Lockora Security Audit -- WordPress 插件

Lockora Security Audit helps site owners and agencies review a WordPress site's security posture from the admin area.

开发者	cmdgw
更新时间	2026年8月6日 01:40
PHP版本:	7.4 及以上
WordPress版本:	7.0
版权:	GPLv2 or later
版权网址:	版权信息

Upload the lockora-security-audit folder to /wp-content/plugins/.
Activate Lockora Security Audit from the Plugins screen.
Go to Tools > Lockora Security Audit.
Click Run Scan.

0.3.1

Added CSV and TXT exports for WordPress core integrity results.
Added a clipboard action for unexpected WordPress core files.
Added guarded one-click rotation of authentication keys and salts stored directly in wp-config.php.

0.3.0

Added bounded scan history and current-versus-previous finding comparisons.
Added contextual links from findings to Who Changed It? or its WordPress.org listing.
Added the lockora_scan_completed action for scan-result integrations.

0.2.2

Added: style altered WordPress core files list items and heading in red color (#b32d2e) for enhanced visibility.

0.2.1

Fixed: core integrity checks now show the full list of altered/missing/extra files through an interactive collapsible UI details panel when there are more than 5 files.
Added: auto-trigger scan update when loading the admin dashboard after plugin upgrade, ensuring the detailed file lists are populated immediately without manual intervention.

0.2.0

Fixed: wp-config.php can now be found one directory above the WordPress root, matching core behavior.
Fixed: authentication salt checks now use runtime constants, so salts defined outside wp-config.php (for example Bedrock-style configs) are no longer reported as missing and can no longer receive duplicate defines.
Fixed: generated salts can no longer be corrupted by regex replacement characters, and wp-config.php writes are now verified and rolled back if the written file does not match.
Fixed: admin notices are stored server-side instead of being read from the URL, removing a notice spoofing vector.
Fixed: network-activated plugins are no longer reported as inactive on multisite.
Fixed: the inactive administrator check now uses recorded last-login times instead of short-lived session tokens, removing false positives.
Fixed: the security header check falls back to GET when a server rejects HEAD requests, and the default fallback theme now follows WP_DEFAULT_THEME.
Added: public exposure checks for debug.log, readme.html, uploads directory listing, PHP execution in uploads, and author enumeration.
Added: SSL certificate expiry, database table prefix, automatic update posture, and login protection plugin checks.
Added: Site Health integration with a scan summary and key configuration tests.
Added: WP-CLI commands wp lockora scan and wp lockora report with JSON output and a --strict flag for CI.
Added: uninstall cleanup that removes all plugin options, transients, and user meta on deletion.
Hardened: AI report generation now uses a lock against concurrent requests, sanitizes finding text before prompting, and instructs the model to treat finding text as untrusted data.

0.1.2

Lowered the required WordPress version to 6.0 for non-AI security scanning and hardening checks.
Kept AI client reports disabled unless WordPress 7.0+ AI Client support is available.

0.1.1

Fixed HTTP security header scanning when a server returns duplicate headers as arrays.

0.1.0

Initial prototype with manual scans, hardening checks, core integrity checks, PHP version checks, vulnerability posture checks, optional Wordfence feed matching, and optional client-ready AI reports.

Lockora Security Audit

标签

下载

详情介绍:

安装:

常见问题:

更新日志: