feat(security): 新增网站安全扩展模块并支持修改手机脱敏验证

src/Auth/Moderation.php

@@ -124,6 +124,25 @@ class Moderation {
             }
         }
 
+        // [防刷机制]评论限制（后台「扩展&增强 → 网站安全」），管理员不受限；
+        // 未登录用户按 IP 判断，与下方审核限流（间隔/每小时）互为补充。
+        if (!current_user_can('manage_options') && class_exists('\AKSRT\Extensions\SecurityHardening')) {
+            $security = \AKSRT\Settings\ExtensionRuntime::get_security_settings();
+            $brush = \AKSRT\Extensions\SecurityHardening::brush_allow(
+                'comment',
+                $actor > 0 ? (string) $actor : $this->get_client_ip(),
+                (int) $security['security_brush_comment_10min'],
+                (int) $security['security_brush_comment_day']
+            );
+            if ($brush !== true) {
+                wp_die(
+                    '<p>' . esc_html((string) $brush) . '</p>',
+                    esc_html__('评论提交失败', 'aksrt'),
+                    ['response' => 429]
+                );
+            }
+        }
+
         $config = $this->get_config();
 
         if (empty($config['enabled'])) {

src/Auth/ServicePart1a.php

@@ -140,6 +140,16 @@ trait ServicePart1a {
 			}
 		}
 
+		// [防刷机制]注册限制（后台「扩展&增强 → 网站安全」），按 IP 判断且不豁免管理员。
+		if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+			$security = \AKSRT\Settings\ExtensionRuntime::get_security_settings();
+			$brush_ip = function_exists('aksrt_get_client_ip') ? aksrt_get_client_ip() : (string) ($_SERVER['REMOTE_ADDR'] ?? '');
+			$brush = \AKSRT\Extensions\SecurityHardening::brush_allow('register', $brush_ip, (int) $security['security_brush_register_10min'], (int) $security['security_brush_register_day']);
+			if ($brush !== true) {
+				return ['success' => false, 'error' => (string) $brush];
+			}
+		}
+
 		$user_id = wp_create_user($user_login, $password, $user_email);
 		if (is_wp_error($user_id)) {
 			if ($ref_service) {

src/Auth/ServicePart1b.php

@@ -114,6 +114,16 @@ trait ServicePart1b {
 			}
 		}
 
+		// [防刷机制]注册限制（后台「扩展&增强 → 网站安全」），按 IP 判断且不豁免管理员。
+		if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+			$security = \AKSRT\Settings\ExtensionRuntime::get_security_settings();
+			$brush_ip = function_exists('aksrt_get_client_ip') ? aksrt_get_client_ip() : (string) ($_SERVER['REMOTE_ADDR'] ?? '');
+			$brush = \AKSRT\Extensions\SecurityHardening::brush_allow('register', $brush_ip, (int) $security['security_brush_register_10min'], (int) $security['security_brush_register_day']);
+			if ($brush !== true) {
+				return ['success' => false, 'error' => (string) $brush];
+			}
+		}
+
 		// 创建用户
 		$user_id = wp_create_user($username, $pass, '');
 		if (is_wp_error($user_id)) {