MVO Segurança e Proteção
| 开发者 | mvotools |
|---|---|
| 更新时间 | 2026年10月15日 20:56 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Two-factor authentication (TOTP) compatible with Google Authenticator and one-time recovery codes.
- Optional XML-RPC blocking.
- Prevention of executable file uploads and execution rules for the uploads directory.
- Reduced username enumeration and less revealing login errors.
- Directory listing protection.
- Temporary IP-based blocking against brute-force login attempts.
- On-demand vulnerability and suspicious-file scanner.
- Encrypted quarantine and manual deletion of eligible suspicious files.
- Restricted automatic recovery for non-executable media and documents in the uploads directory.
- File integrity baselines and comparisons.
- Write-permission hardening for application code directories.
- Application Password and administrative session controls.
- Locally stored security event log.
- Sensitive-file protection and security HTTP headers.
- Conservative application firewall rules for high-confidence attack patterns.
安装:
- In your WordPress dashboard, open Plugins > Add New Plugin > Upload Plugin.
- Select the MVO Segurança e Proteção ZIP file and install it.
- Activate the plugin.
- Open MVO Tools > MVO Segurança e Proteção.
- Review the modules and enable only the protections suitable for your hosting environment.
- Whenever possible, test filesystem permissions and .htaccess-dependent modules in a staging environment before applying them to production.
常见问题:
Does the plugin scan continuously?
No. The vulnerability and malware-indicator scanner is started manually by an administrator and runs on demand.
Does the plugin remove malware automatically?
No. Eligible files are quarantined or permanently deleted only after an explicit administrator action. Quarantine is generally recommended before permanent deletion.
Can I restore quarantined PHP files automatically?
No. For security and directory compliance, automatic restoration is limited to permitted media/document files inside uploads. Restore other files from a trusted backup or reinstall their legitimate package.
Is quarantine deleted when I uninstall the plugin?
No. Encrypted quarantine files are intentionally preserved to reduce the chance of losing isolated files by accidentally uninstalling the plugin. The database encryption key must also be preserved to decrypt them.
Can I use email-based 2FA?
No. The 2FA module uses TOTP apps, including Google Authenticator and compatible alternatives.
Do the .htaccess modules work on Nginx?
Managed .htaccess rules require Apache or LiteSpeed. Nginx requires equivalent server configuration; the plugin does not claim to enforce unsupported .htaccess rules. Encrypted quarantine blobs may need an additional Nginx deny rule to prevent public downloads.
Will the File Permissions module prevent every malicious change?
No. It adds a filesystem-hardening layer, but it cannot replace correct ownership, ACLs, hosting isolation, updates, or independent backups.
Does the plugin send information to MVO Soluções?
No. This plugin has no proprietary telemetry and does not transmit security logs, IP addresses, files, or scan results to MVO. WordPress may request checksums from WordPress.org when performing a manual core integrity check.
更新日志:
- Shortened the directory summary to comply with the WordPress.org 150-character limit.
- Prepared public presentation assets and documentation improvements.
- Translated plugin metadata and directory documentation into English.
- Updated contributor and version metadata, and replaced legacy JavaScript globals.
- Moved new encrypted quarantine storage into the plugin-specific uploads directory.
- Added read-only legacy storage migration and restricted automatic restoration to non-executable uploads media and documents.
- Removed unnecessary translation domain loading and polished legacy-brand labels.
- First public release.
- Introduced 13 independent security and hardening modules.
- Added TOTP 2FA, attack prevention, on-demand scanner, encrypted quarantine, integrity monitoring, file permissions, security logs, sensitive-file protection, security headers, and firewall.