Title: Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection Author: lunexiait Published: 2026 年 5 月 16 日 Last modified: 2026 年 9 月 13 日 --- 搜索插件 ![](https://ps.w.org/lunexia-htaccess-shield/assets/banner-772x250.png?rev=3693517) ![](https://ps.w.org/lunexia-htaccess-shield/assets/icon-256x256.png?rev=3693517) # Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection 作者：[lunexiait](https://profiles.wordpress.org/lunexiait/) [下载](https://downloads.wordpress.org/plugin/lunexia-htaccess-shield.3.2.2.zip) * [详情](https://cn.wordpress.org/plugins/lunexia-htaccess-shield/#description) * [评价](https://cn.wordpress.org/plugins/lunexia-htaccess-shield/#reviews) * [安装](https://cn.wordpress.org/plugins/lunexia-htaccess-shield/#installation) * [开发进展](https://cn.wordpress.org/plugins/lunexia-htaccess-shield/#developers) [支持](https://wordpress.org/support/plugin/lunexia-htaccess-shield/) ## 描述 **Lunexia Security & .htaccess Shield** is an all-in-one WordPress security suite engineered to defend your website against attacks, malicious bots, unauthorized login attempts, and malware infections. Combining proven **.htaccess server hardening**, an intelligent **Web Application Firewall (WAF)**, **Two-Factor Authentication ( 2FA / OTP login protection)**, **login brute force defense**, and a deep **malware scanner with 1-click quarantine**, Lunexia provides comprehensive website security that is ultra-lightweight, safe, and fully compatible with WordPress 7.0 Modern admin and PHP 8+. Whether you need rock-solid login protection, two-factor authentication, malware removal, or instant .htaccess security headers, Lunexia delivers enterprise-grade protection with zero bloat. ### 🛡️ Key Security Features: * **Two-Factor Authentication (2FA) & OTP Login Security**: Add time-based one- time password (OTP) verification for Administrators, Editors, and custom roles. Protect your login forms from credential stuffing and unauthorized access. * **Login Brute Force Protection**: Detect, limit, and automatically block malicious IP addresses attempting brute force login attacks. * **Web Application Firewall (WAF)**: Real-time inspection for SQL Injection (SQLi), Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Remote Code Execution( RCE) attempts without breaking page builders like Elementor or Gutenberg. * **Malware Scanner & Threat Detection**: Deep file integrity and heuristic scanner to detect webshells, backdoors, obfuscated base64 code, eval injections, and unauthorized core file modifications. * **1-Click Quarantine & Cleanup**: Instantly isolate infected files into a safe, non-executable quarantine vault with full 1-click restoration and permanent deletion controls. * **Automatic .htaccess Hardening**: Safely apply proven Apache/LiteSpeed security rules with automatic timestamped backups before every change. * **Admin Approval Workflow**: Require administrator approval for newly registered administrative and editor accounts before they can log in. * **Backend Access Control**: Restrict access to `wp-admin` and `wp-login.php` exclusively to trusted, whitelisted IP addresses. * **Security Headers Protection**: Automatically enforce Content Security Policy( CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and Referrer-Policy. * **Live Traffic Monitor & IP Reputation**: Real-time traffic surveillance tracking visitor requests, malicious bots, automated crawlers, and blocked threat origins. * **Modern WordPress 7.0 Ready**: Centered layout, high-DPI retina interface, and modern glassmorphic dashboard widgets. ### 🔒 Security Rules Included: * Disable directory browsing and file listing (`Options -Indexes`) * Protect `wp-config.php` database credentials and `.htaccess` configuration files * Block direct web access to sensitive files (`.bak`, `.sql`, `.log`, `.ini`, `. sh`, `.env`) * Disable XML-RPC (`xmlrpc.php`) to block pingback DDoS and brute force amplifications * Prevent unauthorized PHP script execution in the `wp-content/uploads/` directory * Block malicious query string injections, GLOBALS variable overrides, and script tags * Block author enumeration attacks (`?author=1`) to prevent username discovery * Enforce essential HTTP security headers (XSS Protection, No-Sniff, HSTS, Frame Guard) ### ⚡ Safe, Non-Destructive & Reliable: * Automatically creates a backup before applying any file modifications. * Uses native WordPress filesystem APIs for maximum server compatibility. * All generated rules are cleanly encapsulated in custom markers for 1-click restore. * Seamless compatibility with Elementor, Gutenberg, WooCommerce, and caching plugins. ### External Services This plugin connects to external services as follows: **Lunexia License Authority (api.lunexiait.com)** This plugin connects to the Lunexia central license server to validate commercial license authenticity, verify cryptographic Ed25519 tokens, and check domain bindings. This connection is used when activating, validating, or deactivating a license key in the plugin dashboard. * **Purpose**: Validates license authenticity, cryptographic tokens, and domain licensing. * **When it’s used**: When activating, validating, or deactivating an enterprise license. * **What data is sent**: License key, website URL/domain, verification nonces, PHP and WordPress version numbers. * **Service provider**: Lunexia IT (api.lunexiait.com) * **Terms of Service**: https://lunexiait.com/terms/ * **Privacy Policy**: https://lunexiait.com/privacy/ ## 安装 1. Upload the `lunexia-htaccess-shield` folder to the `/wp-content/plugins/` directory( or search for **Lunexia Security** in **Plugins > Add New**). 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Navigate to **Lunexia Security** in your WordPress admin menu. 4. Review and toggle your desired security rules and login protection features. 5. Click **Save & Apply Rules** to instantly harden your site. ## 常见问题 ### How does the Two-Factor Authentication (2FA) and Login Protection work? Lunexia adds OTP (one-time password) verification during login for selected user roles (such as Administrator and Editor). When enabled, users must enter a secure verification code sent to their registered email address before gaining dashboard access, effectively stopping unauthorized logins even if passwords are leaked. ### Does this plugin work with Elementor and Gutenberg? Yes! Lunexia includes intelligent page builder detection. Firewall inspection automatically accommodates Elementor editor previews, AJAX widget saving, and REST API publishing without false positives or 403 blocks. ### How does the Malware Quarantine Manager work? When the malware scanner detects a suspicious file or backdoor, you can quarantine it with a single click. The file is immediately moved into a secure, isolated quarantine directory with revoked execution permissions (`0400`) and blocked from direct browser access. You can restore the file to its original location or delete it permanently at any time. ### Is this plugin safe for my server? Yes. Lunexia automatically creates timestamped backups of your `.htaccess` file prior to applying any rule changes. If needed, you can restore your configuration with one click from the plugin dashboard. ### Does this replace other security plugins? Lunexia can be used as your primary lightweight security shield or alongside complementary tools. Its low memory footprint and server-level rules provide exceptional performance without slowing down your site. ## 评价 此插件暂无评价。 ## 贡献者及开发者 「Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA)& Malware Protection」是开源软件。 以下人员对此插件做出了贡献。 贡献者 * [ lunexiait ](https://profiles.wordpress.org/lunexiait/) [帮助将「Lunexia Security – .htaccess Shield, Firewall, Two Factor Authentication (2FA) & Malware Protection」翻译成简体中文。](https://translate.wordpress.org/projects/wp-plugins/lunexia-htaccess-shield) ### 对开发感兴趣吗? 您可以[浏览代码](https://plugins.trac.wordpress.org/browser/lunexia-htaccess-shield/)， 查看[SVN仓库](https://plugins.svn.wordpress.org/lunexia-htaccess-shield/)，或通过 [RSS](https://plugins.trac.wordpress.org/log/lunexia-htaccess-shield/?limit=100&mode=stop_on_copy&format=rss) 订阅[开发日志](https://plugins.trac.wordpress.org/log/lunexia-htaccess-shield/)。 ## 更新日志 #### 3.2.2 * Enhanced dual-mode cryptographic token verification supporting both 64-byte Sodium Ed25519 and 32-byte HMAC-SHA256 signatures. * Added staging and local domain normalization (.local, .test, localhost) for seamless local development. * Fixed Lifetime enterprise license status persistence and renewal status indicators. * Polished Midnight Obsidian administrative interface with dynamic cache-busting asset versions. #### 3.2.1 * Upgraded license authority client to `api.lunexiait.com` with Ed25519 cryptographic token verification and anti-tampering protection. * Added 1-click malware quarantine, file restoration, and permanent file deletion actions. * Added live Quarantine Manager dashboard table displaying isolated files and file metadata. * Fixed Elementor editor preview canvas and REST publishing false positives in Web Application Firewall (WAF). * Fixed HTTP method restrictions to preserve REST API and Elementor `DELETE` operations. * Added official high-DPI WordPress.org banners (1544×500, 772×250) and square icons (256×256, 128×128). * SEO optimized title, keywords, and description for security, login, two factor, firewall, and malware searches. #### 3.0.0 * Redesigned dashboard with four separate protection score widgets and modern admin visuals. * Added premium badges to Firewall, Malware Scan, and Advanced Settings navigation tabs. * Added Security Intelligence and Threat Center dashboards for malware, reputation, and threat intelligence visibility. * Centered plugin layout with an 80% width wrapper for a cleaner WordPress 7.0 admin experience. ## 额外信息 * 版本 **3.2.2** * 最后更新：**3 周前** * 活跃安装数量 **不到10** * WordPress 版本 ** 5.0 或更高版本 ** * 已测试的最高版本为 **7.0.7** * PHP 版本 ** 7.4 或更高版本 ** * 语言 * [English (US)](https://wordpress.org/plugins/lunexia-htaccess-shield/) * 标签 * [firewall](https://cn.wordpress.org/plugins/tags/firewall/)[login](https://cn.wordpress.org/plugins/tags/login/) [malware](https://cn.wordpress.org/plugins/tags/malware/)[security](https://cn.wordpress.org/plugins/tags/security/) [two factor](https://cn.wordpress.org/plugins/tags/two-factor/) * [高级视图](https://cn.wordpress.org/plugins/lunexia-htaccess-shield/advanced/) ## 评级 尚未提交反馈。 [您的评价](https://wordpress.org/support/plugin/lunexia-htaccess-shield/reviews/#new-post) [查看全部评论](https://wordpress.org/support/plugin/lunexia-htaccess-shield/reviews/) ## 贡献者 * [ lunexiait ](https://profiles.wordpress.org/lunexiait/) ## 支持 有话要说吗？是否需要帮助？ [查看支持论坛](https://wordpress.org/support/plugin/lunexia-htaccess-shield/)