siteguard
Last commit date
admin
11 years ago
classes
11 years ago
css
11 years ago
images
11 years ago
languages
11 years ago
really-simple-captcha
11 years ago
license.txt
11 years ago
readme.txt
10 years ago
siteguard.php
11 years ago
uninstall.php
11 years ago
readme.txt
148 lines
| 1 | === SiteGuard WP Plugin === |
| 2 | Contributors: jp-secure |
| 3 | Donate link: - |
| 4 | Tags: security, waf, brute force, password list, login lock, login alert, captcha, pingback, fail once |
| 5 | Requires at least: 3.9 |
| 6 | Tested up to: 4.3 |
| 7 | Stable tag: 1.2.3 |
| 8 | License: GPLv2 or later |
| 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | |
| 11 | SiteGurad WP Plugin is the plugin specialized for the protection against the attack to the management page and login. |
| 12 | |
| 13 | == Description == |
| 14 | |
| 15 | You can find docs, FAQ and more detailed information on [English Page](http://www.jp-secure.com/cont/products/siteguard_wp_plugin/index_en.html) [Japanese Page](http://www.jp-secure.com/cont/products/siteguard_wp_plugin/index.html). |
| 16 | |
| 17 | Simply install the SiteGuard WP Plugin, WordPress security is improved. |
| 18 | This plugin is a security plugin that specializes in the login attack of brute force, such as protection and management capabilities. |
| 19 | |
| 20 | Notes |
| 21 | |
| 22 | * It does not support the multisite function of WordPress. |
| 23 | * It only supports Apache 1.3, 2.x for Web servers. |
| 24 | * To use the CAPTCHA function, the expansion library “mbstring” and “gd” should be installed on php. |
| 25 | * To use the management page filter function and login page change function, “mod_rewrite” should be loaded on Apache. |
| 26 | * To use the WAF Tuning Support, WAF ( SiteGuard Lite ) should be installed on Apache. |
| 27 | |
| 28 | There are the following functions. |
| 29 | |
| 30 | * Admin Page IP Filter |
| 31 | |
| 32 | It is the function for the protection against the attack to the management page (under wp-admin.) |
| 33 | To the access from the connection source IP address which does not login to the management page, 404 (Not Found) is returned. |
| 34 | At the login, the connection source IP address is recorded and the access to that page is allowed. |
| 35 | The connection source IP address which does not login for more than 24 hours is sequentially deleted. |
| 36 | The URL (under wp-admin) where this function is excluded can be specified. |
| 37 | |
| 38 | * Rename Login |
| 39 | |
| 40 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. |
| 41 | The login page name (wp-login.php) is changed. The initial value is “login_<5 random digits>” but it can be changed to a favorite name. |
| 42 | |
| 43 | * CAPTCHA |
| 44 | |
| 45 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack, |
| 46 | or to receive less comment spam. For the character of CAPTCHA, hiragana and alphanumeric characters can be selected. |
| 47 | |
| 48 | * Login Lock |
| 49 | |
| 50 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. |
| 51 | Especially, it is the function to prevent an automated attack. The connection source IP address the number of login failure of which reaches |
| 52 | the specified number within the specified period is blocked for the specified time. |
| 53 | Each user account is not locked. |
| 54 | |
| 55 | * Login Alert |
| 56 | |
| 57 | It is the function to make it easier to notice unauthorized login. E-mail will be sent to a login user when logged in. |
| 58 | If you receive an e-mail to there is no logged-in idea, please suspect unauthorized login. |
| 59 | |
| 60 | * Fail Once |
| 61 | |
| 62 | It is the function to decrease the vulnerability against a password list attack. Even is the login input is correct, the first login must fail. |
| 63 | After 5 seconds and later within 60 seconds, another correct login input make login succeed. At the first login failure, the following error message is displayed. |
| 64 | |
| 65 | * Disable Pingback |
| 66 | |
| 67 | The pingback function is disabled and its abuse is prevented. |
| 68 | |
| 69 | * Updates Notify |
| 70 | |
| 71 | Basic of security is that always you use the latest version. If WordPress core, plugins, and themes updates are needed , sends email to notify administrators. |
| 72 | |
| 73 | * WAF Tuning Support |
| 74 | |
| 75 | It is the function to create the rule to avoid the false detection in WordPress (including 403 error occurrence with normal access,) |
| 76 | if WAF ( SiteGuard Lite ) by JP-Secure is installed on a Web server. WAF prevents the attack from the outside against the Web server, |
| 77 | but for some WordPress or plugin functions, WAF may detect the attack which is actually not attack and block the function. |
| 78 | By creating the WAF exclude rule, the WAF protection function can be activated while the false detection for the specified function is prevented. |
| 79 | |
| 80 | = Translate = |
| 81 | |
| 82 | If you have created your own language pack, or have an update of an existing one, you can send [gettext PO and MO files](http://codex.wordpress.org/Translating_WordPress) to sgdev@jp-secure.com so that We can bundle it into SiteGuard WP Plugin. You can download the latest [POT file](http://plugins.svn.wordpress.org/siteguard/trunk/languages/siteguard.pot), and [PO files in each language](http://plugins.svn.wordpress.org/siteguard/branches/languages/). |
| 83 | |
| 84 | == Installation == |
| 85 | |
| 86 | * WordPress dashboard |
| 87 | 1. Please search and install "SiteGuard WP Plugin" from 'Plugins' menu of WordPress dashboard |
| 88 | 2. Activate the plugin through the 'Plugins' menu of WordPress dashboard |
| 89 | |
| 90 | * WordPress.org plugin directory |
| 91 | 1. Please search and download "SiteGuard WP Plugin" |
| 92 | 2. Please upload and install a ZIP file that you downloaded through 'Plugins' menu of WordPress dashboard |
| 93 | 3. Activate the plugin through the 'Plugins' menu of WordPress dashboard |
| 94 | |
| 95 | == Screenshots == |
| 96 | |
| 97 | * SiteGuard WP Plugin - Dashboard - |
| 98 | |
| 99 | == Frequently Asked Questions == |
| 100 | |
| 101 | [English Page](http://www.jp-secure.com/cont/products/siteguard_wp_plugin/faq_en.html) |
| 102 | [Japanese Page](http://www.jp-secure.com/cont/products/siteguard_wp_plugin/faq.html) |
| 103 | |
| 104 | == Changelog == |
| 105 | = 1.2.3 = |
| 106 | * Fix bug that you can not reply comments from the dashboard, if the CAPTCHA is enabled |
| 107 | * Fix bug that the login page is displayed in '/wp-login' even if the Rename Login is enabled |
| 108 | = 1.2.2 = |
| 109 | * Fix bug that XML-RPC access which doesn't need login is recorded as the nameless login history |
| 110 | * Disabling the all functions when installed in multisite environment |
| 111 | * Disabling the several functions when settings of .htaccess was eliminated |
| 112 | = 1.2.1 = |
| 113 | * Supported with WP 4.2 |
| 114 | = 1.2.0 = |
| 115 | * Add the "Updates Notify" feature |
| 116 | * Fix bug that login via XML-RPC to fail, if the CAPTCHA is enabled |
| 117 | * Fix bug that sometimes can't login when you enable the Fail once |
| 118 | = 1.1.2 = |
| 119 | * Supported with WP 4.1 |
| 120 | * Disabling the Admin IP Filter function by default |
| 121 | = 1.1.1 = |
| 122 | * Fix bug that can not save "Login Alert" settings |
| 123 | * Add the "Login Alert" notification variables, IP Address, User-Agent and Referer |
| 124 | = 1.1.0 = |
| 125 | * Add the "Login Alert" feature |
| 126 | * Add the function of inform the new Login page URL by e-mail |
| 127 | * Fix bug that work "Fail Once" even when the password is a mistake |
| 128 | * Fix bug that even if the "Rename Login" has been enabled, and have specified a permanent link to the non-standard, jump to the new login page in /login |
| 129 | = 1.0.6 = |
| 130 | * Supported with Apache 1.3 |
| 131 | * Fix garbling of CAPTCHA by environment |
| 132 | * Fix input check of Rename login path |
| 133 | * Fix some other bugs |
| 134 | = 1.0.5 = |
| 135 | * Add display a warning about changing the login page URL, when activate the plugin |
| 136 | = 1.0.4 = |
| 137 | * Fix bug that fails to update .htaccess, if there is no WordPress settings in .htaccess |
| 138 | = 1.0.3 = |
| 139 | * Fix a problem that "Rename Login" does not work, if you change Permalink settings |
| 140 | * Fix the collision of class name of Really Simple CAPTCHA |
| 141 | = 1.0.2 = |
| 142 | * Fix a minor html escape leakage |
| 143 | * Reduced the problem of affinity with other plugin [WordPress HTTPS (SSL)] |
| 144 | = 1.0.1 = |
| 145 | * Supported with WP 4.0 |
| 146 | = 1.0.0 = |
| 147 | * First release |
| 148 |