Title: Qevix Shield – 2FA, Hide Login, Firewall, File Security & Malware Scanner Author: qevixlabs Published: 2026 年 7 月 31 日 Last modified: 2026 年 8 月 16 日 --- 搜索插件 ![](https://ps.w.org/qevix-shield/assets/banner-772x250.png?rev=3630599) ![](https://ps.w.org/qevix-shield/assets/icon-256x256.png?rev=3633311) # Qevix Shield – 2FA, Hide Login, Firewall, File Security & Malware Scanner 作者：[qevixlabs](https://profiles.wordpress.org/qevixlabs/) [下载](https://downloads.wordpress.org/plugin/qevix-shield.1.1.4.zip) * [详情](https://cn.wordpress.org/plugins/qevix-shield/#description) * [评价](https://cn.wordpress.org/plugins/qevix-shield/#reviews) * [安装](https://cn.wordpress.org/plugins/qevix-shield/#installation) * [开发进展](https://cn.wordpress.org/plugins/qevix-shield/#developers) [支持](https://wordpress.org/support/plugin/qevix-shield/) ## 描述 Qevix Shield protects the parts of a WordPress site that attackers commonly target first: the login page, XML-RPC, files, and URLs that can reveal information about your site. It can help stop brute-force attacks, add two-factor authentication and reCAPTCHA, scan files for malware, protect sensitive files, and record blocked activity in a searchable log. Important events can also be sent to administrators by email. Qevix Shield is safe to activate. Activation does not change how your site works. All security protections are off until you enable them, so you can turn them on one at a time and check the result. The activity log starts automatically, but it only records activity and does not change your site. #### Why Qevix Shield * **Safe to activate.** All security protections are off by default. Turn them on one at a time so you can see exactly what each protection does. * **Easy recovery.** A safe mode in `wp-config.php` can temporarily disable Qevix Shield if you ever lock yourself out. reCAPTCHA keys must pass a test before reCAPTCHA can be enabled. 2FA includes recovery codes and an admin reset. Login lockouts are temporary. * **One plugin for your security needs.** Includes Hide Login, brute-force protection, 2FA, reCAPTCHA, password rules, XML-RPC protection, malware scanning, file and server protection, firewall, and activity logging. * **See what is happening.** Logins, blocked requests, and admin actions appear in a searchable activity log. You can export the log to CSV. Important events can be grouped into one email instead of sending many separate emails. * **Designed to be lightweight.** With all protections enabled, response times are intended to remain close to the site without the plugin. Visitors do not have to wait for an external security service. * **Works with other plugins.** Qevix Shield does not modify or replace other plugins’ code. WooCommerce, membership plugins, and front-end login pages can continue to work, including when Hide Login is enabled. * **Free features.** All features listed above are included for free. No account, license key, trial, or expiring feature is required. The optional Pro add-on adds additional features; it does not unlock features that are already part of the free plugin. #### Login Protection * **Hide Login:** Move the WordPress login page from `/wp-login.php` to a custom login URL. This is off by default. * Choose what blocked visitors see: a 404 page, your homepage, or a custom redirect. * A honeypot field helps block simple bots without affecting normal visitors. * Limit failed login attempts and temporarily block an IP address after too many failed attempts. * Add trusted IP addresses or CIDR ranges so they are not rate-limited or blocked. #### Two-Factor Authentication (2FA) * Use one-time codes from popular authenticator apps such as Google Authenticator, Authy, 1Password, and similar apps. * Set up 2FA separately for each user by scanning a QR code and confirming a code. * Get recovery codes when setting up 2FA. You can download them and use them if you lose your phone. An administrator can also reset 2FA. * Require 2FA for the user roles you choose. Users who are required to use 2FA will be guided through setup before they can continue. * Protect XML-RPC logins for 2FA users by requiring the 2FA code or blocking XML- RPC password logins. Application passwords are not affected. #### reCAPTCHA * Add Google reCAPTCHA to login, registration, and lost-password forms. * Choose between reCAPTCHA v2 (the “I’m not a robot” checkbox) and invisible reCAPTCHA v3. * Protect WooCommerce My Account and checkout forms too. * Developers can add the same protection to other plugin forms using a hook. * reCAPTCHA v3 lets you set a score threshold. You can also enable an email fallback so a genuine user who gets a low score can receive a one-time sign-in link. * Test your reCAPTCHA keys before enabling the protection. This helps prevent incorrect keys from breaking login. * If Google is temporarily unavailable, reCAPTCHA fails open so an outage does not lock users out. #### Password Security * Set a minimum password length. * Require uppercase letters, lowercase letters, numbers, and symbols. * Prevent users from using their username or email address as their password. #### XML-RPC Protection * Disable all XML-RPC methods or disable pingbacks only. * Record every XML-RPC request, including the method and whether it was allowed or blocked. #### Malware Scanner * Scan WordPress core files, plugins, themes, and uploads. Choose which areas to scan. * Compare WordPress core files and plugins from WordPress.org with their official checksums to detect modified files. * Use a malware pattern scanner to check files that cannot be verified with checksums, including themes, uploads, premium plugins, and modified files. * The scanner only reports what it finds. It does not automatically change or delete files. #### File & Server Security * Block direct access to sensitive files such as `.env`, `.git`, `wp-config.php`, and other protected files. * Block access to backup files and database dumps such as `.sql`, `.bak`, `.tar. gz`, and `.wpress`. * Add your own filenames or `*.extension` patterns to block. * Disable directory listing and PHP execution inside the uploads folder. * Qevix Shield can add the required Apache `.htaccess` rules and show the equivalent nginx rules for manual setup. * Hide the WordPress version, REST API discovery links, and identifying server headers. * Block author and user enumeration. * A lightweight firewall helps block common SQL injection, XSS, file inclusion, and command injection attempts, as well as known scanner user agents. #### Sessions, Activity Log & Dashboard * Users can see and end their own active login sessions. * Resetting a password logs out the other sessions for that account. * The activity log records logins, admin actions, and blocked requests, including who, what, when, and where. * Search, filter, and export the activity log to CSV. * Choose how long activity records are kept. * Important events can be emailed to administrators as grouped summaries. * A WordPress dashboard widget shows threats blocked during the last 24 hours and suggests the next protection to enable. * Give selected WordPress roles permission to manage Qevix Shield or view it in read-only mode without giving them full administrator settings access. #### Qevix Shield Pro Qevix Shield is complete on its own, and all features listed above are free. The optional Pro add-on, sold at qevixlabs.com, adds additional features for what happens after a threat is detected. * **Malware cleanup and deeper scanning** — quarantine or delete infected files, dismiss reviewed results, use additional web-shell and backdoor signatures, detect suspicious cron jobs and administrator accounts, scan the database for injected content, and run scheduled daily or weekly scans. * **Leaked-password protection** — check passwords against the Have I Been Pwned database in a privacy-preserving way, block common passwords, set password expiry, prevent password reuse, and force password resets. * **Advanced login blocking** — permanently block IP addresses, filter user agents, and automatically block repeat offenders. * **More alert options** — send grouped alerts through SMS, WhatsApp, Slack, Discord, or webhooks. * **Advanced sessions and access control** — view users’ sessions from an admin screen, enforce idle timeouts, and use WP-CLI commands. * **Additional 2FA and XML-RPC options** — trusted devices, emailed backup codes, and more detailed XML-RPC controls. #### Learn More Every setting has its own screen with a “?” tip explaining the option. For a full walkthrough, including screenshots, feature comparisons, and common questions, see the plugin’s home page: [Qevix Shield on qevixlabs.com](https://qevixlabs.com/products/qevix-shield/). ### External services Qevix Shield does not contact external services by default. Two optional features use external services only after you configure them. **Google reCAPTCHA** — Used only when you enable reCAPTCHA and enter your own Google keys. The protected login page loads Google’s reCAPTCHA script. Each protected attempt sends the reCAPTCHA token, your secret key, and the visitor’s IP address to Google’s verification service (`https://www.google.com/recaptcha/api/siteverify`). The “Test keys” button also contacts Google. Provided by Google: [terms](https://policies.google.com/terms), [privacy policy](https://policies.google.com/privacy). **WordPress.org checksums API** — Used when you run a malware scan. Qevix Shield gets official checksums to identify genuine files and modified files. For WordPress core, it uses WordPress’s `get_core_checksums()` function, which contacts` api.wordpress.org` and sends your WordPress version and locale. For plugins, it gets public checksum information from WordPress.org. Only the plugin slug and version are included in the request. Results are cached for seven days. Plugins without a checksum manifest, such as premium or custom plugins, are scanned normally. Provided by WordPress.org: [privacy policy](https://wordpress.org/about/privacy/). Built-in email alerts use your site’s own email configuration. No third-party email service is required. The other alert channels, such as Slack, Discord, webhooks, SMS, and WhatsApp, and the Have I Been Pwned password check are part of the separate Qevix Shield Pro add- on. Audit logs, lockout records, 2FA secrets, and settings remain in your site’s own database. ## 屏幕截图 [⌊Dashboard showing login attempts, IP lockouts, malware status, password status, threats blocked in the last 24 hours, and recent activity.⌉⌊Dashboard showing login attempts, IP lockouts, malware status, password status, threats blocked in the last 24 hours, and recent activity.⌉[ Dashboard showing login attempts, IP lockouts, malware status, password status, threats blocked in the last 24 hours, and recent activity. [⌊Activity Log showing logins, admin actions, and blocked requests. The log can be searched, filtered, and exported to CSV.⌉⌊Activity Log showing logins, admin actions, and blocked requests. The log can be searched, filtered, and exported to CSV.⌉[ Activity Log showing logins, admin actions, and blocked requests. The log can be searched, filtered, and exported to CSV. [⌊Login Protection for limiting failed logins, temporarily blocking IPs, and allowing trusted IPs or CIDR ranges.⌉⌊Login Protection for limiting failed logins, temporarily blocking IPs, and allowing trusted IPs or CIDR ranges.⌉[ Login Protection for limiting failed logins, temporarily blocking IPs, and allowing trusted IPs or CIDR ranges. [⌊Hide Login for changing the default /wp-login.php URL and choosing what blocked visitors see.⌉⌊Hide Login for changing the default /wp-login.php URL and choosing what blocked visitors see.⌉[ Hide Login for changing the default `/wp-login.php` URL and choosing what blocked visitors see. [⌊When the login is hidden, logged-out visitors who open /wp-admin/ receive a 404 page instead of a login form.⌉⌊When the login is hidden, logged-out visitors who open /wp-admin/ receive a 404 page instead of a login form.⌉[ When the login is hidden, logged-out visitors who open `/wp-admin/` receive a 404 page instead of a login form. [⌊Two-Factor Authentication setup using a QR code and authenticator app.⌉⌊Two-Factor Authentication setup using a QR code and authenticator app.⌉[ Two-Factor Authentication setup using a QR code and authenticator app. [⌊Ten one-time recovery codes that can be downloaded and stored safely.⌉⌊Ten one- time recovery codes that can be downloaded and stored safely.⌉[ Ten one-time recovery codes that can be downloaded and stored safely. [⌊Login challenge requiring the authenticator code or a recovery code after the password.⌉⌊Login challenge requiring the authenticator code or a recovery code after the password.⌉[ Login challenge requiring the authenticator code or a recovery code after the password. [⌊reCAPTCHA settings with v2 checkbox or invisible v3 scoring, including the required key test.⌉⌊reCAPTCHA settings with v2 checkbox or invisible v3 scoring, including the required key test.⌉[ reCAPTCHA settings with v2 checkbox or invisible v3 scoring, including the required key test. [⌊reCAPTCHA checkbox displayed on the WordPress login form.⌉⌊reCAPTCHA checkbox displayed on the WordPress login form.⌉[ reCAPTCHA checkbox displayed on the WordPress login form. [⌊Password Security settings for minimum length, character requirements, and password restrictions.⌉⌊Password Security settings for minimum length, character requirements, and password restrictions.⌉[ Password Security settings for minimum length, character requirements, and password restrictions. [⌊Password expiry, password reuse prevention, and forced password reset settings.⌉⌊ Password expiry, password reuse prevention, and forced password reset settings.⌉[ Password expiry, password reuse prevention, and forced password reset settings. [⌊Malware Scanner for checking WordPress core, plugins, themes, and uploads.⌉⌊Malware Scanner for checking WordPress core, plugins, themes, and uploads.⌉[ Malware Scanner for checking WordPress core, plugins, themes, and uploads. [⌊Malware scan results showing the severity, file location, and reason for each finding.⌉⌊Malware scan results showing the severity, file location, and reason for each finding.⌉[ Malware scan results showing the severity, file location, and reason for each finding. [⌊File Security for blocking access to sensitive files, backups, database dumps, and custom file patterns.⌉⌊File Security for blocking access to sensitive files, backups, database dumps, and custom file patterns.⌉[ File Security for blocking access to sensitive files, backups, database dumps, and custom file patterns. [⌊Security settings for hiding version information and blocking common SQL injection, XSS, traversal, and other attack patterns.⌉⌊Security settings for hiding version information and blocking common SQL injection, XSS, traversal, and other attack patterns.⌉[ Security settings for hiding version information and blocking common SQL injection, XSS, traversal, and other attack patterns. [⌊XML-RPC Protection for disabling XML-RPC methods or pingbacks and recording requests.⌉⌊ XML-RPC Protection for disabling XML-RPC methods or pingbacks and recording requests .⌉[ XML-RPC Protection for disabling XML-RPC methods or pingbacks and recording requests. [⌊Sessions showing signed-in devices with browser, IP address, and last activity, with the option to end sessions.⌉⌊Sessions showing signed-in devices with browser, IP address, and last activity, with the option to end sessions.⌉[ Sessions showing signed-in devices with browser, IP address, and last activity, with the option to end sessions. [⌊A list of active user sessions so unfamiliar sessions can be found and ended.⌉⌊ A list of active user sessions so unfamiliar sessions can be found and ended.⌉[ A list of active user sessions so unfamiliar sessions can be found and ended. [⌊Email notification settings for important security events.⌉⌊Email notification settings for important security events.⌉[ Email notification settings for important security events. [⌊Optional SMS or WhatsApp alerts through Twilio or the WhatsApp Cloud API.⌉⌊Optional SMS or WhatsApp alerts through Twilio or the WhatsApp Cloud API.⌉[ Optional SMS or WhatsApp alerts through Twilio or the WhatsApp Cloud API. [⌊Optional Slack, Discord, or webhook alerts.⌉⌊Optional Slack, Discord, or webhook alerts.⌉[ Optional Slack, Discord, or webhook alerts. [⌊General settings for roles, activity-log retention, and uninstall behavior.⌉⌊General settings for roles, activity-log retention, and uninstall behavior.⌉[ General settings for roles, activity-log retention, and uninstall behavior. [⌊A diagnostic report that removes secrets before being sent to the support team.⌉⌊ A diagnostic report that removes secrets before being sent to the support team.⌉[ A diagnostic report that removes secrets before being sent to the support team. ## 安装 1. Upload the `qevix-shield` folder to `/wp-content/plugins/`, or install Qevix Shield from the WordPress Plugins screen. 2. Activate the plugin. 3. Go to **Qevix Shield Settings**. 4. Turn on the protections you want, one at a time. ## 常见问题 ### Is everything really free? Yes. Every feature listed on this page is available after installation. There is no account, license key, trial, expiry, or locked setting. The optional Pro add-on adds separate features. It does not unlock features that are already included in the free plugin. ### Do I need to configure anything after activating? Only the protections you want to use. Qevix Shield does not change your site when you activate it. Turn on each protection from its settings screen when you are ready. The activity log starts recording activity immediately, but it does not change your site. ### Will it slow down my site? Qevix Shield is designed to be lightweight. With all protections enabled, response times are intended to stay close to the same site without the plugin. Visitors do not need to wait for an external security service. ### Will it lock me out of my own site? Qevix Shield is designed to prevent this. Login rate limits and IP lockouts apply only to failed login attempts and are temporary. You can also add your IP address to the whitelist. Hide Login is off by default. If you enable it, save or bookmark your new login URL. If you do get locked out, you can use the recovery method below. ### I’ve locked myself out. How do I recover? Add this line to `wp-config.php`: ``` define( 'QEVIX_SHIELD_SAFE_MODE', true ); ``` This temporarily disables Qevix Shield protections without changing your saved settings. You can then log in, fix the problem, and remove the line. This works even when you cannot access the WordPress dashboard because `wp-config. php` loads before the plugin. One exception: server rules already added to `.htaccess` or nginx are enforced by the web server. If necessary, remove or disable those rules manually. ### Does it work with WooCommerce and plugins that have their own login pages? Yes. WooCommerce, membership plugins, LMS plugins, and page-builder login widgets can continue to use their own login pages. Hide Login only changes the standard WordPress login URL, so these separate login pages can continue to work. ### I use the Pro add-on. Do the versions need to match? No. The free plugin and Pro add-on have separate version numbers. They are released as a pair, but their version numbers may be different. Keeping both updated is recommended. If the versions become too different, Pro will show a notice telling you which one needs to be updated. ## 评价 ![](https://secure.gravatar.com/avatar/b05960297a28bc5d22511fe4a6ff5e894040eeb1c50b17706e586440b7b04707? s=60&d=retro&r=g) ### 󠀁[Simple and exactly what needed](https://wordpress.org/support/topic/simple-and-exactly-what-needed/)󠁿 [nirajkarki](https://profiles.wordpress.org/nirajkarki/) 2026 年 8 月 5 日 The setup was quick, and features like login protection, two factor authentication with reCAPTCHA made my web more secure. It’s lightweight, easy to use – I will recommended it! [ 阅读所有1条评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/) ## 贡献者及开发者 「Qevix Shield – 2FA, Hide Login, Firewall, File Security & Malware Scanner」是开 源软件。 以下人员对此插件做出了贡献。 贡献者 * [ qevixlabs ](https://profiles.wordpress.org/qevixlabs/) [帮助将「Qevix Shield – 2FA, Hide Login, Firewall, File Security & Malware Scanner」翻译成简体中文。](https://translate.wordpress.org/projects/wp-plugins/qevix-shield) ### 对开发感兴趣吗? 您可以[浏览代码](https://plugins.trac.wordpress.org/browser/qevix-shield/)，查看 [SVN仓库](https://plugins.svn.wordpress.org/qevix-shield/)，或通过[RSS](https://plugins.trac.wordpress.org/log/qevix-shield/?limit=100&mode=stop_on_copy&format=rss) 订阅[开发日志](https://plugins.trac.wordpress.org/log/qevix-shield/)。 ## 更新日志 #### 1.1.4 * Tested with WordPress 7.1. No settings, defaults, or protection behavior changed. * Confirmed compatibility with WordPress 7.1 changes that could affect plugins. Qevix Shield does not modify the editor, image processing, toolbar, or jQuery. * Confirmed that the new WordPress Abilities API REST routes follow the same REST API authentication rules. * Rewrote this listing in plainer English, and documented the WordPress.org checksums API under External services. * No settings were added, removed, renamed, or changed. #### 1.1.3 * The Activity Log now uses simple English names such as “Signed in”, “Idle session ended”, and “Sensitive file blocked — .env”. * Severity and status are displayed consistently across the plugin. * Fixed dashboard recommendations that could appear before the related protection was actually active. * Fixed the Password Policy status showing “Strong” when the password protection was disabled. * Added clear limits to several numeric settings so invalid values are caught while entering them. * Disabled settings that cannot work while their main protection is turned off. * Fixed the Login Protection status so it no longer says “Enforcing” when no login protection feature is active. * Updated the rate-limit example to use the values currently configured by the site owner. * Empty values in activity and session tables now show an em dash instead of a blank space. * Fixed repeated HTML IDs on Malware Scanner and 2FA forms. * No settings were added, removed, renamed, or changed. #### 1.1.2 * Fixed the Enable 2FA switch so turning it off completely disables 2FA enforcement. * Existing 2FA enrolments are kept, so turning 2FA back on restores them without requiring users to set it up again. #### 1.1.1 * Now supports WordPress 6.5 and PHP 7.2. No other behavior changed. #### 1.1.0 * Redesigned the WordPress admin screens. * Replaced plain checkboxes with switches for on/off settings. * Added status indicators showing the current state of each protection. * Settings that cannot work because another protection is off are now disabled until they can be used. * Fixed the reCAPTCHA key test so it remains available when reCAPTCHA is disabled. * Fixed the reCAPTCHA v2 key test so it waits for Google’s script to load before showing the checkbox. * Moved notices to one consistent location on each screen. * Improved the 2FA recovery-code section. * Moved the Activity Log into its own screen. * Made the Sessions list consistent across the plugin. * Renamed the login-hiding screen to “Hide Login” everywhere. * No settings or saved values were changed. #### 1.0.0 * Initial release. ## 额外信息 * 版本 **1.1.4** * 最后更新：**4 天前** * 活跃安装数量 **不到10** * WordPress 版本 ** 6.5 或更高版本 ** * 已测试的最高版本为 **7.1** * PHP 版本 ** 7.2 或更高版本 ** * 语言 * [English (US)](https://wordpress.org/plugins/qevix-shield/) * 标签 * [firewall](https://cn.wordpress.org/plugins/tags/firewall/)[malware scanner](https://cn.wordpress.org/plugins/tags/malware-scanner/) [recaptcha](https://cn.wordpress.org/plugins/tags/recaptcha/)[security](https://cn.wordpress.org/plugins/tags/security/) [two factor authentication](https://cn.wordpress.org/plugins/tags/two-factor-authentication/) * [高级视图](https://cn.wordpress.org/plugins/qevix-shield/advanced/) ## 评级 5 星（最高 5 星）。 * [ 1 条 5 星评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/?filter=5) * [ 0 条 4 星评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/?filter=4) * [ 0 条 3 星评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/?filter=3) * [ 0 条 2 星评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/?filter=2) * [ 0 条 1 星评价 ](https://wordpress.org/support/plugin/qevix-shield/reviews/?filter=1) [您的评价](https://wordpress.org/support/plugin/qevix-shield/reviews/#new-post) [查看全部评论](https://wordpress.org/support/plugin/qevix-shield/reviews/) ## 贡献者 * [ qevixlabs ](https://profiles.wordpress.org/qevixlabs/) ## 支持 有话要说吗？是否需要帮助？ [查看支持论坛](https://wordpress.org/support/plugin/qevix-shield/)