包简介

Basic security helper for WordPress.

README 文档

README

Basic security helper for WordPress.

Features

PHP Files Editation Disabled.
Directory Listing Disabled.
PHP Files Forbidden for uploads and wp-includes.
Disallow file editor for (plugins & themes).
Remove WordPress version from assets url.
Disable REST API methods to anonymous users.
Disable XmlRpc service.
Disallow upload plugin/theme zip file manually via dashboard.
Prevent deactivate security without FTP or file manager access.

Getting Started

via composer

from wp-content/plugins folder run composer create-project yemenifree/wp-security
Activate the plugin through the 'Plugins' menu in WordPress
All done.

Manually

Download last version
unzip & rename folder to wp-security
Upload the folder wp-security to the /wp-content/plugins/ directory
Activate the plugin through the 'Plugins' menu in WordPress
All done.

Uninstall

Remove lock file /wp-content/plugins/wp-security/.wp-security-lock via FTP or file manager (CPanel).
Deactivate plugin through the "Plugins page" in WordPress.
Uninstall plugin.

Why lock file

The goal of this plugin prevents use some built-in functions to a hacking website by users they have access to the dashboard, so to confirmed deactivate this plugin you need access to FTP or CPanel to remove the lock file.

TODO

Secure/Scan all upload files.
~~Disable upload plugin manually (zip plugin) form admin panel.~~

Change log

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security

If you discover any security related issues, please email yemenifree@yandex.com instead of using the issue tracker.

Credits

License

The MIT License (MIT). Please see License File for more information.

yemenifree/wp-security 适用场景与选型建议

yemenifree/wp-security 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 12 次下载、GitHub Stars 达 2，最近一次更新时间为 2017 年 11 月 26 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「security」「wordpress」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 yemenifree/wp-security 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 yemenifree/wp-security 我们能提供哪些服务？

定制开发 / 二次开发

基于 yemenifree/wp-security 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发

与 yemenifree/wp-security 相关的其它包

同方向 / 同关键字的高下载量 PHP Composer 包推荐，方便对比选型：

sil/route-security-bundle 7

Provide a way to secure accesses to all routes of an symfony application.

eftec/securityonemysql 6

It's a barebone security class written on PHP

bugbuster/integrity_check 3

Contao CMS integrity check for some files

vartroth/php-security-lint 0

A PHP security linter to detect insecure functions like var_dump, print_r, and other dangerous functions in your codebase

cboxdk/laravel-ssrf 0

Cbox SSRF — a hardened, config-driven guard against server-side request forgery for outbound URLs in Laravel. Blocks private/reserved/cloud-metadata targets, pins DNS, and refuses redirects.

artetecha/upsun-wp 0

Must-use plugin integrating WordPress with the Upsun platform: environment awareness, router-cache friendliness, safe preview clones, deploy migrations, Site Health checks, and a wp upsun CLI command.

yemenifree/wp-security

包简介

关键字：