NHR Secure – Security, Firewall, 2FA, Login Protection & Activity Log

外掛說明

NHR Secure is a complete security plugin for WordPress: it protects the sign-in form and the accounts behind it, filters hostile requests, hardens the site, scans for known vulnerabilities and changed files, and keeps a record of what happened. It is small, needs no account or cloud service, and has no upsells.

Everything lives in one screen under Tools → Secure, with a light and a dark theme. Changes save as you make them.

Nothing that could lock you out is on by default, and there is always a way back in: one line in wp-config.php or one WP-CLI command (see the FAQ).

Key Features

Dashboard

• A security score out of 100, built from checks of your site as it is today: known vulnerabilities, pending updates, administrators without two-factor, an admin username, open registration, HTTPS, debug output, secret keys, PHP version, exposed files and more.
• A “To fix” list ordered by seriousness, where each item takes you to the right setting.
• The same result appears in Tools → Site Health.

Login

• Limit login attempts. An address is locked out after repeated failures, with lockouts that get longer for repeat offenders. IPv6 visitors are counted per network, and a burst of parallel guesses is counted in full. See who is locked out and unlock them with one click.
• Move the sign-in page. Choose your own login address; wp-login.php and wp-admin then answer “Not found” to anyone who is not signed in. The new address is tested and emailed to you before it takes effect.
• Two-factor authentication. Authenticator app (Google Authenticator, Authy, 1Password and others), passkeys, or emailed codes, with recovery codes. Users set it up on their profile and must prove it works before it switches on. Wrong codes are counted per account, so a code cannot be guessed by starting over, and the account’s owner is emailed when someone has their password. Require it for the roles you choose, with a grace period.
• Trusted browsers. Optionally let users skip the second step on a browser for 7, 30 or 90 days.
• Two-factor outside wp-admin. The [nhrrob_secure_2fa] shortcode and WooCommerce’s “Account details” page let customers and members enrol.
• Generic sign-in errors, so the form does not confirm that a username exists.
• Bot check with Cloudflare Turnstile, Google reCAPTCHA v2 or hCaptcha on the sign-in, register and lost-password forms (optional, with your own keys).

Users & Sessions

• Every user with their role, two-factor status, last sign-in and active sessions.
• Sign out one user or everyone else, reset a user’s two-factor, and automatically sign out idle users who can work in the dashboard (customers and subscribers are left alone).
• Password expiry for administrators and editors, and “require a new password” for one user, a role or everyone.

Firewall

• Address rules for IPv4 and IPv6, single addresses or ranges. Allowed addresses skip every rule and are never locked out.
• Request filter for probing requests: path traversal, hunts for config and backup files, and SQL or script fragments in the address. It starts in log-only mode so you can see what it would refuse, and any match can be allowed with one click. It checks the address of visitors who are not signed in; checking submitted forms is optional and limited to rules that normal writing cannot trigger.
• Probe lockout. An address that keeps asking for files that do not exist (.php, .env, backups) is locked out of the public site; the sign-in form stays reachable. Broken links, missing images and requests triggered from other websites do not count.
• Country rule for the sign-in page or the whole site (when your site is behind Cloudflare) and user-agent rules.

Hardening

• Turn off XML-RPC, the theme and plugin file editor and application passwords; hide usernames from visitors and the WordPress version; send security headers; limit the REST API to signed-in users with a list of routes left public.
• Require strong passwords for administrators and editors, and optionally refuse passwords found in known breaches.
• Every switch says what could stop working, so you can decide.
• File protection that is verified. The plugin requests debug.log, readme files and the uploads folder from your own site and shows what came back. On Apache and LiteSpeed it can add the rules for you; on nginx it shows the lines to add.

Scanner

• Known vulnerabilities in WordPress, plugins and themes, checked daily, with one alert per new finding.
• WordPress files compared with the official release: changed, missing, and files that do not belong.
• Plugin files compared with their WordPress.org releases.
• Code changes outside updates. A fingerprint of every plugin and theme, including the ones WordPress.org cannot verify; a change without a new version is reported.
• Database content checked for invisible iframes and obfuscated JavaScript in posts and settings.
• Suspicious code review of every PHP file in wp-content. Findings can be viewed and quarantined (renamed so they cannot run) and restored. Nothing is deleted.
• Scheduled scans, daily or weekly, in the background, with an email when something new turns up.

Activity

• Sign-ins of users who can edit the site, lockouts, user and role changes, plugin and theme changes, changes to critical site settings, and what the firewall refused. Routine entries make room first, so a busy shop or an attack cannot push the important ones out.
• Search, filter by type and importance, export to CSV. Bursts are folded into one entry.
• Email alerts for a new administrator, a new vulnerability, a new scan finding or a burst of lockouts, and an optional weekly summary.

Small and tidy

• No database tables. Everything is stored in a handful of capped options.
• No visitor is looked up with an outside service.
• Settings can be exported and imported. WP-CLI commands are included.

What it is not

NHR Secure has no cloud threat feed and is not a malware cleaner. The request filter runs inside WordPress, and the scanner finds things for a person to review. If your site has been hacked, ask a professional clean-up service.

External Services

The plugin works without any outside service. The connections below are made only for the feature named.

WPVulnerability (www.wpvulnerability.net) — the vulnerability check.
Sent: the slug of each installed plugin and theme, and your WordPress version. Nothing about your site, users or visitors. When: once a day, and when you press “Check now”.
Service: https://www.wpvulnerability.com/ · Privacy: https://www.wpvulnerability.com/privacy/

WordPress.org (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org) — the file comparisons.
Sent: your WordPress version and language, and the slug and version of each plugin, to fetch the official checksums; the path of a core file when you choose to replace it with the official copy. When: only when you press “Compare now” or “Replace”.
Privacy: https://wordpress.org/about/privacy/

Bot check: Cloudflare Turnstile, Google reCAPTCHA or hCaptcha — off unless you switch it on, choose one provider and enter your own keys.
While it is on, the sign-in, register and lost-password screens load that provider’s script in the visitor’s browser, and the plugin sends the visitor’s token and IP address to the provider to verify it.
Cloudflare Turnstile (challenges.cloudflare.com): Terms https://www.cloudflare.com/website-terms/ · Privacy https://www.cloudflare.com/privacypolicy/
Google reCAPTCHA (www.google.com/recaptcha): Terms https://policies.google.com/terms · Privacy https://policies.google.com/privacy
hCaptcha (js.hcaptcha.com, api.hcaptcha.com): Terms https://www.hcaptcha.com/terms · Privacy https://www.hcaptcha.com/privacy

Have I Been Pwned – Pwned Passwords (api.pwnedpasswords.com) — “Refuse passwords found in known breaches”. Off unless you switch it on.
Sent: the first five characters of the SHA-1 hash of a password, when an administrator or editor sets one. The password itself never leaves your site.
Terms: https://haveibeenpwned.com/TermsOfUse · Privacy: https://haveibeenpwned.com/Privacy

File protection and the test of a moved login address make requests from your site to itself.

Source Code

The admin app is built with @wordpress/scripts. The readable source is included in the plugin under admin/src/, and the compiled files are in admin/build/. The two-factor setup screen uses the MIT-licensed lean-qr library (https://github.com/davidje13/lean-qr) to draw the QR code in the browser.