Title: NoHackMe Defender Author: Roman Published: 2024 年 6 月 3 日 Last modified: 2026 年 10 月 17 日 --- 搜索插件 ![](https://ps.w.org/nohackme-defender/assets/banner-772x250.jpg?rev=3096698) ![](https://ps.w.org/nohackme-defender/assets/icon-256x256.png?rev=3096698) # NoHackMe Defender 作者：[Roman](https://profiles.wordpress.org/needtome/) [下载](https://downloads.wordpress.org/plugin/nohackme-defender.1.1.14.zip) * [详情](https://cn.wordpress.org/plugins/nohackme-defender/#description) * [评价](https://cn.wordpress.org/plugins/nohackme-defender/#reviews) * [开发进展](https://cn.wordpress.org/plugins/nohackme-defender/#developers) [支持](https://wordpress.org/support/plugin/nohackme-defender/) ## 描述 The NoHackMe Defender plugin ensures the security of your WordPress site by blocking IP addresses when receiving suspicious requests, or when too many requests are received from a single IP over a certain period. The plugin offers comprehensive protection mechanisms including: * Hacking protection: Blocks IP addresses that send suspicious data. * Parsing protection: Prevents malicious parsing attempts on your website. * DoS protection: Stops denial-of-service attacks by limiting excessive requests. * Password brute force protection: Prevents repeated login attempts to guess passwords. Explore our instructional videos to see the NoHackMe Defender plugin in action and learn how to configure settings and manage blocked IP addresses efficiently: 1. [Protect Your WordPress Site for Free – Installing and Configuring NoHackMe Defender Plugin](https://youtu.be/l6LFvNn7RE8): A thorough guide on activating and configuring the NoHackMe Defender plugin, including its free version features. 2. [How to Protect Your Site from Hackers, Parsing, and DoS – Testing WordPress Plugin NoHackMe Defender](https://youtu.be/DqTvUfLmmGQ): Demonstrates the plugin’s effectiveness in blocking suspicious requests and securing your site. For more information and a live demonstration, visit our [Plugin Demo Page](https://needtome.com/nohackme/). Special thanks to our sponsors for supporting the development of this plugin: – [malinovsky.io](https://malinovsky.io) – [gloap.net](https://gloap.net) – [gloapm.com](https://gloapm.com)– [o-keto.com](https://o-keto.com) ## 屏幕截图 [⌊screenshot-1.png⌉⌊screenshot-1.png⌉[ screenshot-1.png [⌊screenshot-2.png⌉⌊screenshot-2.png⌉[ screenshot-2.png [⌊screenshot-3.png⌉⌊screenshot-3.png⌉[ screenshot-3.png [⌊screenshot-4.png⌉⌊screenshot-4.png⌉[ screenshot-4.png [⌊screenshot-5.png⌉⌊screenshot-5.png⌉[ screenshot-5.png [⌊screenshot-6.png⌉⌊screenshot-6.png⌉[ screenshot-6.png ## 常见问题 ### How does the plugin detect visitor IP addresses behind a reverse proxy? By default, the plugin uses the connection address from `REMOTE_ADDR` and ignores forwarded client-IP headers. To use `X-Forwarded-For`, explicitly configure your reverse proxy addresses before the NoHackMe Defender include in `wp-config.php`: ``` define( 'NOHACKME_DEFENDER_TRUSTED_PROXIES', array( '10.0.0.10', '2001:db8::10', '192.0.2.0/24' ) ); ``` Use only the exact IP addresses or narrow CIDR ranges of proxies you control. The proxy must overwrite or safely append `X-Forwarded-For`; the plugin ignores `HTTP_CLIENT_IP`. If your production proxy configuration is unknown, leave this setting undefined. ### Is the plugin fully available in one version? Yes. The plugin is now distributed as a single version with all functionality available without a paid upgrade. ### How can I support the plugin developer? If NoHackMe Defender helps protect your site, you can support further development via the donation links listed in the plugin settings page. ### Can the plugin show the country for a blocked IP? Yes. Add the Sypex Geo PHP API file `SxGeo.php` and the country database `SxGeo. dat` to the GeoIP directory under your WordPress uploads directory: `wp-content/ uploads/nohackme-defender/geo/`. Create the folders if they do not exist. If your site uses a custom uploads directory, use that directory instead of `wp-content/ uploads`. This location is outside the plugin, so plugin updates will not remove the files. For backward compatibility, the plugin also checks the old `wp-content/plugins/nohackme- defender/lib/geo/` folder. Both files must be present in the same directory. IP blocking works without GeoIP files, but the country is shown as unknown. Download the PHP API and Sypex Geo Country database from the [official Sypex Geo download page](https://sypexgeo.net/ru/download/). ### About the plugin developer You can download and view my portfolio in [Google Docs](https://docs.google.com/document/d/141cWx986ApRqlxEIb3GUHEGQ-US1c3KutbzRqr3osm8/edit?usp=sharing). Also, find me on [LinkedIn](https://www.linkedin.com/in/roman-klymenko-parad0x/). For website and WordPress plugin development inquiries, email [paraz0n3@gmail.com](https://cn.wordpress.org/plugins/nohackme-defender/paraz0n3@gmail.com?output_format=md). ## 评价 此插件暂无评价。 ## 贡献者及开发者 「NoHackMe Defender」是开源软件。 以下人员对此插件做出了贡献。 贡献者 * [ Roman ](https://profiles.wordpress.org/needtome/) 「NoHackMe Defender」插件已被翻译至 2 种本地化语言。 感谢[所有译者](https://translate.wordpress.org/projects/wp-plugins/nohackme-defender/contributors) 为本插件所做的贡献。 [帮助将「NoHackMe Defender」翻译成简体中文。](https://translate.wordpress.org/projects/wp-plugins/nohackme-defender) ### 对开发感兴趣吗? 您可以[浏览代码](https://plugins.trac.wordpress.org/browser/nohackme-defender/)， 查看[SVN仓库](https://plugins.svn.wordpress.org/nohackme-defender/)，或通过[RSS](https://plugins.trac.wordpress.org/log/nohackme-defender/?limit=100&mode=stop_on_copy&format=rss) 订阅[开发日志](https://plugins.trac.wordpress.org/log/nohackme-defender/)。 ## 更新日志 #### 1.1.14 * Decide the wp-admin exemption from the normalized request path only, so query strings such as ?next=/wp-admin/ no longer disable the early checks. Admin screens still skip rate limits and payload rules, but sensitive scanner paths stay blocked. * Store request counters by absolute minute and remove stale entries, so traffic from a previous hour can no longer trigger a ban; a request is now counted from 1. #### 1.1.13 * Run the early firewall when nohackme.php is included before ABSPATH is defined or from standalone PHP scripts that do not load WordPress; the firewall locates its storage from the plugin folder. Command-line scripts are skipped. #### 1.1.12 * Fix suspicious-path blocking being skipped when the client address cannot be determined, as intended in 1.1.10. * Return early when nohackme.php is loaded without WordPress (direct requests and standalone scripts) instead of terminating the script. #### 1.1.11 * Keep direct wp-config.php includes by standalone maintenance scripts from terminating; run the early firewall only when ABSPATH is available. * Keep firewall storage and Google/Yandex exception paths available to helper functions so blocks and crawler ranges use the configured uploads directory. #### 1.1.10 * Ignore the spoofable HTTP_CLIENT_IP header and trust forwarded client addresses only when the direct peer is an explicitly configured proxy. * Fail closed when a loopback proxy does not provide a usable trusted forwarding chain, preventing the proxy address from matching internal-IP exclusions. * Keep suspicious-path blocking active when the client address cannot be determined, without writing shared counters under an empty IP key. * Improve compatibility and output handling in the early request firewall. #### 1.1.9 * Store GeoIP files in the WordPress uploads directory so plugin updates do not remove them, while continuing to support the previous plugin folder. #### 1.1.8 * Verified compatibility with WordPress 7.1.3, including suspicious-path blocking and the English/Russian demonstrations. #### 1.1.7 * Tested with WordPress 7.1.2. #### 1.1.6 * Added a runtime safety guard that ignores overly broad short alphabetic payload rules such as `or` or `and`, preventing normal URLs like `/sailors/` from being blocked. * Existing active short alphabetic payload rules are now automatically marked inactive in the stored rules file during default-rule synchronization. * Removed the broad standalone `or` payload signature from default rules while keeping safer quoted SQL variants. * Added a “Разблокировать всех” button to the blocked IP admin page to clear all current IP blocks at once. #### 1.1.5 * Split suspicious request payload patterns and suspicious URL path patterns into two separate admin sections with independent URLs and submenu entries. * Added the Suspicious URL paths admin page for sensitive files, foreign CMS/framework fingerprints, admin panels, and service endpoints. * Added separate temporary protection toggles for payload/body scanning and suspicious URL path scanning. * Added per-rule Active checkboxes so individual rules can be temporarily disabled without deleting them. * Added per-row Delete buttons for both rule lists, making it clear that unused rules can be removed directly. * Disabled rules are preserved in the settings files and ignored by the runtime scanner until re-enabled. * Updated default-list synchronization so disabled default rules are not re-added as active duplicates. #### 1.1.4 * Added raw request body and decoded JSON scanning for REST, GraphQL, and other API-style POST/PUT/PATCH/DELETE requests. * Added request URI, query string, request parameters, and User-Agent scanning to close bypasses where suspicious paths or scanner signatures were not submitted as normal form parameters. * Added immediate blocking for sensitive scanner paths such as `.env`, `wp-config. php`, `composer.json`, backup/swap/SQL dump extensions, PHP-CGI probes, and exposed debug/runtime endpoints. * Added immediate blocking for high-confidence foreign CMS and framework scanner paths, including Drupal, Joomla, Magento, Laravel, Symfony, TYPO3, Umbraco, and Ghost fingerprints. * Added a missing-file probe counter that blocks IPs repeatedly requesting non- existent high-risk files such as executable script variants, backups, logs, archives, or config files. * Added new default suspicious fragments for REST batch abuse, GraphQL probes, PHP-CGI attempts, exposed configuration/debug paths, and additional SQL injection patterns. * Existing suspicious-fragment lists now receive missing default security signatures without removing custom entries. #### 1.1.2 * The plugin is now distributed as a single version without a separate premium/ free split. * Added a support block with donation links to the settings page. * Removed premium-only UI restrictions and related admin notices. #### 1.1.1 * Fixed deletion of blocked IPs from the middle of the list in the admin panel. * Added IPv6 support for blocked IPs, whitelists, range matching, and admin display. * Added buttons to update Google and Yandex crawler IP ranges from their official sources. * Improved admin update UX: buttons now show progress and reload the page after a successful update. * Added safer file locking for counters and ban files to reduce race conditions under concurrent requests. * Removed unnecessary unauthenticated AJAX actions for admin-only operations. #### 1.1.0 * Fixed issue with the IP whitelist functionality. * Added a page view counter for a single IP in 10 minutes to the Statistics section. * Updated the logic of page view counters for a single IP in 1 minute and 50 minutes in the Statistics section. #### 1.0.0 * Initial release: Includes hacking, parsing, DoS, and password brute force protection. ## 额外信息 * 版本 **1.1.14** * 最后更新：**7 小时前** * 活跃安装数量 **10+** * WordPress 版本 ** 6.0 或更高版本 ** * 已测试的最高版本为 **7.1.3** * PHP 版本 ** 7.4 或更高版本 ** * 语言 * [English (US)](https://wordpress.org/plugins/nohackme-defender/) 、 [Russian](https://ru.wordpress.org/plugins/nohackme-defender/) 和 [Ukrainian](https://uk.wordpress.org/plugins/nohackme-defender/). * [翻译成简体中文](https://translate.wordpress.org/projects/wp-plugins/nohackme-defender) * 标签 * [anti-hack](https://cn.wordpress.org/plugins/tags/anti-hack/)[firewall](https://cn.wordpress.org/plugins/tags/firewall/) [IP-blocking](https://cn.wordpress.org/plugins/tags/ip-blocking/)[protection](https://cn.wordpress.org/plugins/tags/protection/) [security](https://cn.wordpress.org/plugins/tags/security/) * [高级视图](https://cn.wordpress.org/plugins/nohackme-defender/advanced/) ## 评级 尚未提交反馈。 [您的评价](https://wordpress.org/support/plugin/nohackme-defender/reviews/#new-post) [查看全部评论](https://wordpress.org/support/plugin/nohackme-defender/reviews/) ## 贡献者 * [ Roman ](https://profiles.wordpress.org/needtome/) ## 支持 有话要说吗？是否需要帮助？ [查看支持论坛](https://wordpress.org/support/plugin/nohackme-defender/) ## 捐助 您愿意支持这个插件的发展吗? [ 捐助此插件 ](https://www.donationalerts.com/r/needtome)