Sitemap Guardian

Description

Sitemap Guardian by Sitemap Co. provides a scored local web application firewall with canonicalized XSS, RFI/LFI, SQL injection, code-execution, traversal, and protocol rules; login rate limiting; privacy-conscious audit and traffic logging; smart 404 throttling; comment spam heuristics; response headers; WordPress hardening; whole-site suspicious-code scanning with live file-by-file progress; and WordPress core checksum verification.

Login lockouts are enforced per IP. Requests rejected during an active lockout do not increment the password-failure counter or extend the original expiry. Seven-day dashboard and email totals are capped at the configured failure threshold for each IP and lockout-duration window.

Identity monitoring includes anonymous author/REST/oEmbed enumeration protection, programmatic administrator-role guards, administrator login and password-change emails, critical file-scan alerts, and weekly security summaries. Email delivery uses WordPress wp_mail. Administrator-login emails link the direct remote IP to an Opentracker lookup page; Sitemap Guardian does not contact Opentracker automatically, but opening the link sends the IP to that service.

The audit trail defaults to the latest seven local calendar days, supports date filtering and pagination with 100 raw events per page, and groups repeated actions from the same IP into expandable rows. New audit events show the validated IP address where available.

Audit timestamps are stored in UTC internally and displayed using the timezone, date format, and time format configured in WordPress General Settings.

When Smart 404 protection reaches its configured probe threshold, the audit trail records and displays the attempted URL path without its query string. Grouped events show every captured path inside the accordion.

Blocked and Learning-mode firewall events likewise display their sanitized request path without query-string data, both in individual audit rows and grouped accordion occurrences.

Firewall audit entries explain why the request was blocked or detected, distinguishing manual IP blocks, attack-tool user agents, and scored rule matches. Applicable firewall rule IDs are displayed for technical review.

Successful sign-in audit rows display the sanitized WordPress username together with the validated IP address where available. Grouped sign-in accordions show the username for every occurrence.

Administrators can add a validated audit-event IP directly to the firewall block list. The control preserves existing rules, recognizes IPv4 and IPv6 CIDR ranges, and refuses to block the current administrator IP or an address covered by the allowlist.

New audit events record a sanitized user-agent string of up to 255 characters and display it on individual rows and inside grouped occurrences. Older retained events show that the browser was not recorded.

The WordPress administrator menu uses a dedicated white, transparent Sitemap Co. logo asset in place of the generic shield icon, optimized for visibility against the dark expanded and collapsed menu layouts.

Country access rules can block listed countries or allow only listed countries using Cloudflare’s locally supplied visitor-country header or the sitemap_guardian_country_code WordPress integration filter. Unknown-country behavior and authenticated-administrator bypass are configurable. No visitor IP is sent to an external geolocation lookup service.

Country rules use a searchable checkbox picker with locally bundled SVG flags, localized country names, ISO codes, and a Tor-network option. Existing code-based selections migrate without changing enforcement. Flag artwork is provided by the MIT-licensed flag-icons project and does not require a CDN request.

Sitemap Guardian admin dates always include the calendar day and use the WordPress site timezone. Date-time displays use a localized day Month year date together with the time format configured in WordPress General Settings and the active timezone abbreviation or offset.

The Sitemap Guardian WordPress admin-menu icon is constrained to the standard menu-icon dimensions on every admin page, including when another plugin or admin theme overrides WordPress image styles.

Authenticated WordPress content editors with the unfiltered_html capability can save trusted HTML through admin and REST write requests without triggering payload-signature false positives. IP, country, bot, and user-agent protections remain enforced, and public submissions remain fully inspected.

Emergency controls provide an IP-only total-site lockdown and a master pause for active Sitemap Guardian protections. Independent uninstall preferences control removal of managed .htaccess marker rules and permanent deletion of plugin tables, settings, scan data, and user metadata.

Before its first managed .htaccess change, Sitemap Guardian stores a clean copy in the WordPress database. Cleanup restores the exact original file when no unrelated changes have occurred; otherwise it removes only Sitemap Guardian marker blocks so newer third-party rules are preserved.

Independent protection-status email settings report plugin deactivation, firewall enable/disable changes, and master pause/resume changes with the responsible WordPress user, IP address, site time, and website URL where available.

Settings pages detect unsaved field changes and warn before switching Sitemap Guardian tabs, refreshing, closing, or navigating away. Submitting Save Changes clears the warning.

Advanced hardening provides managed Apache/LiteSpeed rules for directory indexes, web access to .htaccess and wp-config.php, server signatures, upload request size, upload-script execution, and image hotlinking. PHP controls add a WordPress upload cap, safe site-wide HTTPS redirects, XML-RPC/feed restrictions, XSS request inspection, blank-header POST blocking, and forward-confirmed reverse-DNS validation for user agents claiming to be Google crawlers. Server rules require compatible Apache/LiteSpeed AllowOverride configuration; Nginx rules must be applied at the hosting layer.

Login security adds an optional custom login path, local arithmetic CAPTCHA with a honeypot, email one-time login codes, RFC 6238 TOTP enrollment through WordPress profiles, optional hiding of password-recovery links, and an explicit force-reset action for all existing users. Email verification depends on reliable wp_mail delivery. TOTP secrets are stored in user metadata and must be protected by normal database access controls.

Maintenance operations include a daily file-permission check, an explicit bounded permission repair, atomic WordPress salt rotation, and guarded single-site database-prefix migration. Salt rotation logs out every user. Prefix migration refuses Multisite, validates table names and collisions, uses an atomic SQL table rename, updates role/capability keys, and rolls table names back if wp-config.php cannot be committed. Always take tested off-site file and database backups before either operation.

The Sitemap Guardian overview displays a cached, sanitized list of recent security announcements from the official WordPress.org security news feed. A feed outage never blocks or delays security controls.

Suspicious-code findings can be marked as false positives. Ignores are fingerprinted to the file path, rule, indicator, and SHA-256 file hash, so any later file modification is automatically inspected and alerted again.

Administrators can mark suspicious-code findings as false positives or permanently delete a confirmed malicious file. Deletion requires a per-file nonce and an unchanged SHA-256 hash from the latest scan. Sitemap Guardian does not provide a PHP or JavaScript file editor. Deleting plugin or theme files can break a site; maintain a tested backup and rescan immediately afterward.

Administrators are warned when Wordfence or another known overlapping firewall, login-security, malware-scanning, or hardening plugin is active. Sitemap Guardian never deactivates another plugin automatically.

No WordPress plugin can prevent every attack. Use maintained hosting, least privilege, prompt updates, tested off-site backups, TLS, and an incident-response plan alongside this plugin.

Privacy

This version sends no product telemetry. WordPress core checksum scans contact WordPress.org. Security audit events store a validated IP address where available, plus a keyed IP hash, in the site’s own database; older events recorded before version 0.11.0 contain only the irreversible hash. Records follow the configured retention period. Audit context is bounded and sanitized. Administrators choose whether deletion of the plugin also removes its database tables, settings, scan results, and user metadata.

External services

WordPress core checksum verification contacts the official WordPress.org checksum service when a scan is finalized.

The dashboard requests the official WordPress.org security-news RSS feed. The response is cached locally and a failure does not affect protection.

Administrator-login emails can contain an Opentracker IP lookup link. Sitemap Guardian does not contact Opentracker automatically; the IP address is sent to Opentracker only if an email recipient opens that link.