Title: Assist Security
Author: AssistPress
Published: <strong>2026 年 8 月 6 日</strong>
Last modified: 2026 年 8 月 6 日

---

搜尋外掛

![](https://s.w.org/plugins/geopattern-icon/assist-security.svg)

# Assist Security

 由 [AssistPress](https://profiles.wordpress.org/assistpress/) 開發

[下載](https://downloads.wordpress.org/plugin/assist-security.0.1.2.zip)

 * [詳細資料](https://tw.wordpress.org/plugins/assist-security/#description)
 * [使用者評論](https://tw.wordpress.org/plugins/assist-security/#reviews)
 *  [安裝方式](https://tw.wordpress.org/plugins/assist-security/#installation)
 * [開發資訊](https://tw.wordpress.org/plugins/assist-security/#developers)

 [技術支援](https://wordpress.org/support/plugin/assist-security/)

## 外掛說明

WordPress signs every login cookie and nonce with eight secret keys and salts stored
in `wp-config.php` (`AUTH_KEY` through `NONCE_SALT`). If those secrets leak — through
an old backup, a stolen config file, or a contractor who still has access — an attacker
can forge valid authentication cookies for as long as the keys stay unchanged. Rotating
them invalidates every existing session immediately.

Assist Security makes that rotation safe, automatic, and auditable.

#### 🔑 Rotate Security Keys

 * **One-click rotation** from a clean, colorful settings screen
 * **Locally generated keys** using PHP’s cryptographically secure random number
   generator. No calls to any external API, no network dependency
 * **Verified atomic writes.** The new configuration is built in memory, written
   to a temporary file with restricted permissions, verified, atomically swapped
   in, then verified again — with automatic rollback if any step fails. The writer
   refuses to touch your file unless all eight keys are found, so a partial rotation
   is impossible
 * **Key health checks** for missing, weak, duplicated, or placeholder keys. Only
   the verdict is ever shown; your key values never leave the server
 * **Audit log** recording every attempt: timestamp, result, trigger, user, optional
   IP, duration, and how many sessions were signed out — with filtering, pagination,
   and CSV export
 * **Failure alerts** emailed to the site administrator if a rotation ever fails
 * **Site Health test** that flags key problems and keys older than 180 days
 * **WP-CLI commands** — `wp assist-security rotate` and `wp assist-security status`
 * **Custom config locations** supported: `wp-salt.php`, a `wp-config.php` above
   the web root, or any path you choose with a filter

#### Built the right way

 * Beautiful, responsive settings screen with no page reloads and no build step
 * REST API under `assist-security/v1`; no admin-ajax
 * No bundled SDKs, no Composer dependencies, no external HTTP requests, no telemetry
 * Every input sanitized, every output escaped, every query prepared
 * Multisite aware: management is restricted to network administrators
 * Privacy-conscious: IP logging is optional and data removal on uninstall is opt-
   in
 * Settings import and export as JSON
 * Fully translatable, with a bundled POT file

Assist Security is built on a module architecture, so further protections can be
added as self-contained modules in future releases.

## 安裝方式

 1. Upload the `assist-security` folder to `/wp-content/plugins/`, or install it through**
    Plugins  Add New**.
 2. Activate **Assist Security** from the Plugins screen.
 3. Open the new **Assist Security** menu in your admin sidebar.
 4. Check your key health on the Security Keys tab and rotate whenever you need to.

**Note:** rotating the keys signs out every user, including you. The plugin warns
you first and sends you to the login screen afterwards.

For rotation to work, `wp-config.php` (or your custom salt file) must be writable
by PHP. The Security Keys tab and Site Health both report this.

## 常見問題集

### Will rotating the keys break my site?

No. The writer refuses to modify your configuration file unless all eight keys are
found, verifies the result before and after an atomic swap, and rolls back automatically
if anything is wrong. If a rotation cannot complete safely, your original file is
left untouched.

### Why is everyone logged out afterwards?

That is the point. Invalidating existing cookies is what makes rotation a security
measure. Session tokens are cleared as well.

### Where do the new keys come from?

They are generated on your own server with PHP’s cryptographically secure random
number generator. The plugin makes no external requests.

### Does the plugin ever show or send my keys?

No. Key values are never displayed, logged, exported, or transmitted. The health
check reads each constant only long enough to decide whether it is missing, weak,
or duplicated, and reports that verdict alone.

### My wp-config.php is outside the web root, or I use wp-salt.php. Is that supported?

Yes. The plugin checks `wp-salt.php`, `wp-config.php`, and the parent directory 
automatically. You can also point it anywhere:

    ```
    add_filter( 'assist_security_config_file', function () { return '/path/to/wp-salt.php'; } );
    ```

### Is it multisite compatible?

Yes. On multisite, only network administrators (`manage_network_options`) can manage
the plugin.

### How often should I rotate?

Every one to three months suits most sites. Rotate immediately if you suspect a 
leak, after removing an administrator, or after restoring from a backup of unknown
origin. The Site Health test reminds you once your keys pass 180 days.

### What data does the plugin store?

Settings in a single option, and rotation records in its own database table. IP 
addresses are recorded only if you enable that option. Everything is removed on 
uninstall only if you opt in first, on the Tools tab.

## 使用者評論

這個外掛目前沒有任何使用者評論。

## 參與者及開發者

以下人員參與了開源軟體〈Assist Security〉的開發相關工作。

參與者

 *   [ AssistPress ](https://profiles.wordpress.org/assistpress/)

[將〈Assist Security〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/assist-security)

### 對開發相關資訊感興趣？

任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/assist-security/)、
查看 [SVN 存放庫](https://plugins.svn.wordpress.org/assist-security/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/assist-security/?limit=100&mode=stop_on_copy&format=rss)
訂閱[開發記錄](https://plugins.trac.wordpress.org/log/assist-security/)。

## 變更記錄

#### 0.1

 * Initial release.

## 中繼資料

 *  版本 **0.1.2**
 *  最後更新 **3 週前**
 *  啟用安裝數 **少於 10 次**
 *  WordPress 版本需求 ** 6.0 或更新版本 **
 *  已測試相容的 WordPress 版本 **7.0.4**
 *  PHP 版本需求 ** 7.4 或更新版本 **
 *  語言
 * [English (US)](https://wordpress.org/plugins/assist-security/)
 * 標籤:
 * [salts](https://tw.wordpress.org/plugins/tags/salts/)[security](https://tw.wordpress.org/plugins/tags/security/)
   [security keys](https://tw.wordpress.org/plugins/tags/security-keys/)[session](https://tw.wordpress.org/plugins/tags/session/)
   [wp-config](https://tw.wordpress.org/plugins/tags/wp-config/)
 *  [進階檢視](https://tw.wordpress.org/plugins/assist-security/advanced/)

## 評分

這個項目尚無任何評論記錄。

[撰寫評分](https://wordpress.org/support/plugin/assist-security/reviews/#new-post)

[查看全部使用者評論](https://wordpress.org/support/plugin/assist-security/reviews/)

## 參與者

 *   [ AssistPress ](https://profiles.wordpress.org/assistpress/)

## 技術支援

使用者可在技術支援論壇提出意見反應或使用問題。

 [檢視技術支援論壇](https://wordpress.org/support/plugin/assist-security/)