Secure Access Bridge
| 开发者 | prokashsarker2026 |
|---|---|
| 更新时间 | 2026年10月13日 13:34 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- One-Click Temporary Login: Generate secure access links instantly without requiring users to type a password.
- Passwordless Access: Provide full or restricted WordPress access without ever exposing sensitive user credentials.
- Smart Access Profiles: Choose from predefined roles (Support, Developer, Client, Designer, SEO) or build custom profiles for precise control.
- Granular Security Restrictions: Limit temporary access by:
- Allowed menus & capabilities
- IP address & Country code
- Device type & Browser
- Session duration & Idle timeout
- Full Activity Audit Trail: Track every critical action performed by temporary users to ensure complete accountability.
- Change Recovery (Snapshots): Automatically create recoverable snapshots of content changes so you can review and restore if a temporary user makes a mistake.
- QR Code Login Support: Display a scannable QR code for instant mobile login access.
- Webhook Notifications (Slack/Discord): Get instant alerts via webhooks whenever a temporary login is used or critical actions are performed.
- Stealth Mode (White-label): Hide the plugin menu completely and access it only via a secret URL parameter.
- Automatic Data Cleanup: Automatically delete expired login links and session data to keep your database fast and clean.
- Give a plugin or theme developer temporary access to troubleshoot a bug.
- Let a client safely review their website before launch.
- Provide an SEO expert restricted access to update meta tags.
- Keep a clear audit log of what a temporary user did on your site.
- Ensure maximum WordPress security by enforcing session expirations.
安装:
- Upload the
secure-access-bridgefolder to the/wp-content/plugins/directory, or install the ZIP through Plugins > Add New > Upload Plugin. - Activate Secure Access Bridge from the WordPress Plugins screen.
- Open Secure Access Bridge from the admin menu.
- Click "Create Link", select a profile (e.g., Developer or Support), configure expiry, and share the generated link securely.
常见问题:
Does this plugin share my real WordPress password?
No. Secure Access Bridge generates a unique URL that bypasses the standard login screen entirely. Your actual WordPress password is never shared, exposed, or changed.
How secure are the temporary login tokens?
Extremely secure. Generated access tokens are cryptographically hashed before being stored in your database. Even if your database is compromised, the temporary login URLs cannot be extracted or reversed.
Can I restrict what menus a temporary user can see?
Absolutely! You can use predefined access profiles or configure custom rules to restrict allowed menus, specific capabilities, and even restrict access by country or IP address.
Can I manually revoke a temporary login link?
Yes. Administrators can instantly revoke or delete any active temporary access link from the plugin dashboard with one click.
Does the plugin support QR code logins for mobile?
Yes. You can generate a QR code for the login URL, allowing users to scan and log in directly from their mobile devices. (QR codes are generated securely via the external QRServer service).
What happens when a session expires?
The temporary user is instantly logged out of WordPress, and the link becomes invalid.
What happens if I deactivate or uninstall the plugin?
If deactivated, all temporary login links will instantly stop working. If you completely uninstall the plugin, all custom database tables, options, and logs are safely removed from your site.
Can I use country restrictions without a GeoIP service?
Country checks read CDN/proxy headers such as Cloudflare CF-IPCountry. The plugin does not call an external GeoIP API. Without those headers the country is treated as Unknown, and any link with country restrictions will deny access. Use the testing Simulate Country Code setting only on staging.
更新日志:
- Security/Performance: Added shared-host friendly email rate limits (default 20/hour, max 50/hour, burst 5/minute) so low servers cannot flood mail queues.
- Security: Hardened email sender headers and validated login URLs before email delivery.
- Security: Stealth-mode cookie now uses HttpOnly + SameSite=Lax and constant-time token compare.
- Performance: Deferred heavy activity/recovery hooks to temporary users only; cached temp-user capability checks; throttled session activity DB writes.
- Fix: Unified link/session/log datetimes to WordPress local time (fixes wrong expiry on non-UTC sites).
- Fix: Change Recovery now tracks all temporary login sessions (not only dummy users).
- Fix: Safer IP detection defaults; optional proxy trust via filter.
- Enhancement: Restriction arrays stored as JSON going forward, with backward-compatible read for legacy serialized rows.
- Compatibility: Added upgrade migrator so existing installs keep settings/tables/cron intact when updating.
- Docs: Clarified country restrictions need CDN/proxy GeoIP headers (e.g. Cloudflare CF-IPCountry).
- Tweak: Cron scheduling moved off every page load; expired cleanup runs in small batches.
- Enhancement: Massive SEO improvements in plugin description and metadata.
- Feature: Added full translation support with POT file and 10 default languages (bn_BD, de_DE, fr_FR, es_ES, it_IT, pt_BR, nl_NL, ru_RU, ja, ar).
- Tweak: Refactored and improved UI text to be more user-friendly.
- Initial release of Secure Access Bridge.