DecaGuard — Compromise Detection for WooCommerce

Most shop owners find out they have been hacked when their payment provider tells them, or when a customer complains about a fraudulent charge. By then the damage is done. DecaGuard learns what your shop normally looks like, then watches for anything that changes without your say-so: files appearing where files should not appear, new administrator accounts, hidden add-ons, settings that quietly gained code in them, and outside companies that started running code on your pages. When it finds something, it explains what happened in ordinary language — what the risk is to your money and your customers, and what to do next. If the change was you, one click marks it as expected and you never hear about it again. It watches. It does not touch anything. DecaGuard never blocks, deletes, quarantines, modifies, or repairs anything on your shop. It is not a firewall, it does not sit between your customers and your pages, and it never touches your checkout, your payment gateway callbacks, or the WooCommerce API. This is deliberate. Real compromises leave several ways back in. Automated cleanup either misses one — leaving you confidently reinfected — or deletes something your shop needs and takes it offline. Both are worse than a clear warning and a decision you make yourself. What it looks at

• Your files. Program files appearing in your uploads folder, code hidden inside images, changes to WordPress's own files (checked against the official published list), and changes to your main settings file.
• Your database. Web addresses hidden in your shop's settings, scheduled tasks that no add-on owns, and tasks that quietly fetch instructions from outside.
• Your accounts. New administrators, accounts that gained powers they did not have, and — importantly — accounts or add-ons that have been hidden from your own lists. Nothing legitimate hides from you.
• Code running on your pages. Which outside companies run code on your shop, when one of them quietly changes what it sends you, and web addresses that are near-identical imitations of ones you trust.

Built to be quiet A security tool that cries wolf gets switched off, and then it protects nobody. DecaGuard spends its first two days simply learning your shop and raising nothing at all. It knows that add-on updates change files constantly, that payment gateways send odd-looking data, and that bulk imports look like attacks. Findings are graded, and anything you confirm as expected stays quiet for good. What this plugin sends outside your site DecaGuard makes a small number of outbound requests, all of them listed here:

1. api.wordpress.org — downloads the official checksum list for your exact WordPress version, so modified core files can be spotted. No information about your site is sent; only the version number and language are in the request.
2. Your own shop's public pages — the plugin requests your homepage, cart page and one product page, exactly as a visitor's browser would, to see what code runs on them. These requests never leave your own server.
3. Files your pages already load from other companies — if one of your pages loads a file from, say, a payment provider or a chat widget, the plugin downloads that same file and compares it with what it saw last time. This is what lets it tell you when a company you rely on quietly changes the code it runs on your shop, which is how several large 2026 attacks worked.

The request is anonymous: it identifies the plugin and nothing else. Your address, your shop's name, your customers and your orders are not part of it, and no data is sent anywhere — the plugin only downloads. Only addresses that already appear in your own pages are ever requested. If you would rather it did not, switch off Outside code under DecaGuard → Settings. Every other check carries on working. No customer data, order data, or personal information ever leaves your site.

1. In your WordPress admin, go to Plugins → Add New and search for "DecaGuard".
2. Click Install Now, then Activate.
3. Open DecaGuard → Settings, enter the address you want warnings sent to, and tick "Send me a summary of anything found". Anything urgent or important is emailed the moment it appears; everything else arrives in a daily summary.

That is all. DecaGuard begins learning your shop straight away. For the first two days it watches quietly and raises nothing, so it can learn what is normal on your shop before it starts telling you about changes. After that, anything it finds appears on the DecaGuard screen.

0.2.0

• Instant email now covers every urgent and important finding for everyone.
• Prefixed all classes, options, tables and scheduled tasks to avoid collisions.
• Uses the WordPress path APIs throughout, fixing a case where a wp-config.php located above the site root was never checked.
• Removed the site address from requests for third-party files, and added a setting to switch those requests off entirely.

0.1.0

• First release.
• File, database, account and page-code monitoring.
• Severity grading with a false-positive exclusions layer.
• Two-day learning period on activation.
• Dashboard with one-click confirmation, instant email on urgent findings, and a daily summary email.