Title: CenterShield – Site Security: Login Protection, 2FA, File Protection & Malware Scan Author: WPセンター Published: سپتامبر 26, 2026 Last modified: سپتامبر 26, 2026 --- Search plugins ![](https://ps.w.org/centershield/assets/banner-772x250.png?rev=3714371) ![](https://ps.w.org/centershield/assets/icon-256x256.png?rev=3714371) # CenterShield – Site Security: Login Protection, 2FA, File Protection & Malware Scan By [WPセンター](https://profiles.wordpress.org/wpcenterjp/) [Download](https://downloads.wordpress.org/plugin/centershield.1.0.0.zip) * [Details](https://azb.wordpress.org/plugins/centershield/#description) * [Reviews](https://azb.wordpress.org/plugins/centershield/#reviews) * [Installation](https://azb.wordpress.org/plugins/centershield/#installation) * [Development](https://azb.wordpress.org/plugins/centershield/#developers) [Support](https://wordpress.org/support/plugin/centershield/) ## Description CenterShield is a WordPress security plugin built for Japanese site owners and the agencies that maintain their sites. It brings login protection, two-factor authentication, hardening, file protection and malware scanning together in one place. Every setting explains what it protects and what changes when you turn it on, so you can choose the measures your site needs without security expertise. **The admin interface and all messages are in Japanese only.** Activating the plugin changes nothing on your site. Press “apply recommended settings” to enable the recommended set in one step, or turn on each feature yourself. #### Account and login protection * Login attempt limiting (brute force protection) * Username disclosure prevention * Custom login URL * HTTP Basic authentication on the login screen (written to .htaccess on Apache) * reCAPTCHA v2 / v3 * Two-factor authentication (authenticator app, email, backup codes) * XML-RPC disabling (signed Jetpack requests are still allowed) * IP address restriction for the admin area #### Disabling unused features and weak settings * Pingback * REST API restriction (well known plugins such as Contact Form 7, Jetpack and WooCommerce stay allowed) * Author archive pages * Theme and plugin file editor, application passwords * Unneeded tags in wp_head, such as the WordPress version, the RSD link and emoji scripts #### File and server protection * Blocking direct access to wp-includes, wp-config.php, configuration and backup files * Blocking PHP execution in the uploads folder * Disabling directory listing * Security headers such as X-Frame-Options * Removing publicly readable files such as readme.html * Permission review and correction #### Ongoing protection * Input filtering (lightweight WAF) * Comment spam blocking (honeypot, rate limit, previous spam history) * Detection of plugins and themes that have gone two years without an update or are not tested with your version of WordPress #### Malware scanning * Comparison against official checksums for WordPress core and plugins hosted on WordPress.org. Differences limited to comments or line endings are reported as informational * Matching against a known vulnerability database * Pattern matching against malware signatures bundled with the plugin and updated from the author’s server * Change detection against the previous scan, for themes and plugins that are not on WordPress.org * Database inspection of posts, widgets and administrator accounts * Quarantine, restore from the official original, and difference display ### External services This plugin connects to the following external services. No site content, post data or user data is transmitted to any of them, and every request identifies itself with a fixed user agent rather than the WordPress default, which would carry your site address. #### api.wpcenter.jp (WP Center, the plugin author) Used to download malware signature definitions and known vulnerability data. The request is sent when the plugin checks for definition updates and when a scan needs vulnerability data. What is sent: the plugin version, and the metadata that any web request carries, namely your server IP address and a fixed user agent string(“ WPCenterSecurity/” followed by the plugin version) that does not contain your site address. What is received: signature definitions, their digital signature, and vulnerability records. Your site address and the list of plugins and themes installed on your site are never sent; matching is performed locally on your site. Terms of service: https://wpcenter.jp/plugin-terms/ Privacy policy: https://wpcenter. jp/privacy/ The vulnerability records served from this endpoint originate from Wordfence Intelligence, provided by Defiant, Inc., and include CVE records from the MITRE Corporation. Copyright designations for both are shown with every record in the scan results, and the Wordfence Intelligence terms are reproduced in licenses/wordfence-intelligence-terms.txt inside this plugin. WP Center is not affiliated with, endorsed by or sponsored by Wordfence or Defiant, Inc. Wordfence Intelligence: https://www.wordfence.com/threat-intel/ Wordfence Intelligence terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/ Wordfence privacy policy: https://www.wordfence.com/privacy-policy/ CVE terms of use: https:// www.cve.org/Legal/TermsOfUse #### api.wordpress.org and downloads.wordpress.org Used to obtain official checksums during a scan. What is sent: the WordPress version and locale, and the slug and version of each plugin being verified. What is received: file checksums. WordPress.org privacy policy: https://wordpress.org/about/privacy/ #### core.svn.wordpress.org and plugins.svn.wordpress.org Used only when you press “compare with the original” or “restore the original” on a scan result. What is sent: the version and file path of the file being retrieved. What is received: that single original file, from the official WordPress.org repository. WordPress.org privacy policy: https://wordpress.org/about/privacy/ #### www.google.com (reCAPTCHA) Used only if you enable reCAPTCHA and enter your own keys. The reCAPTCHA script is then loaded on the forms you select, and the token is verified against Google. What is sent: the reCAPTCHA token, your secret key and the visitor IP address. Google terms: https://policies.google.com/terms Google privacy policy: https:// policies.google.com/privacy ### Third-party resources * Vulnerability data: Wordfence Intelligence Vulnerability Database (https://www. wordfence.com/threat-intel/). Copyright Defiant, Inc. CVE records copyright The MITRE Corporation. Redistributed under the Wordfence Intelligence Terms and Conditions, a copy of which is included in licenses/wordfence-intelligence-terms.txt. Each record displays its copyright designation in the scan results. * Original file comparison: the public WordPress.org checksum API and SVN repositories. * Part of the malware definitions: Linux Malware Detect (LMD) signatures, Copyright R-fx Networks, GNU GPL v2, https://github.com/rfxn/linux-malware-detect, incorporated under the terms of the GPL. Known malicious domains: URLhaus (abuse.ch, CC0, https://urlhaus.abuse.ch/). * QR code generation: qrcode-generator v1.4.4, Copyright (c) 2009 Kazuhiko Arase, MIT License (assets/js/qrcode.min.js). ### 日本語 WPセンターが提供する国産・日本語対応の WordPress セキュリティ対策プラグインです。 管理画面とメッセージはすべて日本語です。 ログイン保護、2段階認証、設定の強化、ファイル保護、マルウェアスキャンをまとめて管理 でき、ひとつずつ「何のための設定か」「どんな効果があるか」を確認しながら有効化でき ます。 有効化した時点では何も変更されず、「推奨設定をまとめて適用」を押すか、項目 ごとに選んで有効にします。 マルウェアスキャンでは、WordPress 本体と公式プラグインを原本と照合し、既知の脆弱 性データベースと突き合わせ、不正コードのパターンを検査します。 検出結果からは隔離、 原本の復元、差分表示が行えます。 脆弱性情報は Wordfence Intelligence（Defiant, Inc. 提供）に由来し、CVE 情報は MITRE Corporation によるものです。各レコードに著作権表示を表示しています。 当プラグイン は Wordfence および Defiant, Inc. とは無関係です。 ## Screenshots [⌊Dashboard with the recommended settings status, the apply button and the site environment check⌉⌊Dashboard with the recommended settings status, the apply button and the site environment check⌉[ Dashboard with the recommended settings status, the apply button and the site environment check [⌊Account and login protection settings⌉⌊Account and login protection settings⌉[ Account and login protection settings [⌊File and server protection written to .htaccess⌉⌊File and server protection written to .htaccess⌉[ File and server protection written to .htaccess [⌊Malware scan results with severity ratings⌉⌊Malware scan results with severity ratings⌉[ Malware scan results with severity ratings ## Installation 1. Upload the plugin and activate it. Nothing is changed on your site at this point. 2. Open the “CenterShield” menu and press “apply recommended settings” on the dashboard, or enable individual settings yourself. 3. Run a malware scan. ## FAQ ### I forgot my custom login URL Rename this plugin’s folder under wp-content/plugins/ using FTP or your hosting file manager. The plugin stops loading and /wp-login.php works again. Your settings are preserved. The exact folder name is shown on the Settings tab of the plugin. ### I am locked out of the admin area Add `define( 'WPCS_DISABLE', true );` to wp-config.php. Every feature of the plugin pauses while that line is present. ### I forgot the HTTP Basic authentication password Basic authentication is applied by .htaccess, so renaming the plugin folder does not remove it. Open the .htaccess file in your site root and delete the block that starts with the Basic authentication comment inside the “CenterShield” markers. Full instructions are on the Settings tab of the plugin. ### Does the plugin change my site when I activate it? No. Every setting is off after activation. Nothing is written to .htaccess and no scan is scheduled until you choose to enable it. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CenterShield – Site Security: Login Protection, 2FA, File Protection & Malware Scan” is open source software. The following people have contributed to this plugin. Contributors * [ WPセンター ](https://profiles.wordpress.org/wpcenterjp/) [Translate “CenterShield – Site Security: Login Protection, 2FA, File Protection & Malware Scan” into your language.](https://translate.wordpress.org/projects/wp-plugins/centershield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/centershield/), check out the [SVN repository](https://plugins.svn.wordpress.org/centershield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/centershield/) by [RSS](https://plugins.trac.wordpress.org/log/centershield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. ## Meta * Version **1.0.0** * Last updated **19 ساعاتلار ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/centershield/) * Tags * [2FA](https://azb.wordpress.org/plugins/tags/2fa/)[firewall](https://azb.wordpress.org/plugins/tags/firewall/) [login](https://azb.wordpress.org/plugins/tags/login/)[malware](https://azb.wordpress.org/plugins/tags/malware/) [security](https://azb.wordpress.org/plugins/tags/security/) * [Advanced View](https://azb.wordpress.org/plugins/centershield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/centershield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/centershield/reviews/) ## Contributors * [ WPセンター ](https://profiles.wordpress.org/wpcenterjp/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/centershield/)