Ultimate Security For WooCommerce -- WordPress 插件

开发者	programmelab wpultimatesecurity
更新时间	2026年9月15日 04:50
捐献地址:	去捐款
PHP版本:	7.1 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

Ultimate Security handles the traffic that actually reaches a WordPress site: automated login attempts, brute-force runs, comment and form spam, and probes at well-known paths. It covers two-factor authentication, login lockouts, CAPTCHA, a movable login URL, session controls, vulnerability scanning, and Cloudflare edge rules — set up from one admin screen, without editing files or writing firewall rules by hand. [youtube https://www.youtube.com/watch?v=MU7KivId-cE] There is no usage tracking and nothing phones home. The plugin contacts an outside service only when you switch on a feature that needs one, and each is listed under External Services below. Features that belong to the Pro add-on are labelled as such. Setup wizard The first run is a five-step wizard. You answer a few questions about the site, it runs a quick scan, and you pick one of seven starting templates: basic, moderate, strict, agency, blog, membership, or WooCommerce. Before it changes anything it shows you a full diff, and you can undo everything it did later without losing edits you made yourself. It also gives you an emergency access link — keep it somewhere safe, and you can switch the plugin off from a browser if you ever lock yourself out. Two-factor authentication

Email one-time codes, no app required, for any user.
Authenticator apps (TOTP and HOTP) with QR enrolment — Google Authenticator, Authy, Microsoft Authenticator and similar.
Per-role configuration: pick which roles use email codes and which use an app.
Rate limiting on code entry, with a configurable attempt limit and lockout.
Optional 2FA event logging.
Covers the WordPress, WooCommerce and Ultimate Member login forms, with a separate setting for XML-RPC.

Move wp-login.php to a secret URL so bots can't find it, with a configurable post-login redirect.
Show your own consent or policy text on the login form.

Password policies

Require a minimum length, mixed case, numbers and special characters, or start from a preset.
Expiry with advance warning, a grace period, and email notification.
Password history, so old passwords can't be reused.
Force a password change on first login.
Reject compromised passwords, checked against the Have I Been Pwned range API by k-anonymity — the password itself never leaves the site.
Optionally turn off self-service password reset and point people at your own process instead.

Brute-force protection

Limit failed logins and lock offenders out automatically.
Progressive lockouts, so repeat offenders wait longer each time.
Configurable retry-reset window, plus a permanent block list.
A recovery link an administrator can generate for a locked-out user, valid for 15 minutes. For the sole administrator, the emergency deactivation link from the wizard is the way back in.
Trusted proxies: list your CDN or load balancer so lockouts and logs see real visitor addresses. Cloudflare is recognised automatically, and Site Health tells you when this is needed.

Session management

Limit concurrent logins per user; block the new login or end the oldest session.
Idle timeout for inactive sessions.
HttpOnly, Secure and SameSite flags on auth cookies.
Optionally bind a session to its IP and/or browser to catch hijacking.

CAPTCHA and spam

Google reCAPTCHA v2 and v3, with a v3 score threshold, IP and user-agent allowlists, a bypass for logged-in users, and a verification log.
Cloudflare Turnstile, with theme, size, language and appearance options, deferred loading, custom failure messages, and its own log.
Both cover the WordPress login, registration, lost-password and comment forms, and the WooCommerce login, registration, lost-password and checkout forms.
No-conflict mode and provider priority keep two CAPTCHAs off the same form.
Validate your site and secret keys from the settings page before going live.
If the provider is unreachable, forms keep working.

Vulnerability scanning

Scans WordPress core, plugins and themes for known vulnerabilities.
No API key needed — it uses the keyless WPVulnerability database by default.
Add a WPScan or Patchstack key for more coverage, with automatic failover between providers.
Scheduled scans and email alerts, filtered by severity.
Flags plugins that haven't been updated in a long time.
Scan history, run-to-run comparison, and an ignore list for findings you've accepted.
Results show up in Site Health, the dashboard widget, the plugins list, and menu counters.

Cloudflare WAF rules Connect your own Cloudflare account and manage edge rules from wp-admin. [youtube https://www.youtube.com/watch?v=W2v08QaSCl4]

Let verified search, monitoring, backup, SEO and social crawlers through.
Block aggressive crawlers and sensitive WordPress paths.
Block data-center hosts and TOR exit nodes.
Challenge large cloud providers and specific countries.
Challenge VPN traffic and requests to wp-login.php.
Virtual patches that block requests exploiting known core CVEs at the edge until you can update.
Preview the generated expressions before deploying, review the live rules on your zone, and read request, threat and bandwidth analytics.

Security keys (salts)

Rotate the keys and salts in wp-config.php on demand or on a schedule — daily, weekly, monthly, quarterly, or twice a year.
Advance notice before a scheduled rotation, so the forced re-login isn't a surprise.
Quiet hours, plus pause and skip-next controls.
Rotation history, with the option to restore a previous set.

Update manager

Set auto-update policy for core, plugins and themes. Per-plugin and per-theme overrides and the update history are part of Pro.
Update windows, allowed days, and freeze periods for when you don't want changes.
Delay updates by a set number of days to let others hit the bugs first.
Optional maintenance mode during updates, and detection of version-controlled installs.
Email notifications and a daily digest.

Monitoring, security score and logs

A security score with a per-check breakdown of what's pulling it down.
Activity log for logins, logouts, lockouts, and 2FA and password events, with a retention period you set.
Session log for session events and anomalies.
A "who's online" view of currently active users.
Core file-integrity check against the official WordPress.org checksums.
Site Health entries covering plugin, server, database, filesystem, theme and WordPress diagnostics.
A dashboard widget summarising failed logins, issues found, outdated plugins and the current score.

Test mode Run your rules without blocking anyone and review a log of what would have been blocked before you enforce it. Choose which roles it applies to (or leave the list empty for every role), keep admins excluded, and an admin-bar marker plus a dashboard notice remind you it's on. Login limits for visitors who are not signed in are always enforced, even in Test Mode, and Test Mode switches itself off after seven days so a forgotten test cannot leave protections off. Tools, migration and backup

Import from Wordfence Login Security — preview what comes across, run it, and roll it back if you change your mind.
Export and import settings as JSON for staging-to-production moves or recovery.
Reset all settings to defaults, and clear the plugin cache.
Diagnostics for REST API, cron (with a manual run trigger), and server status.
An emergency deactivation URL that switches the plugin off if you're locked out.

Works with what you already run Ultimate Security detects and adapts to WooCommerce, Ultimate Member, common page builders, form plugins, caching plugins and SEO plugins, and warns you when another security plugin is already doing the same job. WP-CLI wp ultimate-security template list wp ultimate-security template apply [--dry-run] wp ultimate-security template undo wp ultimate-security export [--file=] wp ultimate-security import [--dry-run] wp ultimate-security status wp ultimate-security unlock | --ip= | --all wp ultimate-security 2fa disable wp ultimate-security captcha off wp ultimate-security login-url reset Learn more

Website — features and articles.
Documentation — setup guides, troubleshooting and how-tos.
YouTube — walkthroughs and tutorials.

1.0.29 This update includes everything since 1.0.28 and follows a full security review of the plugin. Most of that work happens behind the scenes; below is what you will notice. If your site sits behind Cloudflare, a CDN or a proxy, or you use CAPTCHA on your login form, update promptly. Login protection

Sites behind Cloudflare, a load balancer or another proxy are no longer at risk of locking everyone out after a few failed logins. Cloudflare is recognised automatically. For other proxies there is a new Trusted proxies setting with a Detect button that fills in the right value for you, and Site Health tells you if it needs attention.
When you are locked out, the login page now says how many minutes remain and how to get back in with a recovery link from an administrator.
Brute-force protection is stronger all round: failed sign-ins are always counted, the login page gives nothing away about which usernames exist, and recovery links cannot be guessed.
The emergency deactivation link now expires after 30 days. A fresh one is always shown on the plugin's screens, so use the current one rather than an old copy.
New WP-CLI commands let you clear a lockout, turn off two-factor for a user, turn off CAPTCHA, or reset the login address from the command line if you are ever locked out. CAPTCHA
A wrong or rejected Secret Key can no longer lock everyone out. The plugin warns you in Site Health and with an admin notice, and lets real people through for up to an hour while you fix it.
The reCAPTCHA and Turnstile pages ask you to verify your keys before login-form protection can be switched on.
The "strict" setup template now keeps sign-in forms closed during a CAPTCHA outage. Other templates are unchanged.
reCAPTCHA's floating badge no longer shows on a login page where Turnstile is in charge.
The WooCommerce CAPTCHA reminder can be dismissed and only appears on the Dashboard, Plugins and WooCommerce screens. Two-factor authentication
The code box on the login screen is now six separate digit boxes, and the same box is used when you set up two-factor on your profile. Pasting a code with a space or a dash in it fills the whole box, browsers offer the code they just received, and a mistyped code no longer uses up one of your tries.
If the two-factor email cannot be sent, the sign-in screen says so and points you to Resend, a backup code or an administrator.
Email and SMS two-factor must be confirmed with a code before they can be saved, the same as the authenticator app.
New option, "Require authorization to reset 2FA", for each method. When on, a user must enter their password before that method can be reset. Off by default.
Two-factor users can optionally keep using application passwords (the WordPress mobile app, Jetpack). Off by default.
The login screen now works on sites with a strict Content Security Policy. Settings that now do what they say
Test Mode no longer switches off brute-force protection for visitors, and it turns itself off seven days after you start it, with an email to the administrator.
Password expiry set in days now expires passwords in days; it was counting months. People who joined before the rule get a full period before they are asked to change their password.
The Maximum Security template signed non-administrators out after five idle minutes without saying so. It now sets 30 minutes, lists it, and the login page explains why you were signed out. New installs no longer get a short idle timeout when session limits are turned on.
The security score can now reach the top level with the free plugin. The Hardening card says its recommendations are applied by Pro instead of showing a percentage.
Scheduled vulnerability scans no longer appear several times under Tools → Scheduled Tasks. Setup wizard
Setup ends with a short progress screen that runs your first checks and fills in the dashboard, so it shows real numbers the first time you open it. You can skip it.
The wizard lists every setting that starts to apply when a template turns a module on. Admin screens
Switches are never greyed out. On pages that need Pro, flipping a switch opens the Pro dialog. Pro-only pages are shown read-only with a note at the top.
The settings pages now fit a phone screen.
Settings that fail to load are shown read-only with a Retry button. Leaving a page with unsaved changes asks first, and so does Discard. Save errors name the fields that need attention.
Forcing a password reset for all users now shows a progress bar and completes on large sites.
The Dashboard's failed sign-ins list matches its total, and the Server protection panel no longer checks for fail2ban.
Updating a plugin or theme from the Update Manager requires the normal WordPress permission to install updates.
Site Health no longer shows a warning while measuring folder sizes, and its "writable" checks work on Windows hosting.
Firewall rules the plugin creates in your Cloudflare account have a clearer name. Existing rules are updated in place, not duplicated.
Messages that include a name or a number now translate correctly.
Smaller fixes: the Upgrade to Pro button works, Give Feedback opens the feedback form, the review prompt can be dismissed for good, WordPress's own update notices show on plugin screens again, and the email blocklist page has a new address (old links still work).

1.0.28 Includes everything from 1.0.27, which was never released. Security

Bot protection hardening across CAPTCHA key verification, Test Mode, the login lockout, provider outages and No-Conflict Mode. If you use reCAPTCHA or Cloudflare Turnstile, update promptly.
The salt keys screen shows a masked preview and a strength rating instead of the keys themselves.
Admin screens send less to the browser, and users who are not administrators no longer receive information meant for administrators.
Further hardening around lockout recovery, the Maintenance cron tools, Cloudflare zone IDs, password-expiry redirects and the review notice. Speed
Admin pages are far lighter: the media library scripts are gone (about 110 requests and 11 MB per page view), settings arrive with the page, and the main script is about 40% smaller.
The dashboard opens with its numbers already in place, prepared in the background every 15 minutes. Refresh now shows each check as it finishes.
Charts load only when one is about to be shown, and the sign-in trend chart is back with its hover tooltips. Fixed
A challenge that never loads no longer leaves a form with a permanently disabled submit button.
The login page no longer shows a CAPTCHA error before anything is submitted, and a failed check on the password-reset form appears on the form instead of a blank error page.
Turning off Cloudflare Turnstile hides only its own page, not the whole Bot Protection section, and comment protection no longer disables the Log In button.
Cloudflare Turnstile loads only on pages that can show a protected form.
Key panels behave: clearing removes only the version shown, Re-verify checks the keys you saved, the status matches the version in use, and closing with unsaved keys asks first.
Score thresholds, whitelists, theme and size settings keep exactly what you enter, and there is now an editable message for a form submitted without the challenge.
Debug Log columns sort and paging keeps your place. Wording and typo fixes across the Bot Protection screens.
A database update that stopped part-way is retried instead of being marked done, and uninstall removes everything the plugin created.
Log times are stored in UTC, so retention and dashboard counts stay right in any time zone.
Audit log settings take effect: retention, which events are recorded, and logout logging.
After a salt reset you land on your real login page, including when a custom login URL is active.
Number fields no longer lower the values chosen in the setup wizard, such as a 180-hour lockout becoming 60. Improvements
More on-screen text can be translated.
Requires PHP 7.1 or newer. The plugin already needed it; the listing said 7.0.

1.0.26

Fix: The session activity list and the failed sign-in count on the WordPress dashboard now update as soon as something happens, instead of lagging behind by up to an hour.
Fix: The failed sign-in count on the dashboard shows real numbers again. It was reading a table that no longer exists and always showed zero.
Fix: Cloudflare Turnstile no longer breaks the page when a challenge does not match the form it came from, when Cloudflare cannot be reached, or when its keys cannot be read.
Fix: The WordPress core file check now explains itself when it cannot reach WordPress.org, instead of failing with a PHP error.
Fix: Cached scan results are cleared properly on sites that use Redis or Memcached object caching, a cached dashboard status that could get stuck is refreshed, and uninstalling now removes the last of the plugin's temporary data.
Performance: Security logs are cleaned up automatically after 90 days, so the log tables no longer grow without limit. The clean-up runs in small batches, and developers can change the retention period with a filter.
Performance: Searching session activity is faster, and it loads faster on sites with a long history.
Performance: Who's Online no longer does any work for logged-out visitors, so ordinary page views are unaffected by it.
Performance: User and session lists load faster on sites with many users, and Test Mode records simulated blocks with less database work.
Performance: The lockout clean-up job runs hourly instead of every minute. Lockouts still end exactly when they are supposed to.
Improvement: The plugin now runs on MariaDB and on SQLite-based setups such as WordPress Playground and Local Studio, in addition to MySQL.
Docs: A new FAQ entry explains how object caching (Redis, Memcached) affects login lockouts and two-factor sign-in sessions.
Docs: The plugin listing now has captions for its screenshots.

1.0.25

Fixed: Session cookie hardening (SameSite, Secure) was overridden by WordPress core and never applied.
Fixed: Dashboard hijack and idle-timeout counters read the wrong table and always showed 0.
Fixed: Ending a session from Active Sessions could fail with a fatal error instead of a clear message.
Fixed: Header search listed Active Sessions as Pro and Session Automations as free.
Security: Ending a session from Active Sessions is now a POST request and is recorded in the activity log.
Performance: Active Sessions only queries users who actually hold a session.
Improvement: Settings menus list free features first and Pro features last, and the header Scans menu marks Pro scanners.

1.0.24

New: The redesigned admin interface is now the default for everyone — a cleaner dashboard, settings, and reporting, with light and dark modes that follow your system preference.
Fix: Scheduled security-key (salt) rotation is a free feature, but the setup wizard displayed it as Pro and the Maximum Security template withheld its settings from free installs. Both corrected — applying that template now enables scheduled rotation.
Fix: Security headers and XML-RPC protection are Pro features and are no longer labelled as free in the setup wizard.
Docs: The readme now documents the complete free feature set and discloses every third-party service the plugin contacts.
Maintenance: Removed unreachable code — an unused salt-change extension, a duplicate session route registrar, an unscheduled cron entry, an unused settings group, and unused Pro-feature permission helpers.
Fix: The maintenance file written during plugin and theme updates was not valid PHP. On sites using that option it printed stray text at the top of every page, which broke logins and the plugin's own admin screens, and it could be left behind if an update failed part way through. Maintenance mode itself never actually engaged.
Fix: Changing your security keys and salts now verifies the new wp-config.php before replacing the old one. Previously a bad network response could be written into the file, leaving the site unable to start.
Fix: Saved API keys (reCAPTCHA, Turnstile, WPScan, Patchstack, Twilio) survive a key and salt change. They were previously left unreadable, so those integrations stopped working with no explanation.
Fix: Turning off automatic updates no longer stops WordPress from checking for updates or slows down the admin area. Update notices, including security releases, keep working.
Security: The two-factor code screen is now tied to the browser that signed in. It could previously be shown to another visitor who requested the login page at the right moment.
Security: Two-factor authentication is now required over XML-RPC and for application passwords, which previously bypassed it.
Security: Login attempt limits now count by IP address as well as username, so attempts spread across many usernames are limited and one account can no longer be locked out on demand. Lockout messages no longer reveal whether an account exists.
Security: CAPTCHA can no longer be skipped by sending an authorization header with the login request.
Security: The plugin deactivation link is now confirmed with a form submission instead of acting on a plain link, its secret is kept encrypted, and it changes after each use.
Security: The compromised-password check is rate limited. It could previously be called repeatedly by anyone to exhaust the server.
Security: HTTP authentication now also covers xmlrpc.php, and no longer alters the submitted password before checking it, which could reject valid passwords.
Security: The login recovery link is kept out of settings exports and support reports, and credentials are removed on uninstall even when settings are kept.
Performance: Scan results and CAPTCHA debug logs are no longer loaded on every page request, and settings are read later in the load order.
Performance: Front-end assets now load only where a plugin feature is actually on the page — a page with no forms, widgets, or CAPTCHA loads no plugin CSS/JS and no jQuery.
Improvement: Reworked the Vulnerability Scanner scan-history view — full-width results table and a corrected trend chart.
Maintenance: Removed the previous interface and its opt-in switch, the now-unused styles behind it, and dead IP-switch AJAX handlers.

1.0.23

Privacy: Removed unpublished product-usage analytics code and dependencies before release.
Privacy: Removed automatic dashboard blog-feed and remote country-flag requests.
Fix: Free mode no longer requests Pro-only blocklist routes or mounts Pro-only settings screens.
Compatibility: Restored the documented WordPress 5.6 and PHP 7.0 runtime floor without changing the database schema.
Maintenance: Removed repository GitHub Actions while preserving local release checks.

1.0.22

Improvement: Added localized passkey login feedback supplied by Ultimate Security Pro.
Security: Render passkey login errors as text instead of interpolating error content into HTML.

1.0.21

New: WordPress Salt keys rotation option. Now you can schedule, skip and more when rotating keys.
New: Now you can see the reCaptcha Logs directly from the plugin's setting page.
Improvement: Both reCaptcha and Cloudflare Turnstile follow a similar settings structure for consistency.
Fix: Cloudflare Turnstile and reCAPTCHA whitelist option was not working properly.

1.0.20

New: Improved Session Management settings including concurrent login limits, session cookie hardening and more,
New: Cloudflare Turnstile and reCAPTCHA CAPTCHA verifcation when applying their respective keys.
Improvement: Cloudflare WAF rules function improvement.
Improvement: Code optimization and performance improvements.

1.0.19

Fix: 2FA User role was not working properly.
Fix: Login activity dashboard modal was showing wrong agent.
Improvement: Better user friendly Server Protection Card Design
Improvement: Code cleanup and optimization.

1.0.18

New: One-click Cloudflare WAF rules apply
New: New Modal for Login activity with detailed information.
Improvement: Code cleanup and optimization
Fix: Login redirected URL was showing exisiting login for password reset

1.0.17

Fix: Minor bug fixes and stability improvements
Improvement: Code cleanup and optimization

1.0.16

Improvement: Code improvements to the ovearll plugin making it snappier.

1.0.15

Improvement: Conflict management between applied settings.
Improvement: UI improvements to existing settings pages. Making it more intuitive to use.
Fix: Multiple bug fixes to dashboard. You should get more accurate results now.
Fix: New deactivation URL was not saving after deactiviting-activating plugin.

1.0.14

Fix: Email 2FA codes were not being sent properly
Fix: 2FA code page flickering effect after login

1.0.13

New: Completely redesigned user interface for better usability

1.0.12

New: Security Score meter to track your site's security level
Improvement: Enhanced modal design for better UI/UX

1.0.11

Fix: Minor UI bug fixes

1.0.10

Security: Removed unauthenticated AJAX actions
Security: REST routes now require admin permission

1.0.9

Fix: Dashboard emergency deactivation URL display issue

1.0.8

Improvement: Human-readable values in activity log
Improvement: Reduced plugin size with optimized code
Fix: 2FA reset issue for users
Fix: Password policy not applying to new users

1.0.7

New: Activity Log feature
New: Improved dashboard design
Fix: Nonce validation issues
Fix: Turnstile not showing on comment forms

1.0.6

Fix: Custom login setup issues
Fix: Email 2FA asking for OTP twice
Fix: Feedback form email delivery
Improvement: Reorganized menu navigation
Improvement: Performance optimizations

1.0.5

Fix: Request logs page display issue
Fix: URL Guard SQL query display
Improvement: Performance optimizations

1.0.4

Redesigned settings page interface

Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection

标签

下载

详情介绍:

安装:

屏幕截图:

升级注意事项:

常见问题:

更新日志: