Gracewell Security Suite

开发者	gracewell89
更新时间	2026年10月14日 03:27
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPL-2.0-or-later
版权网址:	版权信息

下载

1.0.0

详情介绍:

Gracewell Security Suite provides these security tools:

Login attempt limits, IP lockouts, IP/CIDR allowlisting and an optional custom login URL.
TOTP authentication compatible with Google Authenticator, Microsoft Authenticator, Authy and other standard authenticator apps. Enrollment requires verification. Secrets are encrypted, backup codes are hashed and single-use, and trusted devices can be revoked.
Per-user 2FA, optional enrollment for other roles, administrator requirements and individual user setup requirements. Required users must complete setup before normal access resumes.
Manual WordPress core checksum verification, modified/missing core file reports, suspicious uploads and backdoor-pattern detection in plugin/theme PHP files. Core findings support bounded text differences and checksum-verified restoration. Suspicious files can be quarantined.
Hardening controls for XML-RPC, the file editor, version disclosure, user enumeration, security headers and executable scripts in uploads. Risk and passed/failed checks are calculated from enabled protections.
Activity logging, configurable retention, exports and responsive light/dark admin themes.

The scanner uses official WordPress.org core checksums. Plugin and theme checks are signature checks rather than official package integrity verification. Scan scope is bounded on large sites. Suspicious findings require review; they are not proof of malware. No external authentication service receives TOTP secrets. Uploads execution protection writes Apache 2.4 .htaccess rules. Nginx and other servers require equivalent server configuration. Security headers should be tested with your site's integrations.

安装:

Upload the gracewell-security-suite folder to /wp-content/plugins/.
Activate Gracewell Security Suite in the WordPress Plugins screen.
Open Security Suite and review login protection and hardening settings.
Scan the authenticator QR code, verify a six-digit code, then generate and save backup codes.
Bookmark your custom login URL and save its private recovery link before enabling URL protection.

升级注意事项:

1.0.0 Initial public release. Existing development settings and authenticator enrollment are preserved. Obsolete integrity-scan scheduling is removed.

常见问题:

Does Gracewell Security Suite require an API key?

No. Authenticator verification is local. Core checksums and original core files are fetched from WordPress.org. Admin scripts, animations and QR generation run from bundled local assets. The interface uses system fonts and sends no requests to font or script CDNs.

What if I lose my authenticator?

Use an unused backup recovery code to sign in. Another administrator can also reset your enrollment if necessary. After verified enrollment, intentionally generate 10 recovery codes and save the plaintext returned by that successful generation response. Normal page loads and get_2fa_data responses show only usage metadata, not old codes. Storage retains salted HMAC-SHA256 verifiers and authenticated encrypted display copies; the internal owner-only helper can still decrypt unused display copies when explicitly requested. Hash-only legacy codes remain usable but cannot be reconstructed. This is restricted disclosure, not irreversible show-once storage. To generate a replacement set, verify your current authenticator or an unused recovery code. This protects recovery credentials from changes by someone possessing only a logged-in session. A successful save replaces and invalidates all previous codes. Redemption removes the used code's verifier and encrypted display copy.

How can I recover a forgotten custom login URL?

The private recovery link shown on Login Protection grants temporary access to the standard login form. It still requires your password and any active 2FA. You can also define GWQSH_DISABLE_LOGIN_URL as true in wp-config.php. Disabling Custom Login URL in the plugin immediately restores the standard routes. The configured route adapts to pretty, index.php and plain WordPress permalinks.

Are scans scheduled?

No. Run scans manually on File Integrity. WordPress cron still handles log retention and expired lockout cleanup.

Does the scanner verify every plugin and theme against an original package?

No. Core files are checked against official checksums. Plugin/theme PHP and uploads are checked for suspicious patterns or executable file types. Files over the signature-scan size limit are skipped. Review scan scope information before interpreting results.

Which versions have been tested?

Minimum supported versions are WordPress 5.3 and PHP 7.4. The latest local integration tests used WordPress 7.1.2 and PHP 8.2.4. Minimum-version combinations have not been executed.

更新日志: