SPP Guardian Security & Maintenance -- WordPress 插件

开发者	talhastackbuggs
更新时间	2026年9月1日 00:35
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

SPP Guardian is a standalone, local-first WordPress security and maintenance plugin built for site owners who need clear explanations rather than raw technical alerts. Every security finding answers five questions:

What happened?
Where is it?
How serious is it?
How could it affect the website?
What is the safest next action?

The scanner combines official WordPress core checksums, local file-change baselines, offline signatures, code and path heuristics, selected database inspection, administrator-account monitoring, cron inspection, update awareness, safe quarantine, restore, and verified core-file repair. No account, licence server, telemetry service, or cloud scanner is required. The plugin does not automatically delete suspicious content. Main features

On-demand and scheduled resumable scans.
Standard and low-resource scan profiles.
WordPress core checksum verification.
WordPress.org-hosted plugin checksum verification with cached official data.
Local file integrity baselines.
PHP-in-uploads and disguised-executable detection.
Web-shell markers, decoded execution chains, command-execution patterns, hidden iframes, and obfuscated JavaScript checks.
Selected posts, comments, options, administrator, and cron inspection.
Separate severity and detection-confidence values.
Protected quarantine with hash verification and restoration.
Official-package repair for eligible WordPress core files.
Update, PHP, cron, HTTPS, file-editor, debug-display, inactive-plugin, and scan-freshness maintenance checks.
Rate-limited email alerts that never contain executable evidence.
Audit log, REST endpoints, and WP-CLI commands.
Conservative uninstall option: keep data by default or delete everything explicitly.
Optional Protection & Firewall module, off by default, with independent switches for brute-force login protection, GET/POST request filtering, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction.
Manual IP allow and block lists, an activity log of what the firewall did and why, and a one-click unlock for an automatic login lockout.

Important limitation No malware scanner can guarantee detection of every malicious file, database payload, zero-day exploit, hosting compromise, encrypted payload, or attacker-controlled server condition. SPP Guardian provides layered risk detection and guided remediation. It does not replace off-site backups, hosting security, server EDR, a WAF/CDN, log monitoring, or professional incident response.

2.0.2

Resolved Plugin Check SQL preparation findings and refined custom-table query handling.
Removed the variable-path autoloader and switched to explicit trusted includes.
Removed unnecessary SELECT-star queries and query-in-loop patterns identified by readiness scanning.
Updated Tested up to for WordPress 7.1.

2.0.1

Security hardening and WordPress.org review remediation.
Uses configured uploads/plugin paths instead of assuming default wp-content locations.
Uses the unique sppgusem_ / SPPGUSEM prefix family for plugin-owned identifiers, including the sppgusem/v1 REST namespace and wp sppgusem-guardian CLI command.

2.0.0

Renamed from GuardianWP Security & Maintenance to SPP Guardian Security & Maintenance. New slug (spp-guardian-security-maintenance), text domain, PHP namespace/classes, internal database table/option/transient/capability/cron-hook prefixes, REST namespace (spp-guardian/v1, was guardianwp/v1), WP-CLI command (wp spp-guardian, was wp guardianwp), and admin menu slugs.
If you have GuardianWP Security & Maintenance installed: deactivate it, then install and activate SPP Guardian Security & Maintenance — your scan history, findings, quarantined files, settings, and capabilities are imported automatically. An admin notice guides you through this if the old plugin is still active when you activate the new one. Any login lockout active at the exact moment of the upgrade is released and brute-force counters restart; a scan already in progress is not resumed.
The guardianwp/v1 REST namespace and wp guardianwp CLI command are retired with no compatibility alias — update any script or integration that calls them directly. The three extension action hooks (scan_completed, file_quarantined, daily_maintenance) keep working under their old guardianwp_* names as deprecated aliases through the 2.x line.
Fixed: a REST POST /settings request that only sends the field(s) it wants to change no longer resets every other setting to its default.
Fixed: the REST findings endpoint now returns a file path relative to the WordPress root, matching what the dashboard already showed, instead of the full server filesystem path.
Fixed: quarantine's own-plugin-directory check no longer over-matches a sibling directory whose name merely starts with the same string as the plugin's own directory.
Addressed every finding from the official WordPress.org Plugin Check tool: removed a discouraged load_plugin_textdomain() call, added missing translator comments, and documented the plugin's direct-database-query usage against its own tables.

1.1.0

Refreshed dashboard visual design: section navigation, restyled hero and metric cards, and clearer panels and tables.
New optional Protection & Firewall module, off by default: brute-force login lockout, GET/POST request filtering, REST API rate limiting, anonymous REST user-enumeration and ?author= probing blocking, and XML-RPC restriction, each independently switchable.
Manual IP allow/deny lists, a firewall activity log, and one-click unlock for an active login lockout.

1.0.0

Initial standalone release.
Resumable file and database scanning.
Offline detection rules and core checksum verification.
File baselines, issue classification, quarantine, restore, and core repair.
Maintenance dashboard, email alerts, REST API, WP-CLI, and audit logging.

SPP Guardian Security & Maintenance

标签

下载

详情介绍:

安装:

常见问题:

更新日志: