siteguard
Last commit date
admin
2 weeks ago
classes
2 weeks ago
css
2 months ago
images
2 months ago
languages
2 weeks ago
really-simple-captcha
3 months ago
changelog.txt
2 months ago
license.txt
11 years ago
readme.txt
2 weeks ago
siteguard.php
2 weeks ago
uninstall.php
2 months ago
readme.txt
181 lines
| 1 | === SiteGuard WP Plugin === |
| 2 | Contributors: jp-secure, egsecuresolutions |
| 3 | Donate link: - |
| 4 | Tags: security, login lock, login alert, captcha, pingback |
| 5 | Requires at least: 6.0 |
| 6 | Tested up to: 7.0 |
| 7 | Stable tag: 1.8.8 |
| 8 | License: GPLv2 or later |
| 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | |
| 11 | Adds WordPress login and admin protections, including CAPTCHA, login lock, login alerts, renamed login URLs, and SiteGuard WAF tuning support. |
| 12 | |
| 13 | == Description == |
| 14 | |
| 15 | SiteGuard WP Plugin helps protect WordPress sites by strengthening login and admin-area security. It helps reduce brute-force login attacks, password list attacks, comment spam, and unauthorized access to `/wp-admin/`. |
| 16 | |
| 17 | = Main Features = |
| 18 | |
| 19 | * Admin Page IP Filter: Restricts wp-admin access to IP addresses that have successfully logged in. |
| 20 | * Rename Login: Changes the URL of the login page from `wp-login.php` to a custom path. |
| 21 | * CAPTCHA: Adds CAPTCHA to login, comment, password reset, and user registration forms. |
| 22 | * Login Lock: Temporarily locks out IP addresses after repeated failed login attempts. |
| 23 | * Login Alert: Sends email notifications when users log in. |
| 24 | * Fail Once: Intentionally rejects the first valid login attempt and requires the user to try again shortly after. |
| 25 | * Protect XML-RPC: Disables pingbacks or all XML-RPC access to help prevent abuse. |
| 26 | * Block Author Query: Helps prevent username leakage through `/?author=<number>` requests. |
| 27 | * Update Notifications: Sends email notifications when updates are available for WordPress core, plugins, or themes. |
| 28 | * WAF Tuning Support: Creates exclusion rules to help prevent false positives when SiteGuard Server Edition WAF is installed. |
| 29 | |
| 30 | = Requirements and Compatibility = |
| 31 | |
| 32 | * WordPress multisite is not supported. |
| 33 | * Apache 1.3, Apache 2.x, and Nginx are supported. |
| 34 | * Rename Login cannot be combined with a login page URL change feature in another plugin. Enable it in only one plugin; using both can leave two login URLs available, or stop the login page from loading. |
| 35 | * CAPTCHA requires the PHP extensions `mbstring` and `gd`. |
| 36 | * WAF Tuning Support requires SiteGuard Server Edition on Apache. |
| 37 | |
| 38 | = Documentation = |
| 39 | |
| 40 | Documentation, FAQs, and more details are available in [English](https://www.jp-secure.com/siteguard_wp_plugin_en/) and [Japanese](https://www.jp-secure.com/siteguard_wp_plugin/). |
| 41 | |
| 42 | = Translations = |
| 43 | |
| 44 | This plugin is translated by the community. We appreciate your help with translations on the [WordPress translation platform](https://translate.wordpress.org/projects/wp-plugins/siteguard/). |
| 45 | |
| 46 | == Installation == |
| 47 | |
| 48 | = From the WordPress Dashboard = |
| 49 | |
| 50 | 1. In the WordPress dashboard, go to Plugins > Add New. |
| 51 | 2. Search for "SiteGuard WP Plugin". |
| 52 | 3. Install and activate the plugin. |
| 53 | |
| 54 | = Manual Installation = |
| 55 | |
| 56 | 1. Search for and download "SiteGuard WP Plugin". |
| 57 | 2. In the WordPress dashboard, go to Plugins > Add New > Upload Plugin. |
| 58 | 3. Upload the downloaded ZIP file. |
| 59 | 4. Install and activate the plugin. |
| 60 | |
| 61 | == Screenshots == |
| 62 | |
| 63 | 1. SiteGuard WP Plugin dashboard. |
| 64 | |
| 65 | == Frequently Asked Questions == |
| 66 | |
| 67 | For FAQs, see the [English](https://www.jp-secure.com/siteguard_wp_plugin_en/faq.html) or [Japanese](https://www.jp-secure.com/siteguard_wp_plugin/faq.html) documentation. |
| 68 | |
| 69 | == Changelog == |
| 70 | |
| 71 | = 1.8.8 = |
| 72 | |
| 73 | * Rename Login: shows a warning when another active plugin is also changing the login page URL. |
| 74 | * Rename Login: fixed an issue where a fresh install could leave the login page inaccessible (the login URL returned 404). |
| 75 | |
| 76 | Special thanks to niflex for the plugin conflict report, and to kitadahi for the login URL report. |
| 77 | |
| 78 | = 1.8.7 = |
| 79 | |
| 80 | * Fixed a cross-site scripting (XSS) vulnerability in the logout URL that could occur when the login page URL is changed. |
| 81 | |
| 82 | Special thanks to daroo (Patchstack) for the report. |
| 83 | |
| 84 | = 1.8.6 = |
| 85 | |
| 86 | * Rename Login: when the login URL falls back to the .php (stub) form, the settings screen now explains why .htaccess could not be used. |
| 87 | * Rename Login: fixed the .htaccess self-test so it works when WordPress has been given its own directory (the WordPress Address differs from the Site Address). |
| 88 | * Block Author Query: the "Disable REST API" exclusion list now uses REST API namespaces instead of plugin names. |
| 89 | |
| 90 | Special thanks to abcdrew and miwarock777 for their contributions to this release. |
| 91 | |
| 92 | = 1.8.5 = |
| 93 | |
| 94 | * Fixed a security issue affecting the login URL protection on some server configurations. |
| 95 | |
| 96 | Special thanks to goto5656 for the report. |
| 97 | |
| 98 | = 1.8.4 = |
| 99 | |
| 100 | * Fixed a security issue affecting the login URL protection on some server configurations. |
| 101 | |
| 102 | Special thanks to goto5656 for the report. |
| 103 | |
| 104 | = 1.8.3 = |
| 105 | |
| 106 | * Fixed an issue where the cleanup of legacy .htaccess rules (which could lock administrators out of /wp-admin/) did not run on sites that had already updated to 1.8.0 or 1.8.1. |
| 107 | |
| 108 | = 1.8.2 = |
| 109 | |
| 110 | * Fixed an issue where upgrading from 1.7.x to 1.8.x could leave legacy .htaccess rules in place, locking administrators out of /wp-admin/. |
| 111 | |
| 112 | Special thanks to t.inoue for the report. |
| 113 | |
| 114 | = 1.8.1 = |
| 115 | |
| 116 | * Fixed a security issue affecting the login URL protection. |
| 117 | |
| 118 | = 1.8.0 = |
| 119 | |
| 120 | * Added support for Nginx and Apache environments that do not use an .htaccess file. |
| 121 | * Improved Login Lock to apply to authentication attempts via XML-RPC. |
| 122 | * Fixed several security issues affecting login URL protection. |
| 123 | * Reviewed and updated the English strings. Special thanks to abcdrew. |
| 124 | |
| 125 | Special thanks to Daiki Honda and Daishi Kuroki for their contributions to this release. |
| 126 | Special thanks to Helena Media Research Corporation for the report. |
| 127 | |
| 128 | = 1.7.12 = |
| 129 | |
| 130 | * Fixed an authorization vulnerability in the login history. Special thanks to Ficus Inc. |
| 131 | * Mitigated CAPTCHA authentication failures in some environments. |
| 132 | |
| 133 | = 1.7.11 = |
| 134 | |
| 135 | * Fixed an issue where a syntax error occurred in PHP 5.6 or earlier. |
| 136 | |
| 137 | = 1.7.10 = |
| 138 | |
| 139 | * Fixed a Guessable CAPTCHA vulnerability (CVE-2026-27411). Special thanks to Patchstack. |
| 140 | |
| 141 | = 1.7.9 = |
| 142 | |
| 143 | * Fixed a deprecated notice for the get_currentuserinfo() function. |
| 144 | |
| 145 | = 1.7.8 = |
| 146 | |
| 147 | * Fixed a warning that occurred in version 1.7.7. |
| 148 | |
| 149 | = 1.7.7 = |
| 150 | |
| 151 | * Fixed a bug where the renamed login URL was leaked when wp-register.php was accessed. |
| 152 | |
| 153 | = 1.7.6 = |
| 154 | |
| 155 | * Fixed an issue where a warning occurred on the login screen in PHP 8.x environments. |
| 156 | |
| 157 | = 1.7.5 = |
| 158 | |
| 159 | * Fixed an issue where a fatal error occurred on the Update Notifications screen in PHP 8.x environments. |
| 160 | |
| 161 | = 1.7.4 = |
| 162 | |
| 163 | * Changed the directory for storing CAPTCHA image files to wp-content/siteguard/. |
| 164 | * Fixed some bugs. |
| 165 | |
| 166 | = 1.7.3 = |
| 167 | |
| 168 | * Fixed an issue where password reset emails could not be sent from the admin page when CAPTCHA was enabled. |
| 169 | |
| 170 | = 1.7.2 = |
| 171 | |
| 172 | * Reviewed and modified source code related to security. |
| 173 | |
| 174 | = 1.7.1 = |
| 175 | |
| 176 | * Fixed an issue where a syntax error occurred in PHP 5.6 or earlier. |
| 177 | |
| 178 | = 1.7.0 = |
| 179 | |
| 180 | * Removed the ability to get the client IP address from X-Forwarded-For due to IP spoofing risk. |
| 181 |