Hard Guard Security

Hard Guard Security is a free, open-source security plugin combining login protection, activity monitoring, local file analysis, antispam, SSL diagnostics, and hardening controls.

The plugin does not lock features behind payment, require a license key, or send telemetry, scan results, or website files to its author. A voluntary PayPal donation link appears only on Hard Guard Security screens and in the plugin row.

Main features:

• Progressive login lockouts by IP address, username, or both.
• IPv4 and IPv6 whitelist, blacklist, CIDR, and hardened trusted-proxy client-IP resolution with explicit header selection.
• Optional custom login URL with safety checks, rollback, and emergency recovery.
• Email-code and RFC 6238 TOTP two-factor authentication.
• Per-user methods, role policies, setup grace periods, recovery codes, and administrator reset.
• Application Password policies, inventory, revocation, inactivity cleanup, and security alerts.
• Searchable Audit Log with severity, category, action, result, retention, alert rules, CSV/JSON export, redaction, and Multisite aggregation.
• Read-only Active Sessions view loaded only when opened, plus on-demand Live Traffic that runs only while an administrator is watching the tab and keeps no traffic history.
• Quick and Full malware scans performed locally with scan history, SHA-256 ignore rules, quarantine, and restoration.
• Optional read-only Database Malware Scanner for manual Quick/Full scans with separate SQL findings and context-aware behavioural heuristics.
• Full and Automatic scans include a separate Vulnerabilities & updates stage for WordPress Core, plugins, and themes.
• Known-vulnerability matching is performed locally against a signed Hard Guard threat-intelligence database; plugin/theme inventory and scan results are not sent to Hard Guard.
• Outdated components are identified separately from known vulnerabilities using WordPress’ existing local update cache, without Hard Guard forcing an additional inventory request.
• WordPress Core integrity checks using official WordPress.org checksums.
• File-permission diagnostics and checks for unexpected executable files.
• Local antispam for native comments, WooCommerce reviews using the comment system, and native registration.
• Optional country allow/block rules using country.is, with IP/CIDR recovery exceptions and fail-open handling.
• SSL certificate, HTTPS redirect, mixed-content, and live security-header diagnostics.
• HSTS, upgrade-insecure-requests, MIME-sniffing, Referrer-Policy, frame protection, Permissions-Policy, and X-Powered-By controls.
• XML-RPC, REST user listing, author enumeration, user sitemap, directory indexing, sensitive-file, uploads PHP, and file-editor hardening.
• Daily Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks, with safety-check rollback.
• Upload Directory Shield adds a second managed .htaccess layer directly in WordPress uploads on Apache/LiteSpeed.
• Suspicious .htaccess detection identifies dangerous PHP/CGI execution directives during daily checks and manual malware scans.
• Dedicated SMTP settings used only for Hard Guard Security messages.
• Settings export/import and optional complete data cleanup during uninstall.
• Personal-data exporter and eraser integration under WordPress Tools.
• The administration interface follows each user’s WordPress dashboard language. Translations are supplied through WordPress.org language packs when available and are not bundled in the plugin ZIP.

Important: Hard Guard Security reduces selected risks but cannot guarantee that a website is secure or malware-free. Keep verified backups, install updates, use secure hosting, and test high-risk changes on a staging site.

External services

Hard Guard Security operates primarily on the local site. The following connections occur only when the related feature is enabled or manually run.

country.is IP-to-country API

When GeoIP or Antispam country rules require a lookup, the visitor IP is sent to https://api.country.is/{ip}. Country results are cached for 24 hours, failures for 10 minutes, and unknown countries fail open.

Service: https://country.is/
Terms of use / usage conditions and rate limits: https://country.is/
Privacy / request logging information: https://country.is/
Source and self-hosting information: https://github.com/lineofflight/country

Cloudflare Turnstile

Turnstile is optional and disabled by default. When enabled, the browser loads JavaScript from Cloudflare and the plugin sends the challenge token, client IP address, configured secret, and verification metadata to Cloudflare Siteverify.

Service documentation: https://developers.cloudflare.com/turnstile/
Privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

WordPress.org checksum services

When an administrator runs the WordPress Core integrity check, the plugin requests official checksum data for the installed WordPress version and locale. Website file contents are not sent to WordPress.org.

WordPress.org privacy policy: https://wordpress.org/about/privacy/
Core checksum reference: https://developer.wordpress.org/reference/functions/get_core_checksums/

Hard Guard vulnerability intelligence database

Vulnerability Monitoring can use a signed compressed database downloaded from the Hard Guard website. Automatic database downloads are disabled by default and start only after an administrator explicitly enables automatic updates; an administrator can also request a one-time manual refresh. The request uses a neutral Hard-Guard-Security/<version> User-Agent and does not include the website URL, installed plugin/theme inventory, installed versions, scan results, file paths, or file contents. Matching against installed software is performed locally. The server hosting the feed can still receive normal connection metadata such as the requesting IP address and request time.

Default feed: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz
Detached signature: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.sig.txt

Data sent and when: only a normal HTTPS GET is made when automatic database updates run or an administrator requests a manual refresh. No site URL, software inventory, installed versions, scan results, file paths, or file contents are added to the request. As with ordinary web hosting, the feed server can receive connection metadata such as the requesting IP address, request time, requested URL, HTTP headers, and the Hard-Guard-Security User-Agent. The downloaded database is public security data and matching is performed locally.

Service endpoint: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz
Service privacy information: https://github.com/endriu7777/WP-Hard-Guard#privacy-conscious-operation
Service implementation/source project: https://github.com/endriu7777/WP-Hard-Guard

The Hard Guard database is built from public vulnerability sources and retains source attribution. The 1.13.0 feed format supports CVE Program / CVE List V5, optional NIST NVD enrichment, GitHub Advisory Database (CC BY 4.0), and CISA Known Exploited Vulnerabilities (CC0). Ambiguous WordPress component mappings should be reviewed before publication rather than guessed. The ZIP does not bundle a vulnerability database. Known-vulnerability coverage becomes active after an administrator enables automatic database updates or requests a manual refresh and a valid signed production feed is downloaded. Hard Guard clearly warns when production coverage is unavailable and never treats a missing database as a clean result.

PayPal donations

After an administrator clicks Donate, the browser submits the hosted-button identifier to PayPal in a new tab. No PayPal scripts, images, or tracking pixels load before the click. PayPal processes the visit and payment under its own terms.

PayPal privacy statement: https://www.paypal.com/privacy
PayPal user agreement: https://www.paypal.com/legalhub/paypal/useragreement-full

Administrator-configured SMTP server

When custom SMTP is enabled, Hard Guard Security connects to the configured server to deliver alerts and email 2FA codes. The provider receives message content and delivery metadata under its own terms.

The administrator’s own website

SSL certificate checks, live security-header scans, mixed-content front-end scans, redirect tests, and server-rule safety checks make HTTP or TLS requests only to the current website configured in WordPress. These requests are initiated by an administrator or by a safety check connected to a setting change.

Privacy

Hard Guard Security stores security data locally. Depending on enabled modules, this can include IP addresses, usernames, login results, event times, administrative actions, request paths without query strings, antispam incident details, file paths, checksums, database table/record identifiers, matched scanner rules, and short escaped excerpts. Database content is inspected only when an administrator explicitly enables Database Malware Scanner for a manual scan and is not uploaded to Hard Guard.

Known password, token, nonce, cookie, authorization, and API-key fields are redacted before Audit Log storage. Plaintext Application Passwords and their hashes are not written to Hard Guard Security logs. TOTP secrets and SMTP passwords are encrypted when Sodium or OpenSSL is available; recovery codes are stored as one-way hashes.

Active Sessions reads existing WordPress login-session metadata only when an authorized administrator opens that tab. Live Traffic is temporary and on-demand: while the tab is open, short browser heartbeats can contain the resolved IP address, logged-in WordPress identity when applicable, current page path, user agent, and last-seen time. This temporary state is not added to Audit Log history and expires shortly after monitoring stops. Sensitive query parameters are redacted.

Retention controls are available for Audit Log, Antispam, scanner history, and other records. WordPress privacy-policy suggestions are added under Settings > Privacy. Personal-data export and erasure callbacks are registered under Tools > Export Personal Data and Tools > Erase Personal Data. Erasure removes user-specific plugin metadata and matching antispam and lockout records, while matching Audit Log events are anonymized so non-personal security metadata can be retained.

Quarantined files remain on the server until restored, manually deleted, or removed during uninstall when complete cleanup is enabled. Scanner file contents and Database Malware Scanner content are not uploaded to an external malware-scanning service. Vulnerability matching also remains local: Hard Guard downloads a signed public database but does not upload installed plugin/theme inventory, versions, scan results, file names, or file contents.