KUMITATE HOSHU -- WordPress 插件

开发者	motok1
更新时间	2026年10月29日 13:16
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

KUMITATE HOSHU ("kumitate-hoshu" is Japanese for protection) closes the ways most WordPress sites get broken into, with as little to configure as possible. Activate it and the protections that cannot lock you out are already on. Everything else is one switch, explained in plain words. Login

Limit login attempts: repeated failures from one address or for one user name are refused for a while, and the password is not even checked during the lock.
Two-factor login: each user can add a time-based code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app, with single-use recovery codes.
Change the login address (off by default): serve the login page at an address of your choosing and answer wp-login.php and the admin area with "not found" for visitors.

Fewer ways in

Hide user names: the author archive by number, the public users endpoint of the REST API, the users sitemap and login errors that confirm a name all stop giving names away.
Close unused doors: XML-RPC and pingbacks off, the theme and plugin file editors removed, the WordPress version hidden.
Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every response.

Checks

Settings check: a score out of 100 and a list of what to fix and how, from debug output to a user named "admin", PHP files in uploads, missing secret keys and waiting updates.
File integrity: the WordPress files on the server compared with the official list from WordPress.org, weekly and on demand; changed, missing and unexpected files are listed.
Known vulnerabilities: installed plugins, themes and WordPress compared with a public vulnerability list, weekly and on demand.
A log of logins, locks, backups, updates and checks, kept for 90 days and at most 20,000 entries, with addresses stored as hashes.

Keep

Backups: wp-content and the database in one .wpress file, the format All-in-One WP Migration (ServMask Inc.) imports, so a backup can also move a site elsewhere. Made by hand or every day or week, kept in a folder closed to visitors, with a chosen number of generations, and downloadable from the same screen. Restore from there too; the current state is backed up first. A .wpress from another site can be uploaded on the same screen and restored, with addresses and paths rewritten.
Automatic updates with a backup first: once a day, waiting plugin and theme updates are installed after a backup; the front and login pages are checked, and if the site stopped answering properly the updated items are put back from that backup and you get an e-mail.

Plugin Check notes a "plugin updater": that is the automatic-updates feature above, which installs updates from WordPress.org through the normal WordPress upgrader. The plugin never changes where updates come from. What this plugin does not do: it cannot protect the web server or operating system, stop a denial-of-service attack, or help once an attacker can already run PHP on the server. Keep WordPress, plugins and themes updated and keep backups away from the server.

Upload the plugin folder to /wp-content/plugins/ or install it from the Plugins screen.
Activate it. Login limits, user name hiding, hardening, headers and the settings check are on at once.
Open KUMITATE HOSHU in the admin menu, read the settings check, and turn on the external connection if you want the file and vulnerability checks.
On your profile, set up two-factor login and keep the recovery codes somewhere safe.

0.2.1

Known vulnerabilities: the check now asks the WPVulnerability database, because the Wordfence feed it used was withdrawn. One small request per installed plugin and theme replaces a list of tens of megabytes, so the check also works on small hosting plans. Plugins and themes closed on WordPress.org are reported too, since they get no more fixes.
Known vulnerabilities: a "Back up, then update" button next to each item that has a fix. The backup is made first (when Backups is on), the update follows, the site is checked, and the item is put back from the backup if the site stopped answering.

0.2.0

Backups in .wpress form, by hand or on a schedule, with restore and a pre-restore safety backup.
Automatic plugin and theme updates with a backup first, a health check and rollback from the backup.

0.1.0

First release: login limits, two-factor login, login address change, user name hiding, hardening, security headers, settings check, file integrity check, vulnerability check, log.

KUMITATE HOSHU

标签

下载

详情介绍:

安装:

常见问题:

更新日志: