All In One WP Security & Firewall的作者是Tips and Tricks HQ, Peter Petreski, Ruhul, Ivy，目前有800,000+个有效安装。已经Tested with 5.4.1版本的wordpress。
A COMPREHENSIVE, EASY TO USE, STABLE AND WELL SUPPORTED WORDPRESS SECURITY PLUGIN
WordPress itself is a very secure platform. However, it helps to add some extra security and firewall to your site by using a security plugin that enforces a lot of good security practices.
The All In One WordPress Security plugin will take your website security to a whole new level.
This plugin is designed and written by experts and is easy to use and understand.
It reduces security risk by checking for vulnerabilities, and by implementing and enforcing the latest recommended WordPress security practices and techniques.
All In One WP Security also uses an unprecedented security points grading system to measure how well you are protecting your site based on the security features you have activated.
Our security and firewall rules are categorized into “basic”, “intermediate” and “advanced”. This way you can apply the firewall rules progressively without breaking your site’s functionality.
The All In One WordPress Security plugin doesn’t slow down your site and it is 100% free.
Visit the WordPress Security Plugin page for more details.
Below is a list of the security and firewall features offered in this plugin:
User Accounts Security
Detect if there is a user account which has the default “admin” username and easily change the username to a value of your choice.
The plugin will also detect if you have any WordPress user accounts which have identical login and display names. Having account’s where display name is identical to login name is bad security practice because
you are making it 50% easier for hackers because they already know the login name.
Password strength tool to allow you to create very strong passwords.
Stop user enumeration. So users/bots cannot discover user info via author permalink.
Protect against “Brute Force Login Attack” with the Login Lockdown feature. Users with a certain IP address or range will be locked out of the system for a predetermined amount of time based on the configuration settings and you can also choose to be notified
via email whenever somebody gets locked out due to too many login attempts.
As the administrator you can view a list of all locked out users which are displayed in an easily readable and navigable table which also allows you to unlock individual or bulk IP addresses at the click of a button.
Force logout of all users after a configurable time period
Monitor/View failed login attempts which show the user’s IP address, User ID/Username and Date/Time of the failed login attempt
Monitor/View the account activity of all user accounts on your system by keeping track of the username, IP address, login date/time, and logout date/time.
Ability to automatically lockout IP address ranges which attempt to login with an invalid username.
Ability to see a list of all the users who are currently logged into your site.
Allows you to specify one or more IP addresses in a special whitelist. The whitelisted IP addresses will have access to your WP login page.
Add Google reCaptcha or plain maths captcha to WordPress Login form.
Add Google reCaptcha or plain maths captcha to the forgot password form of your WP Login system.
User Registration Security
Enable manual approval of WordPress user accounts. If your site allows people to create their own accounts via the WordPress registration form, then you can minimize SPAM or bogus registrations by manually approving each registration.
Ability to add Google reCaptcha or plain maths captcha to the WordPress’s user registration page to protect you from spam user registration.
Ability to add Honeypot to the WordPress’s user registration form to reduce registration attempts by robots.
Easily set the default WP prefix to a value of your choice with the click of a button.
Schedule automatic backups and email notifications or make an instant DB backup whenever you want with one click.
File System Security
Identify files or folders which have permission settings which are not secure and set the permissions to the recommend secure values with click of a button.
Protect your PHP code by disabling file editing from the WordPress administration area.
Easily view and monitor all host system logs from a single menu page and stay informed of any issues or problems occurring on your server so you can address them quickly.
Prevent people from accessing the readme.html, license.txt and wp-config-sample.php files of your WordPress site.
htaccess 和 wp-config.php 文件备份和还原
Easily backup your original .htaccess and wp-config.php files in case you will need to use them to restore broken functionality.
Modify the contents of the currently active .htaccess or wp-config.php files from the admin dashboard with only a few clicks
Ban users by specifying IP addresses or use a wild card to specify IP ranges.
Ban users by specifying user agents.
此插件允许您通过 htaccess 文件轻松地为您的站点添加大量防火墙保护.您的 Web 服务器会处理一个 htaccess 文件。
所以这些防火墙规则会在更改您站点上的 WordPress 代码之前停止恶意脚本。
Access control facility.
Instantly activate a selection of firewall settings ranging from basic, intermediate and advanced.
Enable the famous “6G Blacklist” Firewall rules courtesy of Perishable Press
Forbid proxy comment posting.
Block access to debug log file.
Disable trace and track.
Protect against Cross Site Scripting (XSS) by activating the comprehensive advanced character string filter.
or malicious bots who do not have a special cookie in their browser. You (the site admin) will know how to set this special cookie and be able to log into your site.
WordPress PingBack Vulnerability Protection feature. This firewall feature allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality. This is also helpful to block bots from constantly accessing the xmlrpc.php file and wasting your server resource.
Ability to block fake Googlebots from crawling your site.
Ability to prevent image hotlinking. Use this to prevent others from hotlinking your images.
能够在您的站点上记录所有 404 事件。您还可以选择自动阻止过多攻击 404 的IP地址。
Ability to add custom rules to block access to various resources of your site.
Instantly block Brute Force Login Attacks via our special Cookie-Based Brute Force Login Prevention feature. This firewall functionality will block all login attempts from people and bots.
Ability to add a simple math captcha to the WordPress login form to fight against brute force login attacks.
Ability to hide admin login page. Rename your WordPress login page URL so that bots and hackers cannot access your real WordPress login URL. This feature allows you to change the default login page (wp-login.php) to something you configure.
Ability to use Login Honeypot which will helps reduce brute force login attempts by robots.
如果您的 WordPress 系统中有任何文件已更改，文件更改检测扫描程序可以提醒您.然后，您可以调查，看看是否合法更改或一些错误的代码被注入。
Comment SPAM Security
Monitor the most active IP addresses which persistently produce the most SPAM comments and instantly block them with the click of a button.
Prevent comments from being submitted if it doesn’t originate from your domain (this should reduce some SPAM bot comment posting on your site).
Add a captcha to your wordpress comment form to add security against comment spam.
自动并永久阻止超过一定数量垃圾评论的 IP 地址。
Ability to disable the right click, text selection and copy option for your front-end.
Regular updates and additions of new security features
WordPress Security is something that evolves over time. We will be updating the All In One WP Security plugin with new security features (and fixes if required) on a regular basis so you can rest assured that your site will be on the cutting edge of security protection techniques.
Works with Most Popular WordPress Plugins
It should work smoothly with most popular WordPress plugins.
Ability to remove the WordPress Generator Meta information from the HTML source of your site.
使您能够从您站点中包含的 JS 和 CSS 文件中删除 WordPress 版本信息。
Ability to prevent people from accessing the readme.html, license.txt and wp-config-sample.php files
Ability to temporarily lock down the front end of your site from general visitors while you do various backend tasks (investigate security attacks, perform site upgrades, do maintenance work etc.)
Ability to export/import the security settings.
Prevent other sites from displaying your content via a frame or iframe.
If you have a question or problem with the All In One Security plugin, post it on the support forum and we will help you.
If you are a developer and you need some extra hooks or filters for this plugin then let us know.
Github repository – http://github.com/Arsenal21/all-in-one-wordpress-security
All In One WP Security plugin can be translated to any language.
Currently available translations:
Visit the WordPress Security Plugin page for more details.
This plugin may collect IP addresses for security reasons such as mitigating brute force login threats and malicious activity.
The collected information is stored on your server. No information is transmitted to third parties or remote server locations.
Go to the settings menu after you activate the plugin and follow the instructions.