ArkHost/WP-Security-Pack
1
0
Fork 0
mirror of https://gitlab.com/ArkHost/WP-Security-Pack.git synced 2026-07-23 23:45:51 +02:00
Code Issues Projects Releases Wiki Activity

v1.0

Browse Source
This commit is contained in:
Yuri Karamian
2026-01-25 22:54:00 +01:00
parent 16c9d86186
commit 79b0dfa371
2 changed files with 48 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-security-pack/includes/class-wpsp-admin.php
+47 -112
View File
@@ -939,9 +939,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Login Access Restriction', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'Restrict access to the WordPress login page by country and/or IP address.', 'wp-security-pack' ); ?><br>
<strong><?php esc_html_e( 'Note:', 'wp-security-pack' ); ?></strong>
<?php esc_html_e( 'This is a restrictive list — ONLY IPs/countries listed here can access the login page. This is different from the global IP Whitelist (IP Control tab), which bypasses all security checks including this restriction.', 'wp-security-pack' ); ?>
<?php esc_html_e( 'Only listed IPs/countries can access login. Different from global whitelist (which bypasses everything).', 'wp-security-pack' ); ?>
</p>
<?php
$geo_blocking = wpsp()->get_component( 'geo_blocking' );
@@ -962,7 +960,7 @@ class WPSP_Admin {
</div>
<?php else : ?>
<div class="notice notice-success inline" style="margin: 10px 0;">
<p><?php esc_html_e( 'GeoIP database is installed. Country detection is available.', 'wp-security-pack' ); ?></p>
<p><?php esc_html_e( 'GeoIP database installed.', 'wp-security-pack' ); ?></p>
</div>
<?php endif; ?>
<table class="form-table">
@@ -991,7 +989,7 @@ class WPSP_Admin {
</option>
<?php endforeach; ?>
</select>
<p class="description"><?php esc_html_e( 'Hold Ctrl/Cmd to select multiple. Leave empty to allow all countries (IP restriction only).', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Ctrl/Cmd to select multiple. Empty = all countries.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1001,12 +999,8 @@ class WPSP_Admin {
echo esc_textarea( WP_Security_Pack::get_setting( 'admin_allowed_ips', '' ) );
?></textarea>
<p class="description">
<?php esc_html_e( 'One IP or CIDR range per line. Leave empty to use country restriction only.', 'wp-security-pack' ); ?><br>
<?php esc_html_e( 'IPs in the global whitelist (IP Control tab) already bypass this restriction — no need to add them here.', 'wp-security-pack' ); ?><br>
<?php
/* translators: %s: Current IP address */
printf( esc_html__( 'Your current IP: %s', 'wp-security-pack' ), '<code>' . esc_html( WPSP_Helper::get_client_ip() ) . '</code>' );
?>
<?php esc_html_e( 'One IP or CIDR per line.', 'wp-security-pack' ); ?>
<?php printf( esc_html__( 'Your IP: %s', 'wp-security-pack' ), '<code>' . esc_html( WPSP_Helper::get_client_ip() ) . '</code>' ); ?>
</p>
</td>
</tr>
@@ -1015,9 +1009,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Email Alerts', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'Receive email notifications for: failed login attempts, IP lockouts, file integrity changes, and malware scan findings.', 'wp-security-pack' ); ?>
</p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Enable', 'wp-security-pack' ); ?></th>
@@ -1046,7 +1037,6 @@ class WPSP_Admin {
<td>
<input type="number" name="wpsp_settings[email_alert_threshold]" min="1" max="100"
value="<?php echo esc_attr( WP_Security_Pack::get_setting( 'email_alert_threshold', 3 ) ); ?>" class="small-text" />
<p class="description"><?php esc_html_e( 'Send alert after this many failed login attempts from the same IP.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1054,6 +1044,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Login Attempt Limiting', 'wp-security-pack' ); ?></h2>
<p class="description"><?php esc_html_e( 'Blocks IPs that fail too many login attempts. Stops brute force attacks.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Enable', 'wp-security-pack' ); ?></th>
@@ -1086,6 +1077,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Custom Login URL', 'wp-security-pack' ); ?></h2>
<p class="description"><?php esc_html_e( 'Hides wp-login.php. Bots can\'t attack what they can\'t find.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Enable', 'wp-security-pack' ); ?></th>
@@ -1114,9 +1106,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'hide_wp_admin', false ) ); ?> />
<?php esc_html_e( 'Return 404 for /wp-admin when not logged in', 'wp-security-pack' ); ?>
</label>
<p class="description">
<?php esc_html_e( 'Direct access to /wp-login.php is also blocked with a 404. Users must visit the custom login URL first, which sets an access cookie allowing WordPress flows (password reset, etc.) to work.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Also blocks /wp-login.php with 404.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1124,9 +1114,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Honeypot Protection', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'Adds a hidden field to login and registration forms that is invisible to humans but gets filled by automated bots. When a bot fills this field, it is immediately blocked.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Hidden field that catches bots. Humans can\'t see it, bots fill it out and get blocked.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Enable', 'wp-security-pack' ); ?></th>
@@ -1144,7 +1132,6 @@ class WPSP_Admin {
<input type="number" name="wpsp_settings[honeypot_ban_duration]" min="1" max="1440"
value="<?php echo esc_attr( WP_Security_Pack::get_setting( 'honeypot_ban_duration', 60 ) ); ?>" class="small-text" />
<?php esc_html_e( 'minutes', 'wp-security-pack' ); ?>
<p class="description"><?php esc_html_e( 'How long to block IPs that trigger the honeypot.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1161,7 +1148,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'hide_login_errors', true ) ); ?> />
<?php esc_html_e( 'Show generic error message on failed login', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Prevents attackers from discovering valid usernames by showing "Invalid username or password" instead of specific errors.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Stops username enumeration.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1172,7 +1159,6 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'admin_login_notify', false ) ); ?> />
<?php esc_html_e( 'Email notification when admin logs in from new IP', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Sends an email alert when an administrator account logs in from an IP address not seen before.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1228,7 +1214,7 @@ class WPSP_Admin {
<h2><?php esc_html_e( 'Country Blocking', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description">
<strong><?php esc_html_e( 'Warning:', 'wp-security-pack' ); ?></strong>
<?php esc_html_e( 'Blocked countries cannot access the ENTIRE website — not just login. Use this only if you want to completely block visitors from specific countries.', 'wp-security-pack' ); ?>
<?php esc_html_e( 'Blocks the ENTIRE site, not just login.', 'wp-security-pack' ); ?>
</p>
<table class="form-table">
<tr>
@@ -1289,9 +1275,7 @@ class WPSP_Admin {
</option>
<?php endforeach; ?>
</select>
<p class="description">
<?php esc_html_e( 'Hold Ctrl/Cmd to select multiple. Visitors from these countries will be blocked from the entire site.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Ctrl/Cmd to select multiple.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1299,9 +1283,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'IP Whitelist (Global Bypass)', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description">
<?php esc_html_e( 'IPs listed here are treated as trusted and bypass ALL security checks: login limits, lockouts, geo-blocking, and login access restrictions.', 'wp-security-pack' ); ?>
</p>
<p class="wpsp-description"><?php esc_html_e( 'These IPs bypass all security checks.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Whitelisted IPs', 'wp-security-pack' ); ?></th>
@@ -1310,11 +1292,8 @@ class WPSP_Admin {
echo esc_textarea( WP_Security_Pack::get_setting( 'ip_whitelist', '' ) );
?></textarea>
<p class="description">
<?php esc_html_e( 'One IP or CIDR range per line.', 'wp-security-pack' ); ?><br>
<?php
/* translators: %s: Current IP address */
printf( esc_html__( 'Your current IP: %s', 'wp-security-pack' ), '<code>' . esc_html( WPSP_Helper::get_client_ip() ) . '</code>' );
?>
<?php esc_html_e( 'One IP or CIDR per line.', 'wp-security-pack' ); ?>
<?php printf( esc_html__( 'Your IP: %s', 'wp-security-pack' ), '<code>' . esc_html( WPSP_Helper::get_client_ip() ) . '</code>' ); ?>
</p>
</td>
</tr>
@@ -1323,6 +1302,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'IP Blacklist', 'wp-security-pack' ); ?></h2>
<p class="description"><?php esc_html_e( 'Permanently blocked IPs. They can\'t access anything.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Blacklisted IPs', 'wp-security-pack' ); ?></th>
@@ -1330,7 +1310,7 @@ class WPSP_Admin {
<textarea name="wpsp_settings[ip_blacklist]" rows="6" class="large-text code"><?php
echo esc_textarea( WP_Security_Pack::get_setting( 'ip_blacklist', '' ) );
?></textarea>
<p class="description"><?php esc_html_e( 'One IP or CIDR range per line. Lines starting with # are comments.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'One IP or CIDR per line. # for comments.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1341,7 +1321,6 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'auto_blacklist_enabled', false ) ); ?> />
<?php esc_html_e( 'Automatically blacklist repeat offenders', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Permanently add IPs to the blacklist after repeated lockouts.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1350,7 +1329,6 @@ class WPSP_Admin {
<input type="number" name="wpsp_settings[auto_blacklist_threshold]" min="1" max="20"
value="<?php echo esc_attr( WP_Security_Pack::get_setting( 'auto_blacklist_threshold', 3 ) ); ?>" class="small-text" />
<?php esc_html_e( 'lockouts', 'wp-security-pack' ); ?>
<p class="description"><?php esc_html_e( 'Number of times an IP must be locked out before being permanently blacklisted.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1433,9 +1411,6 @@ class WPSP_Admin {
<input type="hidden" name="wpsp_settings[wpsp_current_tab]" value="hardening" />
<div class="wpsp-section">
<h2><?php esc_html_e( 'Security Hardening', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'These options reduce your attack surface by disabling unnecessary WordPress features often exploited by attackers.', 'wp-security-pack' ); ?>
</p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Disable XML-RPC', 'wp-security-pack' ); ?></th>
@@ -1445,7 +1420,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'disable_xmlrpc', true ) ); ?> />
<?php esc_html_e( 'Disable XML-RPC endpoint', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'XML-RPC allows remote publishing but is commonly exploited for brute force and DDoS attacks. Disable unless needed for Jetpack, WordPress mobile app, or remote publishing.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Disable unless needed for Jetpack or WordPress mobile app.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1456,7 +1431,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'disable_file_editing', true ) ); ?> />
<?php esc_html_e( 'Disable plugin and theme file editor', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Removes the ability to edit PHP files from Appearance > Theme Editor and Plugins > Plugin Editor. If an attacker gains admin access, they cannot inject malicious code directly.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Removes Theme Editor and Plugin Editor from dashboard.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1467,7 +1442,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'disable_application_passwords', false ) ); ?> />
<?php esc_html_e( 'Disable WordPress application passwords', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Application passwords allow external apps to authenticate via REST API. Disable if you don\'t use third-party apps that connect to your site.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Disable if you don\'t use third-party apps.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1478,7 +1453,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'restrict_rest_api', true ) ); ?> />
<?php esc_html_e( 'Require authentication for REST API access', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Blocks anonymous access to REST API endpoints. Prevents user enumeration (/wp-json/wp/v2/users) and other information disclosure. Essential endpoints like oEmbed remain accessible.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Blocks anonymous REST API access. oEmbed still works.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1489,7 +1464,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'remove_wp_version', true ) ); ?> />
<?php esc_html_e( 'Hide WordPress version information', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Removes the WordPress version from the HTML source, RSS feeds, and script/style URLs. Makes it harder for attackers to identify known vulnerabilities for your version.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Removes version from source, feeds, and script URLs.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1500,7 +1475,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'remove_feed_links', false ) ); ?> />
<?php esc_html_e( 'Remove RSS feed links from HTML head', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Removes auto-discovery links for RSS/Atom feeds. Only enable if you don\'t use RSS feeds.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Only enable if you don\'t use RSS.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1511,7 +1486,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'add_security_headers', true ) ); ?> />
<?php esc_html_e( 'Add HTTP security headers', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Adds headers like X-Frame-Options, X-Content-Type-Options, etc. Configure specific headers in the Security Headers tab.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Configure in Security Headers tab.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1522,7 +1497,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'disable_user_enumeration', true ) ); ?> />
<?php esc_html_e( 'Prevent username discovery', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Blocks ?author=N scans, hides usernames from REST API and oEmbed responses. Attackers commonly enumerate usernames before brute force attacks.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Blocks ?author=N scans and hides usernames from REST API.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1533,7 +1508,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'disable_pingbacks', true ) ); ?> />
<?php esc_html_e( 'Disable pingbacks and trackbacks', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Pingbacks are rarely used legitimately but commonly abused for DDoS amplification attacks and spam.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Rarely used legitimately, often abused for DDoS.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1564,9 +1539,7 @@ class WPSP_Admin {
<input type="hidden" name="wpsp_settings[wpsp_current_tab]" value="headers" />
<div class="wpsp-section">
<h2><?php esc_html_e( 'Security Headers Configuration', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'HTTP security headers instruct browsers to enable security features. Leave a field empty to disable that header.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'HTTP headers that tell browsers to enable security features. Leave empty to disable.', 'wp-security-pack' ); ?></p>
<div class="notice notice-info inline" style="margin: 10px 0;">
<p>
<?php
@@ -1589,7 +1562,7 @@ class WPSP_Admin {
<input type="text" name="wpsp_settings[security_headers][x_content_type_options]" id="header-x_content_type_options"
value="<?php echo esc_attr( $headers['x_content_type_options'] ?? 'nosniff' ); ?>" class="regular-text"
data-default="nosniff" />
<p class="description"><?php esc_html_e( 'Prevents browsers from MIME-sniffing a response away from the declared content-type. Protects against attacks where an attacker tries to disguise malicious content as a safe file type.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Prevents MIME-sniffing attacks.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1600,7 +1573,7 @@ class WPSP_Admin {
<option value="DENY" <?php selected( $headers['x_frame_options'] ?? '', 'DENY' ); ?>>DENY</option>
<option value="SAMEORIGIN" <?php selected( $headers['x_frame_options'] ?? '', 'SAMEORIGIN' ); ?>>SAMEORIGIN</option>
</select>
<p class="description"><?php esc_html_e( 'Protects against clickjacking attacks by controlling whether your site can be embedded in iframes. DENY blocks all framing, SAMEORIGIN allows framing only from your own domain.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Clickjacking protection. DENY = no iframes, SAMEORIGIN = same domain only.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1609,7 +1582,7 @@ class WPSP_Admin {
<input type="text" name="wpsp_settings[security_headers][x_xss_protection]" id="header-x_xss_protection"
value="<?php echo esc_attr( $headers['x_xss_protection'] ?? '1; mode=block' ); ?>" class="regular-text"
data-default="1; mode=block" />
<p class="description"><?php esc_html_e( 'Enables the browser\'s built-in XSS filter. Only needed for legacy browsers (Internet Explorer). Modern browsers like Chrome and Firefox have removed this feature in favor of Content-Security-Policy.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Legacy XSS filter. Only matters for old browsers.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1625,7 +1598,7 @@ class WPSP_Admin {
<option value="strict-origin" <?php selected( $headers['referrer_policy'] ?? '', 'strict-origin' ); ?>>strict-origin</option>
<option value="strict-origin-when-cross-origin" <?php selected( $headers['referrer_policy'] ?? '', 'strict-origin-when-cross-origin' ); ?>>strict-origin-when-cross-origin</option>
</select>
<p class="description"><?php esc_html_e( 'Controls how much referrer information is sent when navigating to other sites. Protects user privacy and prevents leaking sensitive URL parameters.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Controls referrer info sent to other sites.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1634,7 +1607,7 @@ class WPSP_Admin {
<input type="text" name="wpsp_settings[security_headers][permissions_policy]" id="header-permissions_policy"
value="<?php echo esc_attr( $headers['permissions_policy'] ?? 'geolocation=(), microphone=(), camera=()' ); ?>" class="large-text"
data-default="geolocation=(), microphone=(), camera=()" />
<p class="description"><?php esc_html_e( 'Controls which browser features and APIs can be used. Empty parentheses () disable the feature entirely. Prevents malicious scripts from accessing sensitive device features.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Empty () disables the feature. Controls browser API access.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1650,8 +1623,7 @@ class WPSP_Admin {
<span class="description" style="margin-left: 10px;"><?php esc_html_e( 'Loads a basic WordPress-compatible CSP as a starting point.', 'wp-security-pack' ); ?></span>
</p>
<p class="description">
<?php esc_html_e( 'An effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.', 'wp-security-pack' ); ?>
<br><strong><?php esc_html_e( 'Warning:', 'wp-security-pack' ); ?></strong> <?php esc_html_e( 'Incorrect CSP can break your site. Test thoroughly and check browser console for violations. Leave empty to disable.', 'wp-security-pack' ); ?>
<strong><?php esc_html_e( 'Warning:', 'wp-security-pack' ); ?></strong> <?php esc_html_e( 'Incorrect CSP can break your site. Test thoroughly. Leave empty to disable.', 'wp-security-pack' ); ?>
</p>
</td>
</tr>
@@ -1661,10 +1633,7 @@ class WPSP_Admin {
<input type="text" name="wpsp_settings[security_headers][strict_transport_security]" id="header-strict_transport_security"
value="<?php echo esc_attr( $headers['strict_transport_security'] ?? 'max-age=31536000; includeSubDomains' ); ?>" class="large-text"
data-default="max-age=31536000; includeSubDomains" />
<p class="description">
<?php esc_html_e( 'HSTS tells browsers to only connect via HTTPS, preventing protocol downgrade attacks and cookie hijacking. Only sent over HTTPS connections.', 'wp-security-pack' ); ?>
<br><strong><?php esc_html_e( 'Note:', 'wp-security-pack' ); ?></strong> <?php esc_html_e( 'max-age is in seconds. 31536000 = 1 year. Use includeSubDomains to protect all subdomains.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Forces HTTPS. 31536000 = 1 year.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1720,9 +1689,7 @@ class WPSP_Admin {
<input type="hidden" name="wpsp_settings[wpsp_current_tab]" value="2fa" />
<div class="wpsp-section">
<h2><?php esc_html_e( 'Two-Factor Authentication', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'Two-factor authentication adds an extra layer of security by requiring a one-time code from your phone in addition to your password. Even if an attacker steals your password, they cannot log in without access to your authenticator app.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Requires a code from your phone app after password. Stops attackers even if they steal your password.', 'wp-security-pack' ); ?></p>
<?php if ( count( $users_with_2fa ) > 0 || $total_admins > 0 ) : ?>
<div class="wpsp-stats" style="margin: 15px 0;">
@@ -1757,7 +1724,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'two_factor_enforce_admin', false ) ); ?> />
<?php esc_html_e( 'Require 2FA for administrator accounts', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Administrators will be redirected to set up 2FA before they can access the dashboard.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Admins must set up 2FA to access dashboard.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -1765,7 +1732,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Compatible Authenticator Apps', 'wp-security-pack' ); ?></h2>
<p class="description"><?php esc_html_e( 'Any TOTP-compatible authenticator app will work. Popular options include:', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Any TOTP app works:', 'wp-security-pack' ); ?></p>
<ul style="list-style: disc; margin-left: 20px;">
<li><strong>Google Authenticator</strong> - <?php esc_html_e( 'iOS & Android', 'wp-security-pack' ); ?></li>
<li><strong>Authy</strong> - <?php esc_html_e( 'iOS, Android, Desktop (with cloud backup)', 'wp-security-pack' ); ?></li>
@@ -1797,7 +1764,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Backup Codes', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'When 2FA is set up, 10 backup codes are generated. These are one-time codes for emergency access if the authenticator app is unavailable.', 'wp-security-pack' ); ?>
<?php esc_html_e( '10 one-time backup codes are generated at setup.', 'wp-security-pack' ); ?>
</p>
<ul style="list-style: disc; margin-left: 20px; color: #666;">
<li><?php esc_html_e( 'Codes are shown ONCE at setup - users must save them immediately', 'wp-security-pack' ); ?></li>
@@ -1806,12 +1773,6 @@ class WPSP_Admin {
</ul>
</div>
<div class="wpsp-section">
<h2><?php esc_html_e( 'Privacy Note', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'QR codes are generated entirely in the browser using JavaScript - no data is sent to external servers. Your site URL and user email are included in the QR code to display properly in the authenticator app. Authentication secrets are generated locally and stored securely in your database.', 'wp-security-pack' ); ?>
</p>
</div>
<?php
}
@@ -1849,9 +1810,7 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'File Integrity Monitoring', 'wp-security-pack' ); ?></h2>
<p class="description">
<?php esc_html_e( 'Monitors WordPress core files (wp-admin, wp-includes, and root PHP files) by comparing them against official checksums from WordPress.org. Detects unauthorized modifications that could indicate a compromise.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Detects if core WordPress files have been modified. Catches hacked files.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
<th scope="row"><?php esc_html_e( 'Enable', 'wp-security-pack' ); ?></th>
@@ -1887,14 +1846,7 @@ class WPSP_Admin {
<?php if ( ! empty( $file_results['changes']['modified'] ) ) : ?>
<h3><?php esc_html_e( 'Modified Core Files', 'wp-security-pack' ); ?></h3>
<div class="notice notice-warning inline" style="margin: 10px 0;">
<p>
<?php esc_html_e( 'These files differ from the official WordPress distribution. This can happen after:', 'wp-security-pack' ); ?>
</p>
<ul style="list-style: disc; margin-left: 20px;">
<li><?php esc_html_e( 'A WordPress update (normal - re-run scan to update baseline)', 'wp-security-pack' ); ?></li>
<li><?php esc_html_e( 'Manual edits to core files (not recommended)', 'wp-security-pack' ); ?></li>
<li><?php esc_html_e( 'A security compromise (investigate immediately)', 'wp-security-pack' ); ?></li>
</ul>
<p><?php esc_html_e( 'Files differ from WordPress.org. Could be: WP update (normal), manual edit, or compromise.', 'wp-security-pack' ); ?></p>
</div>
<table class="widefat striped">
<thead>
@@ -1929,9 +1881,7 @@ class WPSP_Admin {
?>
<div class="wpsp-section">
<h2><?php esc_html_e( 'Malware Scanner', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description">
<?php esc_html_e( 'Scans PHP files in plugins, themes, and uploads for malicious code patterns like backdoors, web shells, and obfuscated code.', 'wp-security-pack' ); ?>
</p>
<p class="wpsp-description"><?php esc_html_e( 'Looks for backdoors, web shells, and suspicious code in plugins, themes, and uploads.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -1942,7 +1892,7 @@ class WPSP_Admin {
<?php checked( WP_Security_Pack::get_setting( 'malware_scan_enabled', true ) ); ?> />
<?php esc_html_e( 'Enable scheduled malware scanning', 'wp-security-pack' ); ?>
</label>
<p class="description"><?php esc_html_e( 'Runs automatically once per week. Manual scans can be run anytime.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Runs weekly. Manual scans anytime.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -1980,7 +1930,7 @@ class WPSP_Admin {
<h3><?php esc_html_e( 'Suspicious Files Found', 'wp-security-pack' ); ?></h3>
<div class="notice notice-warning inline" style="margin: 10px 0;">
<p>
<?php esc_html_e( 'These files contain suspicious code patterns. Review each finding - some may be false positives from obfuscated commercial plugins or legitimate security tools.', 'wp-security-pack' ); ?>
<?php esc_html_e( 'Review each finding - some may be false positives.', 'wp-security-pack' ); ?>
</p>
</div>
<table class="widefat striped">
@@ -2022,7 +1972,6 @@ class WPSP_Admin {
<button type="button" class="button" id="wpsp-clear-malware-results">
<?php esc_html_e( 'Clear Results', 'wp-security-pack' ); ?>
</button>
<span class="description" style="margin-left: 10px;"><?php esc_html_e( 'Clears the current findings. Next scan will re-check all files.', 'wp-security-pack' ); ?></span>
</p>
<?php elseif ( $malware_results['time'] > 0 ) : ?>
<div class="notice notice-success inline" style="margin: 10px 0;">
@@ -2035,7 +1984,6 @@ class WPSP_Admin {
if ( ! empty( $quarantined_files ) ) :
?>
<h3 style="margin-top: 20px;"><?php esc_html_e( 'Quarantined Files', 'wp-security-pack' ); ?></h3>
<p class="description"><?php esc_html_e( 'Files that have been isolated. They cannot execute from quarantine.', 'wp-security-pack' ); ?></p>
<table class="widefat striped" style="margin-top: 10px;">
<thead>
<tr>
@@ -2251,7 +2199,7 @@ class WPSP_Admin {
<input type="hidden" name="wpsp_settings[wpsp_current_tab]" value="logs" />
<div class="wpsp-section">
<h2><?php esc_html_e( 'Activity Log', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Monitor all security-related events including login attempts, lockouts, and blocked access. Use this log to identify potential threats and review user activity.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Login attempts, lockouts, and blocks. See who\'s trying to get in.', 'wp-security-pack' ); ?></p>
<h3><?php esc_html_e( 'Statistics (Last 30 Days)', 'wp-security-pack' ); ?></h3>
<div class="wpsp-stats">
@@ -2352,7 +2300,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Email Alerts', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Receive email notifications when suspicious activity is detected. Alerts are sent when multiple failed login attempts occur from the same IP.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -2378,7 +2325,6 @@ class WPSP_Admin {
<input type="number" name="wpsp_settings[email_alert_threshold]" min="1" max="50"
value="<?php echo esc_attr( WP_Security_Pack::get_setting( 'email_alert_threshold', 3 ) ); ?>" class="small-text" />
<?php esc_html_e( 'failed login attempts', 'wp-security-pack' ); ?>
<p class="description"><?php esc_html_e( 'Send an alert after this many failed login attempts from the same IP.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -2394,7 +2340,7 @@ class WPSP_Admin {
<input type="number" name="wpsp_settings[log_retention_days]" min="1" max="365"
value="<?php echo esc_attr( WP_Security_Pack::get_setting( 'log_retention_days', 30 ) ); ?>" class="small-text" />
<?php esc_html_e( 'days', 'wp-security-pack' ); ?>
<p class="description"><?php esc_html_e( 'Logs older than this will be automatically deleted via daily cron job.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Auto-deleted daily.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -2461,7 +2407,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Your Current IP', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Make sure your IP is whitelisted before enabling strict security features to avoid locking yourself out.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -2488,13 +2433,9 @@ class WPSP_Admin {
<?php if ( ! $is_whitelisted ) : ?>
<button type="button" class="button button-primary" id="wpsp-whitelist-my-ip"><?php esc_html_e( 'Whitelist My IP', 'wp-security-pack' ); ?></button>
<span id="wpsp-whitelist-status"></span>
<p class="description">
<?php esc_html_e( 'Adds your IP to the global whitelist (IP Control → IP Whitelist).', 'wp-security-pack' ); ?><br>
<?php esc_html_e( 'Whitelisted IPs bypass all security checks: login limits, lockouts, geo-blocking, and login access restrictions.', 'wp-security-pack' ); ?>
</p>
<p class="description"><?php esc_html_e( 'Whitelisted IPs bypass all security checks.', 'wp-security-pack' ); ?></p>
<?php else : ?>
<span style="color: green;">✓ <?php esc_html_e( 'Your IP is already in the global whitelist.', 'wp-security-pack' ); ?></span>
<p class="description"><?php esc_html_e( 'You bypass all security restrictions and cannot be locked out.', 'wp-security-pack' ); ?></p>
<?php endif; ?>
</td>
</tr>
@@ -2503,7 +2444,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Lockout Recovery', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'If you get locked out, use one of these methods to regain access.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -2524,7 +2464,6 @@ class WPSP_Admin {
<td>
<?php esc_html_e( 'Rename or delete the plugin folder via FTP:', 'wp-security-pack' ); ?>
<code>wp-content/plugins/wp-security-pack</code>
<p class="description"><?php esc_html_e( 'This disables the plugin and removes all blocks. Re-enable after logging in.', 'wp-security-pack' ); ?></p>
</td>
</tr>
<tr>
@@ -2554,7 +2493,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Session Management', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Manage user sessions across your site.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -2562,7 +2500,7 @@ class WPSP_Admin {
<td>
<button type="button" class="button" id="wpsp-force-logout-all"><?php esc_html_e( 'Logout All Users', 'wp-security-pack' ); ?></button>
<span id="wpsp-logout-status"></span>
<p class="description"><?php esc_html_e( 'Terminates all user sessions immediately. All users (including you) will need to log in again.', 'wp-security-pack' ); ?></p>
<p class="description"><?php esc_html_e( 'Everyone (including you) will need to log in again.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
@@ -2570,7 +2508,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'Import / Export Settings', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Backup your settings or transfer them to another site.', 'wp-security-pack' ); ?></p>
<table class="form-table">
<tr>
@@ -2594,7 +2531,6 @@ class WPSP_Admin {
<div class="wpsp-section">
<h2><?php esc_html_e( 'System Information', 'wp-security-pack' ); ?></h2>
<p class="wpsp-description"><?php esc_html_e( 'Technical details about your WordPress installation and plugin status.', 'wp-security-pack' ); ?></p>
<table class="widefat striped">
<tr>
@@ -2674,7 +2610,6 @@ class WPSP_Admin {
<th scope="row"><?php esc_html_e( 'Reset All Settings', 'wp-security-pack' ); ?></th>
<td>
<button type="button" class="button" id="wpsp-reset-settings" style="border-color: #d63638; color: #d63638;"><?php esc_html_e( 'Reset to Defaults', 'wp-security-pack' ); ?></button>
<p class="description"><?php esc_html_e( 'This will reset all plugin settings to their default values.', 'wp-security-pack' ); ?></p>
</td>
</tr>
</table>
wp-security-pack/includes/class-wpsp-two-factor.php
+1 -1
View File
@@ -270,7 +270,7 @@ class WPSP_Two_Factor {
?>
<div class="notice notice-warning" style="margin-bottom: 20px;">
<p><strong><?php esc_html_e( 'Two-Factor Authentication Required', 'wp-security-pack' ); ?></strong></p>
<p><?php esc_html_e( 'As an administrator, you are required to set up Two-Factor Authentication before you can access the dashboard.', 'wp-security-pack' ); ?></p>
<p><?php esc_html_e( 'You must set up 2FA to access the dashboard.', 'wp-security-pack' ); ?></p>
</div>
<?php
endif;