Qevix Shield – 2FA, Hide Login, Firewall, File Security & Malware Scanner
| 开发者 | qevixlabs |
|---|---|
| 更新时间 | 2026年10月6日 15:53 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Qevix Shield protects the parts of a WordPress site that attackers commonly target first: the login page, XML-RPC, files, and URLs that can reveal information about your site.
It can help stop brute-force attacks, add two-factor authentication and reCAPTCHA, scan files for malware, protect sensitive files, and record blocked activity in a searchable log. Important events can also be sent to administrators by email.
Qevix Shield is safe to activate. Activation does not change how your site works. All security protections are off until you enable them, so you can turn them on one at a time and check the result. The activity log starts automatically, but it only records activity and does not change your site.
Why Qevix Shield
- Safe to activate. All security protections are off by default. Turn them on one at a time so you can see exactly what each protection does.
- Easy recovery. A safe mode in
wp-config.phpcan temporarily disable Qevix Shield if you ever lock yourself out. reCAPTCHA keys must pass a test before reCAPTCHA can be enabled. 2FA includes recovery codes and an admin reset. Login lockouts are temporary. - One plugin for your security needs. Includes Hide Login, brute-force protection, 2FA, reCAPTCHA, password rules, XML-RPC protection, malware scanning, file and server protection, firewall, and activity logging.
- See what is happening. Logins, blocked requests, and admin actions appear in a searchable activity log. You can export the log to CSV. Important events can be grouped into one email instead of sending many separate emails.
- Designed to be lightweight. With all protections enabled, response times are intended to remain close to the site without the plugin. Visitors do not have to wait for an external security service.
- Works with other plugins. Qevix Shield does not modify or replace other plugins' code. WooCommerce, membership plugins, and front-end login pages can continue to work, including when Hide Login is enabled.
- Free features. All features listed above are included for free. No account, license key, trial, or expiring feature is required. The optional Pro add-on adds additional features; it does not unlock features that are already part of the free plugin.
- Hide Login: Move the WordPress login page from
/wp-login.phpto a custom login URL. This is off by default. - Choose what blocked visitors see: a 404 page, your homepage, or a custom redirect.
- A honeypot field helps block simple bots without affecting normal visitors.
- Limit failed login attempts and temporarily block an IP address after too many failed attempts.
- Add trusted IP addresses or CIDR ranges so they are not rate-limited or blocked.
- Use one-time codes from popular authenticator apps such as Google Authenticator, Authy, 1Password, and similar apps.
- Set up 2FA separately for each user by scanning a QR code and confirming a code.
- Get recovery codes when setting up 2FA. You can download them and use them if you lose your phone. An administrator can also reset 2FA.
- Require 2FA for the user roles you choose. Users who are required to use 2FA will be guided through setup before they can continue.
- Protect XML-RPC logins for 2FA users by requiring the 2FA code or blocking XML-RPC password logins. Application passwords are not affected.
- Add Google reCAPTCHA to login, registration, and lost-password forms.
- Choose between reCAPTCHA v2 (the "I'm not a robot" checkbox) and invisible reCAPTCHA v3.
- Protect WooCommerce My Account and checkout forms too.
- Developers can add the same protection to other plugin forms using a hook.
- reCAPTCHA v3 lets you set a score threshold. You can also enable an email fallback so a genuine user who gets a low score can receive a one-time sign-in link.
- Test your reCAPTCHA keys before enabling the protection. This helps prevent incorrect keys from breaking login.
- If Google is temporarily unavailable, reCAPTCHA fails open so an outage does not lock users out.
- Set a minimum password length.
- Require uppercase letters, lowercase letters, numbers, and symbols.
- Prevent users from using their username or email address as their password.
- Disable all XML-RPC methods or disable pingbacks only.
- Record every XML-RPC request, including the method and whether it was allowed or blocked.
- Scan WordPress core files, plugins, themes, and uploads. Choose which areas to scan.
- Compare WordPress core files and plugins from WordPress.org with their official checksums to detect modified files.
- Use a malware pattern scanner to check files that cannot be verified with checksums, including themes, uploads, premium plugins, and modified files.
- The scanner only reports what it finds. It does not automatically change or delete files.
- Block direct access to sensitive files such as
.env,.git,wp-config.php, and other protected files. - Block access to backup files and database dumps such as
.sql,.bak,.tar.gz, and.wpress. - Add your own filenames or
*.extensionpatterns to block. - Disable directory listing and PHP execution inside the uploads folder.
- Qevix Shield can add the required Apache
.htaccessrules and show the equivalent nginx rules for manual setup. - Hide the WordPress version, REST API discovery links, and identifying server headers.
- Block author and user enumeration.
- A lightweight firewall helps block common SQL injection, XSS, file inclusion, and command injection attempts, as well as known scanner user agents.
- Users can see and end their own active login sessions.
- Resetting a password logs out the other sessions for that account.
- The activity log records logins, admin actions, and blocked requests, including who, what, when, and where.
- Search, filter, and export the activity log to CSV.
- Choose how long activity records are kept.
- Important events can be emailed to administrators as grouped summaries.
- A WordPress dashboard widget shows threats blocked during the last 24 hours and suggests the next protection to enable.
- Give selected WordPress roles permission to manage Qevix Shield or view it in read-only mode without giving them full administrator settings access.
- Malware cleanup and deeper scanning — quarantine or delete infected files, dismiss reviewed results, use additional web-shell and backdoor signatures, detect suspicious cron jobs and administrator accounts, scan the database for injected content, and run scheduled daily or weekly scans.
- Leaked-password protection — check passwords against the Have I Been Pwned database in a privacy-preserving way, block common passwords, set password expiry, prevent password reuse, and force password resets.
- Advanced login blocking — permanently block IP addresses, filter user agents, and automatically block repeat offenders.
- More alert options — send grouped alerts through SMS, WhatsApp, Slack, Discord, or webhooks.
- Advanced sessions and access control — view users' sessions from an admin screen, enforce idle timeouts, and use WP-CLI commands.
- Additional 2FA and XML-RPC options — trusted devices, emailed backup codes, and more detailed XML-RPC controls.
安装:
- Upload the
qevix-shieldfolder to/wp-content/plugins/, or install Qevix Shield from the WordPress Plugins screen. - Activate the plugin.
- Go to Qevix Shield → Settings.
- Turn on the protections you want, one at a time.
屏幕截图:
常见问题:
Is everything really free?
Yes. Every feature listed on this page is available after installation. There is no account, license key, trial, expiry, or locked setting. The optional Pro add-on adds separate features. It does not unlock features that are already included in the free plugin.
Do I need to configure anything after activating?
Only the protections you want to use. Qevix Shield does not change your site when you activate it. Turn on each protection from its settings screen when you are ready. The activity log starts recording activity immediately, but it does not change your site.
Will it slow down my site?
Qevix Shield is designed to be lightweight. With all protections enabled, response times are intended to stay close to the same site without the plugin. Visitors do not need to wait for an external security service.
Will it lock me out of my own site?
Qevix Shield is designed to prevent this. Login rate limits and IP lockouts apply only to failed login attempts and are temporary. You can also add your IP address to the whitelist. Hide Login is off by default. If you enable it, save or bookmark your new login URL. If you do get locked out, you can use the recovery method below.
Does it see the real visitor IP behind Cloudflare, a proxy, or a load balancer?
Yes. Qevix Shield reads the visitor IP from proxy headers such as X-Forwarded-For only when the request comes from a proxy it trusts: Cloudflare, or a proxy on a private or local network address. Headers from anyone else are ignored, so an attacker cannot fake an IP to avoid a lockout or pretend to be on your whitelist.
If your site sits behind a different CDN or proxy with public IP addresses, add its addresses or CIDR ranges in a must-use plugin:
add_filter( 'qevix_shield_trusted_proxies', function () { return array( '192.0.2.0/24' ); } );
I've locked myself out. How do I recover?
Add this line to wp-config.php:
define( 'QEVIX_SHIELD_SAFE_MODE', true );
This temporarily disables Qevix Shield protections without changing your saved settings. You can then log in, fix the problem, and remove the line.
This works even when you cannot access the WordPress dashboard because wp-config.php loads before the plugin.
One exception: server rules already added to .htaccess or nginx are enforced by the web server. If necessary, remove or disable those rules manually.
Does it work with WooCommerce and plugins that have their own login pages?
Yes. WooCommerce, membership plugins, LMS plugins, and page-builder login widgets can continue to use their own login pages. Hide Login only changes the standard WordPress login URL, so these separate login pages can continue to work.
I use the Pro add-on. Do the versions need to match?
No. The free plugin and Pro add-on have separate version numbers. They are released as a pair, but their version numbers may be different. Keeping both updated is recommended. If the versions become too different, Pro will show a notice telling you which one needs to be updated.
更新日志:
1.1.5
- Security fix: login lockouts, the IP whitelist, and the firewall whitelist could be bypassed by sending a fake
X-Forwarded-For,X-Real-IP, orCF-Connecting-IPheader. These headers are now trusted only from Cloudflare or from a proxy on a private or local network. - Behind a chain of proxies, the visitor IP is now taken from the right end of
X-Forwarded-For, so a fake value added by the visitor is skipped. - The Activity Log now records the real visitor IP instead of a value the visitor sent.
- New
qevix_shield_trusted_proxiesfilter for sites behind other CDNs or proxies with public IP addresses. - No settings were added, removed, renamed, or changed.
- Tested with WordPress 7.1. No settings, defaults, or protection behavior changed.
- Confirmed compatibility with WordPress 7.1 changes that could affect plugins. Qevix Shield does not modify the editor, image processing, toolbar, or jQuery.
- Confirmed that the new WordPress Abilities API REST routes follow the same REST API authentication rules.
- Rewrote this listing in plainer English, and documented the WordPress.org checksums API under External services.
- No settings were added, removed, renamed, or changed.
- The Activity Log now uses simple English names such as "Signed in", "Idle session ended", and "Sensitive file blocked — .env".
- Severity and status are displayed consistently across the plugin.
- Fixed dashboard recommendations that could appear before the related protection was actually active.
- Fixed the Password Policy status showing "Strong" when the password protection was disabled.
- Added clear limits to several numeric settings so invalid values are caught while entering them.
- Disabled settings that cannot work while their main protection is turned off.
- Fixed the Login Protection status so it no longer says "Enforcing" when no login protection feature is active.
- Updated the rate-limit example to use the values currently configured by the site owner.
- Empty values in activity and session tables now show an em dash instead of a blank space.
- Fixed repeated HTML IDs on Malware Scanner and 2FA forms.
- No settings were added, removed, renamed, or changed.
- Fixed the Enable 2FA switch so turning it off completely disables 2FA enforcement.
- Existing 2FA enrolments are kept, so turning 2FA back on restores them without requiring users to set it up again.
- Now supports WordPress 6.5 and PHP 7.2. No other behavior changed.
- Redesigned the WordPress admin screens.
- Replaced plain checkboxes with switches for on/off settings.
- Added status indicators showing the current state of each protection.
- Settings that cannot work because another protection is off are now disabled until they can be used.
- Fixed the reCAPTCHA key test so it remains available when reCAPTCHA is disabled.
- Fixed the reCAPTCHA v2 key test so it waits for Google's script to load before showing the checkbox.
- Moved notices to one consistent location on each screen.
- Improved the 2FA recovery-code section.
- Moved the Activity Log into its own screen.
- Made the Sessions list consistent across the plugin.
- Renamed the login-hiding screen to "Hide Login" everywhere.
- No settings or saved values were changed.
- Initial release.