Description
SPP Guardian is a standalone, local-first WordPress security and maintenance plugin built for site owners who need clear explanations rather than raw technical alerts.
Every security finding answers five questions:
- What happened?
- Where is it?
- How serious is it?
- How could it affect the website?
- What is the safest next action?
The scanner combines official WordPress core checksums, local file-change baselines, offline signatures, code and path heuristics, selected database inspection, administrator-account monitoring, cron inspection, update awareness, safe quarantine, restore, and verified core-file repair.
No account, licence server, telemetry service, or cloud scanner is required. The plugin does not automatically delete suspicious content.
Main features
- On-demand and scheduled resumable scans.
- Standard and low-resource scan profiles.
- WordPress core checksum verification.
- WordPress.org-hosted plugin checksum verification with cached official data.
- Local file integrity baselines.
- PHP-in-uploads and disguised-executable detection.
- Web-shell markers, decoded execution chains, command-execution patterns, hidden iframes, and obfuscated JavaScript checks.
- Selected posts, comments, options, administrator, and cron inspection.
- Separate severity and detection-confidence values.
- Protected quarantine with hash verification and restoration.
- Official-package repair for eligible WordPress core files.
- Update, PHP, cron, HTTPS, file-editor, debug-display, inactive-plugin, and scan-freshness maintenance checks.
- Rate-limited email alerts that never contain executable evidence.
- Audit log, REST endpoints, and WP-CLI commands.
- Conservative uninstall option: keep data by default or delete everything explicitly.
- Optional Protection & Firewall module, off by default, with independent switches for brute-force login protection, GET/POST request filtering, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction.
- Manual IP allow and block lists, an activity log of what the firewall did and why, and a one-click unlock for an automatic login lockout.
Important limitation
No malware scanner can guarantee detection of every malicious file, database payload, zero-day exploit, hosting compromise, encrypted payload, or attacker-controlled server condition. SPP Guardian provides layered risk detection and guided remediation. It does not replace off-site backups, hosting security, server EDR, a WAF/CDN, log monitoring, or professional incident response.
External services
SPP Guardian works locally without telemetry or a SPP Guardian cloud service.
When core or WordPress.org plugin checksum verification runs, WordPress may request checksum data for the installed WordPress version and locale from the official WordPress.org API. Core checksum requests identify the WordPress version and locale. Plugin checksum requests identify the public plugin slug and installed version. SPP Guardian does not send site files or database content.
When an authorised administrator explicitly chooses “Repair from official package”, SPP Guardian downloads the matching WordPress package from an official WordPress.org download URL, extracts the requested file locally, verifies it against the official checksum, backs up the current file, writes the replacement, and verifies the result.
PHP maintenance guidance links to the official PHP supported-versions page only when the administrator chooses Review. No data is sent by SPP Guardian merely for displaying the link.
WP-CLI
wp sppgusem-guardian status --format=jsonwp sppgusem-guardian scan --profile=standard --waitwp sppgusem-guardian findings --status=open --format=tablewp sppgusem-guardian quarantine <finding-id> --yes
REST API
Authenticated routes use the namespace sppgusem/v1 and require SPP Guardian capabilities. Available routes include status, scans, findings, quarantine, core repair, restore, resolve, ignore, and settings. If the Protection & Firewall module’s REST rate limiting or authentication requirement is enabled, those settings apply uniformly to all REST API traffic, including requests to these SPP Guardian routes.
Privacy
Normal scans run locally. SPP Guardian stores scan metadata, file paths, hashes, short redacted excerpts, issue records, protected remediation copies, settings, and audit events. It does not store passwords, cookies, full API tokens, or complete malicious payloads in ordinary findings. Protected copies remain on the server until restored or removed during an explicitly configured uninstall.
When the optional Protection & Firewall module is enabled, SPP Guardian also records the visitor IP address, request method, a short redacted excerpt of the request path, and the matched rule for requests it blocks or logs, so the activity can be reviewed and understood later. This activity log is stored locally, is never sent anywhere, and is pruned automatically after the configured retention period.
Installation
- In WordPress, open Plugins > Add New > Upload Plugin.
- Select the SPP Guardian ZIP file and choose Install Now.
- Activate SPP Guardian Security & Maintenance.
- Open SPP Guardian > Scan Centre and run the first full scan.
- Review SPP Guardian > Maintenance and configure the schedule and email recipient under Settings.
- On low-traffic sites, configure a real server cron to call
wp-cron.phpregularly.
Before quarantining or repairing production files, confirm that a separate, tested backup exists.
FAQ
-
Does SPP Guardian automatically delete malware?
-
No. Automatic deletion is unsafe because false positives and active component dependencies can break a site. SPP Guardian backs up and quarantines a confirmed file only after an authorised user approves the action.
-
Does a critical alert always mean the site is compromised?
-
No. Severity describes potential harm. Confidence describes how certain the detector is. Review both values and the evidence before acting.
-
Why are normal file changes shown?
-
The local baseline can report changes to code and configuration files. These are low severity unless another rule identifies suspicious behaviour or an official checksum fails. Ignoring a baseline-only change explicitly accepts the current file as the new local reference.
-
Can it scan very large sites?
-
Scanning is resumable and divided into small batches. Very large files are sampled or skipped according to the configured limit, and coverage information is recorded. WP-CLI is recommended for large or business-critical sites.
-
Is it a web application firewall?
-
SPP Guardian includes an optional, application-layer Protection & Firewall module: brute-force login lockout, GET/POST request filtering against common attack patterns, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction. It runs inside WordPress itself, so it complements rather than replaces a network or edge WAF, a CDN, or your host’s own firewall, and it cannot guarantee blocking every attack. The module is off by default and the GET/POST filters start in a log-only mode so you can review real traffic in the firewall activity log before switching them to block.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“SPP Guardian Security & Maintenance” is open source software. The following people have contributed to this plugin.
Contributors
Translate “SPP Guardian Security & Maintenance” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.0.2
- Resolved Plugin Check SQL preparation findings and refined custom-table query handling.
- Removed the variable-path autoloader and switched to explicit trusted includes.
- Removed unnecessary SELECT-star queries and query-in-loop patterns identified by readiness scanning.
- Updated Tested up to for WordPress 7.1.
2.0.1
- Security hardening and WordPress.org review remediation.
- Uses configured uploads/plugin paths instead of assuming default wp-content locations.
- Uses the unique
sppgusem_/SPPGUSEMprefix family for plugin-owned identifiers, including thesppgusem/v1REST namespace andwp sppgusem-guardianCLI command.
2.0.0
- Renamed from GuardianWP Security & Maintenance to SPP Guardian Security & Maintenance. New slug (
spp-guardian-security-maintenance), text domain, PHP namespace/classes, internal database table/option/transient/capability/cron-hook prefixes, REST namespace (spp-guardian/v1, wasguardianwp/v1), WP-CLI command (wp spp-guardian, waswp guardianwp), and admin menu slugs. - If you have GuardianWP Security & Maintenance installed: deactivate it, then install and activate SPP Guardian Security & Maintenance — your scan history, findings, quarantined files, settings, and capabilities are imported automatically. An admin notice guides you through this if the old plugin is still active when you activate the new one. Any login lockout active at the exact moment of the upgrade is released and brute-force counters restart; a scan already in progress is not resumed.
- The
guardianwp/v1REST namespace andwp guardianwpCLI command are retired with no compatibility alias — update any script or integration that calls them directly. The three extension action hooks (scan_completed,file_quarantined,daily_maintenance) keep working under their oldguardianwp_*names as deprecated aliases through the 2.x line. - Fixed: a REST
POST /settingsrequest that only sends the field(s) it wants to change no longer resets every other setting to its default. - Fixed: the REST findings endpoint now returns a file path relative to the WordPress root, matching what the dashboard already showed, instead of the full server filesystem path.
- Fixed: quarantine’s own-plugin-directory check no longer over-matches a sibling directory whose name merely starts with the same string as the plugin’s own directory.
- Addressed every finding from the official WordPress.org Plugin Check tool: removed a discouraged
load_plugin_textdomain()call, added missing translator comments, and documented the plugin’s direct-database-query usage against its own tables.
1.1.0
- Refreshed dashboard visual design: section navigation, restyled hero and metric cards, and clearer panels and tables.
- New optional Protection & Firewall module, off by default: brute-force login lockout, GET/POST request filtering, REST API rate limiting, anonymous REST user-enumeration and ?author= probing blocking, and XML-RPC restriction, each independently switchable.
- Manual IP allow/deny lists, a firewall activity log, and one-click unlock for an active login lockout.
1.0.0
- Initial standalone release.
- Resumable file and database scanning.
- Offline detection rules and core checksum verification.
- File baselines, issue classification, quarantine, restore, and core repair.
- Maintenance dashboard, email alerts, REST API, WP-CLI, and audit logging.