NIVA Guard
| 开发者 | alimohajer |
|---|---|
| 更新时间 | 2026年10月16日 00:31 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
See and control every outgoing connection of your WordPress plugins and themes. Log each connection with its timing, block ads and promotional notices, cache license checks instead of cutting them off, skip unreachable hosts automatically, turn WP-Cron into a real server cron, and answer scanner probes with a fast static 404.
Many plugins and themes call home on every page load or in the dashboard: advertising feeds, news widgets, license checks, update checks, usage tracking. On a slow or filtered network (some hosting regions cannot reach many foreign servers at all) each of those calls can wait 5 to 15 seconds and slow down the whole site.
NIVA Guard shows which plugin connects to which address and how much time it costs, then lets you decide for each connection: leave it, block it, or (for licenses) cache the answer. Nothing is blocked by default: every switch is off until you turn it on.
Connections
- Logs every outgoing HTTP connection made through the WordPress HTTP API, with the caller (plugin or theme), the address, the context (site, admin, cron, AJAX, REST) and the time it took. Slow connections are highlighted.
- A built-in list of more than 50 known connections (advertising, news feeds, update checks, license checks, tracking), each with an explanation, a type and a separate switch. A "relevant to this site" tab lists only the ones that match the plugins and themes that are active on the site.
- Block a connection completely, or cache a license response for a few hours instead of cutting it off. Blocking a license or plugin-function connection shows a warning first.
- "Seen on your site" lists connections that are not in the built-in list, grouped by plugin or theme, so you can block or cache them too.
- Take a whole plugin offline: everything it sends out is closed except wordpress.org.
- Automatic circuit breaker: a host that fails or answers slowly several times in a row is skipped for a while, so an unreachable server no longer adds seconds to every page. License addresses and hosts you choose are exempt.
- Optional deep tracking of direct PHP connections (
file_get_contents( 'http…' ),fopen) and a static scan of plugin code forcurlandfsockopen. - Reports: counters (connections, total wait, blocked, served from cache), a downloadable text log and summary, and a list of the slowest connections.
- Remove the dashboard widgets you choose; the widget code does not run and its feed is not fetched.
- Hide admin menu items (only hidden, not removed; Dashboard, Settings and Plugins are protected so you cannot lock yourself out).
- Hide promotional admin notices by keyword. Error notices and "new version" notices always stay visible.
- Heartbeat control: slow down or turn off the WordPress Heartbeat separately for the dashboard, the post editor, other admin pages and the front-end.
- Fast 404: answers scanner probes (
.env, backups, fake PHP files) with a light static 404 page instead of loading WordPress. Your real files, redirects and short links are not affected. A backup of.htaccessis kept and restored automatically if the site returns a server error. - WordPress cron: turn off the built-in wp-cron (adds
DISABLE_WP_CRONtowp-config.php) and get a ready cron command for cPanel, CloudLinux, DirectAdmin, Plesk, WP-CLI, wget and curl, matched to your PHP version and your real path, with a sensible interval from 1 minute to 6 hours. The settings page also shows the last successful run, the last failed run and the next scheduled task.
- The plugin makes no external connections of its own and sends no data anywhere. The log stays on your site.
- Files outside the plugin folder are created only after you enable the related option and save; they are removed when you turn the option off or deactivate the plugin.
- The settings page is written in English, is fully translatable (translations are managed on translate.wordpress.org) and adapts to left-to-right and right-to-left languages.
- Upload the plugin to
/wp-content/plugins/niva-guard/or install it from the Plugins screen. - Activate it. Nothing is written outside the plugin folder at this point.
- Open Settings → NIVA Guard, review the options and save.
- Browse the site and the dashboard for a few minutes so connections are recorded, then open the Known connections tab and review the list. For licenses use Cache instead of Block.
- Optional: turn on Load before other plugins so no plugin can connect before the logger starts.
屏幕截图:
常见问题:
Does the plugin send any data to another server?
No. It does not connect to any external service. The only request it makes is to your own site (home URL), once, after it edits .htaccess or wp-config.php, to be sure the site still answers; if the site returns a server error the edit is rolled back. The connection log is stored only on your own site (database and a text file in the uploads folder).
Which files does it create outside its own folder?
Only if you turn the related option on and save the settings:
wp-content/mu-plugins/niva-guard-loader.php— "Load before other plugins", so no connection escapes the logger.wp-content/mu-plugins/niva-guard-heartbeat.php,niva-guard-fast-404.php— the server tools.404.htmlin the site root and a block between# BEGIN NIVA WP Guardand# END NIVA WP Guardin.htaccess— Fast 404. A backup of.htaccessis saved first and restored automatically if the site returns a server error afterwards.wp-config.php— only if you turn on "Disable the built-in WordPress cron": one marked linedefine( 'DISABLE_WP_CRON', true );is added (and removed again when you turn the option off or deactivate the plugin). If the site returns a server error afterwards, the file is restored automatically.
wp-content/uploads/niva-guard/ is created when the first connection is logged. If WordPress cannot write these files, the settings page shows download buttons and manual instructions instead.
Everything is removed when you deactivate or delete the plugin.
Can blocking a connection break something?
Blocking "license" or "plugin function" connections can lock a theme or stop SMS and orders from working. For licenses use "cache" instead of "block". The settings page warns you before you block these.
Does it work on Nginx?
The logger, circuit breaker and Heartbeat control work everywhere. Fast 404 cannot edit .htaccess on Nginx; the settings page gives you the equivalent Nginx snippet instead.
Where is the human-readable source?
All PHP, CSS and JavaScript files in the plugin are unminified and readable.