Maasters Security Shield
| 开发者 | themaasters |
|---|---|
| 更新时间 | 2026年11月2日 02:28 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
安装:
- Upload the
maasters-security-shieldfolder to/wp-content/plugins/or install the ZIP through Plugins > Add New > Upload Plugin. - Activate the plugin.
- Open Maasters Shield in the WordPress admin sidebar to configure protections.
- Test changes on a staging site before enabling strict policies.
常见问题:
Will this plugin make my site completely secure?
No. It adds configurable hardening controls but cannot replace timely updates, strong authentication, reliable backups, least-privilege access, HTTPS, or a security review.
Should I enable Content Security Policy enforcement immediately?
No. Start with Report Only, test your pages and integrations, adjust the policy, and only consider Enforce mode after confirming legitimate resources are not blocked.
When should I enable HSTS, includeSubDomains, or preload?
Enable HSTS only when your site is consistently served over HTTPS. Include subdomains only when every affected subdomain supports HTTPS. The preload directive does not itself submit your domain to browser preload lists.
Why can login protection affect multiple visitors?
Failed attempts are counted by the connecting IP address in REMOTE_ADDR. Visitors sharing a public IP address may share the same rate limit. Proxy headers are not trusted automatically because they can be spoofed unless your server is configured to validate them.
Does the plugin send data to a third party?
No. It does not send telemetry or login-failure data to an external service. Login protection stores local attempt counters using an IP-derived transient key.
How can I disable the theme and plugin file editor?
Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php above the stop-editing line. Maasters Security Shield does not edit wp-config.php.
更新日志:
- Added a distinct
maassesh_prefix to PHP declarations, constants, option and transient keys, settings groups, asset handles, error codes, and CSS selectors. - Migrated existing
mss_settingsoptions without losing saved configuration. - Preserved active login lockouts created with the previous transient prefix.
- Added the required translators comment for the login-lockout message placeholder.
- Updated the readme and internationalization metadata for submission.
- Fixed login-lockout checks so existing authentication errors cannot bypass the rate limit.
- Starts the configured lockout duration when the attempt threshold is reached and does not extend lockouts on each blocked retry.
- Keeps HSTS and CSP behavior independent from the baseline header toggle.
- Loads the admin stylesheet only on the Maasters Shield settings page.
- Added FAQ and upgrade notice sections; improved privacy and policy documentation.
- Replaced the sidebar icon with a dedicated 20 x 20 PNG asset.
- Updated the sidebar icon handling and admin stylesheet rules.
- Moved the plugin to a branded top-level admin menu.
- Added the brand logo to the dashboard header.
- Updated author-enumeration handling to use WordPress query vars.
- Rebuilt the settings screen with functional security controls.
- Added login protection settings and CSP modes.
- Added configurable HSTS max-age with opt-in subdomain/preload directives.
- Removed the obsolete X-XSS-Protection header and duplicate files.
- Added settings validation and IP validation.
- Initial security hardening and settings foundation.