FPX Security Guard
| 开发者 | mamuniu06 |
|---|---|
| 更新时间 | 2026年9月29日 00:18 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
FPX Security Guard closes the openings attackers actually use, and does it without sending your site's data anywhere. There is no account to create and no cloud dashboard: everything runs on your own server.
What it does
- Login protection — limits failed login attempts per IP with a configurable lockout, shows generic errors that leak no hint about which half of the login was wrong, and hides a honeypot field that silently blocks bots.
- Two-factor authentication — standard TOTP (Google Authenticator, Authy, 1Password and the rest). Users turn it on from their own profile, scan a QR code, and get ten one-time recovery codes. Works entirely offline.
- Firewall — blocks SQL injection, XSS, path traversal and RCE patterns in the URL, POST body and cookies, plus known scanner tools and direct requests for sensitive files like .env, .git and wp-config.php.
- Rate limiting — slows down request floods from a single address.
- Security headers — X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, and HSTS on HTTPS.
- CAPTCHA — optional reCAPTCHA v2 or hCaptcha on the login and comment forms, using your own key pair.
- Hardening — turns off XML-RPC and the built-in theme/plugin file editor, removes the WordPress version from your pages, and blocks ?author=N enumeration and the public REST users endpoint.
- Comment protection — honeypot and link limits.
- IP allow and deny lists — trust or block specific addresses and IPv4 ranges. Allowed addresses bypass every other rule.
- Reverse-proxy support — if your site sits behind Cloudflare or a load balancer, tell the plugin, and per-IP blocking acts on the visitor's real address instead of the proxy's. The settings screen shows you the address it currently sees so you can confirm it.
- Overview — a checklist where each gap explains what it costs you and, where possible, is fixed with one click, next to a running count of what was actually blocked over the last seven days.
安装:
- Upload the
fpx-security-guard-profolder to/wp-content/plugins/, or upload the zip via Plugins → Add New → Upload Plugin. - Activate the plugin through the Plugins menu.
- Configure options under Settings → FPX Security Guard.
常见问题:
I enabled Custom Login URL and now I can't find my login page.
Your new login address is whatever you set as the "Login Slug" under Settings — e.g. yoursite.com/your-slug/. It's shown right on the settings page once enabled. If you forget it entirely, add define( 'FPXSG_LOGIN_BYPASS', true ); to wp-config.php to restore normal wp-login.php access, log in, check the slug under Settings, then remove the line.
I enabled Emergency Lockdown and now I can't get back in.
Three rescue paths, in order of ease:
- wp-login.php always works — the lockdown never blocks the login page itself, so sign in as an administrator and it will let you straight through.
- It expires automatically — every lockdown has a maximum duration (set when you enabled it, up to 72 hours) and turns itself off.
- Server access (site owners) — add this line to your wp-config.php file:
define( 'FPXSG_LOCKDOWN_BYPASS', true );— this immediately lifts the lockdown for everyone. Remove the line once you're back in.
I'm locked out of two-factor authentication. How do I get back in?
There are three rescue paths, in order of ease:
- Recovery codes — enter one of your saved one-time recovery codes in the Authentication Code field on the login screen.
- Ask an administrator — any admin can open Users → your profile and reset your 2FA with one click. You can then log in with just your password and set 2FA up again.
- Server access (site owners) — add this line to your wp-config.php file:
define( 'ISG_DISABLE_2FA', true );— this temporarily bypasses 2FA for all logins. Log in, reset your 2FA from your profile, then REMOVE the line again. Because it requires file access, only someone who controls the server can use it.
Will this conflict with other security plugins?
Avoid running multiple firewall/login-limit plugins at once — features may overlap.
I use Jetpack or a mobile app to publish.
Disable the "Disable XML-RPC" option in settings.
更新日志:
1.4.1
- Fixed: the admin screen loaded without its stylesheet on some installs.
- Fixed: the "See pricing" link pointed at a page that no longer exists.
- Changed: clearer notice when an older 1.0.x copy of the plugin is still active.
- New: reverse-proxy support. On a site behind Cloudflare or a load balancer, every visitor previously appeared to share the proxy's IP address, which quietly broke rate limiting, lockouts, auto-ban and geo blocking. Settings → "How visitors reach your site" now shows the address the plugin currently sees, so you can confirm it at a glance. Forwarded headers are only trusted once you opt in, and for Cloudflare only when the request genuinely arrives from Cloudflare's network.
- New: first-run setup. One button applies the settings suited to a typical site, skipping anything that could lock you out.
- New: the Overview tab now reports what was actually blocked over the last seven days, and every failing check explains the consequence and offers a one-click fix instead of just a red cross.
- New: Live Traffic can log errors only, and has a hard ceiling on stored rows so a flood cannot fill your database between hourly cleanups.
- Changed: redesigned the admin screens — grouped settings, switch controls, and a sticky save bar.
- Changed: "AI Threat Detection" is now "Behavioural Threat Scoring". The feature is unchanged; the old name overstated what it does.
- Live Traffic Monitor: redesigned again in a clean, light modern style (icon-badged stat cards, indigo accent, proper toggle switch, refined table) that fits naturally into wp-admin instead of a dark floating panel.
- Live Traffic Monitor: redesigned as a dark "security console" dashboard — live stats strip (unique IPs, error count, logged-in hits), instant filter box, colored status/method badges, country flag emoji, and animated incoming rows.
- Security: sensitive query-string values (license keys, passwords, tokens, API keys) are now masked before being stored in — or displayed from — the traffic log.
- Malware Scanner: expanded pattern list (more webshell signatures, hex/chr obfuscation, dynamic call-from-request, downloader patterns).
- Malware Scanner: optional VirusTotal cross-check — hashes (never file content) of flagged findings and a small sample of recently-modified files are checked against VirusTotal's antivirus engines.
- New: Custom Login URL — hides wp-login.php behind a secret slug.
- New: IP Whitelist / Blacklist — trusted IPs bypass all blocking; blacklisted IPs are denied immediately.
- New: Auto-Ban Repeat Offenders — automatically bans IPs that repeatedly trip other blocking features.
- New: Activity Log — audit trail of settings, user/role, plugin/theme changes, and logins.
- New: Core File Integrity Check — verifies core files against official WordPress.org checksums.
- New: Security Score Dashboard — one-glance checklist of your site's security posture (now the default landing tab).
- New: Login Notification Emails — optional email on every login, not just new devices.
- New: CAPTCHA — optional reCAPTCHA v2 / hCaptcha on login and/or comment forms.
- New: Malware Scanner — flags PHP-executable files in uploads and backdoor/obfuscation patterns in plugins/themes, with one-click quarantine.
- New: Vulnerability Scanner — checks core/plugin/theme versions, PHP version, debug output, HTTPS, and other hardening gaps.
- New: Scheduled Scan — runs both scanners automatically (daily/weekly) with email alerts.
- New: Geo Blocking — Country Block now supports an allow-list mode, in addition to block-list.
- New: Live Traffic Monitor — real-time request log in wp-admin.
- New: AI Threat Detection — local heuristic risk scoring for suspicious requests.
- New: Device Fingerprinting — email alert on a never-seen-before login device.
- New: Cloud Threat Intelligence — optional AbuseIPDB integration with your own API key.
- New: Session Manager — view and force-end active login sessions per user.
- New: Emergency Lockdown — one-click, auto-expiring site lockdown with a wp-config.php escape hatch.
- Settings page reorganized into tabs: Settings, Malware Scanner, Vulnerability Scanner, Live Traffic, Threat Log, Sessions, Emergency Lockdown.
- Initial release.
- Login protection: per-IP attempt limits, lockouts, honeypot, generic error messages.
- Two-Factor Authentication (TOTP): QR-code setup, recovery codes, low-code warnings, works offline.
- DDoS/flood protection via per-IP rate limiting.
- Firewall: malicious query blocking and modern security headers.
- Country blocking (optional, via ip-api.com with local caching).
- Comment spam protection: honeypot and link limits.
- Daily critical-file change detection with admin and email alerts.
- Hardening: XML-RPC off, file editor off, version hiding, user-enumeration blocking.
- Bundled QRCode.js by davidshimjs (MIT license, GPL-compatible) for local QR rendering.