| 1 |
<?php |
| 2 |
/** |
| 3 |
* NETSENSAI Shield |
| 4 |
* |
| 5 |
* Plugin Name: NETSENSAI Shield |
| 6 |
* Plugin URI: https://www.netsensai.pl/store/ |
| 7 |
* Description: NETSENSAI Shield is a security plugin designed to enhance WordPress site protection by offering essential security features based on best practice principles. |
| 8 |
* Version: 1.2 |
| 9 |
* Author: Rafał Gierlicki |
| 10 |
* Author URI: https://www.netsensai.pl |
| 11 |
* Text Domain: netsensai-shield |
| 12 |
* Contributors: netsensai |
| 13 |
* License: GPLv2 or later |
| 14 |
* License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 15 |
*/ |
| 16 |
|
| 17 |
// Exit if accessed directly. |
| 18 |
if ( ! defined( 'ABSPATH' ) ) { |
| 19 |
exit; |
| 20 |
} |
| 21 |
|
| 22 |
/** |
| 23 |
* Filter admin title so it's never null. |
| 24 |
* |
| 25 |
* @param string $title Admin page title. |
| 26 |
* @return string Modified title. |
| 27 |
*/ |
| 28 |
function ns_shield_fix_admin_title( $title ) { |
| 29 |
return (string) $title; |
| 30 |
} |
| 31 |
add_filter( 'admin_title', 'ns_shield_fix_admin_title', 0, 1 ); |
| 32 |
|
| 33 |
/** |
| 34 |
* Define tooltip function for login URL explanation. |
| 35 |
*/ |
| 36 |
if ( ! function_exists( 'ns_shield_get_login_url_tooltip' ) ) { |
| 37 |
function ns_shield_get_login_url_tooltip() { |
| 38 |
return __( 'Changing the login URL helps protect your site from brute-force attacks aimed at the default wp-login.php endpoint. If the default URL remains unchanged, attackers could easily target it to attempt password cracking or credential stuffing attacks.', 'netsensai-shield' ); |
| 39 |
} |
| 40 |
} |
| 41 |
|
| 42 |
/** |
| 43 |
* Include plugin function files. |
| 44 |
*/ |
| 45 |
require_once plugin_dir_path( __FILE__ ) . 'includes/login_url_functions.php'; |
| 46 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_wp_api_json.php'; |
| 47 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_xml_rpc.php'; |
| 48 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_app_passwords.php'; |
| 49 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_file_editor.php'; |
| 50 |
require_once plugin_dir_path( __FILE__ ) . 'includes/disable_default_admin.php'; |
| 51 |
|
| 52 |
/** |
| 53 |
* Enqueue styles and scripts for the admin area. |
| 54 |
*/ |
| 55 |
function ns_shield_enqueue_styles_scripts() { |
| 56 |
wp_enqueue_style( |
| 57 |
'ns_shield-style', |
| 58 |
plugin_dir_url( __FILE__ ) . 'assets/style.css', |
| 59 |
array(), |
| 60 |
filemtime( plugin_dir_path( __FILE__ ) . 'assets/style.css' ) |
| 61 |
); |
| 62 |
wp_enqueue_script( |
| 63 |
'ns_shield-script', |
| 64 |
plugin_dir_url( __FILE__ ) . 'assets/script.js', |
| 65 |
array(), |
| 66 |
'1.0', |
| 67 |
true |
| 68 |
); |
| 69 |
} |
| 70 |
add_action( 'admin_enqueue_scripts', 'ns_shield_enqueue_styles_scripts' ); |
| 71 |
|
| 72 |
/** |
| 73 |
* Add settings link on the plugins page. |
| 74 |
* |
| 75 |
* @param array $links Array of action links. |
| 76 |
* @return array Modified links. |
| 77 |
*/ |
| 78 |
function ns_shield_settings_link( $links ) { |
| 79 |
$settings_link = '<a href="options-general.php?page=secure-options">' . esc_html__( 'Settings', 'netsensai-shield' ) . '</a>'; |
| 80 |
array_unshift( $links, $settings_link ); |
| 81 |
return $links; |
| 82 |
} |
| 83 |
add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), 'ns_shield_settings_link' ); |
| 84 |
|
| 85 |
/* ===================== |
| 86 |
SETTINGS PAGE |
| 87 |
===================== */ |
| 88 |
|
| 89 |
/** |
| 90 |
* Display the settings page. |
| 91 |
*/ |
| 92 |
function ns_shield_secure_options_page() { |
| 93 |
if ( ! current_user_can( 'manage_options' ) ) { |
| 94 |
wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'netsensai-shield' ) ); |
| 95 |
} |
| 96 |
// Sprawdzamy metodę ż� |
| 97 |
dania i czy przesłano pole 'option_page'. |
| 98 |
if ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] && isset( $_POST['option_page'] ) && 'ns_shield_options_group' === $_POST['option_page'] ) { |
| 99 |
// Nonce jest weryfikowany w options.php – poniższa funkcja uspokaja narzędzie analizy. |
| 100 |
check_admin_referer( 'ns_shield_options_group-options' ); |
| 101 |
} |
| 102 |
?> |
| 103 |
<div id="netsensai-shield-plugin" class="wrap"> |
| 104 |
|
| 105 |
<!-- Banner reklamowy wersji PRO --> |
| 106 |
<div style="border: 1px solid #555; padding: 5px; margin: 5px 0; background-color: transparent; text-align: center; color: #fff;"> |
| 107 |
<p style="font-size: 1.2em; font-weight: bold; margin-bottom: 5px;"> |
| 108 |
<?php esc_html_e( 'Upgrade to NETSENSAI-SHIELD PRO for enhanced protection and advanced features.', 'netsensai-shield' ); ?> |
| 109 |
</p> |
| 110 |
<p> |
| 111 |
<?php esc_html_e( 'Get yours now at:', 'netsensai-shield' ); ?> |
| 112 |
<a href="https://netsensai.pl/store" target="_blank" rel="noopener noreferrer" style="color: #fff; text-decoration: underline;"> |
| 113 |
https://netsensai.pl/store |
| 114 |
</a> |
| 115 |
</p> |
| 116 |
</div> |
| 117 |
|
| 118 |
<h2><?php echo esc_html__( 'Security Options', 'netsensai-shield' ); ?></h2> |
| 119 |
|
| 120 |
<!-- Wyświetlenie logotypów --> |
| 121 |
<div style="display: flex; align-items: center; gap: 20px; margin-bottom: 10px;"> |
| 122 |
<a href="https://www.netsensai.pl/store/" target="_blank" style="display: flex; align-items: center; gap: 20px;"> |
| 123 |
<img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/ns_logo.png' ); ?>" |
| 124 |
alt="<?php echo esc_attr__( 'Netsensai-Shield Logo', 'netsensai-shield' ); ?>" |
| 125 |
style="width: 200px; height: auto; margin-bottom: -20px;"> |
| 126 |
<img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/netsensai.pl_logo.png' ); ?>" |
| 127 |
alt="<?php echo esc_attr__( 'Netsensai-Logo', 'netsensai-shield' ); ?>" |
| 128 |
style="width: 220px; height: auto; margin-bottom: -20px;"> |
| 129 |
</a> |
| 130 |
</div> |
| 131 |
|
| 132 |
<!-- |
| 133 |
Formularz przesyłany jest do options.php, gdzie nonce jest weryfikowany automatycznie, |
| 134 |
gdyż settings_fields() generuje odpowiednie pola ukryte. |
| 135 |
--> |
| 136 |
<form method="post" action="options.php"> |
| 137 |
<?php |
| 138 |
settings_fields( 'ns_shield_options_group' ); |
| 139 |
do_settings_sections( 'secure-options' ); |
| 140 |
submit_button(); |
| 141 |
?> |
| 142 |
</form> |
| 143 |
|
| 144 |
</div> <!-- .wrap --> |
| 145 |
<?php |
| 146 |
} |
| 147 |
|
| 148 |
/** |
| 149 |
* Add settings menu in the admin. |
| 150 |
*/ |
| 151 |
function ns_shield_secure_options_menu() { |
| 152 |
add_options_page( |
| 153 |
esc_html__( 'Security Options', 'netsensai-shield' ), |
| 154 |
esc_html__( 'Security Options', 'netsensai-shield' ), |
| 155 |
'manage_options', |
| 156 |
'secure-options', |
| 157 |
'ns_shield_secure_options_page' |
| 158 |
); |
| 159 |
} |
| 160 |
add_action( 'admin_menu', 'ns_shield_secure_options_menu' ); |
| 161 |
|
| 162 |
/** |
| 163 |
* Register settings and fields for Levels 1 and 2. |
| 164 |
*/ |
| 165 |
function ns_shield_secure_options_settings() { |
| 166 |
register_setting( 'ns_shield_options_group', 'ns_shield_login_url', 'sanitize_text_field' ); |
| 167 |
register_setting( 'ns_shield_options_group', 'ns_shield_login_url_enabled', 'sanitize_text_field' ); |
| 168 |
register_setting( 'ns_shield_options_group', 'ns_shield_wp_api_json', 'sanitize_text_field' ); |
| 169 |
register_setting( 'ns_shield_options_group', 'ns_shield_xml_rpc', 'sanitize_text_field' ); |
| 170 |
register_setting( 'ns_shield_options_group', 'ns_shield_file_editor', 'sanitize_text_field' ); |
| 171 |
register_setting( 'ns_shield_options_group', 'ns_shield_app_passwords', 'absint' ); |
| 172 |
|
| 173 |
// Level 1: Basic Security |
| 174 |
add_settings_section( 'ns_shield_level_1', esc_html__( 'Level 1: Basic Security', 'netsensai-shield' ), null, 'secure-options' ); |
| 175 |
add_settings_field( 'ns_shield_login_url', esc_html__( 'Change Login URL', 'netsensai-shield' ), 'ns_shield_change_login_url', 'secure-options', 'ns_shield_level_1' ); |
| 176 |
add_settings_field( 'ns_shield_default_admin', esc_html__( 'Disable Default Admin', 'netsensai-shield' ), 'ns_shield_disable_default_admin', 'secure-options', 'ns_shield_level_1' ); |
| 177 |
add_settings_field( 'ns_shield_xml_rpc', esc_html__( 'Disable XML-RPC', 'netsensai-shield' ), 'ns_shield_field_xml_rpc', 'secure-options', 'ns_shield_level_1' ); |
| 178 |
|
| 179 |
// Level 2: Intermediate Security |
| 180 |
add_settings_section( 'ns_shield_level_2', esc_html__( 'Level 2: Intermediate Security', 'netsensai-shield' ), null, 'secure-options' ); |
| 181 |
add_settings_field( 'ns_shield_wp_api_json', esc_html__( 'Disable WP API JSON', 'netsensai-shield' ), 'ns_shield_field_wp_api_json', 'secure-options', 'ns_shield_level_2' ); |
| 182 |
add_settings_field( 'ns_shield_file_editor', esc_html__( 'Disable File Editor', 'netsensai-shield' ), 'ns_shield_field_file_editor', 'secure-options', 'ns_shield_level_2' ); |
| 183 |
add_settings_field( 'ns_shield_app_passwords', esc_html__( 'Disable WordPress Application Passwords', 'netsensai-shield' ), 'ns_shield_field_app_passwords', 'secure-options', 'ns_shield_level_2' ); |
| 184 |
|
| 185 |
// Przygotowanie fragmentów tekstu z tłumaczeniami. |
| 186 |
$white_text = '<span style="font-size:20px; color:#fff !important;">' . esc_html__( 'More features, more possibilities', 'netsensai-shield' ) . '</span>'; |
| 187 |
$yellow_text = '<span style="font-size:20px; color:#E6DB00 !important;"> – <a href="' . esc_url( 'https://netsensai.pl/store' ) . '" target="_blank" style="color:#E6DB00 !important; text-decoration:none;">' . esc_html__( 'purchase a lifetime PRO license', 'netsensai-shield' ) . '</a></span>'; |
| 188 |
|
| 189 |
$level3_title = esc_html__( 'Level 3: Advanced Security', 'netsensai-shield' ) . '<br><br>' . $white_text . ' ' . $yellow_text; |
| 190 |
|
| 191 |
add_settings_section( |
| 192 |
'ns_shield_level_3', |
| 193 |
wp_kses_post( $level3_title ), |
| 194 |
null, |
| 195 |
'secure-options' |
| 196 |
); |
| 197 |
} |
| 198 |
add_action( 'admin_init', 'ns_shield_secure_options_settings' ); |
| 199 |
|
| 200 |
/* ===================== |
| 201 |
FIELD CALLBACKS |
| 202 |
===================== */ |
| 203 |
|
| 204 |
function ns_shield_field_xml_rpc() { |
| 205 |
$checked = get_option( 'ns_shield_xml_rpc', 0 ) ? 'checked' : ''; |
| 206 |
echo '<label class="switch">'; |
| 207 |
echo '<input type="checkbox" name="ns_shield_xml_rpc" value="1" ' . esc_attr( $checked ) . '>'; |
| 208 |
echo '<span class="slider round"></span>'; |
| 209 |
echo '<div class="tooltip">' . esc_html__( 'Disabling XML-RPC blocks unauthorized remote access attempts, which can enhance security. If XML-RPC remains enabled, hackers might attempt to perform DDoS attacks by sending multiple requests or brute-force password attacks to gain control over your site.', 'netsensai-shield' ) . '</div>'; |
| 210 |
echo '</label>'; |
| 211 |
} |
| 212 |
|
| 213 |
function ns_shield_field_wp_api_json() { |
| 214 |
$checked = get_option( 'ns_shield_wp_api_json', 0 ) ? 'checked' : ''; |
| 215 |
echo '<label class="switch">'; |
| 216 |
echo '<input type="checkbox" name="ns_shield_wp_api_json" value="1" ' . esc_attr( $checked ) . '>'; |
| 217 |
echo '<span class="slider round"></span>'; |
| 218 |
echo '<div class="tooltip">' . esc_html__( 'Disabling WP API JSON can protect your site from unauthorized access to sensitive data through the API. If left enabled, hackers may exploit WP API JSON to gather information about your site’s structure or perform enumeration attacks on users, which can lead to brute-force attacks.', 'netsensai-shield' ) . '</div>'; |
| 219 |
echo '</label>'; |
| 220 |
} |
| 221 |
|
| 222 |
function ns_shield_field_file_editor() { |
| 223 |
$checked = get_option( 'ns_shield_file_editor', 0 ) ? 'checked' : ''; |
| 224 |
echo '<label class="switch">'; |
| 225 |
echo '<input type="checkbox" name="ns_shield_file_editor" value="1" ' . esc_attr( $checked ) . '>'; |
| 226 |
echo '<span class="slider round"></span>'; |
| 227 |
echo '<div class="tooltip">' . esc_html__( 'Disabling the file editor in the WP dashboard prevents unauthorized or accidental code changes. If left enabled, attackers who gain access to your admin panel could inject malicious code into your theme or plugin files, leading to a defacement of the site or the deployment of malware.', 'netsensai-shield' ) . '</div>'; |
| 228 |
echo '</label>'; |
| 229 |
} |
| 230 |
|
| 231 |
function ns_shield_field_app_passwords() { |
| 232 |
$checked = get_option( 'ns_shield_app_passwords', 0 ) ? 'checked' : ''; |
| 233 |
echo '<label class="switch">'; |
| 234 |
echo '<input type="checkbox" name="ns_shield_app_passwords" value="1" ' . esc_attr( $checked ) . '>'; |
| 235 |
echo '<span class="slider round"></span>'; |
| 236 |
echo '<div class="tooltip">' . esc_html__( 'Disabling application passwords secures against creating unauthorized accesses to your site’s API. If left enabled, hackers may exploit application passwords to gain persistent access to your site, enabling them to execute unauthorized API requests or even escalate their privileges.', 'netsensai-shield' ) . '</div>'; |
| 237 |
echo '</label>'; |
| 238 |
} |
| 239 |
|
| 240 |
/** |
| 241 |
* Flush rewrite rules after settings update. |
| 242 |
*/ |
| 243 |
function ns_shield_flush_rewrite_rules_on_settings_update() { |
| 244 |
if ( is_admin() && isset( $_GET['settings-updated'] ) && 'true' === $_GET['settings-updated'] ) { |
| 245 |
flush_rewrite_rules(); |
| 246 |
} |
| 247 |
} |
| 248 |
add_action( 'admin_init', 'ns_shield_flush_rewrite_rules_on_settings_update', 20 ); |
| 249 |
|
| 250 |
/** |
| 251 |
* Flush rewrite rules on plugin activation. |
| 252 |
*/ |
| 253 |
function ns_shield_activation_flush() { |
| 254 |
if ( function_exists( 'ns_shield_add_rewrite_rule' ) ) { |
| 255 |
ns_shield_add_rewrite_rule(); |
| 256 |
} |
| 257 |
flush_rewrite_rules(); |
| 258 |
} |
| 259 |
register_activation_hook( __FILE__, 'ns_shield_activation_flush' ); |
| 260 |
|
| 261 |
/** |
| 262 |
* Flush rewrite rules on plugin deactivation. |
| 263 |
*/ |
| 264 |
function ns_shield_deactivation_flush() { |
| 265 |
flush_rewrite_rules(); |
| 266 |
} |
| 267 |
register_deactivation_hook( __FILE__, 'ns_shield_deactivation_flush' ); |
| 268 |
?> |
| 269 |
|
