Beschreibung

For over 8 years Security Ninja has helped thousands site owners like you to feel safe. Run 50+ security tests in an instant & discover issues you didn’t even know existed. Help yourself now with Ninja’s simplicity & ease of use.

Automatically block 600 million bad IPs with one click! Security Ninja Pro Cloud Firewall will help you stay one step ahead of bad guys by using the collective know-how of millions of attacked sites, and ban bad guys before they even open your site.

Read more about Pro version on Security Ninja site or give us a shout on Twitter @WPSecurityNinja.

perform 50+ security tests with one click
Security Ninja does not make any changes – it’s your site, you have full control
check your site for security vulnerabilities, issues & holes
take preventive measures against attacks
don’t let script kiddies hack your site
prevent 0-day exploit attacks
optimize and speed-up your database
every test is explained, documented and instructions provided on how to fix problems
tests include:
- brute-force attack on user accounts to test password strength
- numerous installation parameters tests
- file permissions
- version hiding
- 0-day exploits tests
- debug and auto-update modes tests
- database configuration tests
- Apache and PHP related tests
- WP options tests
complete list of tests:
- Check if WordPress core is up to date
- Check if automatic WordPress core updates are enabled
- Check if plugins are up to date
- Check if there are deactivated plugins
- Check if active plugins have been updated in the last 12 months
- Check if active plugins are compatible with your version of WP
- Check if themes are up to date
- Check if there are any deactivated themes
- Check if full WordPress version info is revealed in page’s meta data
- Check if readme.html file is accessible via HTTP on the default location
- Check if license.txt file is accessible via HTTP on the default location
- Check if REST API links are displayed in page’s meta data
- Check the PHP version
- Check the MySQL version
- Check if server response headers contain detailed PHP version info
- Check if expose_php PHP directive is turned off
- Check if user with username „admin“ and administrator privileges exists
- Check if „anyone can register“ option is enabled
- Check user’s password strength with a brute-force attack
- Check for display of unnecessary information on failed login attempts
- Check if database table prefix is the default one
- Check if security keys and salts have proper values
- Check the age of security keys and salts
- Test the strength of WordPress database password
- Check if general debug mode is enabled
- Check if database debug mode is enabled
- Check if JavaScript debug mode is enabled
- Check if display_errors PHP directive is turned off
- Check if WordPress installation address is the same as the site address
- Check if wp-config.php file has the right permissions (chmod) set
- Check if install.php file is accessible via HTTP on the default location
- Check if upgrade.php file is accessible via HTTP on the default location
- Check if register_globals PHP directive is turned off
- Check if PHP safe mode is disabled
- Check if allow_url_include PHP directive is turned off
- Check if plugins/themes file editor is enabled
- Check if uploads folder is browsable by browsers
- Test if user with ID “1” and administrator role exists
- Check if Windows Live Writer link is present in pages’ header data
- Check if wp-config.php is present on the default location
- Check if MySQL server is connectable from outside with the WP user
- Check if EditURI link is present in pages’ header data
- Check if TimThumb script is used in the active theme
- Check if the server is vulnerable to the Shellshock bug #6271
- Check if the server is vulnerable to the Shellshock bug #7169
- Check if admin interface is delivered via SSL
- Check if MySQL account used by WordPress has too many permissions
- Test if a list of usernames can be fetched by looping through user IDs on http://siteurl.com/?author={ID}
- Check if server response headers contain Strict-Transport-Security.
- Check if server response headers contain X-XSS-Protection.
- Check if server response headers contain X-Frame-Options.
- Check if server response headers contain X-Content-Type-Options.

Security Ninja PRO has seven additional modules: Cloud Firewall, Block Suspicious Page Requests, Country Blocking, Core Scanner, Malware Scanner, Auto Fixer, Events Logger & Scheduled Scanner. They provide an all-in-one security solution for any site. With premium support and continuous updates Security Ninja Pro is a perfect tool to keep your site safe. See what the PRO version offers

Remember to add your suggestions to https://trello.com/b/6qxtAlzY/wp-security-ninja-public-roadmap

What others say about the plugin

License info

jQuery Cookie Plugin, Copyright 2013 Klaus Hartl

Screenshots

Fast & easy to understand interface
Security Ninja test results are simple and easy to read
Every test has a detailed explanation and instructions on how to fix the problem

Installation

Follow the usual routine;

Open WordPress admin, go to Plugins, click Add New
Enter „Security Ninja“ in search and hit Enter
Plugin will show up as the first on the list, click „Install Now“
Activate & go to Tools – Security Ninja to make your site more secure

Or if needed, upload manually;

Download the plugin.
Unzip it and upload to wp-content/plugin/
Open WordPress admin – Plugins and click „Activate“ next to the plugin
Activate & go to Tools – Security Ninja to make your site more secure

FAQ

Who is this plugin for?

For anyone who wants to make their site more secure and prevent downtime due to hackers

Will this plugin slow my site down?

Absolutely not. You may experience a slight slow down while tests are being run but that takes less than a minute.

Will it work on my theme?

Sure! Security Ninja works with all themes.

What changes will Security Ninja make to my site?

None! Security Ninja will just give you the test results and suggest corrective measures with precise instruction. It will not make any changes to your site.

Is this plugin safe to use?

Of course. It’s a reporting-only tool. It doesn’t make any changes to your site.

Is this plugin legal to use?

Yes. It’s your site you can do whatever you want with it. Running tests on other people’s sites is illegal but Security Ninja can only perform tests on the WordPress page it’s installed on.

It’s not working!!! Arrrrrrrrr

We did our very best to make Security Ninja compatible with all plugins and themes, but problems can still happen. Here are a few places to get help:

Plugin Documentation

Help and support

You can also check out the community support – head over to the support forum open a new thread, and we’ll help you ASAP.

Rezensionen

vuk04 19. April 2019

Super useful, would recommend! 🙂

karmikovic 15. April 2019

Free version is only good for a quick security check. My professional recommendation, find a different plugin or fork over the cash.

eLeXeM 20. Oktober 2018

but this might be due to my rather poorly resourced current hosting (with an I/O ceiling at 1MB/s) :/ So I cannot really give any stars - but this review is mainly to encourage a look at maybe tweaking this to be able to run on such somewhat underequipped environments also? If I ever get it to run I'll be glad to revisit this rating, of course.

rhemfur 5. August 2018

This plugin says that have a "malware" but don't tell where, if you wanna know where is it you have to buy a Pro version.

kathrynsnipes 8. Mai 2018

This plugin is so useful, helped me a lot.

casperbakketun 6. Mai 2018

Great reporting tool!

Lies alle 22 Rezensionen

Mitwirkende & Entwickler

„Security Ninja – WordPress Security Plugin“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt:

„Security Ninja – WordPress Security Plugin“ wurde in 1 Sprache übersetzt. Danke an die Übersetzerinnen und Übersetzer für ihre Mitwirkung.

Übersetze „Security Ninja – WordPress Security Plugin“ in deine Sprache.

Interessiert an der Entwicklung?

Durchstöbere den Code, sieh dir das SVN Repository an oder abonniere das Entwicklungsprotokoll per RSS.

Änderungsprotokoll

5.63

2019/10/15
WordPress Multisite compatible.
Tested WP 5.2.4 compatible.
NEW: Checks for Strict Transport Security (HSTS) security header.
NEW: Checks for security header „X-XSS-Protection“.
NEW: Checks for security header „X-Frame-Options“.
NEW: Checks for security header „X-Content-Type-Options“.
Fix problem with .htaccess code for blocking username enumeration. Thank you David 🙂
Fix problem clicking arrow in results list opened and then closed the result details. Thank you Thomas 🙂
Added more inline help on Core Scanner page.
Updated 3rd party library – Freemius SDK to 2.3.1
More details shown for blocked suspicious requests.
89,418 downloads

5.62

2019/10/03
Security Tests – Added check for if license.txt exists.
Fixed minor bugs in JavaScript code.
Auto Fix – Remove license.txt if exists.
Firewall – Added direct link to VirusTotal details lookup for IPs. Thank you Jose.
Event Log – Rotating syslog can now be set to 7 or 30 days. Thank you Jose.
86,242 downloads

5.61

2019/09/27
Security Tests – Reworked the way the scan works – See which tests are being made.
Security Tests – Added timer showing the progress.
Security Tests – Added error notices in case a test causes problems with the scans.
Event Logger – Improved syslog integration, get detailed event logging for use with Splunk or other Security information and event management (SIEM) systems.
Whitelabel still in beta – Improvements – hiding plugin from list – Thanks Jay.
Scheduled Scanner – Fixes „Unknown Error“ and e-mails now include details about what changed – Thank you Thomas 🙂
84,143 downloads

5.60

2019/09/23
BUGFIX: Getting country ISO code could end up in PHP Error „Call to undefined function“ – Thank you Thomas 🙂
Beta: Event logging to rotating 7-day syslog files in wp-content/uploads/security-ninja/logs/ – Thank you Jose 🙂
81,876 downloads

5.59

2019/09/21
This update introduces a couple of improvements to the security tests and a couple of minor fixes.
Thank you all for bug reports and suggestions! Check out the public roadmap here: https://trello.com/b/6qxtAlzY/wp-security-ninja-public-roadmap
FIX: Security Testing – Fixed bug in detecting EditURI XML-RPC is disabled. Thank you Thomas 🙂
FIX: Security Testing – Autofixer now properly blocks EditURI and also access to
FIX: Core Scanner: Fix false positive with renamed install.php and upgrade.php
Security Testing – Changed suggestion for readme.html, install.php and upgrade.php
Improvement: Security Testing – Auto Fixer – Delete install.php and upgrade.php instead of renaming.
Updated browser detection routines – Thanks Jay 🙂
Malware Scanner – Improved the core WP checksum scanning.
Whitelabel feature now in beta testing 🙂
80,553 downloads

5.58

2019/09/15
Warning if running Security Scans with less than PHP 7
Fixed some options not getting deleted when deleting plugin.
78,396 downloads

5.57

2019/09/12
Added warning for potential conflict with Anti-Spam by CleanTalk. Thank you Courtney for the report.
Bugfix – Tests not always loading properly with different user capacities.
Readme update – added video and more tests.
76,958 downloads

5.56

2019/09/10
Bugfix – Security tests not working properly in some environments.
Added instructions for fixing „Check if the REST API links are shown in code“.
75,392 downloads

5.55

2019/09/08
Minor fixes in JavaScript code.
Cleaned up plugin code.
Added more strings for translators.
73,947 downloads

5.54

2019/09/06
Fix – Security tests popups with details not working.
NEW: Added test if REST API links are visible in the header.
72,766 downloads

5.53

2019/09/05
Tested with WP 5.2.3.
Attempted a fix for loading JS code when other plugins have faulty code. Thank you Vanessa.
Removed noticed regarding Security Ninja Pro not on official wordpress.org repository. Thank you Ivar.
Removed script, jQuery.ScrollTo – not used anymore.
Cleaned up JS code.
71,672 downloads

5.52

2019/08/29
Fix – Admin notices could sometimes break internal admin pages from showing correctly.
Removed language files from plugin.
69,202 downloads

5.51

2019/08/27
Minor language updates and small bugfixes.
67,868 downloads

5.50

2019/08/23
Major rewrite and a lot of new features added.
Started making plugin translatable.
Malware Scanner – Plugin integrity checker is more accurate and reports fewer false positives.
Bumped version from 2.x to 5.50 – Aligning free and pro version numbers.
More userfriendly for new users with tips in the admin interface.
More inline help on relevant pages.
New: Getting started tips – Notices that informs you of next steps.
Malware: Updated whitelists
Fixes problem with databases not created properly.
New cached JSON folders are removed on deactivation
NEW: Plugin Integrity check – validate installed plugins against wordpress.org API.
Moved WordFence warning to „Security Tests“ tab only.
Nicer emails in „Your secret access link“
Improved: Emails sent by Scheduled Scanner are much nicer looking and more informative.
Better logging blocked login attempts.
Firewall – New: Top countries. See which countries are bringing the most traffic.
Fix for database tables not always being created when updating from Free to Pro.
Firewall – fixed empty results showing up.
More details on why a visitor is blocked in the log.
New: Malware Scanner – View whitelisted files.
New: Core Scanner – Detects unknown files in core folders.
New: Core Scanner – Find leftover files from older WordPress installations.
New: Core Scanner – Delete unwanted files individually or all unknown files.
New: Firewall – Country blocking, useful if you get a lot of bad traffic from specific countries.
New: Firewall – Top visitors log kept for the last 30 days. Discover top visitors and use to decide on which IPs or countries to block.
New: Firewall – Logging individual visits per IP
New: Firewall – Suspicious requests are blocked – based on the great BBQ: Block Bad Queries by Jeff Starr.
New: Firewall – Redirect blocked visitors – You can show a message or redirect blocked visitors to another website.
Design overhaul to get closer to WP look and feel.
Updated 3rd party libraries, Select2
66,070 downloads

2.50

2019/02/25
fix: deactivated themes test
56,100 downloads

2.46

2018/10/17
fix: MySQL version test
47,700 downloads

2.45

2018/06/11
new test: usernames lookup via user ID
41,000 downloads

2.40

2018/04/10
we hit 10k installs on March 14th
bug fixes
introduced the Cloud Firewall
discount for old users

2.35

2017/12/25
added Malware Scanner with hidden results

2.30

2017/12/08
bug fixes
added Database Optimizer tab

2.25

2017/10/10
bug fixes

2.20

2017/05/19
fixed 3 tests
bug fixes
lower PRO price

2.15

2016/12/08
5 new tests
tests tab removed – details are now available in a lightbox from the main tab
bug fixes

2.10

2016/10/13
Security Ninja PRO is now available
minor bug fixes

2.05

2016/09/05
added action that fires on remote access change (disable/enable/reset)
added license.txt
we passed 5000 active installs

2.0

2016/08/30
initial release on wp.org
plugin transferred from CodeCanyon to WordPress.org
license changed to GPLv2

1.0

2011/09/27
initial release on CodeCanyon