siteguard
Last commit date
admin
3 years ago
classes
2 years ago
css
3 years ago
images
11 years ago
languages
5 years ago
really-simple-captcha
2 years ago
test
3 years ago
.htaccess
3 years ago
license.txt
11 years ago
readme.txt
2 years ago
siteguard.php
2 years ago
uninstall.php
3 years ago
readme.txt
213 lines
| 1 | === SiteGuard WP Plugin === |
| 2 | Contributors: jp-secure |
| 3 | Donate link: - |
| 4 | Tags: security, waf, brute force, password list, login lock, login alert, captcha, pingback, fail once |
| 5 | Requires at least: 3.9 |
| 6 | Tested up to: 6.6 |
| 7 | Stable tag: 1.7.7 |
| 8 | License: GPLv2 or later |
| 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | |
| 11 | SiteGurad WP Plugin is the plugin specialized for the protection against the attack to the management page and login. |
| 12 | |
| 13 | == Description == |
| 14 | |
| 15 | You can find docs, FAQ and more detailed information on [English Page](https://www.jp-secure.com/siteguard_wp_plugin_en/) [Japanese Page](https://www.jp-secure.com/siteguard_wp_plugin/). |
| 16 | |
| 17 | Simply install the SiteGuard WP Plugin, WordPress security is improved. |
| 18 | This plugin is a security plugin that specializes in the login attack of brute force, such as protection and management capabilities. |
| 19 | |
| 20 | Notes |
| 21 | |
| 22 | * It does not support the multisite function of WordPress. |
| 23 | * It only supports Apache 1.3, 2.x for Web servers. |
| 24 | * To use the CAPTCHA function, the expansion library “mbstring” and “gd” should be installed on php. |
| 25 | * To use the management page filter function and login page change function, “mod_rewrite” should be loaded on Apache. |
| 26 | * To use the WAF Tuning Support, WAF ( SiteGuard Server Edition ) should be installed on Apache. |
| 27 | |
| 28 | There are the following functions. |
| 29 | |
| 30 | * Admin Page IP Filter |
| 31 | |
| 32 | It is the function for the protection against the attack to the management page (under wp-admin.) |
| 33 | To the access from the connection source IP address which does not login to the management page, 404 (Not Found) is returned. |
| 34 | At the login, the connection source IP address is recorded and the access to that page is allowed. |
| 35 | The connection source IP address which does not login for more than 24 hours is sequentially deleted. |
| 36 | The URL (under wp-admin) where this function is excluded can be specified. |
| 37 | |
| 38 | * Rename Login |
| 39 | |
| 40 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. |
| 41 | The login page name (wp-login.php) is changed. The initial value is “login_<5 random digits>” but it can be changed to a favorite name. |
| 42 | |
| 43 | * CAPTCHA |
| 44 | |
| 45 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack, |
| 46 | or to receive less comment spam. For the character of CAPTCHA, hiragana and alphanumeric characters can be selected. |
| 47 | |
| 48 | * Login Lock |
| 49 | |
| 50 | It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. |
| 51 | Especially, it is the function to prevent an automated attack. The connection source IP address the number of login failure of which reaches |
| 52 | the specified number within the specified period is blocked for the specified time. |
| 53 | Each user account is not locked. |
| 54 | |
| 55 | * Login Alert |
| 56 | |
| 57 | It is the function to make it easier to notice unauthorized login. E-mail will be sent to a login user when logged in. |
| 58 | If you receive an e-mail to there is no logged-in idea, please suspect unauthorized login. |
| 59 | |
| 60 | * Fail Once |
| 61 | |
| 62 | It is the function to decrease the vulnerability against a password list attack. Even is the login input is correct, the first login must fail. |
| 63 | After 5 seconds and later within 60 seconds, another correct login input make login succeed. At the first login failure, the following error message is displayed. |
| 64 | |
| 65 | * Disable Pingback |
| 66 | |
| 67 | The pingback function is disabled and its abuse is prevented. |
| 68 | |
| 69 | * Block Author Query |
| 70 | |
| 71 | Prevents leakage of user names due to "/?author=<number>" access. |
| 72 | |
| 73 | * Updates Notify |
| 74 | |
| 75 | Basic of security is that always you use the latest version. If WordPress core, plugins, and themes updates are needed , sends email to notify administrators. |
| 76 | |
| 77 | * WAF Tuning Support |
| 78 | |
| 79 | It is the function to create the rule to avoid the false detection in WordPress (including 403 error occurrence with normal access,) |
| 80 | if WAF ( SiteGuard Server Edition ) by EG Secure Solutions is installed on a Web server. WAF prevents the attack from the outside against the Web server, |
| 81 | but for some WordPress or plugin functions, WAF may detect the attack which is actually not attack and block the function. |
| 82 | By creating the WAF exclude rule, the WAF protection function can be activated while the false detection for the specified function is prevented. |
| 83 | |
| 84 | = Translate = |
| 85 | |
| 86 | If you have created your own language pack, or have an update of an existing one, you can send [gettext PO and MO files](http://codex.wordpress.org/Translating_WordPress) to sgdev@jp-secure.com so that We can bundle it into SiteGuard WP Plugin. You can download the latest [POT file](http://plugins.svn.wordpress.org/siteguard/trunk/languages/siteguard.pot), and [PO files in each language](http://plugins.svn.wordpress.org/siteguard/branches/languages/). |
| 87 | |
| 88 | == Installation == |
| 89 | |
| 90 | * WordPress dashboard |
| 91 | 1. Please search and install "SiteGuard WP Plugin" from 'Plugins' menu of WordPress dashboard |
| 92 | 2. Activate the plugin through the 'Plugins' menu of WordPress dashboard |
| 93 | |
| 94 | * WordPress.org plugin directory |
| 95 | 1. Please search and download "SiteGuard WP Plugin" |
| 96 | 2. Please upload and install a ZIP file that you downloaded through 'Plugins' menu of WordPress dashboard |
| 97 | 3. Activate the plugin through the 'Plugins' menu of WordPress dashboard |
| 98 | |
| 99 | == Screenshots == |
| 100 | |
| 101 | * SiteGuard WP Plugin - Dashboard - |
| 102 | |
| 103 | == Frequently Asked Questions == |
| 104 | |
| 105 | [English Page](https://www.jp-secure.com/siteguard_wp_plugin_en/faq/) |
| 106 | [Japanese Page](https://www.jp-secure.com/siteguard_wp_plugin/faq/) |
| 107 | |
| 108 | == Changelog == |
| 109 | = 1.7.7 = |
| 110 | * Fix a bug where renamed login URL was leaked when wp-register.php was accessed |
| 111 | = 1.7.6 = |
| 112 | * Fix a problem that a warning occurred on the Login screen in the PHP8.x environment |
| 113 | = 1.7.5 = |
| 114 | * Fix a problem that a serious error occurred on the Updates Notify screen in the PHP8.x environment |
| 115 | = 1.7.4 = |
| 116 | * Changed the directory to store CAPTCHA image files to wp-content/siteguard/ |
| 117 | * Fix some bugs |
| 118 | = 1.7.3 = |
| 119 | * Fix an issue where password reset could not be sent from the management page when CAPTCHA was enabled |
| 120 | = 1.7.2 = |
| 121 | * Reviewed and modified source code related to security |
| 122 | = 1.7.1 = |
| 123 | * Fix the problem that a syntax error occurs in PHP5.6 or earlier |
| 124 | = 1.7.0 = |
| 125 | * Removed ability to get client IP address from X-Forwarded-For due to IP spoofing risk |
| 126 | = 1.6.1 = |
| 127 | * Fix the problem that an error occurs when suppressing the redirect from the management page to the login page |
| 128 | = 1.6.0 = |
| 129 | * Add the "Block Author Query" feature |
| 130 | = 1.5.2 = |
| 131 | * Fix a syntax error before php5.4 |
| 132 | = 1.5.1 = |
| 133 | * Fix a server error when mod_access_compat is not loaded in apache2.4 |
| 134 | * In the Admin Page IP Filter function, fix an issue where site health loopback requests fail |
| 135 | = 1.5.0 = |
| 136 | * Add the function not to redirect from admin page to login page |
| 137 | * Add site-health.php to the initial value of the exclusion path |
| 138 | = 1.4.3 = |
| 139 | * Fix bug in 1.4.2 "Notice：Use of undefined constant HTTPS" |
| 140 | = 1.4.2 = |
| 141 | * In the Rename Login function, correct the problem that is redirected to the https renamed login page from the http /wp-login.php |
| 142 | = 1.4.1 = |
| 143 | * Fix bug that some functions are disabled |
| 144 | = 1.4.0 = |
| 145 | * Enabled to get client IP address from X-Forwarded-For header |
| 146 | * Strict operation check of each function |
| 147 | * Change not to use session |
| 148 | = 1.3.4 = |
| 149 | * Fix an issue where CAPTCHA might fail in 1.3.3 |
| 150 | = 1.3.3 = |
| 151 | * Fix bug that fatal error occurs when fails to send mail |
| 152 | * Inprove the security of the CAPTCHA function |
| 153 | * Disabling the Rename Login function when qTranslate X plugin is enabled in order to avoid conflicts |
| 154 | = 1.3.2 = |
| 155 | * Fix bug that fatal error occurs when fails to send mail |
| 156 | = 1.3.1 = |
| 157 | * Fix conflicts with other plugins in a session related |
| 158 | = 1.3.0 = |
| 159 | * Add the "Disable XMLRPC" feature |
| 160 | * In the Login History, add display the login type that indicates whether via login page or xmlrpc |
| 161 | * Fix that the Fail Once error message to be not the same as the failure |
| 162 | * Fix that the permission of .htaccess to change from 0644 to 0604 |
| 163 | * Delete the mistaken characters of CAPTCHA |
| 164 | = 1.2.5 = |
| 165 | * In the Admin Page IP Filter function, fix bug that can be accessed from the IP address that failed to login to the management page |
| 166 | * In the Rename Login function, correct the problem that is redirected to the renamed login page from the /wp-signup.php |
| 167 | = 1.2.4 = |
| 168 | * Fix bug that there is a case which can acccess management pages from non login client |
| 169 | * Disabling the several functions when there is no .htaccess write permission |
| 170 | = 1.2.3 = |
| 171 | * Fix bug that you can not reply comments from the dashboard, if the CAPTCHA is enabled |
| 172 | * Fix bug that the login page is displayed in '/wp-login' even if the Rename Login is enabled |
| 173 | = 1.2.2 = |
| 174 | * Fix bug that XML-RPC access which doesn't need login is recorded as the nameless login history |
| 175 | * Disabling the all functions when installed in multisite environment |
| 176 | * Disabling the several functions when settings of .htaccess was eliminated |
| 177 | = 1.2.1 = |
| 178 | * Supported with WP 4.2 |
| 179 | = 1.2.0 = |
| 180 | * Add the "Updates Notify" feature |
| 181 | * Fix bug that login via XML-RPC to fail, if the CAPTCHA is enabled |
| 182 | * Fix bug that sometimes can't login when you enable the Fail once |
| 183 | = 1.1.2 = |
| 184 | * Supported with WP 4.1 |
| 185 | * Disabling the Admin IP Filter function by default |
| 186 | = 1.1.1 = |
| 187 | * Fix bug that can not save "Login Alert" settings |
| 188 | * Add the "Login Alert" notification variables, IP Address, User-Agent and Referer |
| 189 | = 1.1.0 = |
| 190 | * Add the "Login Alert" feature |
| 191 | * Add the function of inform the new Login page URL by e-mail |
| 192 | * Fix bug that work "Fail Once" even when the password is a mistake |
| 193 | * Fix bug that even if the "Rename Login" has been enabled, and have specified a permanent link to the non-standard, jump to the new login page in /login |
| 194 | = 1.0.6 = |
| 195 | * Supported with Apache 1.3 |
| 196 | * Fix garbling of CAPTCHA by environment |
| 197 | * Fix input check of Rename login path |
| 198 | * Fix some other bugs |
| 199 | = 1.0.5 = |
| 200 | * Add display a warning about changing the login page URL, when activate the plugin |
| 201 | = 1.0.4 = |
| 202 | * Fix bug that fails to update .htaccess, if there is no WordPress settings in .htaccess |
| 203 | = 1.0.3 = |
| 204 | * Fix a problem that "Rename Login" does not work, if you change Permalink settings |
| 205 | * Fix the collision of class name of Really Simple CAPTCHA |
| 206 | = 1.0.2 = |
| 207 | * Fix a minor html escape leakage |
| 208 | * Reduced the problem of affinity with other plugin [WordPress HTTPS (SSL)] |
| 209 | = 1.0.1 = |
| 210 | * Supported with WP 4.0 |
| 211 | = 1.0.0 = |
| 212 | * First release |
| 213 |