Title: CodeCanvas Guard
Author: codecanvasinc
Published: <strong>August 28, 2026</strong>
Last modified: August 28, 2026

---

Search plugins

![](https://ps.w.org/codecanvas-guard/assets/banner-772x250.png?rev=3670780)

![](https://ps.w.org/codecanvas-guard/assets/icon-256x256.png?rev=3670780)

# CodeCanvas Guard

 By [codecanvasinc](https://profiles.wordpress.org/codecanvasinc/)

[Download](https://downloads.wordpress.org/plugin/codecanvas-guard.1.3.2.zip)

 * [Details](https://wordpress.org/plugins/codecanvas-guard/#description)
 * [Reviews](https://wordpress.org/plugins/codecanvas-guard/#reviews)
 *  [Installation](https://wordpress.org/plugins/codecanvas-guard/#installation)
 * [Development](https://wordpress.org/plugins/codecanvas-guard/#developers)

 [Support](https://wordpress.org/support/plugin/codecanvas-guard/)

## Description

CodeCanvas Guard is a local-first WordPress security suite built around reviewable
changes and safe recovery.

Core features include:

 * Safe, Balanced, and Strict protection profiles.
 * A recovery-first custom login route with browser verification before activation.
 * Username-and-IP rate limiting, CIDR allow/block rules, a login honeypot, and 
   generic login errors.
 * TOTP two-factor authentication with encrypted secrets and one-use recovery codes.
 * Optional role-based 2FA enforcement and optional Cloudflare Turnstile.
 * REST user protection, author-enumeration blocking, XML-RPC and pingback controls,
   security headers, and file-editor protection.
 * WordPress core and eligible WordPress.org plugin checksum checks.
 * Local suspicious-PHP patterns, executable uploads, unsafe permissions, recent
   sensitive-file changes, and known-vulnerability matching.
 * Critical, High, Medium, Informational, and Unavailable findings with exact reasons
   and evidence.
 * Administrator-reviewed findings, exact-file hash approvals, filters, and protected
   CSV/JSON exports.
 * Scheduled scans and priority-aware file monitoring with explicit coverage reporting.
 * Administrator-approved trusted repairs, protected recovery points, quarantine,
   restore, and rollback.
 * Security activity logs, update awareness, session review, and optional email 
   alerts.

Scheduled scans do not modify files. Repair, quarantine, restore, and rollback actions
require an authenticated administrator action and nonce. Guard does not send telemetry
to CodeCanvas.

### Emergency Recovery

The dashboard can create a one-time emergency login link. The link expires after
30 minutes and opens a 15-minute recovery session.

For hosting-level recovery, add the following above the stop-editing comment in `
wp-config.php`:

    ```
    define( 'CODECANVAS_GUARD_DISABLE', true );
    ```

Remove the line after access is restored and the configuration is corrected.

### External Services

CodeCanvas Guard uses external services only for the features described below.

#### WordPress.org services

Integrity scans, native update awareness, and approved trusted repairs use official
WordPress.org services. Depending on the action, WordPress sends the installed WordPress
version and locale, or plugin/theme identifiers and versions, and receives checksum
data, update metadata, or an official package. Guard uses the native WordPress HTTP
and updater APIs. These requests occur during manual or scheduled scans, update 
checks, and an administrator-approved repair.

Service: https://wordpress.org/
 Privacy policy: https://wordpress.org/about/privacy/
Terms: https://wordpress.org/about/terms/

#### Wordfence Intelligence

Known-vulnerability matching is optional. When enabled with an API key, the server
sends the API key and normal HTTP request metadata to Wordfence Intelligence and
downloads its V3 production vulnerability feed. Guard compares the feed with the
installed inventory locally; website files and the installed inventory are not uploaded
to Wordfence. The service requires a Wordfence Intelligence API key.

Service and setup: https://www.wordfence.com/help/wordfence-intelligence/v3-accessing-
and-consuming-the-vulnerability-data-feed/
 Terms and privacy: https://www.wordfence.
com/terms-of-use-and-privacy-policy/

#### Cloudflare Turnstile

Turnstile is optional and disabled by default. When configured, Cloudflare’s challenge
script loads on interactive login pages. Cloudflare can process browser and device
information under its policy. During login, Guard sends the challenge response, 
configured secret, and visitor IP address to Cloudflare for verification.

Service: https://www.cloudflare.com/products/turnstile/
 Privacy policy: https://
www.cloudflare.com/privacypolicy/ Terms: https://www.cloudflare.com/website-terms/

### Privacy

Guard can store WordPress user IDs, IP addresses, event times, action summaries,
limited technical context, user agents, and hashed device fingerprints for security
and accountability. Administrators choose log retention from 7 to 365 days; the 
default is 30 days.

The plugin also stores security settings, encrypted 2FA and optional service credentials,
recovery-code hashes, protected-login state, scan evidence, file hashes, approvals,
and repair/quarantine metadata. Repair and quarantine files remain on the same server
in a protected local directory.

Guard adds suggested text to Settings > Privacy and integrates with WordPress personal-
data export and erasure tools. Erasure anonymizes user-linked audit events and removes
device fingerprints and unfinished 2FA setup data. Active 2FA credentials are retained
while the WordPress account exists to avoid weakening account security.

### Source Code and Licenses

CodeCanvas Guard is licensed GPLv2 or later. The bundled QR generator is MIT licensed.
Its human-readable upstream source is available at:

https://github.com/kazuhikoarase/qrcode-generator/tree/js2.0.4/js

See `THIRD-PARTY-NOTICES.txt` for the complete notice.

## Installation

 1. Back up the site and confirm hosting-panel or SSH access.
 2. Install and activate CodeCanvas Guard.
 3. Open CodeCanvas Guard and apply the Balanced profile.
 4. Configure 2FA from Users > Two-Factor Security.
 5. Generate and save an emergency recovery link before configuring a protected login
    route.
 6. Verify and activate the protected route, then test it in a private browser.
 7. Test checkout, membership, mobile-app, PWA, password-reset, and integration flows
    before applying Strict mode.

## FAQ

### Does Guard automatically remove malware?

No. Scans report evidence. Trusted WordPress sources can be reinstalled and executable
uploads can be quarantined only after explicit administrator approval. Custom, premium,
database, or ambiguous findings remain manual-review items.

### Why can some plugins not be repaired automatically?

Automatic repair is available only when the exact installed version has a trusted
WordPress.org package and checksum set. Premium, custom, or repository-removed plugins
require a trusted vendor package or manual restoration.

### Does repair activate another plugin?

No. Guard does not change another plugin’s activation status. If WordPress leaves
a repaired plugin inactive, Guard verifies the installed files and asks an administrator
to reactivate it manually from the native Plugins screen.

### Are repairs reversible?

Eligible plugin repairs create a protected pre-repair copy. Verification failure
triggers file rollback, and successful repairs retain a manual rollback point. Permission
repairs retain the previous mode. Quarantined files require a separate restore approval.
Keep a current hosting backup.

### Does fingerprint reduction make WordPress impossible to detect?

No. Guard removes common public indicators and simple enumeration paths, but themes,
assets, APIs, and behaviour can still reveal WordPress.

### Does the protected login route work with plain permalinks?

The request-path fallback is designed to work when pretty permalinks are unavailable.
Hosting rules, caching, and other security plugins can interfere, so verify the 
route before activation.

### Will XML-RPC blocking affect integrations?

It can. Jetpack, WordPress mobile apps, and other integrations may require XML-RPC.
The Balanced profile leaves XML-RPC available.

### Should I enable HSTS immediately?

No. Enable HSTS only after the whole site and every required resource work permanently
over HTTPS.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“CodeCanvas Guard” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ codecanvasinc ](https://profiles.wordpress.org/codecanvasinc/)

[Translate “CodeCanvas Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/codecanvas-guard)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/codecanvas-guard/),
check out the [SVN repository](https://plugins.svn.wordpress.org/codecanvas-guard/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/codecanvas-guard/)
by [RSS](https://plugins.trac.wordpress.org/log/codecanvas-guard/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.3.2

 * Replaced standalone browser `<style>` output with WordPress-enqueued stylesheet
   assets.
 * Moved login honeypot and Turnstile presentation rules into an enqueued login 
   stylesheet.
 * Tightened nonce ordering for settings and session actions so request data is 
   inspected only after intent verification.
 * Added explicit capability checks to self-service 2FA management actions.
 * Rotated protected-login route-test tokens after successful verification so each
   test URL is single-use.
 * Corrected the bundled QR generator source URL and WordPress.org contributor metadata.
 * Added narrowly scoped Plugin Check annotations for Cloudflare Turnstile’s required
   external service endpoints and reduced the session-user query to only rendered
   fields.

#### 1.3.1

 * Replaced repair, quarantine, rollback, permission, and vault mutations with the
   WordPress Filesystem API.
 * Replaced the dynamic audit query with literal prepared queries and short-lived
   cache invalidation.
 * Hardened public route, recovery-cookie, login-challenge, and settings input handling.
 * Added narrow reviewer annotations for public authentication tokens, one-time 
   migrations, custom audit tables, and optional Turnstile service loading.
 * Scoped uninstall variables, completed new migration-state cleanup, and preserved
   the legacy audit table until explicit uninstall.
 * Removed the export stream close warning and renamed the main runtime class to
   the unique plugin namespace.

#### 1.3.0

 * Replaced the former three-letter namespace with the unique `CCGUARD_` and `ccguard_`
   prefixes.
 * Added a verified migration for profiles, protected-login state, scan data, encrypted
   settings, 2FA metadata, transients, scheduled jobs, and audit events.
 * Preserved existing emergency and pending route-test links during the namespace
   upgrade.
 * Removed automatic activation of repaired plugins and added an explicit manual-
   reactivation result.
 * Added WordPress privacy-policy text, a personal-data exporter, and an anonymizing
   eraser.
 * Completed uninstall cleanup for new and legacy records, schedules, transients,
   metadata, tables, and protected vaults.
 * Added complete external-service disclosures and human-readable QR source attribution.
 * Updated WordPress compatibility metadata and reduced the directory readme below
   the processing limit.

Older release history is available in `changelog.txt`.

## Meta

 *  Version **1.3.2**
 *  Last updated **18 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.2 or higher **
 *  Tested up to **7.0.4**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [audit log](https://wordpress.org/plugins/tags/audit-log/)[hardening](https://wordpress.org/plugins/tags/hardening/)
   [login](https://wordpress.org/plugins/tags/login/)[security](https://wordpress.org/plugins/tags/security/)
   [two factor](https://wordpress.org/plugins/tags/two-factor/)
 *  [Advanced View](https://wordpress.org/plugins/codecanvas-guard/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/codecanvas-guard/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/codecanvas-guard/reviews/)

## Contributors

 *   [ codecanvasinc ](https://profiles.wordpress.org/codecanvasinc/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/codecanvas-guard/)