TugraCyber
| 开发者 | skromets |
|---|---|
| 更新时间 | 2026年10月5日 18:27 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
TugraCyber keeps an inventory of every script running on your checkout page and alerts you when a script's content changes silently, which is the signature of Magecart-style card skimming attacks.
- Runs only on the checkout page. This is exactly the scope of PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1.
- Script inventory. A SHA-256 hash of each script's content is recorded, so silent changes are caught immediately.
- Removed and returning script detection. You get an alert when a known script disappears from the page, or reappears after being marked as removed.
- Late-added script detection. Scripts that are added to the checkout page after it has loaded are also inventoried.
- Outbound address monitoring. You get an alert when the checkout page starts sending requests to a new external domain, which is where skimmed card data is typically sent.
- PCI DSS 6.4.3/11.6.1 report. Available from the dashboard in your TugraCyber account.
- WooCommerce must be active (monitoring runs only on the WooCommerce checkout page).
- A TugraCyber account and a collector address.
安装:
- Install and activate the plugin.
- Create a TugraCyber account at https://tugracyber.com/public/onboarding.html. After sign-up you will see three values: Collector Endpoint, Site ID and Write Key.
- In WordPress, go to Settings > TugraCyber, enter those three values and save.
- Visit your checkout page once. The first script inventory is sent automatically.
- Use the "Open your TugraCyber dashboard" button on the settings page to see your scripts and alerts.
常见问题:
Which pages does this plugin run on?
Only the WooCommerce checkout page. It does nothing on other pages.
I don't have a TugraCyber account. Can I still install it?
Yes, but monitoring does not start until the Collector Endpoint, Site ID and Write Key are all entered.
What data does the plugin send?
The URL and SHA-256 content hash of the scripts on the checkout page, and the domain names (no paths or content) of external addresses the checkout page sends requests to. See the "External Services" section above. Page content and customer or payment data are never sent.
更新日志:
0.3.0
- Detects scripts that are added to the checkout page after it has loaded.
- Monitors which external domains the checkout page sends requests to and alerts you about new ones (domain names only).
- The dashboard shows these addresses so you can mark them as known or suspicious.
- Settings page now takes the Site ID and Write Key from your TugraCyber account, so your reports show up in your own dashboard.
- Settings page is in English and translatable.
- Added a link to create an account and a button to open your dashboard.
- Initial release: agent injection on the checkout page, settings page, automatic site ID and write key generation.