| 1 |
<?php |
| 2 |
/** |
| 3 |
* NETSENSAI Shield |
| 4 |
* |
| 5 |
* Plugin Name: NETSENSAI Shield |
| 6 |
* Plugin URI: https://www.netsensai.pl/store/ |
| 7 |
* Description: NETSENSAI Shield is a security plugin designed to enhance WordPress site protection by offering essential security features based on best practice principles. |
| 8 |
* Version: 1.1 |
| 9 |
* Author: Rafał Gierlicki |
| 10 |
* Author URI: https://www.netsensai.pl |
| 11 |
* Text Domain: netsensai-shield |
| 12 |
* Contributors: netsensai |
| 13 |
* License: GPLv2 or later |
| 14 |
* License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 15 |
*/ |
| 16 |
|
| 17 |
// Exit if accessed directly. |
| 18 |
if ( ! defined( 'ABSPATH' ) ) { |
| 19 |
exit; |
| 20 |
} |
| 21 |
|
| 22 |
/** |
| 23 |
* Filter admin title so it's never null. |
| 24 |
* |
| 25 |
* @param string $title Admin page title. |
| 26 |
* @return string Modified title. |
| 27 |
*/ |
| 28 |
function ns_shield_fix_admin_title( $title ) { |
| 29 |
return (string) $title; |
| 30 |
} |
| 31 |
add_filter( 'admin_title', 'ns_shield_fix_admin_title', 0, 1 ); |
| 32 |
|
| 33 |
/** |
| 34 |
* Define tooltip function for login URL explanation. |
| 35 |
*/ |
| 36 |
if ( ! function_exists( 'ns_shield_get_login_url_tooltip' ) ) { |
| 37 |
function ns_shield_get_login_url_tooltip() { |
| 38 |
return __( 'Changing the login URL helps protect your site from brute-force attacks aimed at the default wp-login.php endpoint. If the default URL remains unchanged, attackers could easily target it to attempt password cracking or credential stuffing attacks.', 'netsensai-shield' ); |
| 39 |
} |
| 40 |
} |
| 41 |
|
| 42 |
/** |
| 43 |
* Include plugin function files. |
| 44 |
*/ |
| 45 |
require_once plugin_dir_path( __FILE__ ) . 'includes/login_url_functions.php'; |
| 46 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_wp_api_json.php'; |
| 47 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_xml_rpc.php'; |
| 48 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_app_passwords.php'; |
| 49 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_file_editor.php'; |
| 50 |
require_once plugin_dir_path( __FILE__ ) . 'includes/apply_security_headers.php'; |
| 51 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_directory_indexing.php'; |
| 52 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_default_admin.php'; |
| 53 |
require_once plugin_dir_path( __FILE__ ) . 'includes/apply_hsts_header.php'; |
| 54 |
|
| 55 |
/** |
| 56 |
* Enqueue styles and scripts for the admin area. |
| 57 |
*/ |
| 58 |
function ns_shield_enqueue_styles_scripts() { |
| 59 |
wp_enqueue_style( |
| 60 |
'ns_shield-style', |
| 61 |
plugin_dir_url( __FILE__ ) . 'assets/style.css', |
| 62 |
array(), |
| 63 |
filemtime( plugin_dir_path( __FILE__ ) . 'assets/style.css' ) |
| 64 |
); |
| 65 |
wp_enqueue_script( |
| 66 |
'ns_shield-script', |
| 67 |
plugin_dir_url( __FILE__ ) . 'assets/script.js', |
| 68 |
array(), |
| 69 |
'1.0', |
| 70 |
true |
| 71 |
); |
| 72 |
} |
| 73 |
add_action( 'admin_enqueue_scripts', 'ns_shield_enqueue_styles_scripts' ); |
| 74 |
|
| 75 |
/** |
| 76 |
* Add settings link on the plugins page. |
| 77 |
* |
| 78 |
* @param array $links Array of action links. |
| 79 |
* @return array Modified links. |
| 80 |
*/ |
| 81 |
function ns_shield_settings_link( $links ) { |
| 82 |
$settings_link = '<a href="options-general.php?page=secure-options">' . esc_html__( 'Settings', 'netsensai-shield' ) . '</a>'; |
| 83 |
array_unshift( $links, $settings_link ); |
| 84 |
return $links; |
| 85 |
} |
| 86 |
add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), 'ns_shield_settings_link' ); |
| 87 |
|
| 88 |
/* ===================== |
| 89 |
SETTINGS PAGE |
| 90 |
===================== */ |
| 91 |
|
| 92 |
/** |
| 93 |
* Display the settings page. |
| 94 |
*/ |
| 95 |
function ns_shield_secure_options_page() { |
| 96 |
if ( ! current_user_can( 'manage_options' ) ) { |
| 97 |
wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'netsensai-shield' ) ); |
| 98 |
} |
| 99 |
?> |
| 100 |
<div id="netsensai-shield-plugin" class="wrap"> |
| 101 |
|
| 102 |
<!-- Banner reklamowy wersji PRO --> |
| 103 |
<div style="border: 1px solid #555; padding: 5px; margin: 5px 0; background-color: transparent; text-align: center; color: #fff;"> |
| 104 |
<p style="font-size: 1.2em; font-weight: bold; margin-bottom: 5px;"> |
| 105 |
<?php _e( 'Upgrade to NETSENSAI-SHIELD PRO for enhanced protection and advanced features.', 'netsensai-shield' ); ?> |
| 106 |
</p> |
| 107 |
<p> |
| 108 |
<?php _e( 'Get yours now at:', 'netsensai-shield' ); ?> |
| 109 |
<a href="https://netsensai.pl/store" target="_blank" rel="noopener noreferrer" style="color: #fff; text-decoration: underline;"> |
| 110 |
https://netsensai.pl/store |
| 111 |
</a> |
| 112 |
</p> |
| 113 |
</div> |
| 114 |
|
| 115 |
<h2><?php echo esc_html__( 'Security Options', 'netsensai-shield' ); ?></h2> |
| 116 |
|
| 117 |
<!-- Display logos similarly to the premium version --> |
| 118 |
<div style="display: flex; align-items: center; gap: 20px; margin-bottom: 10px;"> |
| 119 |
<a href="https://www.netsensai.pl/store/" target="_blank" style="display: flex; align-items: center; gap: 20px;"> |
| 120 |
<img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/ns_logo.png' ); ?>" |
| 121 |
alt="<?php echo esc_attr__( 'Netsensai-Shield Logo', 'netsensai-shield' ); ?>" |
| 122 |
style="width: 200px; height: auto; margin-bottom: -20px;"> |
| 123 |
<img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/netsensai.pl_logo.png' ); ?>" |
| 124 |
alt="<?php echo esc_attr__( 'Netsensai-Logo', 'netsensai-shield' ); ?>" |
| 125 |
style="width: 220px; height: auto; margin-bottom: -20px;"> |
| 126 |
</a> |
| 127 |
</div> |
| 128 |
|
| 129 |
<form method="post" action="options.php"> |
| 130 |
<?php |
| 131 |
settings_fields( 'ns_shield_options_group' ); |
| 132 |
do_settings_sections( 'secure-options' ); |
| 133 |
submit_button(); |
| 134 |
?> |
| 135 |
</form> |
| 136 |
|
| 137 |
</div> <!-- Dopiero tutaj zamykamy .wrap --> |
| 138 |
<?php |
| 139 |
} |
| 140 |
|
| 141 |
/** |
| 142 |
* Add settings menu in the admin. |
| 143 |
*/ |
| 144 |
function ns_shield_secure_options_menu() { |
| 145 |
add_options_page( |
| 146 |
esc_html__( 'Security Options', 'netsensai-shield' ), |
| 147 |
esc_html__( 'Security Options', 'netsensai-shield' ), |
| 148 |
'manage_options', |
| 149 |
'secure-options', |
| 150 |
'ns_shield_secure_options_page' |
| 151 |
); |
| 152 |
} |
| 153 |
add_action( 'admin_menu', 'ns_shield_secure_options_menu' ); |
| 154 |
|
| 155 |
/** |
| 156 |
* Register settings and fields. |
| 157 |
*/ |
| 158 |
function ns_shield_secure_options_settings() { |
| 159 |
register_setting( 'ns_shield_options_group', 'ns_shield_login_url', 'sanitize_text_field' ); |
| 160 |
register_setting( 'ns_shield_options_group', 'ns_shield_login_url_enabled', 'sanitize_text_field' ); |
| 161 |
register_setting( 'ns_shield_options_group', 'ns_shield_wp_api_json', 'sanitize_text_field' ); |
| 162 |
register_setting( 'ns_shield_options_group', 'ns_shield_xml_rpc', 'sanitize_text_field' ); |
| 163 |
register_setting( 'ns_shield_options_group', 'ns_shield_file_editor', 'sanitize_text_field' ); |
| 164 |
register_setting( 'ns_shield_options_group', 'ns_shield_app_passwords', 'absint' ); |
| 165 |
register_setting( 'ns_shield_options_group', 'ns_shield_security_headers', 'sanitize_text_field' ); |
| 166 |
register_setting( 'ns_shield_options_group', 'ns_shield_directory_indexing', 'sanitize_text_field' ); |
| 167 |
register_setting( 'ns_shield_options_group', 'ns_shield_default_admin', 'absint' ); |
| 168 |
register_setting( 'ns_shield_options_group', 'ns_shield_new_admin_login', 'sanitize_text_field' ); |
| 169 |
register_setting( 'ns_shield_options_group', 'ns_shield_hsts', 'sanitize_text_field' ); |
| 170 |
register_setting( 'ns_shield_options_group', 'ns_shield_debug', 'sanitize_text_field' ); |
| 171 |
// Register new settings for CSP headers. |
| 172 |
register_setting( 'ns_shield_options_group', 'ns_shield_csp_header_light', 'intval' ); |
| 173 |
register_setting( 'ns_shield_options_group', 'ns_shield_csp_header_hard', 'ns_shield_sanitize_csp_hard' ); |
| 174 |
|
| 175 |
// Level 1: Basic Security |
| 176 |
add_settings_section( 'ns_shield_level_1', esc_html__( 'Level 1: Basic Security', 'netsensai-shield' ), null, 'secure-options' ); |
| 177 |
add_settings_field( 'ns_shield_login_url', esc_html__( 'Change Login URL', 'netsensai-shield' ), 'ns_shield_change_login_url', 'secure-options', 'ns_shield_level_1' ); |
| 178 |
add_settings_field( 'ns_shield_default_admin', esc_html__( 'Disable Default Admin', 'netsensai-shield' ), 'ns_shield_disable_default_admin', 'secure-options', 'ns_shield_level_1' ); |
| 179 |
add_settings_field( 'ns_shield_xml_rpc', esc_html__( 'Disable XML-RPC', 'netsensai-shield' ), 'ns_shield_field_xml_rpc', 'secure-options', 'ns_shield_level_1' ); |
| 180 |
|
| 181 |
// Level 2: Intermediate Security |
| 182 |
add_settings_section( 'ns_shield_level_2', esc_html__( 'Level 2: Intermediate Security', 'netsensai-shield' ), null, 'secure-options' ); |
| 183 |
add_settings_field( 'ns_shield_wp_api_json', esc_html__( 'Disable WP API JSON', 'netsensai-shield' ), 'ns_shield_field_wp_api_json', 'secure-options', 'ns_shield_level_2' ); |
| 184 |
add_settings_field( 'ns_shield_file_editor', esc_html__( 'Disable File Editor', 'netsensai-shield' ), 'ns_shield_field_file_editor', 'secure-options', 'ns_shield_level_2' ); |
| 185 |
add_settings_field( 'ns_shield_app_passwords', esc_html__( 'Disable WordPress Application Passwords', 'netsensai-shield' ), 'ns_shield_field_app_passwords', 'secure-options', 'ns_shield_level_2' ); |
| 186 |
|
| 187 |
// Level 3: Advanced Security |
| 188 |
add_settings_section( 'ns_shield_level_3', esc_html__( 'Level 3: Advanced Security', 'netsensai-shield' ), null, 'secure-options' ); |
| 189 |
add_settings_field( 'ns_shield_directory_indexing', esc_html__( 'Disable Directory Indexing', 'netsensai-shield' ), 'ns_shield_field_directory_indexing', 'secure-options', 'ns_shield_level_3' ); |
| 190 |
add_settings_field( 'ns_shield_hsts', esc_html__( 'Enable HSTS', 'netsensai-shield' ), 'ns_shield_field_hsts', 'secure-options', 'ns_shield_level_3' ); |
| 191 |
add_settings_field( 'ns_shield_security_headers', esc_html__( 'Apply Security Headers', 'netsensai-shield' ), 'ns_shield_field_security_headers', 'secure-options', 'ns_shield_level_3' ); |
| 192 |
} |
| 193 |
add_action( 'admin_init', 'ns_shield_secure_options_settings' ); |
| 194 |
|
| 195 |
/* ===================== |
| 196 |
FIELD CALLBACKS |
| 197 |
===================== */ |
| 198 |
|
| 199 |
function ns_shield_field_xml_rpc() { |
| 200 |
$checked = get_option( 'ns_shield_xml_rpc', 0 ) ? 'checked' : ''; |
| 201 |
echo '<label class="switch">'; |
| 202 |
echo '<input type="checkbox" name="ns_shield_xml_rpc" value="1" ' . esc_attr( $checked ) . '>'; |
| 203 |
echo '<span class="slider round"></span>'; |
| 204 |
echo '<div class="tooltip">' . esc_html__( 'Disabling XML-RPC blocks unauthorized remote access attempts, which can enhance security. If XML-RPC remains enabled, hackers might attempt to perform DDoS attacks by sending multiple requests or brute-force password attacks to gain control over your site.', 'netsensai-shield' ) . '</div>'; |
| 205 |
echo '</label>'; |
| 206 |
} |
| 207 |
|
| 208 |
function ns_shield_field_wp_api_json() { |
| 209 |
$checked = get_option( 'ns_shield_wp_api_json', 0 ) ? 'checked' : ''; |
| 210 |
echo '<label class="switch">'; |
| 211 |
echo '<input type="checkbox" name="ns_shield_wp_api_json" value="1" ' . esc_attr( $checked ) . '>'; |
| 212 |
echo '<span class="slider round"></span>'; |
| 213 |
echo '<div class="tooltip">' . esc_html__( 'Disabling WP API JSON can protect your site from unauthorized access to sensitive data through the API. If left enabled, hackers may exploit WP API JSON to gather information about your site’s structure or perform enumeration attacks on users, which can lead to brute-force attacks.', 'netsensai-shield' ) . '</div>'; |
| 214 |
echo '</label>'; |
| 215 |
} |
| 216 |
|
| 217 |
function ns_shield_field_file_editor() { |
| 218 |
$checked = get_option( 'ns_shield_file_editor', 0 ) ? 'checked' : ''; |
| 219 |
echo '<label class="switch">'; |
| 220 |
echo '<input type="checkbox" name="ns_shield_file_editor" value="1" ' . esc_attr( $checked ) . '>'; |
| 221 |
echo '<span class="slider round"></span>'; |
| 222 |
echo '<div class="tooltip">' . esc_html__( 'Disabling the file editor in the WP dashboard prevents unauthorized or accidental code changes. If left enabled, attackers who gain access to your admin panel could inject malicious code into your theme or plugin files, leading to a defacement of the site or the deployment of malware.', 'netsensai-shield' ) . '</div>'; |
| 223 |
echo '</label>'; |
| 224 |
} |
| 225 |
|
| 226 |
function ns_shield_field_app_passwords() { |
| 227 |
$checked = get_option( 'ns_shield_app_passwords', 0 ) ? 'checked' : ''; |
| 228 |
echo '<label class="switch">'; |
| 229 |
echo '<input type="checkbox" name="ns_shield_app_passwords" value="1" ' . esc_attr( $checked ) . '>'; |
| 230 |
echo '<span class="slider round"></span>'; |
| 231 |
echo '<div class="tooltip">' . esc_html__( 'Disabling application passwords secures against creating unauthorized accesses to your site’s API. If left enabled, hackers may exploit application passwords to gain persistent access to your site, enabling them to execute unauthorized API requests or even escalate their privileges.', 'netsensai-shield' ) . '</div>'; |
| 232 |
echo '</label>'; |
| 233 |
} |
| 234 |
|
| 235 |
function ns_shield_field_security_headers() { |
| 236 |
$checked = get_option( 'ns_shield_security_headers', 0 ) ? 'checked' : ''; |
| 237 |
echo '<label class="switch">'; |
| 238 |
echo '<input type="checkbox" name="ns_shield_security_headers" value="1" ' . esc_attr( $checked ) . '>'; |
| 239 |
echo '<span class="slider round"></span>'; |
| 240 |
echo '<div class="tooltip">' . esc_html__( 'Applying security headers can protect your site from XSS attacks and other threats. Without them, your site could be vulnerable to cross-site scripting (XSS) attacks or clickjacking, allowing attackers to steal sensitive data or trick users into executing malicious actions.', 'netsensai-shield' ) . '</div>'; |
| 241 |
echo '</label>'; |
| 242 |
} |
| 243 |
|
| 244 |
/** |
| 245 |
* FIELD CALLBACK: Directory Indexing. |
| 246 |
*/ |
| 247 |
function ns_shield_field_directory_indexing() { |
| 248 |
$checked = get_option( 'ns_shield_directory_indexing', 0 ) ? 'checked' : ''; |
| 249 |
echo '<label class="switch">'; |
| 250 |
echo '<input type="checkbox" name="ns_shield_directory_indexing" value="1" ' . esc_attr( $checked ) . '>'; |
| 251 |
echo '<span class="slider round"></span>'; |
| 252 |
echo '<div class="tooltip">' . esc_html__( 'Directory indexing allows attackers to list and access files in directories that lack an index file, exposing sensitive files and configurations. If directory indexing is not disabled, attackers can execute Directory Traversal attacks, gaining access to configuration files, logs, or even databases.', 'netsensai-shield' ) . '</div>'; |
| 253 |
echo '</label>'; |
| 254 |
} |
| 255 |
|
| 256 |
/** |
| 257 |
* FIELD CALLBACK: HSTS. |
| 258 |
*/ |
| 259 |
function ns_shield_field_hsts() { |
| 260 |
$checked = get_option( 'ns_shield_hsts', 0 ) ? 'checked' : ''; |
| 261 |
echo '<label class="switch">'; |
| 262 |
echo '<input type="checkbox" name="ns_shield_hsts" value="1" ' . esc_attr( $checked ) . '>'; |
| 263 |
echo '<span class="slider round"></span>'; |
| 264 |
echo '<div class="tooltip">' . esc_html__( 'HTTP Strict Transport Security (HSTS) enforces HTTPS, ensuring that all communication between the browser and the server is encrypted. This is critical for protecting sensitive user data and preventing man-in-the-middle attacks.', 'netsensai-shield' ) . '</div>'; |
| 265 |
echo '</label>'; |
| 266 |
} |
| 267 |
|
| 268 |
/** |
| 269 |
* Flush rewrite rules after settings update. |
| 270 |
* |
| 271 |
* This function checks if the settings page was updated and flushes the rewrite rules |
| 272 |
* so that changes (such as a new custom login URL) take effect. |
| 273 |
*/ |
| 274 |
function ns_shield_flush_rewrite_rules_on_settings_update() { |
| 275 |
if ( is_admin() && isset( $_GET['settings-updated'] ) && 'true' === $_GET['settings-updated'] ) { |
| 276 |
flush_rewrite_rules(); |
| 277 |
} |
| 278 |
} |
| 279 |
add_action( 'admin_init', 'ns_shield_flush_rewrite_rules_on_settings_update', 20 ); |
| 280 |
|
| 281 |
/** |
| 282 |
* Flush rewrite rules on plugin activation. |
| 283 |
*/ |
| 284 |
function ns_shield_activation_flush() { |
| 285 |
// Upewnij się, że reguły niestandardowego login URL s� |
| 286 |
dodane. |
| 287 |
if ( function_exists( 'ns_shield_add_rewrite_rule' ) ) { |
| 288 |
ns_shield_add_rewrite_rule(); |
| 289 |
} |
| 290 |
flush_rewrite_rules(); |
| 291 |
} |
| 292 |
register_activation_hook( __FILE__, 'ns_shield_activation_flush' ); |
| 293 |
|
| 294 |
/** |
| 295 |
* Flush rewrite rules on plugin deactivation. |
| 296 |
*/ |
| 297 |
function ns_shield_deactivation_flush() { |
| 298 |
flush_rewrite_rules(); |
| 299 |
} |
| 300 |
register_deactivation_hook( __FILE__, 'ns_shield_deactivation_flush' ); |
| 301 |
?> |
