Xerotact SHIELD-X Security
| 开发者 | xerotact |
|---|---|
| 更新时间 | 2026年9月16日 20:20 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv3 |
| 版权网址: | 版权信息 |
标签
下载
详情介绍:
- A guided security baseline that helps you get protected quickly.
- A firewall that watches suspicious traffic in Log only mode first, with temporary and permanent blocking available when you are ready.
- Malware, changed-file, database, and vulnerability scans that help you find issues before they become bigger problems.
- Login protection with rate limits, 2FA, human challenges, and recovery controls.
- Practical hardening for safer file access, security headers, and common WordPress attack surfaces.
- Restore points and database backups before important changes, plus clear activity and security-posture views to help you stay in control.
- Notifications sends important security events to the right people through instant alerts or email digests.
- Cloudflare audits and, after an administrator reviews the change set, manages a selected Cloudflare zone's edge-security baseline with encrypted API-token storage and rollback snapshots.
- Pulse monitors uptime, speed, content changes, traffic, mail, and WordPress cron health.
- Recovery adds an isolated recovery workflow for serious incidents and safer full-site restores.
- Scheduler automates recurring SHIELD-X tasks with WordPress cron or system cron.
- Updates delivers protected SHIELD-X and add-on updates inside WordPress.
安装:
- Upload the
xerotact-shield-x-securitydirectory to/wp-content/plugins/, or install the ZIP from the WordPress Plugins screen. - Activate SHIELD-X from the WordPress Plugins screen.
- Open SHIELD-X > Setup in the WordPress admin menu and follow the Setup Assistant.
- Review the System page for PHP extensions, filesystem writability, human challenge settings, file type policy, and configuration portability.
- Review Firewall, Malware/Virus, Login Security, Hardening, and Lockdown before enabling enforcement-style controls.
屏幕截图:
常见问题:
Does SHIELD-X require a cloud account?
No. Core WAF, scanner, hardening, login security, backups, restore points, and logs are local. Vulnerability advisory feeds are optional and configurable by the site administrator.
Does the WAF block traffic by default?
No. SHIELD-X is designed to start conservatively. Use log-only mode first, review hits and false positives, then explicitly choose rule actions or enforce mode when you are ready. Matched scores are diagnostic by default; score-threshold challenge/block behavior is an advanced opt-in setting.
Does the WAF inspect complete request bodies and long headers?
No. For shared-hosting safety, SHIELD-X inspects a bounded body surface, currently 32 KB by default and configurable up to 128 KB. Login, comment, admin-post/admin-ajax, WooCommerce, and contact form bodies are inspected as redacted key/value text so passwords, nonces, tokens, payment fields, and session fields are not stored. Multipart uploads are inspected through form fields, filenames, MIME types, sizes, and part headers, not binary file contents. Country blocking uses country headers supplied by a trusted proxy or CDN, such as Cloudflare, and does not bundle a GeoIP database.
Does the WAF run before WordPress loads?
No. The WordPress.org package is a pure WordPress plugin, so request inspection runs after WordPress begins loading.
What does SHIELD-X not replace?
SHIELD-X does not replace host-level malware cleanup, a server firewall, CDN edge protection, off-site backups, or emergency hosting support. It adds WordPress-level monitoring, hardening, recovery, and investigation tools that work inside the permissions available to a WordPress plugin.
Does SHIELD-X scan vendored libraries inside other plugins?
No. By default, SHIELD-X skips wp-content/cache/, wp-content/upgrade/, wp-content/plugins/xerotact-shield-x-security/, node_modules/, vendor/ inside plugins and themes, and SHIELD-X private storage under .shield-x/.
Vendored libraries should be reviewed by their authors. If you want to inspect a specific vendored path, copy it outside vendor/ first and run a targeted recheck from the SHIELD-X Scan page.
Which database content does the scanner inspect?
The database scanner inspects bounded batches from wp_options, recent post/page content, post metadata, comments, administrator accounts, administrator capability metadata, widgets, redirects, and WP-Cron payloads. It is a local security review tool, not a full database export scanner.
Which files can the scanner skip by design?
For performance and safe shared-hosting behavior, SHIELD-X skips vendor dependency folders, package caches, generated build folders, upgrade/temp folders, private backup storage, and oversized or unchanged files where metadata proves they did not change since the trusted baseline. This keeps routine scans responsive while focusing deeper checks on new or modified files.
Does the User Profiler track visitors automatically?
No. The User Profiler is opt-in. When enabled, it uses a first-party cookie and stores recent request metadata locally for security investigation.
Can I move SHIELD-X settings to another site?
No. Settings exports are signed with this site's WordPress auth salts, so they can only be restored on the same WordPress site that created them.
Can I compare modified WordPress core files with clean copies?
Yes. The scanner can download the matching official WordPress release archive from WordPress.org for core files and official WordPress.org plugin packages for installed plugins. SHIELD-X uses those hashes to avoid flagging unmodified official files as suspicious.
Can I use SHIELD-X on shared hosting?
Yes. SHIELD-X is designed for PHP-only shared hosting. Optional features such as filesystem lockdown depend on host permissions and PHP configuration.
Can WP-CLI change hardening files?
Only with explicit confirmation. SHIELD-X hardening writes from WP-CLI require an administrator-gated command and SHIELDX_CLI_CONFIRM=yes, so direct wp eval calls cannot silently modify wp-config.php or .htaccess.
What happens on uninstall?
SHIELD-X treats plugin delete/reinstall as a maintenance path by default. When WordPress runs the plugin uninstaller, SHIELD-X removes scheduled events and reverts active Lockdown state. It keeps SHIELD-X settings, database findings, audit/activity data, backups, restore points, local logs, and private storage so a plugin upload, replacement, or reinstall does not erase customer data. To remove all SHIELD-X data on plugin deletion, enable Delete all SHIELD-X data when WordPress deletes the plugin on SHIELD-X > Cleanup before using WordPress' Delete action. The SHIELDX_PURGE_ON_UNINSTALL constant remains available for managed deployments.
更新日志:
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- Fixed backup retention controls so Mode, Count, Days, and Save stay aligned at every card width.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- Preserved Jetpack VaultPress Backup compatibility when front-controller servers expose the signed request query only in
REQUEST_URI, including arbitrary numeric REST namespace versions.
- Jetpack VaultPress Backup requests keep their signed backup payload flow while WAF SQLi inspection remains active for the route, query, headers, and non-SQL payload rules across future Jetpack REST namespace versions.
- Arranged backup retention fields in one responsive row with three columns.
- Cleanup now offers one-click rotation beside each log preview and a resumable Rotate all now action that processes every eligible log regardless of age, date, or size.
- Reduced private add-on bootstrap file I/O by caching request-local module metadata and avoiding duplicate header reads without bypassing package signature verification.
- Repaired local canonical-domain WP-Cron loopbacks so scheduled security maintenance and threat-intelligence jobs run inside Docker.
- Coalesced database-table cache invalidation writes and replaced repeated admin asset content hashing with lightweight versioned file timestamps.
- Hardened add-on loading with signed per-file verification before PHP execution.
- Improved WAF engine-error handling, reverse-proxy secure cookies, and context-bound secret encryption with backward-compatible migration.
- Updated security tooling dependencies and strengthened isolated test discovery.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- Security Trends now moves into its full-width top dashboard position before lazy asset loading begins, so a refresh no longer requires scrolling to make the widget appear.
- Security Trends now self-heals stale WordPress Dashboard placement data that could leave the widget checked in Screen Options but missing from every dashboard column.
- Security Trends now render with the WordPress Dashboard instead of waiting for a second admin request, while the initial render stays bounded to indexed daily counters.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.
- License checks now allow 20 seconds to connect and retry timeout, DNS, and connection failures through WordPress's alternate Fsockopen transport while preserving TLS verification.
- Static assets with safe version cache-busters no longer consume the WAF inspection budget; other query strings remain inspected.
- Deferred admin pages now allow slower valid responses to finish before showing a retry option.
- Manual license status checks now contact the license server when a stored key is invalid or expired instead of reporting that the check was skipped.
- WAF engine budget exhaustion now records an operational warning without blocking visitors; genuine attack-rule matches continue to enforce normally.
- WAF diagnostics now distinguish time-limit exhaustion from pattern-limit exhaustion.
- Virtual Patch administrative status messages now require a verified redirect.
- Kept the public release history within the WordPress.org parser limit.
- WAF enforcement now blocks requests when its inspection budget is exhausted, while monitor mode continues to log without blocking.
- Sensitive login, XML-RPC, and user-enumeration rate limits now block when all limiter storage is unavailable.
- Requests to static assets with query strings are inspected before they can bypass the WAF.
- Accelerated full backup and isolated restore with adaptive file batches up to 1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB I/O ceiling.