Title: DecaGuard — Compromise Detection for WooCommerce Author: DiegoDeca Published: August 29, 2026 Last modified: August 29, 2026 --- Search plugins ![](https://ps.w.org/decaguard-compromise-detection-for-woocommerce/assets/banner- 772x250.png?rev=3671606) ![](https://ps.w.org/decaguard-compromise-detection-for-woocommerce/assets/icon- 256x256.png?rev=3671606) # DecaGuard — Compromise Detection for WooCommerce By [DiegoDeca](https://profiles.wordpress.org/deca1992/) [Download](https://downloads.wordpress.org/plugin/decaguard-compromise-detection-for-woocommerce.0.2.0.zip) * [Details](https://wordpress.org/plugins/decaguard-compromise-detection-for-woocommerce/#description) * [Reviews](https://wordpress.org/plugins/decaguard-compromise-detection-for-woocommerce/#reviews) * [Installation](https://wordpress.org/plugins/decaguard-compromise-detection-for-woocommerce/#installation) * [Development](https://wordpress.org/plugins/decaguard-compromise-detection-for-woocommerce/#developers) [Support](https://wordpress.org/support/plugin/decaguard-compromise-detection-for-woocommerce/) ## Description Most shop owners find out they have been hacked when their payment provider tells them, or when a customer complains about a fraudulent charge. By then the damage is done. DecaGuard learns what your shop normally looks like, then watches for anything that changes without your say-so: files appearing where files should not appear, new administrator accounts, hidden add-ons, settings that quietly gained code in them, and outside companies that started running code on your pages. When it finds something, it explains what happened in ordinary language — what the risk is to your money and your customers, and what to do next. If the change was you, one click marks it as expected and you never hear about it again. #### It watches. It does not touch anything. DecaGuard never blocks, deletes, quarantines, modifies, or repairs anything on your shop. It is not a firewall, it does not sit between your customers and your pages, and it never touches your checkout, your payment gateway callbacks, or the WooCommerce API. This is deliberate. Real compromises leave several ways back in. Automated cleanup either misses one — leaving you confidently reinfected — or deletes something your shop needs and takes it offline. Both are worse than a clear warning and a decision you make yourself. #### What it looks at * **Your files.** Program files appearing in your uploads folder, code hidden inside images, changes to WordPress’s own files (checked against the official published list), and changes to your main settings file. * **Your database.** Web addresses hidden in your shop’s settings, scheduled tasks that no add-on owns, and tasks that quietly fetch instructions from outside. * **Your accounts.** New administrators, accounts that gained powers they did not have, and — importantly — accounts or add-ons that have been hidden from your own lists. Nothing legitimate hides from you. * **Code running on your pages.** Which outside companies run code on your shop, when one of them quietly changes what it sends you, and web addresses that are near-identical imitations of ones you trust. #### Built to be quiet A security tool that cries wolf gets switched off, and then it protects nobody. DecaGuard spends its first two days simply learning your shop and raising nothing at all. It knows that add-on updates change files constantly, that payment gateways send odd-looking data, and that bulk imports look like attacks. Findings are graded, and anything you confirm as expected stays quiet for good. #### What this plugin sends outside your site DecaGuard makes a small number of outbound requests, all of them listed here: 1. **api.wordpress.org** — downloads the official checksum list for your exact WordPress version, so modified core files can be spotted. No information about your site is sent; only the version number and language are in the request. 2. **Your own shop’s public pages** — the plugin requests your homepage, cart page and one product page, exactly as a visitor’s browser would, to see what code runs on them. These requests never leave your own server. 3. **Files your pages already load from other companies** — if one of your pages loads a file from, say, a payment provider or a chat widget, the plugin downloads that same file and compares it with what it saw last time. This is what lets it tell you when a company you rely on quietly changes the code it runs on your shop, which is how several large 2026 attacks worked. 4. The request is anonymous: it identifies the plugin and nothing else. Your address, your shop’s name, your customers and your orders are not part of it, and no data is sent anywhere — the plugin only downloads. Only addresses that already appear in your own pages are ever requested. 5. If you would rather it did not, switch off **Outside code** under DecaGuard Settings. Every other check carries on working. No customer data, order data, or personal information ever leaves your site. ## Screenshots [⌊The DecaGuard screen: findings in plain English, worst first, each with a one- click "This was me".⌉⌊The DecaGuard screen: findings in plain English, worst first, each with a one-click "This was me".⌉[ The DecaGuard screen: findings in plain English, worst first, each with a one-click“ This was me”. [⌊Settings: choose where warnings go and how often your shop is checked.⌉⌊Settings: choose where warnings go and how often your shop is checked.⌉[ Settings: choose where warnings go and how often your shop is checked. ## Installation 1. In your WordPress admin, go to Plugins Add New and search for “DecaGuard”. 2. Click Install Now, then Activate. 3. Open **DecaGuard Settings**, enter the address you want warnings sent to, and tick “Send me a summary of anything found”. Anything urgent or important is emailed the moment it appears; everything else arrives in a daily summary. That is all. DecaGuard begins learning your shop straight away. For the first two days it watches quietly and raises nothing, so it can learn what is normal on your shop before it starts telling you about changes. After that, anything it finds appears on the **DecaGuard** screen. ## FAQ ### Will this slow my shop down? No. DecaGuard adds nothing at all to the pages your customers see. All the work happens in the background, in small pieces, and pauses itself so it never hogs your hosting. ### Will it break my shop? It cannot. DecaGuard only looks — it never changes, deletes, or blocks anything. It also never goes near your checkout or your payment gateway. ### It says a new add-on appeared, but that was me. Then click “This was me”. It records that, and you will not be asked about that one again. ### Why did it not tell me anything for the first two days? Because it was learning. Every shop is different, and a tool that starts shouting before it knows what is normal on yours is a tool that gets switched off. After two days it has a picture of your shop and will tell you when that picture changes. ### I already run another security plugin. Is that a problem? No, but you may hear about the same thing twice, once from each. DecaGuard notices when another security plugin is active and mentions it on the dashboard. ### Does it clean up an infection? No, deliberately. Attacks usually leave several ways back in, and automatic cleanup either misses one or deletes something your shop needs. DecaGuard tells you what it found and what to do about it, and leaves the decision to you and your developer. ### Does it work without WooCommerce? Yes. The checks all work on any WordPress site. The cart and product page checks simply do not run when WooCommerce is not installed. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “DecaGuard — Compromise Detection for WooCommerce” is open source software. The following people have contributed to this plugin. Contributors * [ DiegoDeca ](https://profiles.wordpress.org/deca1992/) [Translate “DecaGuard — Compromise Detection for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/decaguard-compromise-detection-for-woocommerce) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/decaguard-compromise-detection-for-woocommerce/), check out the [SVN repository](https://plugins.svn.wordpress.org/decaguard-compromise-detection-for-woocommerce/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/decaguard-compromise-detection-for-woocommerce/) by [RSS](https://plugins.trac.wordpress.org/log/decaguard-compromise-detection-for-woocommerce/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.2.0 * Instant email now covers every urgent and important finding for everyone. * Prefixed all classes, options, tables and scheduled tasks to avoid collisions. * Uses the WordPress path APIs throughout, fixing a case where a wp-config.php located above the site root was never checked. * Removed the site address from requests for third-party files, and added a setting to switch those requests off entirely. #### 0.1.0 * First release. * File, database, account and page-code monitoring. * Severity grading with a false-positive exclusions layer. * Two-day learning period on activation. * Dashboard with one-click confirmation, instant email on urgent findings, and a daily summary email. ## Meta * Version **0.2.0** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [ecommerce](https://wordpress.org/plugins/tags/ecommerce/)[File Integrity](https://wordpress.org/plugins/tags/file-integrity/) [malware detection](https://wordpress.org/plugins/tags/malware-detection/)[security](https://wordpress.org/plugins/tags/security/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/decaguard-compromise-detection-for-woocommerce/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/decaguard-compromise-detection-for-woocommerce/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/decaguard-compromise-detection-for-woocommerce/reviews/) ## Contributors * [ DiegoDeca ](https://profiles.wordpress.org/deca1992/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/decaguard-compromise-detection-for-woocommerce/)