Scudo Security
| 开发者 |
totaliweb
freemius |
|---|---|
| 更新时间 | 2026年8月25日 20:16 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Scudo Security is designed to harden your site without breaking it. It detects your exact hosting environment and only offers controls that can actually work there — disabling the rest with a clear explanation and a fallback. Every change is previewed, applied reversibly, verified, and rolled back automatically if the verification fails. If you are ever locked out, three independent recovery routes get you back in.
Honest scope. On shared PHP hosting there is no always-on antivirus daemon. Real, continuous protection comes from per-request firewalling, scheduled scans, file-change detection, and access monitoring — not a resident process. Scudo Security is built around prevention and hardening, with reversible quarantine instead of destructive cleanup.
Included for free
- Web Application Firewall — inspects every request as WordPress boots and blocks SQL-injection, cross-site-scripting, path-traversal and command-injection patterns. Conservative by design, and it always stands down in Safe Mode so it can never be the reason you are locked out.
- Malware & integrity scan — chunked, resumable scans that compare your WordPress core files against the official WordPress.org checksums and your installed plugins and themes against their official packages, plus a database scan for injected scripts, rogue administrator accounts and malicious scheduled tasks. Self-optimising: the scan automatically right-sizes its workload to your host's memory and time limits, so it never times out on small hosting and runs faster on powerful servers.
- Reversible clean-up — quarantine a suspicious file instead of deleting it, or restore a tampered core file from the official WordPress source after a checksum match.
- Brute-force protection — login-attempt limiting with automatic IP lockouts, plus an invisible CAPTCHA that stops password-guessing bots, and a manual IP block list.
- Two-factor authentication (TOTP) — self-enrolment with an authenticator app and backup codes.
- Hardening baseline — applied automatically on activation and fully reversible: the WordPress version is hidden, user enumeration is blocked, the built-in file editor is disabled, the basic security headers are sent, and PHP execution is denied inside your uploads folder. Each change takes a restore point first, verifies itself, and rolls itself back if the verification fails.
- Security headers — clickjacking, MIME-sniffing, referrer and permissions protection, written into your server configuration where the host allows it so they reach cached pages and static files too, with a live check that reports what actually arrived. Plus an HTTPS/HSTS check.
- Security score + dashboard — a transparent, explainable score with real per-day activity charts.
- Activity log — every sensitive operation and security block, with search and filters.
- Hide the admin bar for non-administrators.
- Safe Mode / recovery — three DB-less escape routes if anything goes wrong.
- Custom firewall rules — write your own allow and block rules on top of the built-in engine.
- GeoIP country blocking (verified against the CDN's published IP ranges) and advanced per-IP rate limiting.
- Hide the login page behind a secret URL with bot redirection, and keep non-administrators out of wp-admin entirely.
- Two-factor enforcement by role — require two-factor for the roles you choose, instead of leaving it to each user.
- Compromised-password blocking — a k-anonymity check that rejects passwords found in known breaches, sending only the first five characters of a hash.
- Content-Security-Policy builder — compose and ship a CSP without hand-editing headers.
- Email alerts and a weekly security report — an administrator-login notice and a weekly digest.
- Activity-log CSV export — download the filtered log for reporting or an audit.
- Configuration export and import — move a tuned setup from one site to the next.
- The optional AI security advisor — reviews your posture and proposes prioritised, validated fixes. Proposals only; nothing is ever applied automatically. Off by default, bring your own API key, with consent and redaction.
安装:
- Upload the plugin to
/wp-content/plugins/scudo-security(or install the zip via Plugins → Add New → Upload Plugin). - Activate through the Plugins screen.
- Open Scudo Security and follow the on-screen guidance.
屏幕截图:
常见问题:
Will this break my site?
Avoiding that is the central design goal. Activation applies only a small, reversible baseline; everything riskier goes through a preview with an automatic rollback, and Safe Mode is reachable through three routes that work without the database.
What does the plugin change when I activate it?
It applies a conservative, fully reversible baseline: hiding the WordPress version, blocking user enumeration, disabling the built-in file editor, sending the basic security headers, and adding an .htaccess rule inside your uploads folder (wp-content/uploads, as returned by wp_upload_dir()) that stops PHP files there from being executed. Nothing outside that folder and the plugin's own settings is touched. Every one of these is applied through the same detect → preview → apply → verify → rollback contract, each with its own restore point, and any of them can be rolled back individually through the plugin's REST API (scudo/v1/hardening/<module>/rollback) or by deactivating the plugin's baseline. Dedicated on-screen controls for each module are on the roadmap.
Does it call external servers?
Only for the features listed under External services below, and only when that feature runs. The integrity scan compares your core files against the official WordPress.org checksums; the optional "repair from official source" action fetches pristine core files from the official WordPress source; Freemius handles licensing/updates (usage data is opt-in); and a vulnerability feed is fetched only if you choose to configure a feed URL. No analytics or tracking SDK is bundled.
Is the free version crippled?
No. The free version includes a complete, standard security experience — firewall, scans, brute-force protection, 2FA, hardening, headers and the dashboard. Pro adds advanced controls for power users and agencies.
How is the bundled admin interface built?
The admin app is compiled from the TypeScript/SCSS source shipped under assets/app/src. To rebuild the compiled bundle in assets/app/build, run npm install then npm run build (it uses WordPress Scripts / webpack).
更新日志:
1.2.0
- Important fix — settings could silently fail to save. All plugin settings live in a single database record, and two parts of the plugin saving at the same moment could overwrite each other. The most visible symptom: switching on the security headers saved only the HSTS part, while the screen still reported everything as active. The same fault also affected the protections applied automatically when the plugin is first activated — they could appear enabled while being switched off in the database — and it discarded the restore point that lets a change be undone. If your site is affected, this update fixes it; open Scudo Security once and re-check the switches on the Hardening and Headers cards.
- Security headers now reach cached pages. Headers were only ever added by PHP, and a page served from a cache never runs PHP — so on a cached site visitors received no security headers at all. Where the host allows it, Scudo Security now writes them into your server configuration as well, which also covers static files and error pages. On servers it cannot configure (nginx) it shows you the exact snippet to paste. The card no longer claims "Active" from a saved setting: it fetches your own site and reports, header by header, what actually arrived.
- The scanner no longer reports a clean site as compromised. Deleting Akismet, Hello Dolly or the unused default themes is good practice, but because WordPress ships them inside its own download the scan counted every deleted file as a missing core file — around a hundred "issues" on a perfectly healthy site. Core and bundled extras are now judged separately, exactly as WP-CLI does.
- Findings now explain themselves. Each result carries a severity that reflects where the file is and whether it can run code, plus a plain-language reason and a recommended action. A modified file in WordPress itself is critical; a plugin's own cache file or a translation is informational and no longer triggers an alarm or lowers your score. "Repair from official source" will no longer quietly reinstall a bundled plugin you removed on purpose.
- Marking a finding as a false positive works. The dismissal option previously refused every kind of finding a real site needs to dismiss. It now works for plugin and theme findings, still refuses to hide changes to WordPress's own code, and automatically re-flags a file if it changes again.
- Safe Mode has a way out. The recovery screen rendered blank, leaving no way to leave Safe Mode from the browser. It is now a simple page with a button, plus a new
wp scudo recovercommand. - Two-factor codes can no longer be guessed indefinitely; repeated wrong codes are throttled per account, without ever locking you out of the login screen.
- The "brute-force protection" switch is now actually honoured, and the login option that promised an instant IP ban now describes what it really does.
- An expired session no longer blanks a tab: you get a message asking you to reload.
- Your security score no longer counts controls your hosting cannot support, so an nginx site is not marked down for something it was never offered.
- Translations now come from the WordPress.org community. The plugin used to ship machine-generated translations for fifteen languages that no native speaker had reviewed, and it loaded them in a way that pre-empted the official language packs entirely — so a good community translation could never replace a poor bundled one. The plugin now registers its own folder only as a fallback, exactly as WordPress expects, and ships no unreviewed translations. If your language is not translated yet, you can help at https://translate.wordpress.org/projects/wp-plugins/scudo-security/
- Important fix — the firewall no longer blocks people who are allowed to write. With the firewall active, an ordinary edit containing an embedded video, a custom HTML block or a code sample could be answered with "403 Forbidden", because the request was inspected without checking who sent it. Anyone who can author content is now exempt, exactly as the Pro traffic controls have always been. Visitors and low-privilege accounts are still filtered.
- Removed the last references to a curated vulnerability feed as a Pro service. The advisory feed URL is a free feature and accepts any JSON feed you choose.
- Corrected three strings in the admin interface that described capabilities the plugin does not have: the upgrade prompts offered "real-time signatures" (the rule set is the same in both tiers — what Pro really adds is custom rules), and the alerts recommendation promised instant notification of threats when what it sends is an administrator-login notice and a weekly digest.
- First public release on WordPress.org. Earlier version numbers were pre-release builds distributed only to Pro customers; the notes below record what changed in them.
- Important fix — the firewall now actually blocks. The Web Application Firewall read an internal setting that nothing ever wrote, so it stayed dormant even though the dashboard reported it as active. It now follows the switch on the Firewall screen, which is on by default, and blocks SQL-injection, cross-site-scripting, path-traversal and command-injection patterns. It still stands down completely in Safe Mode. If you had deliberately disabled the firewall, that choice is respected.
- The "SQL injection & XSS protection" switch is now a real control: turning it off stops those two rule families while path-traversal and command-injection protection keep running.
- Documentation accuracy: the feature lists in the readme and inside the plugin now describe only what the plugin actually does. A few capabilities that were listed but never implemented have been removed from the descriptions — no working feature was taken away.
- Fixed a serious bug in the "block user enumeration" hardening module: while it was enabled, every unauthenticated REST API request failed with a server error on PHP 8 — not only the users endpoint, but the whole API. The module now leaves WordPress's own route metadata untouched and only protects the users routes, as intended.
- The same module now runs before WordPress's canonical redirect, so
?author=Nno longer bounces to the author archive and reveals the username it is meant to hide. - Fixed a notice under WP_DEBUG: opening the Activity Log with no filters prepared a database query that had nothing to bind.
- Updated the bundled Freemius SDK to 2.13.4 (the current upstream release). The bundled copy is now byte-for-byte identical to the official one, so it can be verified against the upstream repository.
- The integrity scan now documents its use of downloads.wordpress.org in "External services", and fetches WordPress.org core files through wp_safe_remote_get() with a response-size limit.
- Fixed a recurring database error from the scheduled maintenance clean-up: finished background jobs were aged on a column the jobs table does not have, so the purge failed (and logged an error under WP_DEBUG) on every run. Old finished jobs are now removed correctly.
- Uninstall no longer queries the quarantine table without checking that it exists, so no database error is emitted when the table was never created.
- Packaging: the SPA's tsconfig.json is now shipped alongside the TypeScript source, so the compiled bundle can actually be rebuilt from the included source.
- The uploads directory is now always resolved via wp_upload_dir() — including the Safe-Mode recovery marker — with no constant-based fallback, fully supporting custom and multisite upload locations.
- Improved how the plugin references file and directory locations: files the plugin creates are written under wp_upload_dir(), the root .htaccess is located with get_home_path() (as WordPress core does), and every remaining reference to WordPress's own core/plugin/content directories — which the integrity and malware scanner must read — is centralized in a single, documented helper class.
- Packaging: the Composer manifest (composer.json/composer.lock) is again included in the plugin, so the dependency list is available for review — as the WordPress.org guidelines request, even though it is only used for development.
- Two-factor authentication: the self-service 2FA endpoints (status, enrolment, confirm, disable, backup codes) are now available to any signed-in user for their own account, instead of requiring the site-administrator capability.
- Free build: the two remaining premium controls that still appeared as disabled buttons — the custom firewall-rule builder and the activity-log CSV export — now show a plain "available in Pro" pointer instead, so the free version has no locked or disabled interactive controls.
- Packaging: the plugin now ships the admin app's TypeScript/SCSS source alongside the compiled bundle, and no longer bundles composer.json/composer.lock.
- Fixed a PHP warning that could appear under WP_DEBUG: the bundled Composer autoloader now resolves classes via PSR-4 instead of a hard-coded classmap, so optional Pro-only classes that are not part of this free build resolve cleanly to "not present" without attempting to include a missing file. Also added a defensive file-presence check before loading those optional classes.
- Fixed loading of the bundled translations (corrected the .mo filename so the shipped locales load).
- WordPress.org compliance: removed the code-level required-payment trial. The free version is updated by WordPress.org; Freemius is used only for optional Pro licence activation and opt-in diagnostics (readme "External services" clarified).
- The admin-menu sub-item styling now uses wp_add_inline_style() instead of printing an inline tag.
- First public release.
- Free: environment-aware hardening, base WAF (SQLi/XSS), self-optimising malware & integrity scan, brute-force protection with anti-lockout, TOTP two-factor, login CAPTCHA, comment/form spam protection, one-click security headers, security score with prioritised recommendations, activity log, and Safe Mode with three DB-less recovery routes.
- Adaptive scan: classify each finding (false positive / warning / dangerous); confirmed false positives are suppressed safely (content-bound) on future scans, and detection tunes itself to your site.
- Real, responsive security score that reflects every feature you enable; a one-click "Plans & features" comparison.
- Multisite-aware: network activation provisions every site, and new sites are provisioned automatically.
- Seamless updates: database migrations apply themselves on update (no reactivation), including on headless / WP-CLI deployments.
- Pro: custom firewall rules, GeoIP & advanced rate limiting, hide-login, role-based 2FA enforcement, compromised-password blocking, email alerts & weekly report, plug-and-play Content-Security-Policy builder, activity-log CSV export, config export/import, and the optional AI security advisor (Anthropic Claude, bring your own API key — proposals only, nothing applied automatically).
- Environment detection + capability matrix, Safe Mode with three DB-less recovery routes, secure baseline on activation.
- Hardening modules, security headers, core integrity scan and heuristic malware scan with reversible quarantine.
- Self-optimising scans: chunk size auto-tunes to the host's memory and execution-time limits (no timeouts on small hosts, faster on big ones).
- Tested against the latest WordPress release; core updates are recorded in the activity log.
- Brute-force protection, TOTP two-factor, password policy, activity log, security score and a React dashboard with real metrics and charts.
- Premium layer (Pro): custom firewall rules, GeoIP, advanced rate limiting, hide-login, 2FA enforcement by role, compromised-password, email alerts, config export/import, and the optional AI security advisor.