Title: DevaGroup DevaGuard – Site Security Monitor Author: DevaGroup Published: October 28, 2026 Last modified: October 30, 2026 --- Search plugins ![](https://ps.w.org/devagroup-devaguard/assets/banner-772x250.png?rev=3770700) ![](https://ps.w.org/devagroup-devaguard/assets/icon-256x256.png?rev=3770688) # DevaGroup DevaGuard – Site Security Monitor By [DevaGroup](https://profiles.wordpress.org/kasroka/) [Download](https://downloads.wordpress.org/plugin/devagroup-devaguard.0.1.18.zip) * [Details](https://wordpress.org/plugins/devagroup-devaguard/#description) * [Reviews](https://wordpress.org/plugins/devagroup-devaguard/#reviews) * [Installation](https://wordpress.org/plugins/devagroup-devaguard/#installation) * [Development](https://wordpress.org/plugins/devagroup-devaguard/#developers) [Support](https://wordpress.org/support/plugin/devagroup-devaguard/) ## Description [DevaGuard](https://devaguard.pl) is a website security monitoring service run by DEVAGROUP sp. z o.o., Kraków, Poland. This plugin connects your site to a DevaGuard dashboard. Once a day, and right after every update, it collects information about your site and sends it to the DevaGuard server you configure. The dashboard turns it into a plain-language repair plan: what is urgent, why it matters and who should fix it. The plugin is read-only. It never changes your content, settings or files, never installs anything and does not expose any endpoint on your site. What the plugin reports: * WordPress, PHP, database and web server versions, plugins and themes with available updates. * File integrity: core and WordPress.org plugin files compared with official checksums, PHP files in uploads, unknown PHP files in wp-content, files changed in the last 7 days. * Suspicious rules in .htaccess, .user.ini and wp-config.php (only findings and a file hash are sent, never the file contents). * Injected scripts in posts, options and post meta (only the location and type of finding are sent, never the content). * Administrator events: new administrator, e-mail or password change, login from a new network, failed login bursts. Logins and IP addresses stay on your site; only hashes and counts are sent. * Last backup date (UpdraftPlus and common backup plugins). DevaGuard suggests what to check. It is not an oracle and does not replace the person responsible for the site or a security audit. No warnings does not mean no risk. DevaGuard is not limited to WordPress. Sites built on PrestaShop, Joomla, Drupal, Magento, OpenCart or custom code are monitored with a single agent file or with checks from outside (uptime, SSL, domain, blacklists). This plugin is the WordPress part of the service. DevaGuard is built and maintained by [DevaGroup](https://devagroup.pl). Service, dashboard and help: [devaguard.pl](https://devaguard.pl). ### External services This plugin sends data to a DevaGuard server. Nothing is sent until an administrator enters the server address and the site key in Tools DevaGuard. * What is sent: the report described above (software versions, plugin and theme list, integrity and configuration findings, hashed administrator logins, event counts). Passwords, wp-config.php contents, post contents and visitor or administrator IP addresses are never sent. * When: once a day, after plugin, theme or core updates, and when you click “Send data now”. In addition, every 5 minutes (WP-Cron) a short signed “site is alive” signal is sent to the same server. It contains the site ID, a timestamp, a signature, the signal interval, the HTTP status code and response time of the site’s own home page (checked by the plugin with a request to the site itself) and the expiry date of the site’s SSL certificate (read at most every 12 hours). No content of the site and no personal data. It lets the dashboard tell a real outage from a hosting firewall that blocks the DevaGuard server. * Where: the server address you enter. The DevaGuard service is operated by DEVAGROUP sp. z o.o., Kraków, Poland. * Terms of service: https://devaguard.pl/regulamin * Privacy policy: https://devaguard.pl/polityka-prywatnosci To check whether sensitive files (for example .env, wp-config.php backups or database dumps) are publicly accessible, the plugin requests those files from your own site( a request to itself, only for files that exist on disk). Only the file path and the result are reported, never the file contents. In the same way the plugin checks whether visitors can see account logins (/?author=1, /wp-json/wp/v2/users), XML- RPC, the WordPress version in the page code and readme.html; only yes/no results, the number of listed accounts and the version number are reported. To check file integrity the plugin also downloads official checksums from WordPress. org (api.wordpress.org and downloads.wordpress.org). Only the WordPress version, locale, plugin slugs and plugin versions are sent there. ## Screenshots [⌊Dashboard: all monitored sites with their status at a glance.⌉⌊Dashboard: all monitored sites with their status at a glance.⌉[ Dashboard: all monitored sites with their status at a glance. [⌊Site view: what was checked and what needs attention.⌉⌊Site view: what was checked and what needs attention.⌉[ Site view: what was checked and what needs attention. [⌊Repair plan: what is urgent, why it matters and who should fix it.⌉⌊Repair plan: what is urgent, why it matters and who should fix it.⌉[ Repair plan: what is urgent, why it matters and who should fix it. [⌊Issues to fix, each with who should fix it and step-by-step instructions.⌉⌊Issues to fix, each with who should fix it and step-by-step instructions.⌉[ Issues to fix, each with who should fix it and step-by-step instructions. [⌊Plugins and themes: versions, available updates and known vulnerabilities.⌉⌊Plugins and themes: versions, available updates and known vulnerabilities.⌉[ Plugins and themes: versions, available updates and known vulnerabilities. [⌊Alert settings: who gets e-mails and how often.⌉⌊Alert settings: who gets e-mails and how often.⌉[ Alert settings: who gets e-mails and how often. ## Installation 1. Install and activate the plugin. 2. In your DevaGuard dashboard add the site and copy the server address and the site key. 3. Go to Tools DevaGuard, paste both, click Save, then “Send data now”. ## FAQ ### Does it slow down my site? No. The plugin does nothing on visitor requests. The daily report runs in WP-Cron. ### Does it fix problems? No. It only reports. Fixes are made by the site administrator or the hosting company, following the instructions in the dashboard. ### Can I see what is sent? Yes. Tools DevaGuard shows everything the plugin collects, with a copy button. ### How do I remove it? Deactivate and delete the plugin. Uninstalling removes all its options and scheduled events. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “DevaGroup DevaGuard – Site Security Monitor” is open source software. The following people have contributed to this plugin. Contributors * [ DevaGroup ](https://profiles.wordpress.org/kasroka/) [Translate “DevaGroup DevaGuard – Site Security Monitor” into your language.](https://translate.wordpress.org/projects/wp-plugins/devagroup-devaguard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/devagroup-devaguard/), check out the [SVN repository](https://plugins.svn.wordpress.org/devagroup-devaguard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/devagroup-devaguard/) by [RSS](https://plugins.trac.wordpress.org/log/devagroup-devaguard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.18 * Detects a phpMyAdmin login page that the hosting provider serves under the site address (/phpmyadmin/, /pma/), even when it is not a folder of the site. Placeholder pages such as “phpMyAdmin moved” are ignored. #### 0.1.17 * After an automatic WordPress update the report is sent with the new version. Before, the report sent right after the update still carried the old version, so the updated core files were reported as modified. #### 0.1.16 * The site checks from inside whether account logins (/?author=1, REST users list), XML-RPC, the WordPress version and readme.html are visible to visitors, so the DevaGuard server no longer sends these requests from outside. Hosting firewalls( ModSecurity) treated them as a scan and blocked the DevaGuard server. #### 0.1.15 * Plugin renamed to “DevaGroup DevaGuard – Site Security Monitor” (directory review). The DevaGuard service and dashboard keep their name. * Sites behind Cloudflare: the login log records the visitor’s real address (taken from the Cloudflare header only when the connection really comes from Cloudflare), so ordinary logins are no longer reported as “from a new network”. * Administrator logins through XML-RPC and application passwords are logged too( once per hour per account and network). * Each login records how many failed attempts came from the same address in the hour before; plugin and theme installations are logged with the account that made them. #### 0.1.14 * The “site is alive” signal is sent every 5 minutes and includes the site’s own home page status and SSL certificate expiry date, so the dashboard can see the site from inside when the hosting firewall blocks the DevaGuard server. #### 0.1.13 * The report is sent right after plugins, themes or WordPress are updated, without waiting for WP-Cron. * “Verify after fixing” in the DevaGuard dashboard now requests a fresh report on the next heartbeat. * PHP libraries that plugins install in uploads (Composer packages, e.g. PDF generators for invoices) are reported separately and no longer raise a break-in alert; each file is still checked for typical web shell code. #### 0.1.12 * First release in the WordPress.org directory. ## Meta * Version **0.1.18** * Last updated **19 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.2 or higher ** * Tags * [File Integrity](https://wordpress.org/plugins/tags/file-integrity/)[monitoring](https://wordpress.org/plugins/tags/monitoring/) [security](https://wordpress.org/plugins/tags/security/)[uptime](https://wordpress.org/plugins/tags/uptime/) [vulnerability](https://wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://wordpress.org/plugins/devagroup-devaguard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/devagroup-devaguard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/devagroup-devaguard/reviews/) ## Contributors * [ DevaGroup ](https://profiles.wordpress.org/kasroka/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/devagroup-devaguard/)