional geojs.io lookup, public visitor IPs without a header are sent to geojs.io and cached for 7 days. See Third-party services below for URLs, terms, and privacy policies.

安装:

  1. Upload the flex-website-security folder to /wp-content/plugins/, or install the zip via Plugins → Add New → Upload Plugin.
  2. Activate Flex Website Security.
  3. Go to Flex Website Security → Settings and save the hardening options you need.
  4. Optional: Login page for a custom login URL and captcha.
  5. Optional: Access for lockouts, permanent IP blocks, and country rules.
  6. Open Audit to confirm which protections are on.

升级注意事项:

1.2.3 Renamed to Flex Website Security. 1.2.2 Plugin URI removed for now. Author URI remains https://flexible.am/. 1.2.1 Readme and review fixes. Access → Clear lockouts now works. Permanent IP blocks are still kept.

常见问题:

Is this a firewall or malware scanner?

No. Flex Website Security turns on common hardening options. Pair it with Flex SSL for HTTPS and HSTS, and keep WordPress, themes, and plugins updated.

What if I lock myself out of a custom login URL?

Add define( 'FLEX_SECURITY_DISABLE_CUSTOM_LOGIN', true ); to wp-config.php, or rename the plugin folder over SFTP. Bookmark the new login URL before you log out.

What if a country rule blocks the site or login?

Add define( 'FLEX_SECURITY_DISABLE_COUNTRY_BLOCK', true ); to wp-config.php, then fix Mode, Apply to, or the country list on Access. Whole website mode still allows the login form so you can sign in and change the rule. Admin-only mode restricts login and wp-admin for guests.

Does Clear lockouts remove permanent IP blocks?

No. It removes temporary failed-login lockouts only. Permanent blocks stay until you Unblock them on Access.

Do captcha failures count toward lockout?

No. Failed captcha checks do not increment the attempt counter.

Will this break Jetpack or a mobile app?

Disabling XML-RPC or Application Passwords can affect older apps and some Jetpack features. Turn those options off if you still need them.

What happens when I uninstall?

Deleting the plugin removes settings, IP lockouts/blocks, and country lookup cache. It does not remove DISALLOW_FILE_EDIT if you defined that constant yourself in wp-config.php.

更新日志:

1.2.3 1.2.2 1.2.1 1.2.0 1.1.0 1.0.0