WP Guardian
| 开发者 |
jfcby
butterflymedia |
|---|---|
| 更新时间 | 2026年3月19日 06:11 |
| 捐献地址: | 去捐款 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv3 or later |
| 版权网址: | 版权信息 |
详情介绍:
WP Guardian is a simple but effective plugin that locks down your WordPress website to ensure it's protected and safe.
About
Using this plugin couldn't be easier as it's designed to be as straight forward as possible to make sure you can get your website safe and secure so you can get on with more important things. WP Guardian includes features such as a powerful firewall and Two-Step verification for logging in.
安装:
- Download the plugin package.
- Upload to the /wp-content/plugins/ directory.
- Activate the plugin in the dashboard.
- Go to the settings page and configure the plugin to get started.
常见问题:
How does this plugin secure my WordPress site?
This plugin helps secure your website by locking things down with a range of effective tools with a simple interface.
How good is the security of this plugin?
The plugin is by no means a one stop solution for everything. It's designed to be simple, giving you a range of essential security features to harden your site's security defences.
How does Two-Step verification work?
The option is available on your profile page when enabled globally. It will let you choose a method in which a code is sent to a secondary location for you to enter at login before you can authenticate.
更新日志:
1.9.0
- Add Plugin Guard feature to block plugin installation and activation unless an admin unlocks via Settings → Plugin Guard
- Remove File Guardian feature to reduce complexity and improve performance
- Update WordPress compatibility
- Fix: All REST API requests (including unauthenticated) are now excluded from firewall blocking to support Gravity Forms and other plugins
- Fix: Gravity Forms REST API endpoints are now whitelisted to prevent blocking form submissions
- Fix: Gravity Forms form submissions from logged-out users now work correctly
- Fix: Regex pattern error in security measures file access restriction (preg_match unknown modifier warning)
- Fix: Authenticated REST API requests are now properly excluded from firewall blocking
- Fix: POST scanning no longer blocks authenticated REST API requests when saving pages
- Fix: Security measures no longer interfere with authenticated REST API requests
- Fix: File Guardian now correctly scans root directory for files only (not folders)
- Fix: File Guardian now scans wp-admin and wp-includes directories recursively for both files and folders
- Fix: File Guardian path normalization to prevent duplicate directory names in file listings
- Fix: File Guardian integrity check now excludes wp-content/plugins, wp-content/themes, and wp-content/languages from core file checks
- Fix: File Guardian now automatically deletes suspicious PHP files in root directory that are not in WordPress core checksums
- Fix: Circular progress bar stroke color now displays correctly
- Fix: Circular progress bar percentage calculation now accurately reflects Guardian score
- Security measures now included in Guardian percentage calculation (excluding Script Cleaner aggressive filter)
- Guardian percentage calculation redistributed to allow 100% score when all security measures are enabled
- Rename "Obfuscated Script Cleaner" to "Script Cleaner" throughout user-facing text and comments
- Fix: Script Cleaner now properly detects and removes Trojan:HTML/Redirector.SSF!MTB malware
- Enhanced malware detection patterns to match real-time filter capabilities
- Add detection for hex-encoded obfuscated scripts and additional obfuscation techniques (String.fromCharCode, unescape, decodeURIComponent)
- Script Cleaner now detects _0x obfuscation patterns, atob/eval functions, and urshort.live redirect domains
- Add UI toggle for Script Cleaner aggressive filtering (off by default)
- Script Cleaner is now less aggressive: only removes detected malicious scripts, not all HTML
- Fix: HTML is no longer stripped from post/page content unless aggressive mode is enabled
- Remove SQLite logging functionality to reduce complexity and improve performance
- Add Script Cleaner feature to scan and remove malicious injected scripts from all post types
- Add real-time protection to block malicious content from being saved
- Optimize memory usage by reducing SQLite cache size from 32MB to 8MB
- Improve memory efficiency for better performance on resource-constrained servers
- Consolidate security measures: merge directory browsing protection options, combine sensitive file blocking options, and unify PHP execution prevention measures for a cleaner interface
- Fix a few minor issues for compatibility with WordPress 6.9
- Improve security measures notifications
- Improve security measures for directory browsing protection
- Add Security Measures feature with 18 configurable security options
- Add comprehensive file whitelist for common legitimate files
- Add file permission management for wp-config.php
- Improve security key validation with complexity checks
- Enhanced bot protection and file access restrictions
- All security measures enabled by default with toggle options
- Update WordPress compatibility
- Update WordPress compatibility
- Only check for POST injection when not logged in
- Fix session starting when headers are already sent
- Reduce query string length check from 2000 to 1000 characters
- Remove a deprecated UA check
- Test and insure compatibility with the Pepper plugin
- Further sanitize and unslash data
- Add new brute force protection feature
- Update WordPress compatibility
- Add option to restrict external POST requests
- Clean up the plugin Dashboard
- Clean up the admin stylesheet
- Remove the inefficient login lockdown feature
- Remove several obsolete features (the plugin is 8 years old, after all)
- Refactor the Settings page to use the native settings API, instead of jQuery accordions
- Rebrand Gatekeeper to Guardian
- Fix the firewall module being requested twice
- Implement a better Dashboard section
- Add default settings for the firewall to make it truly plug and play
- Make blocked requests count more prominent
- Set foundation for SQLite lockout logging
- Remove the aside section from the Dashboard
- Implement logging for malicious requests
- Implement log pruning
- Move all security settings to a new tab
- Refactor the Dashboard tab
- Remove broken automatic core updates options
- Remove unused constants
- Fix request logging function
- Add malicious request counter
- Add new Settings tab
- Move Settings page to the Settings tab
- Ignore AJAX and REST requests in the firewall
- Fix issues with the firewall (for good)
- Remove obsolete features, such as database backups and version control
- Fix issues with pattern matching in the firewall
- Add new firewall feature
- Add new security settings
- Sanitize and escape all data
- Fix the plugin header information (stable tag, tested up to, etc.)
- Implement WordPress Coding Standards (WPCS)
- Replace index.html with index.php in the root directory
- Remove changelog.md file and move contents to readme.txt
- Remove readme.md file and move contents to readme.txt
- More updates to author information
- Updated author information - Removed Daniel James danieltj
- To see the full revision history, please read the
CHANGELOG.mdfile which explains any changes that have been made.
- Released: 19th November 2017
- Fixed a mistake listed in the change log file.
- Removed the button links to security and settings next to the page titles.
- Released: 19th November 2017
- Fixed a bug where database backups weren't attached to emails.
- Improved some of the transaltion strings throughout the plugin.
- Released: 13th November 2017
- Added the ability to remove support for Emoji scripts.
- Updated how CSS and JS assets are loaded for users.
- Updated a few language translation strings.
- Released: 8th November 2017
- Fixed a bug which caused some meta data to not be removed properly.
- Improvements to a range of code documentation and meta data.
- Released: 26th October 2017
- Added a new directory within the uploads folder for database backups.
- Improvements to database backup function and supporting documentation.
- Improvements to the database upgrade notice and l10n strings.
- Removed a deprecated callback function for the settings section.
- Removes the user meta for Two Step Verification when the plugin is deleted.
- Released: 16th October 2017
- Added new field to send backup emails to different email address.
- Added a new setting to allow WP_DEBUG to be enabled/disabled via the dashboard.
- Improved the Version Control page to now include update information.
- Improved the CSS styling for the plugin user interface.
- Improved overall code base and removed unused functions that are no longer used.
- Improved some language strings and corrected a sentence that wasn't translatable.
- Released: 12th October 2017
- Fixed the implementation of Two Step Verification code expiry.
- Improvements to core functions and inline documentation.
- Improved some of the language strings and provided more context.
- Updated the server config to include some essential rewrite rules.
- Updated the readme.txt file with more useful information.
- Released: 11th October 2017
- Initial version