Title: WM Guard
Author: Witte Marketing
Published: September 24, 2026
Last modified: September 24, 2026
---
Search plugins
# WM Guard
By [Witte Marketing](https://profiles.wordpress.org/wittemarketing/)
[Download](https://downloads.wordpress.org/plugin/wm-guard.1.0.0.zip)
* [Details](https://wordpress.org/plugins/wm-guard/#description)
* [Reviews](https://wordpress.org/plugins/wm-guard/#reviews)
* [Installation](https://wordpress.org/plugins/wm-guard/#installation)
* [Development](https://wordpress.org/plugins/wm-guard/#developers)
[Support](https://wordpress.org/support/plugin/wm-guard/)
## Description
From the outside you can’t tell whether a plugin needs an important update, whether
system files have been modified, or whether a backup even exists. **WM Guard** reads
exactly these things – directly on your server – and shows them in plain language
under _Settings WM Guard_.
WM Guard’s site assessment works without an account or a connection to Witte Marketing.
Optional Witte Marketing services are activated only by explicit user action. Optional
online diagnostics use WordPress.org APIs only after an administrator actively enables
them in Settings, as documented below. WM Guard turns technical WordPress checks
into a clear overview of your site’s condition and the issues that deserve your
attention.
**What WM Guard checks**
* PHP version including end of security support
* WordPress version and pending updates for plugins and themes
* Unmodified core files (checksum comparison against WordPress.org)
* Program files in the uploads folder – a typical hiding place for backdoors
* Backup: detected solution and age of the last backup
* Maintenance mode and search engine visibility
* Default user role and open self-registration
* The “admin” username, error display (debug), folder permissions
* System email addresses, database version, memory limit
* Email authentication of your domain: SPF record and DMARC policy (via DNS)
* Further condition checks in the spirit of WordPress Site Health: recommended
PHP extensions, autoload data size, object cache, database character set, automatic
plugin updates, WordPress memory limit
* Inactive plugins and themes, pretty permalinks
* Recommended, privacy-friendly plugins per category (statistics, spam protection,
SMTP, activity log, text-to-speech)
**Principles**
* **Never changes your files.** The assessment only reads – it runs nothing and
writes no files.
* **No automatic transfer to Witte Marketing.** Site data is sent to Witte Marketing
only after an explicit action (see “External services”).
* **Online diagnostics require consent.** Core checksum and plugin-directory checks
use official WordPress.org APIs only after an administrator enables optional
online diagnostics in Settings. They use a neutral WM Guard user agent and send
only the WordPress version/locale or plugin identifier required for the check–
not your site’s URL, content, usernames, passwords, or customer data.
* **No personal content is transmitted.** The assessment does not transmit site
content, usernames, passwords, database credentials, orders, or customer data
to Witte Marketing.
* **Protection only on request.** The optional extra protection is off by default,
works purely at runtime, and can be switched off again at any time – it too changes
no file.
* **Switch off any time.** WM Guard can be deactivated at any time, and its own
stored data is removed on uninstall.
**Extra protection (optional)**
On request, WM Guard can switch on individual protections: make username enumeration
harder (block the REST users list and the ?author query for anonymous visitors),
disable XML-RPC, lock the backend file editor, and neutralize login messages. All
are off by default, work purely at runtime through WordPress filters – no file is
changed – and each can be switched off again at any time.
**Optional: the free Web Check by Witte Marketing**
On request – and only after an explicit action – you can additionally request a
free external analysis of your site (loading time, findability, accessibility, legal
notice requirements) and have the detailed report sent to you by email. Optionally
you can also enable ongoing monitoring by Witte Marketing. Without these actions,
no site data is sent to Witte Marketing. WordPress.org queries are separate optional
online diagnostics requiring their own opt-in.
### External services
WM Guard has optional WordPress.org online diagnostics and optional services by
Witte Marketing (Werner Witte, Ampfing, Germany). It also offers an independently
clickable vulnerability lookup and, if you enable online diagnostics, DNS and own-
site HTTP checks. Witte Marketing is contacted only after the explicit actions described
below.
**1. Free external analysis**
When you click “Get free external analysis”, the
address and name of this site plus the installed WM Guard version are sent to `https://
witte.marketing/wp-json/wm-webcheck/v1/agent/analyze` so the publicly reachable
homepage can be checked from the outside and the result shown here.
**2. Request the detailed report**
When you submit the report form, the address
of this site, the contact name and email address you entered, your consent flag,
and the consent-text version are sent to `https://witte.marketing/wp-json/wm-webcheck/
v1/agent/report` to deliver the report to you by email (with a confirmation link,
double opt-in).
**3. Enable ongoing monitoring**
When you enable monitoring, the address and name
of this site, the WM Guard endpoint, an access key, and the installed WM Guard version
are sent to `https://witte.marketing/wp-json/wm-webcheck/v1/agent/connect`. After
that, Witte Marketing may retrieve the technical overview shown above. The access
key is accepted only through the `X-WM-Agent-Key` request header, not as a URL parameter.
If an optional Witte Marketing workflow needs the current consent text and it is
not already available from the previous response, WM Guard may read it from `https://
witte.marketing/wp-json/wm-webcheck/v1/agent/consent` after that workflow has been
initiated by the administrator.
**4. Show external monitoring**
If a connection exists, WM Guard retrieves the
monitoring data (uptime, outages, server response time, page performance, SSL/domain
expiry) from `https://witte.marketing/wp-json/wm-webcheck/v1/agent/monitoring` when
you open its page, and displays it. Only the address of this site and the access
key are sent. Without an existing connection, nothing is retrieved.
In no case are content, usernames, passwords, database credentials or full logs
transmitted. You can end an activation again at any time.
Provider and legal information:
* Privacy policy: https://witte.marketing/datenschutz/
* Legal notice: https://witte.marketing/impressum/
* Web Check service description: https://witte.marketing/web-check/
**5. Official WordPress.org APIs (optional online diagnostics, off by default)**
Only after you enable “Allow optional online diagnostics” under Settings WM Guard
Settings, WM Guard may query WordPress.org when you open its page or during an enabled
notification run. For core-file integrity, WM Guard queries `https://api.wordpress.
org/core/checksums/1.0/` and sends the installed WordPress version and package locale.
For the removed/unmaintained-plugin check, WM Guard queries `https://api.wordpress.
org/plugins/info/1.2/` and sends the plugin identifier (slug). These checks are
cached (core checksums: 12 hours; plugin-directory result: 24 hours) and use a neutral`
WM Guard/` user agent so the site’s address is not included in the HTTP
user agent. WM Guard does not run these WordPress.org checks or schedule directory
queries before the opt-in. You can turn it off again at any time; pending directory
jobs and their cached results are removed. No separate outbound connectivity request
is sent; reachability is inferred from WordPress’ existing update state.
Provider: WordPress.org – privacy policy: https://wordpress.org/about/privacy/
**Additional online diagnostics under the same opt-in**
With this setting enabled,
WM Guard can query public SPF and DMARC DNS TXT records for the domain of the site,
and send HTTP GET/POST requests to its own site URL for maintenance-mode, REST and
loopback checks. DNS lookups necessarily reveal the queried domain to the configured
DNS resolver. The self-requests contact the website server and can appear in its
access logs. Results are cached. Without opt-in, these checks are unavailable rather
than reported as successful. This option does not activate any Witte Marketing service.
**6. Known-vulnerability check (wpvulnerability.net)**
Independently of Witte Marketing,
you can click “Check for security vulnerabilities now” in the “Known security vulnerabilities”
area. WM Guard then queries the free, public vulnerability database wpvulnerability.
net for each installed plugin (`https://www.wpvulnerability.net/plugin//`). Only the identifier (the directory name) of each plugin is transmitted – no
version numbers, not the address of your site, and no personal data; the comparison
against your installed versions happens locally afterwards. In its default state,
and without this click, nothing is queried. No access key is required.
Provider: wpvulnerability.net – website and terms of use: https://www.wpvulnerability.
net/
## Installation
1. Install and activate the plugin.
2. View local results under **Settings WM Guard**. Optional: enable online diagnostics
on the Settings tab to consent to documented network checks.
3. Optional: request a free external analysis or enable ongoing monitoring.
## FAQ
### Can WM Guard change my site?
The assessment only reads and changes no file. In addition there are optional protections(
extra protection): they are off by default, work only at runtime, and can be switched
off again at any time – they too write or change no file.
### Is data transmitted automatically?
No site data is sent to Witte Marketing unless you explicitly use one of the optional
actions described under “External services”. Optional WordPress.org, DNS and self-
HTTP diagnostics are disabled until you actively enable them in Settings. The independent
wpvulnerability.net lookup runs only when you click its button.
### Do I have to connect to Witte Marketing to use the plugin?
No. The technical overview works without a Witte Marketing account or connection.
WordPress.org integrity and plugin-directory checks can be enabled separately under
Settings WM Guard Settings. The Witte Marketing connection is a different optional
add-on.
### What if the access key falls into the wrong hands?
Generate a new key under _Settings WM Guard_. The previous one stops working immediately.
Alternatively, block access completely or end the connection.
### Does WM Guard promise security?
No. It points out technical issues and helps with maintenance. Security is risk
reduction, not a guarantee.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“WM Guard” is open source software. The following people have contributed to this
plugin.
Contributors
* [ Witte Marketing ](https://profiles.wordpress.org/wittemarketing/)
“WM Guard” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/wm-guard/contributors)
for their contributions.
[Translate “WM Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/wm-guard)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/wm-guard/), check out
the [SVN repository](https://plugins.svn.wordpress.org/wm-guard/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/wm-guard/) by [RSS](https://plugins.trac.wordpress.org/log/wm-guard/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* Initial public release of WM Guard.
* Read-only WordPress health and security assessment with plain-language findings.
* Checks WordPress, PHP, plugin and theme updates, core-file integrity, suspicious
files, backup status, maintenance mode, permissions, configuration, email authentication
and additional Site Health-style conditions.
* Optional runtime hardening for username enumeration, XML-RPC, the backend file
editor and login messages.
* Optional known-vulnerability check via wpvulnerability.net, started only by explicit
administrator action.
* Optional Witte Marketing Web Check and monitoring integration, activated only
by explicit administrator action.
* External monitoring endpoint is locked by default; access keys are accepted only
through the `X-WM-Agent-Key` request header.
* Optional WordPress.org, DNS and self-HTTP checks require explicit opt-in; WordPress.
org requests use a neutral user agent and are documented under “External services”.
* Includes malware-scan safeguards to prevent the scanner’s own built-in web-shell
signatures from triggering false positives.
* Daily notification processing is scheduled only when alarm or monthly-report
notifications are enabled.
* Prepared for WordPress.org translation delivery through translate.wordpress.org;
no bundled `.po` or `.mo` files are included.
## Meta
* Version **1.0.0**
* Last updated **7 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.7 or higher **
* Tested up to **7.1.2**
* PHP version ** 8.1 or higher **
* Languages
* [English (US)](https://wordpress.org/plugins/wm-guard/) and [German](https://de.wordpress.org/plugins/wm-guard/).
* [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/wm-guard)
* Tags
* [backup](https://wordpress.org/plugins/tags/backup/)[maintenance](https://wordpress.org/plugins/tags/maintenance/)
[monitoring](https://wordpress.org/plugins/tags/monitoring/)[security](https://wordpress.org/plugins/tags/security/)
[updates](https://wordpress.org/plugins/tags/updates/)
* [Advanced View](https://wordpress.org/plugins/wm-guard/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/wm-guard/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/wm-guard/reviews/)
## Contributors
* [ Witte Marketing ](https://profiles.wordpress.org/wittemarketing/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/wm-guard/)