GuardianWP Security & Maintenance

=== GuardianWP Security & Maintenance === Contributors: guardianwp Tags: malware scanner, security, maintenance, integrity, quarantine Requires at least: 6.4 Tested up to: 7.0 Requires PHP: 7.4 Stable tag: 1.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

Local malware detection, integrity monitoring, safe quarantine, verified WordPress core repair, an optional application-layer firewall, and plain-language maintenance guidance.

== Description ==

GuardianWP is a standalone, local-first WordPress security and maintenance plugin built for site owners who need clear explanations rather than raw technical alerts.

Every security finding answers five questions:

• What happened?
• Where is it?
• How serious is it?
• How could it affect the website?
• What is the safest next action?

The scanner combines official WordPress core checksums, local file-change baselines, offline signatures, code and path heuristics, selected database inspection, administrator-account monitoring, cron inspection, update awareness, safe quarantine, restore, and verified core-file repair.

No account, licence server, telemetry service, or cloud scanner is required. The plugin does not automatically delete suspicious content.

= Main features =

• On-demand and scheduled resumable scans.
• Standard and low-resource scan profiles.
• WordPress core checksum verification.
• WordPress.org-hosted plugin checksum verification with cached official data.
• Local file integrity baselines.
• PHP-in-uploads and disguised-executable detection.
• Web-shell markers, decoded execution chains, command-execution patterns, hidden iframes, and obfuscated JavaScript checks.
• Selected posts, comments, options, administrator, and cron inspection.
• Separate severity and detection-confidence values.
• Protected quarantine with hash verification and restoration.
• Official-package repair for eligible WordPress core files.
• Update, PHP, cron, HTTPS, file-editor, debug-display, inactive-plugin, and scan-freshness maintenance checks.
• Rate-limited email alerts that never contain executable evidence.
• Audit log, REST endpoints, and WP-CLI commands.
• Conservative uninstall option: keep data by default or delete everything explicitly.
• Optional Protection & Firewall module, off by default, with independent switches for brute-force login protection, GET/POST request filtering, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction.
• Manual IP allow and block lists, an activity log of what the firewall did and why, and a one-click unlock for an automatic login lockout.

= Important limitation =

No malware scanner can guarantee detection of every malicious file, database payload, zero-day exploit, hosting compromise, encrypted payload, or attacker-controlled server condition. GuardianWP provides layered risk detection and guided remediation. It does not replace off-site backups, hosting security, server EDR, a WAF/CDN, log monitoring, or professional incident response.

== Installation ==

1. In WordPress, open Plugins > Add New > Upload Plugin.
2. Select the GuardianWP ZIP file and choose Install Now.
3. Activate GuardianWP Security & Maintenance.
4. Open GuardianWP > Scan Centre and run the first full scan.
5. Review GuardianWP > Maintenance and configure the schedule and email recipient under Settings.
6. On low-traffic sites, configure a real server cron to call wp-cron.php regularly.

Before quarantining or repairing production files, confirm that a separate, tested backup exists.

== External services ==

GuardianWP works locally without telemetry or a GuardianWP cloud service.

When core or WordPress.org plugin checksum verification runs, WordPress may request checksum data for the installed WordPress version and locale from the official WordPress.org API. Core checksum requests identify the WordPress version and locale. Plugin checksum requests identify the public plugin slug and installed version. GuardianWP does not send site files or database content.

When an authorised administrator explicitly chooses "Repair from official package", GuardianWP downloads the matching WordPress package from an official WordPress.org download URL, extracts the requested file locally, verifies it against the official checksum, backs up the current file, writes the replacement, and verifies the result.

PHP maintenance guidance links to the official PHP supported-versions page only when the administrator chooses Review. No data is sent by GuardianWP merely for displaying the link.

== Frequently Asked Questions ==

= Does GuardianWP automatically delete malware? =

No. Automatic deletion is unsafe because false positives and active component dependencies can break a site. GuardianWP backs up and quarantines a confirmed file only after an authorised user approves the action.

= Does a critical alert always mean the site is compromised? =

No. Severity describes potential harm. Confidence describes how certain the detector is. Review both values and the evidence before acting.

= Why are normal file changes shown? =

The local baseline can report changes to code and configuration files. These are low severity unless another rule identifies suspicious behaviour or an official checksum fails. Ignoring a baseline-only change explicitly accepts the current file as the new local reference.

= Can it scan very large sites? =

Scanning is resumable and divided into small batches. Very large files are sampled or skipped according to the configured limit, and coverage information is recorded. WP-CLI is recommended for large or business-critical sites.

= Is it a web application firewall? =

GuardianWP includes an optional, application-layer Protection & Firewall module: brute-force login lockout, GET/POST request filtering against common attack patterns, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction. It runs inside WordPress itself, so it complements rather than replaces a network or edge WAF, a CDN, or your host's own firewall, and it cannot guarantee blocking every attack. The module is off by default and the GET/POST filters start in a log-only mode so you can review real traffic in the firewall activity log before switching them to block.

== WP-CLI ==

• wp guardianwp status --format=json
• wp guardianwp scan --profile=standard --wait
• wp guardianwp findings --status=open --format=table
• wp guardianwp quarantine <finding-id> --yes

== REST API ==

Authenticated routes use the namespace guardianwp/v1 and require GuardianWP capabilities. Available routes include status, scans, findings, quarantine, core repair, restore, resolve, ignore, and settings. If the Protection & Firewall module's REST rate limiting or authentication requirement is enabled, those settings apply uniformly to all REST API traffic, including requests to these GuardianWP routes.

== Privacy ==

Normal scans run locally. GuardianWP stores scan metadata, file paths, hashes, short redacted excerpts, issue records, protected remediation copies, settings, and audit events. It does not store passwords, cookies, full API tokens, or complete malicious payloads in ordinary findings. Protected copies remain on the server until restored or removed during an explicitly configured uninstall.

When the optional Protection & Firewall module is enabled, GuardianWP also records the visitor IP address, request method, a short redacted excerpt of the request path, and the matched rule for requests it blocks or logs, so the activity can be reviewed and understood later. This activity log is stored locally, is never sent anywhere, and is pruned automatically after the configured retention period.

== Changelog ==

= 1.1.0 =

• Refreshed dashboard visual design: section navigation, restyled hero and metric cards, and clearer panels and tables.
• New optional Protection & Firewall module, off by default: brute-force login lockout, GET/POST request filtering, REST API rate limiting, anonymous REST user-enumeration and ?author= probing blocking, and XML-RPC restriction, each independently switchable.
• Manual IP allow/deny lists, a firewall activity log, and one-click unlock for an active login lockout.

= 1.0.0 =

• Initial standalone release.
• Resumable file and database scanning.
• Offline detection rules and core checksum verification.
• File baselines, issue classification, quarantine, restore, and core repair.
• Maintenance dashboard, email alerts, REST API, WP-CLI, and audit logging.