| 开发者 | cmdgw |
|---|---|
| 更新时间 | 2026年9月20日 06:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
lockora-security-audit folder to /wp-content/plugins/.No. It provides reversible hardening toggles for selected low-risk settings. Other findings should be reviewed by an administrator, developer, or host.
No. The scanner works without AI on WordPress 6.0 and newer. AI client reports are optional and require WordPress 7.0 or newer with AI Client support plus a configured AI Connector.
No. It can optionally use a configured Wordfence Intelligence API key for known vulnerability matching.
No. Plugin, theme, must-use plugin, and language directories contain legitimate executable files and are excluded from this anomaly pass by default. Lockora checks their update and vulnerability posture separately. The anomaly scan focuses on uploads, the wp-content root, cache and upgrade locations, backups, and secret-like files.
Developers can tune the scan with the lockora_wp_content_allowed_files, lockora_wp_content_excluded_paths, lockora_wp_content_executable_extensions, lockora_wp_content_sensitive_extensions, lockora_wp_content_archive_extensions, lockora_wp_content_scan_max_files, and lockora_wp_content_max_reported_paths filters. Allowed and excluded paths are relative to the wp-content directory.
The plugin is designed to send sanitized scan findings only. It does not intentionally send passwords, salts, API keys, raw logs, user lists, or file contents.
lockora_vulnerability_findings filter are now validated before they are counted, scored, stored, or displayed, so a malformed entry from another plugin can no longer break a scan.lockora_scan_completed action for scan-result integrations.wp lockora scan and wp lockora report with JSON output and a --strict flag for CI.