Ironfang Security
| 开发者 | ironfang |
|---|---|
| 更新时间 | 2026年10月30日 03:26 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- whether WordPress, plugin and theme updates are available, using the update information WordPress has already stored, and how old that information is;
- which plugins and themes are installed but not in use, keeping one default theme as WordPress advises;
- whether the server's PHP version still receives security fixes, and how the site is set to update;
- whether WordPress is set up for HTTPS;
- whether PHP errors are shown to visitors, and whether a debug log is kept inside the site's files;
- whether the dashboard file editors are on, and who on the server can read or change wp-config.php;
- whether wp-config.php sets its own security keys and salts, or WordPress is using ones stored in the database;
- whether the uploads directory holds files named to run as PHP, which WordPress never puts there (by name only: files are never opened);
- whether copies of wp-config.php, .env files, database dumps, archives or .git folders are in the site's public directories (by name only: files are never opened or requested);
- what public registration grants, and which accounts have administrator-level access;
- which administrator accounts have application passwords, and which of those passwords are not being used.
- It does not change your site's settings, unless you turn off the file editors with it.
- It does not contact Ironfang or any other service.
- It is not a firewall or malware scanner, and it does not block attacks.
- It does not give your site a security score or certify that it is safe.
安装:
- Upload the plugin ZIP from Plugins › Add New Plugin › Upload Plugin, or extract it into
wp-content/plugins/ironfang-security. - Activate the plugin. Activation does not change any site setting.
- Open Ironfang Security in the admin menu. Only users who can manage site options can see it.
屏幕截图:
常见问题:
Does this plugin protect my site from attacks?
No. It is not a firewall and does not block traffic. It is intended to identify configuration risks so you can act on them.
Why do some results say "Could not be determined"?
A check reports that when it cannot observe enough to give an answer: for example when WordPress has not stored recent update information, or when a scan started from WP-CLI cannot see the web server's PHP settings. Such a result is never counted as passed. Each one explains what is missing and what to do.
What has it been tested with?
WordPress 6.8, 7.0 and 7.1, with PHP 8.1 to 8.5 (not every combination); Apache and nginx; a site behind an HTTPS reverse proxy; a site in a subdirectory; read-only site files; a Redis object cache; and alongside WooCommerce, WP Super Cache and Wordfence. Other set-ups have not been tested.
Where can I get help or send feedback?
Email hello@ironfang.com. If a check fails to run, include the reason it shows.
How do I report a security vulnerability in this plugin?
Email security@ironfang.com, privately, not in the support forum. Include the plugin, WordPress and PHP versions, steps to reproduce and the access an attacker needs. We acknowledge reports within 3 business days and give an assessment within 7 days. We aim to fix critical and high severity issues within 14 days of confirming them, and others within 90 days. We coordinate disclosure with you, publish an advisory once the fix is released, and credit you unless you prefer not to be. There is no paid bug bounty.
Can it turn off the file editors?
Yes, if you ask it to. On the "Dashboard file editor" check's page, choose "Turn off the file editors". Nobody, administrators included, can then edit theme or plugin code from the dashboard, as with DISALLOW_FILE_EDIT. Installing and updating plugins and themes keeps working. The check runs again to confirm it, and you can turn the editors back on there.
It works only while the plugin is active: deactivating or deleting the plugin turns the editors back on. For a permanent change, add DISALLOW_FILE_EDIT to wp-config.php. If something already turns the editors off, the plugin says so and does not offer the change.
From WP-CLI, run wp ironfang-security hardening apply file_editor --user=<administrator>, or undo to turn them back on. wp ironfang-security hardening list shows the current state, and log shows who changed it and when.
What happens when I uninstall it?
Deactivating stops any running scan and keeps the plugin's stored data. If you turned the file editors off with the plugin, they turn back on while it is deactivated, and off again if you reactivate it. Deleting the plugin removes the data it created and nothing else. To keep the results, download a report from Ironfang Security › Settings before deleting it; a deactivated plugin cannot make a report, so reactivate it first if needed.
更新日志:
- New: five checks. Security keys and salts in wp-config.php; files named to run as PHP in the uploads directory; copies of wp-config.php, .env files, database dumps, archives and .git folders in the site's public directories; unused application passwords on administrator accounts; and inactive plugins and themes. The file checks go by name only and never open the files.
- New: the last scan's results in Tools › Site Health, as a Status test and an Info section, for administrators. Site Health never runs a scan, and never says the site is safe.
- Fixed: the readme listed the screenshots twice.
- New: turn off the dashboard's theme and plugin file editors from the "Dashboard file editor" check's page, or with
wp ironfang-security hardening apply file_editor. It has the same effect as DISALLOW_FILE_EDIT without editing wp-config.php. The check confirms it, you can undo it, and each change is logged. It works only while the plugin is active, and is not offered when something already turns the editors off. - Changed: the file editor check reports when Ironfang Security turns the editors off, and reports a finding if other code turns them back on.
- Fixed: reports called the directory above WordPress the site root. It is now labelled "[directory above WordPress]".
- First release: twelve local checks covering updates, PHP support, update policy, HTTPS, PHP error display, the debug log, the dashboard file editors, wp-config.php permissions, registration and administrator accounts; a software inventory; findings with evidence and guidance, recheck and ignore; scan recovery; and a redacted report download.