菜单
MU-plugin that restricts wp-login.php and wp-admin/ to trusted IP ranges at the PHP level. Belt-and-suspenders alongside .htaccess whitelisting. Has a safety valve: if no trusted CIDRs are configured, all IPs are allowed (so you can't lock yourself out).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.
| name | admin-guard |
| description | MU-plugin that restricts wp-login.php and wp-admin/ to trusted IP ranges at the PHP level. Belt-and-suspenders alongside .htaccess whitelisting. Has a safety valve: if no trusted CIDRs are configured, all IPs are allowed (so you can't lock yourself out). |
| triggers | ["restrict admin access","whitelist admin IP","wp-admin IP restriction","block admin from outside","protect login page"] |
PHP-level restriction of wp-login.php and wp-admin/ to trusted IP ranges.
Runs at init priority 1 — before any plugin or theme code.
# 1. Set your trusted IPs first (CRITICAL — do this before deploying)
# Edit wp-content/mu-plugins/wp-arsenal-config.php:
# define('WP_ARSENAL_TRUSTED_CIDRS', ['YOUR_HOME_IP', 'YOUR_OFFICE_IP']);
# 2. Deploy
cp scripts/hardening/mu-plugins/admin-guard.php \
/path/to/wp-content/mu-plugins/
Always configure WP_ARSENAL_TRUSTED_CIDRS before deploying. The plugin
has a built-in safety valve: if no trusted CIDRs are set, all IPs are allowed
(so you can't lock yourself out), but this defeats the purpose.
| URL | Behaviour |
|---|---|
/wp-login.php | Trusted IPs only |
/wp-admin/*.php | Trusted IPs only |
/wp-admin/admin-ajax.php | Allowed from any IP (public themes use it) |
/wp-admin/admin-post.php | Allowed from any IP (form handlers) |
/wp-json/ (REST API) | Allowed from any IP (headless/API clients) |
| Public pages | Not affected |
define('WP_ARSENAL_TRUSTED_CIDRS', [
'203.0.113.', // Your home IP (first 3 octets)
'198.51.100.', // Your office IP
'127.0.0.1', // Localhost
'82.165.', // IONOS server monitoring (if on IONOS)
]);
If your home IP changes, use a VPN with a fixed exit IP, or:
TRUSTED_CIDRS/wp-admin (Zero Trust)wp-firewall.py with --allow-admin-ip YOUR_CURRENT_IP to update .htaccess rules quickly| Plugin | Scope | Trigger |
|---|---|---|
ip-blocker.php | Entire site blocked | IP in WP_ARSENAL_BLOCKED_CIDRS |
admin-guard.php | Admin area only | IP not in WP_ARSENAL_TRUSTED_CIDRS |
Use both together: ip-blocker for known-bad IPs, admin-guard to lock admin
to your known-good IPs.