Description
GuardForge hardens your WordPress site against common attacks without requiring an account or an API key. It applies proven hardening rules on activation, monitors for brute-force login attempts, protects your own account with two-factor authentication, checks your files against the build wordpress.org actually published, and keeps an audit log whose rows are hash-chained — so a line edited or deleted after the fact is detectable rather than deniable.
Nothing in the Free list below is capped, timed, or unlocked by paying. One thing in it reaches the network, it is off until you switch it on, and External services below describes it exactly: the file-integrity scan asks wordpress.org what your WordPress and your wordpress.org plugins are supposed to contain, so it can tell you when a file is not part of the official build — it sends a version number and a plugin slug, never your site’s address and nothing about your content.
Free
- Hardening score — twenty-one checks of your own installation, scored 0-100, with each row stating exactly how many points it is worth and linking to the screen that fixes it. No outbound request: every check reads this site.
- Staging / development mode — GuardForge notices when it is running on a copy of your site and stops acting on the world: lockouts are recorded but not enforced, and no notification e-mail, alert or firewall rule leaves the copy. Nothing that can switch it on survives a database copy, so a dump from staging can never disarm your live site.
- Login brute-force protection with per-IP lockout and automatic unblock
- Two-factor authentication for your own account — TOTP, a login challenge, and single-use recovery codes. Every logged-in user can reach the 2FA screen and protect their own login, not just administrators: editors, authors and shop managers hold accounts worth phishing too. The enrolment QR is drawn on your own server: no image is fetched from anywhere, so your secret never leaves the site.
- File integrity against the official checksums — off until you switch the monitor on in Settings, because the comparison asks wordpress.org for the hashes. Once on: every core file, and every plugin hosted on wordpress.org, is compared against the hashes wordpress.org publishes for that exact release. So the screen can say more than “this changed since yesterday”: it separates files that are official, modified, missing, and not in the official build at all — which is what a backdoor looks like, and which no scan-to-scan comparison can ever see, because a shell that was already there when the baseline was taken looks like every other unchanged file.
- A premium or custom plugin, and any theme, has no published hashes anywhere. Those files are marked “no reference” and stay on the scan-to-scan comparison. They are never counted as clean — a tick beside something nothing checked is worse than no tick at all.
- A core file that is modified or missing is named on the screen with its verdict, next to a link to Dashboard Updates: re-installing WordPress is what puts core files back, and this plugin does not write into wp-admin or wp-includes itself.
- Audit log, hash-chained — it records logins, failed attempts, option changes, plugin and theme activity, and user and role changes, and every row carries the hash of the row before it. Press “Verify chain” and the table is walked: change one field on one row and that row no longer matches its own hash; delete a row and the next one points at a hash nothing in the table produces. Neither is visible in the table itself, which is the point — an audit log an intruder can tidy up afterwards is decoration. Reading and verifying are free; only streaming it out as CSV is a Pro feature.
- Security hardening: disable XML-RPC, remove version headers, protect wp-config.php via .htaccess
- Content-Security-Policy header — your policy, sent report-only by default so a wrong rule cannot break the site
- IP management — allowlist, lift a lockout, login-log browser
- Spam-bot honeypot on the comment form
- WordPress core file protection rules (.htaccess)
Pro
GuardForge Pro is a separate add-on (installed alongside this free plugin) that unlocks:
- Two-factor enforcement policy — require every administrator to be enrolled before they can use the admin
- Alerts to Telegram, Slack and a signed webhook — a card per channel rather than a box of JSON, each with its own minimum severity, a “Send test” that really sends through the same dispatcher, and a digest you can leave immediate or batch hourly or daily. Quiet hours hold the ordinary traffic until morning, while a lockdown or a malware finding goes straight through them. Bot tokens, Slack URLs and HMAC secrets are encrypted on your own site and the form never prints one back — it shows the last four characters and nothing else
- Lockdown mode — one switch that closes registration, comments, XML-RPC and anonymous REST writes. It can also throw itself, if you ask it to: twenty different addresses locked out inside ten minutes, or a finding from the malware scanner. An automatic lockdown lifts itself after an hour, writes both ends to the audit log, e-mails you, and never fires on a copy of your site
- Vulnerability database — published advisories for WordPress, your plugins and your themes, matched against what is installed here, in real time as they are issued
- Patch by update — off until you switch it on: when an advisory names the version that fixes it and WordPress is offering an update that reaches it, GuardForge installs that update on cron, one plugin per run, with an allow list and a deny list, and tells you by e-mail and in the audit log. Never on a staging copy, never on a plugin directory that is a symbolic link, and never twice in a day after a failure
- Geo-IP blocking — block or allowlist whole countries
- Cloudflare Firewall Sync — push locked IPs into your own Cloudflare zone, with your own scoped token. Cloudflare’s published list of edge addresses is refreshed daily, IPv6 included, so a site behind a newer edge does not quietly start logging, counting and geo-locating every visitor as the edge itself
- WAF managed ruleset — in-PHP firewall covering SQLi, LFI, XSS, and PHP injection
- Malware scanner — heuristics + signature-based scanning across wp-content
- AI Threat Analytics — batched incident summary and recommendations via forge-api
- Audit log export (CSV, streamed — a year of log does not have to fit in memory)
GuardForge is part of the Forge Suite. Learn more and get Pro at https://avakode.com.
External services
This plugin reaches wordpress.org, and nothing else. Activating it contacts nobody and schedules nothing that would — the file-integrity monitor is off on a fresh install, and switching it on is what puts the daily lookup on the schedule. The only outgoing request it ever makes is the checksum lookup below, it happens only while the file-integrity monitor is switched on, and it asks a public catalogue a question that names nothing of yours.
wordpress.org, for the file-integrity scan. Off until you switch the monitor on in GuardForge > Settings. Then once a day, and whenever you press “Run scan now”, GuardForge asks api.wordpress.org for the checksum list of your WordPress version and locale, and downloads.wordpress.org for the checksum list of each installed plugin it hosts (its folder name and version number). Those are public catalogues: the request carries the version, the locale and the slug, and nothing else — not your site’s address, not your user list, not your content, not a licence key. Answers are cached, and one scan makes at most ten requests, so a site with sixty plugins is covered over a few days rather than in one burst. Switch the file-integrity monitor off in Settings and none of this happens.
- Endpoints: https://api.wordpress.org/core/checksums/1.0/ · https://downloads.wordpress.org/plugin-checksums/
- WordPress.org terms: https://wordpress.org/about/terms/ — privacy: https://wordpress.org/about/privacy/
Nothing about your site is sent on a schedule or in the background. A fresh install makes no request at all and schedules none; with the file-integrity monitor switched on it has one daily request — the checksum lookup, while that monitor is on — and it asks a public catalogue a question that names nothing of yours. Switch the file-integrity monitor off and this plugin makes no outgoing request at all.
Uninstalling
Deleting GuardForge always removes one thing: your two-factor enrolments. That table holds TOTP shared secrets and single-use recovery codes — credential material — and once the plugin is gone nothing can use them, while a database that outlives the plugin gets backed up, exported and copied to staging. Reinstalling means enrolling again, which takes half a minute; leaving shared secrets behind has no upside at all.
Everything else stays by default: your login log, file-integrity snapshots, audit trail and settings all survive a delete, so removing the plugin by accident does not take your history with it. If you want a clean slate, tick Delete GuardForge data on uninstall in GuardForge Settings before you delete.
The hardening score
GuardForge Hardening score works out one number from twenty-one checks of this installation. Every check reads your own site — options, constants, your .htaccess, your user list, WordPress’s own update transients. Nothing is fetched from anywhere, which is also why the score cannot verify a header by fetching your homepage: the score makes no external request of any kind, and that promise is worth more than the extra check. The three things in the free plugin that reach the network — the “Explain” button, the integrity scan’s checksum lookup and the daily advisory download — are all described above, and none of them is the score: it reads what the last scan already worked out and asks nobody anything.
A check that cannot apply here leaves the sum entirely rather than scoring zero. An nginx site has no .htaccess to write, so the two .htaccess checks go to “does not apply” and the remaining checks grow to fill the hundred. Marking a correctly configured site down for lacking an Apache file would be theatre.
Every check sits in one of four weight buckets, and there are no others. 12 is the control whose absence is how sites actually get taken over; 8 is a direct route in, or the loss of the evidence that one was used; 5 is reconnaissance and exposure that shortens somebody else’s work; 2 is worth doing, cheap, and not what the incident report will name. The full table:
https— 12two_factor_admins— 12updates_pending— 12debug_display— 8xmlrpc— 8brute_force— 8file_edit— 8integrity_baseline— 8admin_username— 5user_enumeration— 5rest_restricted— 5security_headers— 5csp— 5sensitive_files— 5audit_log— 5hide_version— 2directory_listing— 2login_captcha— 2pingback— 2bad_useragents— 2notifications— 2
The points a row advertises are the points you actually gain: the weights above are shared out over the checks that apply to your site so that they add up to exactly one hundred, and the headline is the sum of what those rows earned. With the Pro add-on installed and licensed, one more row joins the same list — installed plugins and themes with a published advisory, at 12 — and the shares are worked out again around it. Without the add-on that row does not exist and nothing on the screen mentions it.
The public badge
Off unless you switch it on. When you do, GuardForge issues a link on your own site that publishes a letter grade and the month it was worked out — nothing else.
The grade is not your score. It is worked out only from the eleven checks a stranger can already run against your site from outside with no login: the scheme, XML-RPC, whether ?author=1 gives up a login name, whether the REST API answers anonymous callers, the version in your generator tag, your response headers, your Content-Security-Policy header, whether a directory lists its contents, whether sensitive files answer directly, the login form, and the X-Pingback header. Everything on that list is already public, so the badge tells a passer-by nothing they could not have found by loading your site.
Your numeric score, your two-factor coverage, your brute-force thresholds, your integrity results, whether an account is called admin, your pending updates and any vulnerable components are never published, in any form. The link carries an unguessable token so nobody can walk a list of sites looking for weak ones, it can be reissued or turned off at any moment, views are never logged, and until you switch it on the address is not registered at all — your site answers WordPress’s own 404, exactly like a site without the plugin.
Installation
- Upload the
guardforgefolder to/wp-content/plugins/, or install through Plugins Add New. - Activate GuardForge through the Plugins menu.
- Open GuardForge Settings to review the hardening options.
- Visit GuardForge File integrity to create the initial baseline, and GuardForge 2FA to protect your own login. Point your other users at GuardForge 2FA as well — it is the one GuardForge screen every logged-in role can open, and it only ever touches the account of whoever is looking at it.
FAQ
-
Do I need an account or API key for the free version?
-
No. Every protection runs on your own server, and the one thing that reaches the network needs no account: the file-integrity scan asks wordpress.org for the official checksums of your WordPress version and your wordpress.org plugins, and says nothing about you. See External services above. Nothing else in this plugin ever leaves your site.
-
How do I get the Pro features?
-
Pro features ship in a separate “GuardForge Pro” add-on. Install this free plugin first, then add Pro from https://avakode.com.
-
Does the Pro add-on send my data anywhere?
-
Only what each feature needs. Nothing about your site reaches us from this plugin at all: its one outgoing request is the integrity scan’s checksum lookup, and that goes to wordpress.org. See External services above.
With the Pro add-on installed, its own vulnerability feed sends your licence key and domain, and AI threat analysis — off until you enable it — sends the security events your site already recorded, so it can answer what they mean. Your content, your users and your Cloudflare token never leave the site.
-
How would I know if somebody edited the audit log?
-
Press “Verify chain” on the audit-log screen. Every row carries the hash of the row before it, so an edited field breaks its own row, and a deleted row leaves the next one pointing at a hash the table cannot produce — the check names the first row that failed. Restoring a database backup over a live log will break it too, for the same honest reason. On a log larger than fifty thousand rows the check covers the oldest part and says plainly that it was truncated, rather than dying half-way and leaving you an empty screen; there is no resume yet, so lower the retention window if your log is routinely that big.
-
Will the alerts wake me up at three in the morning?
-
Only for the things that should. Each channel has its own minimum severity and you can batch the traffic into an hourly or a daily digest instead of sending it as it happens. Quiet hours hold ordinary alerts until the hour you name — but a lockdown and a malware finding are let through immediately, which is why every signal carries a category as well as a severity. Alerts are part of the Pro add-on.
-
Will GuardForge conflict with other security plugins?
-
GuardForge is designed to coexist with Wordfence, Sucuri, iThemes Security, and similar plugins. If you notice a conflict, please open a support thread.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“GuardForge” is open source software. The following people have contributed to this plugin.
Contributors
Translate “GuardForge” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.3.5
- The Forge Suite screens look for sibling plugins in the directory WordPress reports and nowhere else, so a site whose plugin directory has been moved on its own is read correctly.
1.3.4
- The file-integrity monitor is off until you switch it on, and activation no longer schedules its daily lookup: the comparison asks api.wordpress.org for the official checksums, and no request goes out before you ask for one. “Run scan now” still runs a single scan whenever you press it.
- The Forge Suite screens look for sibling plugins through WordPress’s own constants, so an installation whose content directory has been moved is read correctly.
- The Geo-IP screen names the path it actually reads the MaxMind database from, instead of assuming the default uploads folder.
- Generated admin markup — the log pagers, the enrolment QR code, the header logo and the alert channel cards — is escaped against an allowlist where it is printed.
1.3.3
- This plugin no longer writes into WordPress’s own directories. A modified or missing core file is reported exactly as before, and the screen now links to Dashboard Updates: re-installing WordPress is what puts core files back.
- The alerts screen loads its script through WordPress instead of printing it into the page.
- Two standing notices — the warning about an add-on too old for this core, and the staging banner — appear on GuardForge screens, the plugin list and the dashboard instead of on every screen in the admin.
1.3.2
- When the vulnerability feed is off, a notice on the dashboard, the plugin list and GuardForge’s own screens tells an administrator so and links to the switch in Settings. It goes away once the feed is on or the notice is dismissed.
1.3.1
- The vulnerability feed stays off until you switch it on in Settings; activation no longer schedules a daily download from api.avakode.com.
- Request input is unslashed and sanitised on every read, queries on the plugin’s own tables are prepared, and admin screens escape their output.
- Two-factor and login CAPTCHA keys carry the full guardforge_ prefix. A challenge started before the update still completes, and uninstall now also removes the CAPTCHA transients.
- The plugin’s site is now guardforge.app: the plugin header, the Forge Suite dashboard and the translations link there, as do the links to Velocity Forge (velocityforge.app) and Flow Forge (flowforgewp.app).
1.3.0
- This release needs GuardForge Pro 1.2.0 or newer — unchanged from 1.2.1; an older add-on is switched off whole, and an admin notice names both versions.
1.2.1
- This release needs GuardForge Pro 1.2.0 or newer. An older add-on is switched off whole rather than left running, and here that is the safer half: an add-on from before 1.2.0 has never heard of staging mode, so on a copy of your site it would go on mailing alerts and pushing to Cloudflare while the banner promised silence. Until you update it alerts to Telegram, Slack or a webhook, the Cloudflare firewall push, automatic lockdown, patch by update, the WAF, malware scanning, AI threat analysis, required 2FA and audit export are unavailable. Your logs, baselines and settings are kept.
- Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product’s too.
- Brand: new product icon and admin logo.
1.2.0
- New in Pro, off until you switch it on: patch by update. When an advisory matching an installed plugin names the version that fixes it, and WordPress is offering an update that reaches that version, GuardForge installs it — on cron, one plugin per run, never during a page request — then e-mails you and writes it to the audit log. An allow list and a deny list decide what it may touch; a staging copy, a plugin directory that is a symbolic link, and anything that failed in the last twenty-four hours are all left alone. An update that is merely newer is never enough: without a named fixed version the rule does nothing.
- Cloudflare’s published edge addresses are now refreshed daily instead of being a snapshot compiled into the plugin, and IPv6 edges are covered for the first time. A stale list is why a site behind a newer Cloudflare edge would log, count and geo-locate every visitor as the edge itself. If the refresh fails the previous list stays in use, and the Cloudflare screen says when it last changed.
- New: the audit log is hash-chained. Every row now carries the hash of the row before it and a hash of its own contents, and a “Verify chain” button walks the table. Edit one field on one row and that row stops matching its own hash; delete a row and the gap shows, because the next row points at a hash nothing in the table produces. Neither was visible before, and an audit log that can be tidied up after the fact is the one piece of evidence an intruder has a reason to touch. Rows written before this release have no hashes and are read as unhashed rather than as a break. Writes are serialised with a real database-level lock, so two events at the same instant cannot fork the chain and have it read afterwards as tampering.
- New in Pro, off until you switch it on: lockdown can throw itself. Twenty different addresses crossing the brute-force threshold inside ten minutes, or — separately, and off by default — a single finding from the malware scanner, and GuardForge closes registration, comments, XML-RPC and anonymous REST writes without waiting for you to read an e-mail. It lifts itself after an hour by default, both ends go into the audit log, you are e-mailed, and it never fires on a copy of your site. The ten-minute window is measured against your site’s own clock rather than the database server’s, which on a host where the two disagree is the difference between a trigger that fires on the first lockout and one that never fires at all.
- Pro alerts are configurable by a person. The screen was a textarea of raw JSON that printed your bot tokens and HMAC secrets back in clear text; it is now a card per channel — Telegram, Slack or a signed webhook — with an enabled toggle, a minimum severity of its own, and a “Send test” that really sends through the same dispatcher and saves nothing. Secrets are encrypted at rest and shown only as their last four characters; leaving the field empty keeps what is there, so the first save through the new form migrates an old clear-text secret without you touching it. Added with them: a digest you can set to immediate, hourly or daily, and quiet hours in your site’s own timezone — which a lockdown or a malware finding bypasses, because those are the two you wanted waking up for.
- New: file integrity against the official checksums. Every core file, and every plugin hosted on wordpress.org, is now compared against the hashes wordpress.org publishes for that exact release, so the screen can say what a scan-to-scan comparison never could: this file is not part of the official build. That is the shape a backdoor has, and it is invisible to a snapshot diff — a shell that was already on disk when the baseline was taken looks exactly like an unchanged core file.
- Each file gets one of five verdicts: official, modified, not in the official build, missing, or no reference. A premium or custom plugin has no published hashes anywhere, and neither does any theme; those files keep the scan-to-scan comparison and are never counted as clean. wordpress.org answers 404 for everything it does not host, and reading that as a pass would put a tick beside the files an attacker is likeliest to be living in.
- The scan asks wordpress.org at most ten times per run and caches every answer, so a site with sixty plugins is covered over a few days rather than in one burst that a cron tick cannot survive. What it could not reach is queued for the next run and the screen names it.
- The hardening score no longer calls a baseline fresh on a site whose own scan found a file nobody published. “File integrity has a fresh baseline — Done” over a web shell located an hour ago was the worst line this plugin could print.
- It is the only thing in the free plugin that sends anything ABOUT your site, and it only happens when you press the button. See Third-Party Services above for exactly what one press sends.
- New: staging / development mode. GuardForge works out whether it is running on a copy — from WP_ENVIRONMENT_TYPE, from a GUARDFORGE_STAGING_MODE constant in wp-config.php, or from a list of staging host names you keep — and then stops acting on the outside world. Lockouts are counted and logged as “soft-locked” but nobody is shut out, the lockout, new-administrator and file-integrity e-mails stop, and with Pro installed the alerts, the Cloudflare firewall push and the credit-spending AI analysis stop too.
- Nothing that can switch staging mode ON is kept in the database. The host list is matched against the address the site is actually served on, so copying a staging database onto your live site stops it matching the instant the domain changes; the only manual on-switch is a wp-config.php constant, which no database dump can carry. Two independent ways to force production exist for the case where a real site is mistaken for a copy.
- While the mode is on it says so on every admin screen and in the admin bar on the front end, names the signal that decided it, and counts what it has held back. The transition on and off is written to the audit log.
- New: a hardening score. Twenty-one checks of your own site, one number out of a hundred, and a checklist where every row states what it is worth and links to the screen that changes it. The weights are published in the readme so the number can be argued with — a score nobody can audit is a score nobody should believe.
- A check that cannot apply to your server leaves the sum instead of scoring zero, so an nginx site is no longer marked down for not having an Apache file, and can still reach 100.
- The score is recorded once a day and kept for a year, so the screen can show whether the site is getting better or quietly drifting.
- New, and off until you ask for it: a public badge. It publishes a letter grade and the month it was checked, worked out only from the eleven things a stranger could already determine by loading your site. Your score and every private check stay private. The link carries an unguessable token, can be reissued or revoked, logs nothing, and does not exist at all until you switch it on.
- Anyone who can log in can now enrol in 2FA. The screen was registered for administrators only, so on a site with one admin and twenty editors, twenty people had no way to switch on a second factor — while the plugin’s own handlers had been willing to enrol them the whole time. GuardForge 2FA is now open to every logged-in role, exactly like WordPress’s own profile screen; every other GuardForge page, and the site-wide “require 2FA for administrators” policy, stay administrators-only.
- Staging mode names only the channels the installed add-on actually holds back. The alert and Cloudflare guards live in GuardForge Pro 1.2.0; beside an older add-on the banner and the settings panel stay quiet about them rather than promising a suppression that is not on the disk.
1.1.0
- Two-factor authentication is now part of the free plugin: TOTP enrolment, the login challenge and single-use recovery codes, for your own account. Requiring 2FA of every administrator stays in Pro.
- File-integrity monitoring now covers plugins and themes on the free plugin too — it is a setting, not a licence.
- The 2FA enrolment screen draws its QR code on your own server. It used to fetch the image from a third-party QR service with your TOTP secret in the URL — the whole second factor, handed to somebody else on every page view. GuardForge now ships its own encoder; nothing about enrolment leaves the site.
- Deleting the plugin now cleans up after itself. There was no uninstall routine before this release, so removing GuardForge left all five of its tables in the database — including your two-factor secrets. Enrolments are always removed now; the rest goes only if you ask, with a new setting for it.
- Audit log export moved into the Pro add-on, where its code now lives — the free plugin no longer carries an exporter it will not run.
- Free screens no longer show disabled Pro controls.
- GuardForge Pro 1.1.0 pairs with this release; nothing in the plugin enforces it, so an older add-on keeps running with the features it does not have simply absent.
1.0.1
- Audit log export (CSV, streamed) — the Pro feature the licence already listed.
- Removed two licence entries with no implementation behind them (multisite admin, daily PDF report); they return when built.
1.0.0
- Initial public release. WordPress.org Free core; Pro features delivered by the separate GuardForge Pro add-on.