WordPressの管理画面の不正ログイン試行を記録し、一定回数の失敗でIPをブロックするセキュリティプラグイン。
sHub-Log strengthens WordPress site security.
Main features:
- Login attempt logging
- Category-based detection (config scans, backdoors, plugin vulnerability scans, admin hacking, spam, and more)
- Optional detection for malicious queries, high-volume requests, and REST API abuse
- Attack summary and detailed logs for a configurable period
- Attack trend charts with selectable period and aggregation interval
- CSV export and AJAX category filtering
- Configurable attack log retention with WP-Cron cleanup
- Attack spike email alerts with cooldown
- Optional signed remote alert and scoring definitions from syn-c.jp
- IP blocking after repeated failures
- Configurable block duration and redirect URL
- Admin dashboard for logs and IP management
- Customizable rate-limit thresholds and windows
- Optional attack-signal-only rate counting
- Exclusion of logged-in users and verified search/AI bots from rate counting
- Verified bot access logging (14-day retention, disabled by default)
- Suspicious 404 flood detection
- IP whitelist and trusted proxy support (auto-trust private proxies and Cloudflare)
- Per-IP risk scoring (disabled by default)
- Administrator IP memory to reduce self-lockouts
- Durable rate/score counters that survive object-cache flushes
FAQ
How do I unblock an IP address?
Open sHub-Log → Security Trend, scroll to Protected IP, and unblock the address from the list.
Does the plugin make external requests?
When attack spike alerts are enabled, the plugin may fetch alert definitions and email templates from syn-c.jp. When remote scoring is enabled, it may fetch a signed score-config.json from syn-c.jp. When verified bot exclusion is enabled, it may fetch published IP range JSON from bot vendors (cached for 24 hours). No attack logs, IP addresses, user information, or site content are sent to syn-c.jp.
What should I check after updating to 1.2.6?
If you saved settings from Basic Settings or Bot Logging Settings before the settings-group fix in 1.2.6, review Advanced Settings or use the Recommended settings button on Basic Settings to restore factory defaults.
Recommended factory defaults:
Setting
Default
Login attempt limit window
5 minutes
Login attempt limit count
5
Block duration
60 minutes
High-volume request threshold
90/minute
404 flood threshold
30/5 minutes
Attack spike email alerts
OFF
Risk scoring
OFF
Bot access logging
OFF (search bot logging ON / AI bot logging OFF when enabled)
Auto-trust private proxies / Cloudflare
ON
Remember administrator IPs
ON
ChangeLog
1.2.15
- Added translations (ja, ko_KR, zh_CN, zh_TW, vi, th) for Auto-trust private/local reverse proxies, Auto-trust Cloudflare edge IPs, and Remember administrator IPs after login.
- Clarified that verified bot access logging is off by default. Japanese admin copy now uses 初期状態 instead of デフォルト/既定値.
- Added translations for REST API / oEmbed detection, trusted proxy help, and login-limit description.
1.2.14
- Added pagination to the Attack Log list so the full selected period (e.g. last 30 days) can be browsed 100 rows at a time.
1.2.13
- Fixed false-positive reverse-proxy admin notice on shared hosting (e.g. Xserver): warn only when auto-trust is disabled for a matching private/Cloudflare REMOTE_ADDR, or when the same untrusted REMOTE_ADDR is observed with multiple distinct forwarded client IPs.
- Added Client IP diagnostics on Advanced Settings (REMOTE_ADDR, forwarded headers, IP used by sHub-Log).
- Japanese plugin action link: “Signup” translation changed from 会員登録 to ユーザー登録.
1.2.12
- Fixed timezone mismatch: block expiry and log window comparisons now use WordPress local time consistently (blocks that never applied, or applied too aggressively, on hosts where MySQL NOW() differed from WordPress time).
- Auto-trust private/local reverse proxies and Cloudflare edge IPs so visitors behind CDN/LB are not collapsed into one IP; admin notice when proxy headers are present but untrusted.
- Softened admin self-lockouts: login failure default raised to 5; remembered administrator IPs after successful manage_options login; admin-area GET login and admin-ajax/admin-post excluded from Admin Area Hacking; that soft category is logged but excluded from automatic IP blocking.
- REST API abuse detection excludes logged-in editors; oEmbed endpoint detection is optional and off by default.
- Config file scans match the final path segment only; malicious query checks evaluate parameters separately to avoid site-search false positives.
- FCrDNS verification supports IPv6 (dns_get_record AAAA) so verified search crawlers on IPv6 are excluded correctly.
- Rate-limit / 404 / score windows moved from transients to a dedicated table so object-cache flushes no longer reset counters.
- Added detection: theme 404 probes, uploads PHP execution probes, VCS/dependency/DB-admin/backup-name scans, user enumeration (?author=N floods / user sitemaps), scanner tool User-Agents, bot UA impersonation (soft), and PROPFIND/TRACE/TRACK methods.
1.2.11
- Added WordPress Core Vulnerability Scan detection for 404 probes under /wp-includes/ (WordPressコア脆弱性スキャン).
- Added sustained attack volume email alerts (at most one email per day when total logs exceed a configurable threshold within a time window).
- Updated bundled translations for the new category and alert settings.
1.2.10
- Fixed bundled .mo files so admin translations load correctly in WordPress.
1.2.9
- Added translation language packs for ja, ko_KR, zh_CN, zh_TW, vi, and th (177 admin strings each; languages/syntaxhub-securelog-*.po and .mo).
- Added build-languages.mjs to compile .po files to .mo; locale-data/*.mjs and write-locale-pos.mjs for maintaining translation sources.
1.2.8
- Admin left menu restored to native WordPress submenu behavior (click sHub-Log to expand items below; standard dark sidebar styling).
- Removed custom AIOSEO-style flyout menu CSS and JavaScript.
- Attack spike alert emails now show bilingual category values (e.g. Suspicious 404 Flood / 不審な404多発).
1.2.7
- Admin UI refactor: WordPress submenus replace the single-page view mode bar (AIOSEO-style flyout menu).
- English-only admin strings; text domain retained for future translations.
- Split admin pages: Security Trend, Search Bot Trend, AI Bot Trend, Basic Settings, Advanced Settings, Risk Scoring Settings, Bot Logging Settings.
- Chart legend colors now match summary card border colors via shared palette helpers.
- Charts auto-scroll horizontally to center buckets that contain data.
- Separate settings option groups for advanced and scoring pages to prevent accidental checkbox resets on save.
1.2.6
- Admin notice for 1.2.6 upgrade with settings verification guidance.
- “Recommended settings” button to restore factory defaults from Simple and Advanced views.
- FAQ note about verifying Advanced settings after updating from buggy 1.2.6 builds.
- Added Bot Analytics view with verified bot access logging (14-day retention, disabled by default).
- Search bot logging defaults ON and AI bot logging defaults OFF when bot logging is enabled.
- Bot Analytics shows separate search and AI trend charts and per-bot access summaries.
- Fixed settings corruption when saving from Simple mode or Bot Analytics (split option groups so only visible fields are saved).
- Redesigned admin view switcher: Simple / Advanced tabs on the left, Bot Analytics pill on the right; active view shown in black.
- Renamed admin labels: measurement window terminology updated to measurement interval/frame wording.
1.2.5
- Split bot rate-count exclusion into separate Search bot (default ON) and AI bot (default OFF) admin toggles.
- Expanded verified AI bot list: GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, PerplexityBot, Perplexity-User, CCBot, Bytespider, Applebot.
1.2.4
- Added verified AI bot support (GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot) to the rate-limit exclusion list. AI bots are verified against each vendor’s published IP range JSON; search crawlers continue to use FCrDNS. User-Agent strings alone are never trusted.
1.2.3
- Security hardening: neutralized CSV formula injection in the attack log CSV export.
- Hardened the blocked-IP redirect by re-applying esc_url_raw() to the admin-configured redirect URL.
- Replaced date() with gmdate() when computing the IP block expiry for timezone-consistent behavior.
1.2.2
- Attack trend chart now supports Analytics-style period selection: 24 hours, 7 days, 14 days, and 21 days (default: 7 days).
- Chart buckets are aligned to on-the-hour boundaries (hourly) or calendar days (daily).
- Aggregation interval options: 1 hour, 3 hours, 6 hours, and 1 day.
1.2.1
- Added Simple mode and Advanced settings views for the admin screen, with per-user view preference persistence.
- Simple mode shows essential settings only.
1.2.0
- Added per-IP risk scoring (disabled by default).
- Signal weights, accumulation window, and record/block thresholds are configurable from the admin screen.
- Added optional retrieval of a signed scoring definition from syn-c.jp.
1.1.9
- URL normalization before pattern matching.
- Suspicious 404 flood detection with configurable threshold and window.
- Configurable high-volume request threshold and time window.
- Option to count only requests with attack signals toward rate limiting.
- Exclusion of logged-in users and verified good bots from rate counting.
- IP whitelist and trusted-proxy support.
- Relaxed default thresholds (90 for high-volume requests, 30 for 404 floods).
1.1.8
- When the previous attack count window is zero, attack spike alert emails now show N/A and an explanatory note instead of a misleading multiplier.
1.1.7
- Refined the attack spike alert email wording for more accurate IP protection messaging.
1.1.6
- Updated the built-in fallback email template for attack spike alerts.
1.1.5
- WordPress 7.0 compatibility display update.
- Admin display order and copy updates.
1.1.4
- Added 24-hour attack trend chart.
- Attack spike email alerts and remote alert definition support.
1.1.2
- Fixed PHP 8 formatting error in admin period labels.
1.1.1
- Renamed plugin to sHub-Log.
- CSV export and AJAX category filtering.
- Attack log table indexes maintained on upgrade.
1.1.0
- Category-based attack log table.
- Suspicious 404, malicious query, rate limit, and REST API abuse detection.
- Attack summary, log retention settings, and auto IP blocking.
1.0.3
- Security hardening: nonces, sanitization, and safer SQL.
1.0.2
- Log deletion improvements and UI updates.
1.0.1
- Initial bug fixes and admin improvements.
1.0.0
