DecaGuard — Compromise Detection for WooCommerce

Most shop owners find out they have been hacked when their payment provider tells
them, or when a customer complains about a fraudulent charge. By then the damage
is done.

DecaGuard learns what your shop normally looks like, then watches for anything
that changes without your say-so: files appearing where files should not appear,
new administrator accounts, hidden add-ons, settings that quietly gained code in
them, and outside companies that started running code on your pages.

When it finds something, it explains what happened in ordinary language — what
the risk is to your money and your customers, and what to do next. If the change
was you, one click marks it as expected and you never hear about it again.

It watches. It does not touch anything.

DecaGuard never blocks, deletes, quarantines, modifies, or repairs anything on
your shop. It is not a firewall, it does not sit between your customers and your
pages, and it never touches your checkout, your payment gateway callbacks, or the
WooCommerce API.

This is deliberate. Real compromises leave several ways back in. Automated
cleanup either misses one — leaving you confidently reinfected — or deletes
something your shop needs and takes it offline. Both are worse than a clear
warning and a decision you make yourself.

What it looks at

• Your files. Program files appearing in your uploads folder, code hidden
  inside images, changes to WordPress’s own files (checked against the official
  published list), and changes to your main settings file.
• Your database. Web addresses hidden in your shop’s settings, scheduled
  tasks that no add-on owns, and tasks that quietly fetch instructions from
  outside.
• Your accounts. New administrators, accounts that gained powers they did not
  have, and — importantly — accounts or add-ons that have been hidden from your
  own lists. Nothing legitimate hides from you.
• Code running on your pages. Which outside companies run code on your shop,
  when one of them quietly changes what it sends you, and web addresses that are
  near-identical imitations of ones you trust.

Built to be quiet

A security tool that cries wolf gets switched off, and then it protects nobody.
DecaGuard spends its first two days simply learning your shop and raising
nothing at all. It knows that add-on updates change files constantly, that
payment gateways send odd-looking data, and that bulk imports look like attacks.
Findings are graded, and anything you confirm as expected stays quiet for good.

What this plugin sends outside your site

DecaGuard makes a small number of outbound requests, all of them listed here:

1. api.wordpress.org — downloads the official checksum list for your exact
   WordPress version, so modified core files can be spotted. No information about
   your site is sent; only the version number and language are in the request.
2. Your own shop’s public pages — the plugin requests your homepage, cart page
   and one product page, exactly as a visitor’s browser would, to see what code
   runs on them. These requests never leave your own server.

3. Files your pages already load from other companies — if one of your pages
   loads a file from, say, a payment provider or a chat widget, the plugin
   downloads that same file and compares it with what it saw last time. This is
   what lets it tell you when a company you rely on quietly changes the code it
   runs on your shop, which is how several large 2026 attacks worked.

   The request is anonymous: it identifies the plugin and nothing else. Your
   address, your shop’s name, your customers and your orders are not part of it,
   and no data is sent anywhere — the plugin only downloads. Only addresses that
   already appear in your own pages are ever requested.

   If you would rather it did not, switch off Outside code under
   DecaGuard → Settings. Every other check carries on working.
   No customer data, order data, or personal information ever leaves your site.