CodeCanvas Guard

CodeCanvas Guard is a local-first WordPress security suite built around reviewable changes and safe recovery.

Core features include:

• Safe, Balanced, and Strict protection profiles.
• A recovery-first custom login route with browser verification before activation.
• Username-and-IP rate limiting, CIDR allow/block rules, a login honeypot, and generic login errors.
• TOTP two-factor authentication with encrypted secrets and one-use recovery codes.
• Optional role-based 2FA enforcement and optional Cloudflare Turnstile.
• REST user protection, author-enumeration blocking, XML-RPC and pingback controls, security headers, and file-editor protection.
• WordPress core and eligible WordPress.org plugin checksum checks.
• Local suspicious-PHP patterns, executable uploads, unsafe permissions, recent sensitive-file changes, and known-vulnerability matching.
• Critical, High, Medium, Informational, and Unavailable findings with exact reasons and evidence.
• Administrator-reviewed findings, exact-file hash approvals, filters, and protected CSV/JSON exports.
• Scheduled scans and priority-aware file monitoring with explicit coverage reporting.
• Administrator-approved trusted repairs, protected recovery points, quarantine, restore, and rollback.
• Security activity logs, update awareness, session review, and optional email alerts.

Scheduled scans do not modify files. Repair, quarantine, restore, and rollback actions require an authenticated administrator action and nonce. Guard does not send telemetry to CodeCanvas.

Emergency Recovery

The dashboard can create a one-time emergency login link. The link expires after 30 minutes and opens a 15-minute recovery session.

For hosting-level recovery, add the following above the stop-editing comment in wp-config.php:

define( 'CODECANVAS_GUARD_DISABLE', true );

Remove the line after access is restored and the configuration is corrected.

External Services

CodeCanvas Guard uses external services only for the features described below.

WordPress.org services

Integrity scans, native update awareness, and approved trusted repairs use official WordPress.org services. Depending on the action, WordPress sends the installed WordPress version and locale, or plugin/theme identifiers and versions, and receives checksum data, update metadata, or an official package. Guard uses the native WordPress HTTP and updater APIs. These requests occur during manual or scheduled scans, update checks, and an administrator-approved repair.

Service: https://wordpress.org/
Privacy policy: https://wordpress.org/about/privacy/
Terms: https://wordpress.org/about/terms/

Wordfence Intelligence

Known-vulnerability matching is optional. When enabled with an API key, the server sends the API key and normal HTTP request metadata to Wordfence Intelligence and downloads its V3 production vulnerability feed. Guard compares the feed with the installed inventory locally; website files and the installed inventory are not uploaded to Wordfence. The service requires a Wordfence Intelligence API key.

Service and setup: https://www.wordfence.com/help/wordfence-intelligence/v3-accessing-and-consuming-the-vulnerability-data-feed/
Terms and privacy: https://www.wordfence.com/terms-of-use-and-privacy-policy/

Cloudflare Turnstile

Turnstile is optional and disabled by default. When configured, Cloudflare’s challenge script loads on interactive login pages. Cloudflare can process browser and device information under its policy. During login, Guard sends the challenge response, configured secret, and visitor IP address to Cloudflare for verification.

Service: https://www.cloudflare.com/products/turnstile/
Privacy policy: https://www.cloudflare.com/privacypolicy/
Terms: https://www.cloudflare.com/website-terms/

Privacy

Guard can store WordPress user IDs, IP addresses, event times, action summaries, limited technical context, user agents, and hashed device fingerprints for security and accountability. Administrators choose log retention from 7 to 365 days; the default is 30 days.

The plugin also stores security settings, encrypted 2FA and optional service credentials, recovery-code hashes, protected-login state, scan evidence, file hashes, approvals, and repair/quarantine metadata. Repair and quarantine files remain on the same server in a protected local directory.

Guard adds suggested text to Settings > Privacy and integrates with WordPress personal-data export and erasure tools. Erasure anonymizes user-linked audit events and removes device fingerprints and unfinished 2FA setup data. Active 2FA credentials are retained while the WordPress account exists to avoid weakening account security.

Source Code and Licenses

CodeCanvas Guard is licensed GPLv2 or later. The bundled QR generator is MIT licensed. Its human-readable upstream source is available at:

https://github.com/kazuhikoarase/qrcode-generator/tree/js2.0.4/js

See THIRD-PARTY-NOTICES.txt for the complete notice.