Qevix Shield
| 开发者 | qevixlabs |
|---|---|
| 更新时间 | 2026年8月4日 14:57 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Qevix Shield is a complete WordPress security plugin for the parts of the site attackers hit first — the login form, XML-RPC, file access, and the URLs that leak information about your install. It stops brute force attacks, adds two-factor authentication and reCAPTCHA, scans for malware, and writes everything it blocks to a searchable activity log that can email you the moment something matters.
It installs neutral: activating it changes nothing about your site. Every protection stays off until you switch it on, so you enable them one at a time and see the effect of each — no surprises, no lockouts on activation. (The audit log runs from the start; that is monitoring only.)
Why Qevix Shield
- Turning it on breaks nothing. Every protection ships off. Enable them one at a time and watch what each does.
- You can't lock yourself out. A one-line safe mode in
wp-config.phpsuspends everything without touching your settings. reCAPTCHA keys must pass a live test before they can be enabled, 2FA has recovery codes plus an admin reset, and lockouts are temporary. - One plugin, the whole checklist. Hide login URL, brute force lockouts, 2FA, reCAPTCHA, password rules, XML-RPC control, malware scanning, file and server hardening, a firewall, and an audit log — instead of five single-purpose plugins.
- You hear about it. Every block, login, and admin action lands in a live, searchable log you can export to CSV. Critical events email you as one grouped summary — an attack wave is one message, not fifty.
- No measurable slowdown. With everything enabled, response times match the deactivated site within measurement noise. Nothing waits on an external service.
- It leaves your other plugins alone. No patching or overriding another plugin's code — WooCommerce, membership, and front-end login pages keep working, even with the hidden login URL on.
- Everything here is free. No account, no license key, no trial, no feature that expires, no greyed-out controls. The optional Pro add-on only adds capabilities of its own on top — it never unlocks something already in this plugin.
- Hide the login page: move it off
/wp-login.phpto a custom login URL of your choosing (off by default). - Choose what a blocked request sees: a 404, your homepage, or a custom redirect.
- A honeypot field catches basic bots without affecting real visitors.
- Limit login attempts: rate-limit failed logins and temporarily lock out an IP, so a brute force run stops after a handful of tries instead of millions.
- Whitelist trusted IPs or whole CIDR ranges (IPv4 or IPv6) so they're never rate-limited or locked out.
- One-time codes from any authenticator app (Google Authenticator, Authy, 1Password, and similar). Setup is per-user: scan a QR code, confirm a code.
- Recovery codes issued at setup with a one-click download, plus an admin reset — a lost phone is never a lockout.
- Require 2FA for any role you choose: an enforced user who hasn't enrolled sees only the setup screen until they do.
- Closes the XML-RPC side door: require the code appended to the password over XML-RPC, or block XML-RPC password logins for 2FA accounts. Application passwords are unaffected.
- Google reCAPTCHA on your login, registration, and lost-password forms — the v2 "I'm not a robot" checkbox or invisible v3 scoring, your choice.
- Covers WooCommerce's my-account and checkout forms too, and a developer hook drops the same check into any other plugin's form.
- v3 adds a tunable score threshold and an optional email fallback: a real person the score misjudges gets a one-time sign-in link instead of a dead end.
- A required "Test keys" step proves your keys work before the switch can be turned on — a wrong-type key would otherwise break login for everyone, including you. Fails open if Google is unreachable, so an outage never locks you out.
- Require a minimum length and character classes (upper, lower, number, symbol).
- Block passwords that are just the account's username or email.
- One switch to disable all XML-RPC methods, or disable pingbacks only.
- Log every XML-RPC request with its method and whether it was allowed or blocked.
- Scan WordPress core, plugins, themes, and uploads — pick any combination.
- Core files and plugins from WordPress.org are compared against their official per-file checksums, so tampering is spotted and untouched files are skipped instead of producing false alarms.
- A pattern engine flags suspicious PHP, obfuscated JavaScript, and common malware signatures in everything that can't be checksum-verified — themes, uploads, premium plugins, and any modified file.
- Report-only: it shows what it found without changing any files.
- Block direct access to sensitive files (
.env,.git,wp-config.php, and more). - Block backup and database dumps (
.sql,.bak,.tar.gz,.wpress), plus your own filenames or*.extensionpatterns. - Disable directory listing and PHP execution in uploads. Writes the Apache
.htaccessrules for you, and shows the nginx equivalent to paste. - Hide the WordPress version, REST API discovery links, and identifying server headers. Block author/user enumeration.
- A lightweight firewall blocks common SQL-injection, XSS, file-inclusion, and command-injection patterns plus known scanner user agents.
- Every user can see and end their own active login sessions; a password reset logs out that account's other sessions.
- The audit log (activity log) records every login, admin action, and block with the who/what/when/where — searchable, filterable, live-updating, CSV-exportable, with a configurable retention period.
- Critical events email your administrators, grouped into one summary instead of fifty (opt-in).
- A WordPress dashboard widget shows threats blocked in the last 24 hours and recommends the next protection to switch on.
- Grant other roles manage or read-only access to Qevix Shield without full
manage_options.
- Malware remediation and deeper detection — quarantine or delete infected files, dismiss reviewed findings, extra web-shell and backdoor signatures, cron-abuse and rogue-admin checks, a database scan for injected content, and scheduled daily/weekly scans.
- Breached-password protection — a privacy-preserving check against the Have I Been Pwned database of a billion leaked passwords, plus a common-password blocklist, expiration, reuse prevention, and forced resets.
- Advanced login blocking — permanent IP blacklists, user-agent filtering, and auto-blacklisting of repeat offenders.
- Multi-channel alerts — SMS, WhatsApp, Slack, Discord, and webhooks, as grouped digests routed by category and severity.
- Session & access control — an admin view of every user's sessions with idle-timeout enforcement, plus WP-CLI commands.
- Extras — trusted devices and an emailed backup code for 2FA, and granular XML-RPC (authenticated-only, allowlist, or trusted IPs).
安装:
- Upload the
qevix-shieldfolder to/wp-content/plugins/, or install it from the Plugins screen. - Activate the plugin.
- Open Qevix Shield → Settings and switch on the protections you want, one at a time.
屏幕截图:
常见问题:
Is everything really free?
Yes. Every feature on this page works the day you install it — no account, no license key, no trial, no expiry, and no greyed-out settings. The separate Pro add-on adds its own extra capabilities on top; it never unlocks anything already in this plugin.
Do I need to configure anything after activating?
Only what you want. Qevix Shield installs neutral — activation changes nothing about your site. You switch on each protection deliberately from its settings tab, so you always know what's active and why. (The audit log starts monitoring right away, but it doesn't alter your site.)
Will it slow down my site?
No measurable difference. With every protection enabled, response times match the same site with the plugin deactivated, within measurement noise. There is no external service your visitors wait on.
Will it lock me out of my own site?
It's built not to. Rate limiting and IP lockouts only apply to failed logins and are temporary; add your own IP to the whitelist to be certain. Login-URL hiding is off by default — if you enable it, bookmark the new address first. And there's always the recovery switch below.
I've locked myself out. How do I recover?
Add this one line to wp-config.php:
define( 'QEVIX_SHIELD_SAFE_MODE', true );
It suspends every Qevix Shield protection without changing any of your settings, so you can log in and fix things, then remove the line. It works even when you can't reach the dashboard, because wp-config.php loads before the plugin. (One exception: server rules already written to .htaccess/nginx are enforced by the web server — edit that block out by hand if you enabled them.)
Does it work with WooCommerce and plugins that have their own login pages?
Yes. WooCommerce, membership and LMS plugins, and page-builder login widgets keep working, including with the hidden login URL on — they use their own pages, not wp-login.php.
I use the Pro add-on. Do the versions need to match?
They release together with the same version number, and matching is the supported pairing. If they drift, nothing breaks: Pro shows a notice telling you which side to update.
更新日志:
1.1.2
- Fixed: the "Enable 2FA" master switch now turns two-factor authentication off completely. Previously a user who had enrolled was still asked for a code at login even with the switch off, because it only controlled whether enrolment was mandatory. It now behaves like every other tab's master switch — off means nothing is enforced.
- Enrolments are kept when the switch is off, so turning it back on restores every user's second factor with no need to re-enrol. Users can still enrol or un-enrol their own account either way.
- Now runs on WordPress 6.5 and PHP 7.2, down from WordPress 6.8 and PHP 8.1. Nothing else changed: no setting was added, removed, renamed or re-defaulted, and no protection behaves differently.
- Redesigned every admin screen: a header band naming the open section, one row of section pills in place of the old tab strip, and settings grouped into cards with two columns where a screen holds two separate decisions.
- Switches replaced the plain checkboxes on every on/off setting, and each screen now shows a live status pill ("Enforcing", "Login hidden", "Alerts silent") reading the setting's real state.
- A setting that cannot act while another is off is now greyed out until the setting it depends on is switched on, all the way down a chain.
- Fixed: on the reCAPTCHA screen the Site Key, Secret Key, Version and "Test keys" button no longer grey out while reCAPTCHA is off. reCAPTCHA cannot be switched on until the keys pass that test, so greying the test out left no way to run it.
- Fixed: "Test keys" with v2 keys could report that the checkbox had loaded without ever drawing one, leaving the test impossible to finish. The test now waits for Google's script to finish loading before drawing the checkbox.
- Notices moved to one place on every screen — directly under the header, above the section pills — instead of appearing wherever the setting that raised them happened to sit.
- Two-factor recovery codes now sit in the card for your own account, above the button that issues them, rather than as a message at the top of the screen. Between issues, that card reports how many of your codes are still unused.
- The Audit Log is a screen of its own rather than a Settings section: it holds no settings, it is a record.
- The Sessions list is now one shared table, so every screen that lists logins shows the same columns.
- The login-hiding screen is now called "Hide Login" everywhere — the section bar, the screen heading and the documentation previously disagreed.
- No settings were added, removed, renamed or re-defaulted. Your saved configuration carries over untouched.
- Initial release.