Segurium – Free Malware Removal & Auto Cleanup for Hacked Websites, Antivirus Scanner, Vulnerability Alerts
| 开发者 | segurium |
|---|---|
| 更新时间 | 2026年10月2日 19:17 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
- Malware removal and cleanup — A full filesystem scan finds the infected files; one click strips the malicious code out and keeps an encrypted, reversible backup, so a wrong call is never permanent. A unified "Threats" view collects every finding.
- Bulk "Fix All" remediation — Queue every detected threat for cleanup in one click on both malware and integrity panels.
- Auto-cleanup on detection — Switch it on and a file that real-time scanning flags is cleaned without waiting for an admin to open the dashboard. Off by default; at its best next to a daily schedule, which applies the same rule.
- Real-time and upload scanning — New and modified files are checked automatically; infected uploads are blocked before they land on disk.
- Integrity scan — Verify WordPress core, plugins and themes against upstream manifests, and restore a rewritten file to its official content. That is how you undo a hack that edited legitimate files. Tampered, delisted and abandoned components show up here too.
- Cleanup with encrypted, reversible backups — Before anything is cleaned, the original file is encrypted (AES-256-GCM) and stored locally. Backups are retained for up to 30 days, subject to per-bucket count and size caps. "Show original" and "Restore" are one click away.
- Scheduled scans — Off / daily / weekly with a locale-aware time picker. Each run chains an integrity check behind the malware pass on the same cadence.
- Two-factor authentication — TOTP apps, email fallback, backup codes, trusted devices, per-role enforcement and grace period.
- Brute-force protection — Multi-tier lockouts on wp-login.php and XML-RPC, honeypot field, manual IP unlock, optional hCaptcha on login.
- Firewall — Allow / deny IP rules, CIDR ranges and country-level filters with a single source-of-truth IP list shared across login, admin and request gating.
- Geo-blocking — Block login or admin traffic by country using a local binary database (auto-updated), with a confirm-or-revert safety net so you can't lock yourself out.
- Security headers — Security HTTP response headers, cookie hardening (SameSite/Secure/HttpOnly), and five one-click preset modes.
- Information Shield — Toggles that hide WordPress version fingerprints, discovery endpoints, asset
?ver=strings, and XML-RPC when you don't use them. - Self-Check security grade — Checks roll up into an A+ to F grade, each with one-click Fix buttons and cross-referenced with third-party services.
- Migration importer — Import your settings from Wordfence, All-In-One Security and Solid Security so you don't lose your hardening when you switch. Sucuri Security is detected too, but its settings live in Sucuri's cloud dashboard and cannot be read locally, so there is nothing to import.
- Disaster recovery — Local encrypted backups can be extracted with a tiny PHP one-liner, even if Segurium is uninstalled.
- Embedded support.
- Scanning is opt-in. Until you accept the service disclosure on the plugin's admin page, nothing contacts the cloud and the plugin stays idle.
- Hash-first, body-on-miss. During a scan, files are checked by SHA-256 first. Only files whose hash is unknown to the cloud have their bytes uploaded for classification, so the volume of content actually leaving your server is small and bounded by what's new on disk.
- No telemetry on your visitors. We look at files and security incidents, not at the people who visit your site.
- On-premise mode. Switch off cloud-assisted malware detection and scans send hashes, paths and metadata only.
安装:
- Upload the
seguriumfolder to/wp-content/plugins/, or install through Plugins → Add New in the WordPress admin. - Activate the plugin through the Plugins menu in WordPress.
- Open Segurium in the admin sidebar and accept the service disclosure to enable scanning.
- (Optional) Import settings from your previous security plugin via Segurium → Migration.
- （可选）在各自的标签页中启用双重身份验证、地理位置封锁和安全标头。
屏幕截图:
常见问题:
其他插件当作高级功能出售的安全功能里，哪些在 Segurium 中是免费的？
全部。双重身份验证支持身份验证器应用（TOTP）、邮件验证码、备份码、受信任设备和按角色强制启用。暴力破解防护带有登录尝试次数限制、锁定、蜜罐和 xmlrpc 覆盖。防火墙支持 IP、CIDR 和国家/地区规则，您可以在登录页面上封锁一个国家/地区。安全标头包含 HSTS、CSP、Referrer-Policy 和 Permissions-Policy，还有 Cookie 加固。地区封锁使用本地数据库。这些都不是试用，也没有一项藏在专业版套餐后面。免费层级只限制云端清理的次数：每 30 天三次。
不打开每个站点的仪表盘，也能在很多站点上设置恶意软件清理吗？
可以。WP-CLI 能接受服务披露并报告清理配额，导出和导入设置则把一个站点的配置带到下一个站点。每个安装运行相同的插件代码和相同的免费配额，所以后来加入的站点与其他站点表现一致。
Segurium 是 WordPress 网站的杀毒软件吗？
实际上是的。同一个问题，有人叫网站病毒，有人叫 WordPress 病毒，有人叫恶意软件，其实是一回事：服务器上不该存在的文件，加上攻击者往该存在的文件里添加的代码。Segurium 对服务器上的文件做哈希，再向云端判定数据库询问每个文件是什么，于是整站的反恶意软件扫描变成一次哈希查找，而不是逐个文件检查。桌面杀毒软件保护您的笔记本电脑。Segurium 为您的 WordPress 文件做同样的事，并清除它找到的东西。
Segurium 能取代付费安全插件吗？
在恶意软件清除、双重身份验证、防火墙、地区封锁和安全标头这几项上，可以。这些正是大多数插件当作高级订阅出售的部分，而 Segurium 在每一次安装中免费提供。付费层级只是提高云端清理的配额。如果您从别的安全插件迁移过来，迁移标签页会从 Wordfence、All-In-One Security 和 Solid Security 导入您的设置，这样切换不会让您丢掉已有的加固。
Segurium 扫描会查找什么？
云端判定数据库已归类为恶意的文件。在一次普通入侵中，这意味着上传的 web shell 或后门、注入主题文件的重定向、垃圾页面、垃圾链接、隐藏链接、丢在上传文件夹里的钓鱼页面、日文关键词攻击，以及加密货币挖矿程序的残留。Segurium 不在乎这个家族叫什么名字，也不在乎有人给它贴上木马还是病毒的标签。它只检查文件是否恶意，以及能否把干净版本放回去。
Segurium 是免费移除恶意软件，还是只负责检测？
它会清除恶意软件。恶意软件清除在免费服务级别上即可运行：每滚动 30 天最多 3 次云清理，足以应对一次典型的入侵事件。多数其他插件免费报告恶意软件，却对修复收费。每一次清理都可以通过本地加密备份还原。
没有备份时，我该如何清理被黑的 WordPress 站点？
这正是常见的情况，也是清理引擎的用途所在。如果攻击者向您自己的文件注入了代码，Segurium 会剥离注入部分，文件的其余内容保持不变。如果文件本身就是纯粹的恶意软件，则会被清空。对于 WordPress 核心、插件和主题文件，完整性扫描会从上游信息清单拉取官方内容，因此即使您没有任何可供还原的副本，也能得到洁净的文件。
我的站点被黑、把访客重定向，或被 Google 列入黑名单。我该怎么办？
在被黑的站点上安装 Segurium，接受服务披露，然后运行一次恶意软件扫描。Segurium 会列出受感染的文件并一键清理，同时为每个原始文件保留加密备份。接着运行完整性扫描，让被攻击改写的核心、插件或主题文件还原为官方内容。重定向、日文 SEO 垃圾和药品垃圾正是藏在这些文件里。恶意软件清除之后，在 Google Search Console 申请重新审核，或请主机商解除暂停；Segurium 移除的是提交申请的理由，它不会替您提交申请。
Segurium 会拖慢我的站点吗？
不应该。扫描以分块的后台任务运行，并有锁保护，因此单次运行不会自我叠加。实时扫描只检查新增和修改过的文件。插件不会在内存中保留大型数据表，也不附带任何二进制文件。
如果 Segurium 标记的文件其实不是恶意软件，会怎么样？
Every cleanup is reversible. Originals are encrypted (AES-256-GCM) and stored locally — retained for up to 30 days, subject to per-bucket count and size caps — and you can restore from backup in one click. You can also submit a false-positive report directly from the threats list, and our team uses those to improve classification.
Segurium 会隔离受感染的文件吗？它会标记有漏洞的插件吗？
There is no separate quarantine folder. Segurium handles a suspicious file in place: it encrypts the original (AES-256-GCM), stores that copy locally, then strips the malicious code out, so the file is neutralised and you can put the original back for up to 30 days. The integrity check compares WordPress core, plugins and themes against upstream manifests and marks a component whose installed release carries a known vulnerability with a red Vulnerable badge and an Update button; tampered, delisted and abandoned components show up there too.
暴力破解防护是否需要 hCaptcha？
No. Brute-force protection works out of the box with rate limits, honeypot and lockouts. hCaptcha is optional — if you already have an hCaptcha site key and secret, you can enable it on the login form for an additional layer. When disabled (the default), no hCaptcha scripts or requests are ever loaded.
支持哪些 PHP 和 WordPress 版本？
PHP 7.4 或更新版本，以及 WordPress 6.2 或更新版本。已定期在 PHP 8.1/8.2/8.3 和 WordPress 6.3 至 7.0 上测试。
卸载插件后会发生什么？
插件选项、自定义数据表和本地扫描备份都会被移除。如果您想保留副本，本地加密备份在卸载前仍可用一小段 PHP 单行代码提取（参见 segurium.com 上的灾难恢复文档）。
我该如何报告 Segurium 自身的安全问题？
请发送邮件至 security@segurium.com，而不要发布公开的支持主题。我们的披露政策、测试基本规则和研究者致谢见 https://segurium.com/security/ —— 其中也说明了我们能够和不能够提供的回报。在修复方案向用户发布之前，请对细节保密。
更新日志:
- Connects through a backup address when the host blocks the main port.
- Scans no longer fail on hosts that block outgoing non-standard ports.
- Redesigned admin page with consistent icons across operating systems.
- 改进了自检标签。
- 在文件较多的网站上，恶意软件扫描不再跳过文件。
- 细微的界面改进
Older entries are in
changelog.txt, which ships with the plugin, and the full history is published at https://segurium.com/changelog/.