Site Lockdown Security

View full plugin documentation - CLICK HERE Site Lockdown Security gives WordPress administrators, agencies, developers, and support teams a full security command center without hiding the best tools behind a paid upgrade. Most WordPress security plugins reserve their strongest features for premium plans: firewalls, file change monitoring, malware scanning, scheduled reports, branded client dashboards, email alerts, login protection, cleanup tools, Cloudflare controls, and advanced hardening. Site Lockdown Security includes those kinds of features in one plugin, and they are not treated as upsells. Use Site Lockdown Security to audit files, lock down important folders, monitor file changes, verify WordPress core integrity, scan for suspicious code, review abandoned folders, enforce password resets, check public file exposure, monitor redirects, protect logins, review risky software, receive branded email alerts, and run a WordPress-aware firewall with Cloudflare and WooCommerce compatibility controls. Premium Features Without Premium Upgrade Fees Site Lockdown Security is built around a simple promise: powerful WordPress security features should not require surprise upgrade fees. Features that are commonly sold as premium add-ons in other WordPress security plugins are included here, including white label branding, firewall controls, file change monitoring, scheduled security reports, infection scanning, cleanup tools, email notification previews, Cloudflare edge actions, login security, and client-ready branded alerts. We will never charge for plugin upgrades or future features. When Site Lockdown Security improves, your security tools improve with it. Key Features

• Firewall Security with Smart Block, Monitor Only, WooCommerce Safe, and Emergency Shield protection modes
• WooCommerce-aware firewall handling for checkout, cart, Store API, REST API, AJAX, and payment gateway flows
• Cloudflare integration with visitor IP detection, API credential testing, edge actions, managed challenges, access rule syncing, and automatic rule cleanup
• Firewall Event Timeline with searchable and filterable events, severity details, manual IP actions, pagination, and daily summary alerts
• IP allowlist and blocklist controls for trusted IPs, CIDR ranges, immediate blocks, and manual firewall response management
• Custom blocked request page with editable title, subtitle, message, button, footer note, and live preview
• Site Lock to make important WordPress files and folders read-only after a site is clean and stable
• Watch Dog File Change Monitor with trusted baselines, new/modified/deleted file detection, review actions, scheduled scans, and alerts
• WordPress Core Check using official WordPress.org checksums to detect modified, missing, unreadable, or unexpected core files
• Infection Scanner for suspicious patterns, malware indicators, obfuscated code, backdoors, spam injections, and unwanted scripts
• Scheduled infection scans, security reports, update checks, and digest emails
• Email notification previews for individual alert types before notifications are sent
• Branded security emails for plugin updates, file changes, core changes, reports, infection scans, risk reviews, software health, digests, and firewall summaries
• White Label Branding for agencies, developers, maintenance providers, and support teams
• White Label import and export to move branding settings between client sites
• Custom branding controls for plugin text, colors, icons, dark icons, banners, email imagery, and dashboard presentation
• Folder and file auditing for root files, wp-content, plugins, themes, uploads, .htaccess files, abandoned folders, and suspicious items
• File preview, download, approve, ignore, delete, include, and bulk actions
• Cleanup tools for old backups, temporary files, logs, cache files, abandoned folders, and other clutter
• Plugin Refresher and Theme Refresher to reinstall clean WordPress.org copies of plugins and themes
• Permissions Check for important WordPress files and folders, including Site Lock-aware status
• Software Health to identify outdated, abandoned, or potentially risky plugins and themes
• Risk Review for common local security issues, severity sorting, ignore/include controls, scheduled checks, and alerts
• Redirect Monitor to test public visitor behavior and alert when visitors may be redirected to an unauthorized website
• Update Monitor for pending WordPress core, plugin, and theme updates with alerts only when updates are available
• Password Reset Enforcement by user role, including immediate session logout and secure reset guidance
• Public File Exposure Check for sensitive backup, log, configuration, database, and metadata files
• Login Security with protected login URL controls, login limits, activity tracking, session controls, and role-based expiration
• Security Tools for XML-RPC exposure, author scans, debug exposure, SSL information, blacklist status, file finding, and hardening reviews
• Setup Guide with progress tracking for recommended protection steps
• Responsive AJAX admin interface designed for fast navigation and practical daily use

Built For Agencies And Client Support Teams Site Lockdown Security includes White Label Branding because security work is often delivered as a professional service. You can brand the admin experience, email imagery, colors, icons, banners, and plugin presentation around your business or client support program. Branding settings can be exported and imported between sites so the same client-ready experience can be reused across multiple installations. These are the kinds of client-facing tools that are often locked behind agency or premium licenses elsewhere. In Site Lockdown Security, they are included. Firewall Security Firewall Security helps protect WordPress from suspicious requests, exploit payloads, scanner signatures, bot signatures, dangerous methods, XML-RPC abuse, REST API exposure, suspicious query strings, and excessive request rates. Protection modes include Smart Block for high-confidence malicious traffic, Monitor Only for tuning without blocking, WooCommerce Safe for checkout and payment compatibility, and Emergency Shield for active attack situations where public traffic needs to be restricted while administrators retain access. Firewall Security also includes event logging, severity tracking, searchable timelines, IP allow/block actions, Cloudflare-aware IP detection, Cloudflare edge actions, notification settings, email summaries, and a customizable blocked request page. Site Lock Site Lock helps prevent unwanted file additions, injected scripts, unauthorized edits, and accidental deletions by making selected WordPress files and folders read-only. You can unlock the site when legitimate updates or maintenance are needed, then apply Site Lock again when finished. Site Lock is useful after a site has been cleaned, audited, updated, or stabilized and you want to reduce the chance of future unexpected file changes. Watch Dog Watch Dog creates a trusted baseline of your site files and compares future scans against that baseline. It reports new, modified, and deleted files so administrators can quickly review changes after updates, maintenance, cleanup work, or suspicious activity. Watch Dog includes file change monitoring, baseline rebuilding, review actions, scheduled scans, protected baseline storage, and email alerts when changes are detected. Watch Dog Baseline Storage Watch Dog stores protected baseline data under: wp-content/uploads/site-lock/watch-dog/ This keeps baseline data outside the plugin folder so it is not removed during plugin updates. Sites updating from older versions automatically migrate Watch Dog baseline storage from the previous location: wp-content/uploads/guard-dog/watch-dog/ After a successful migration, the old storage folder is safely removed and the new Watch Dog storage path remains excluded from Site Lock so baseline files can continue to be updated when needed. Redirect Monitor Redirect Monitor tests public site behavior as different visitor types and alerts when visitors may be redirected to an unauthorized website. It can test the homepage, login page, custom paths, and same-site navigation menu URLs using a focused scan strategy designed to avoid oversized scan jobs. Core Check Core Check compares installed WordPress core files against the official WordPress.org checksum API. It reports modified, missing, unreadable, or unexpected files in WordPress core areas so administrators can review potential core file integrity problems. Update Monitor Update Monitor checks pending WordPress core, plugin, and theme updates and sends email alerts only when updates are available. Infection Scanner The infection scanner reviews site files for suspicious patterns commonly associated with malware, backdoors, obfuscated scripts, spam injections, and unwanted code. Scans can be run manually or scheduled, and results can be included in reports and notifications. Email Notifications Site Lockdown Security includes configurable email alerts for important security events and scheduled checks. Supported notification types include:

• Plugin Update Notification
• Security Snapshot Digest
• Scheduled Infection Scan
• Automated Security Report
• File Change Notification
• Core Change Notification
• Software Health Alert
• Risk Review Alert
• Firewall Realtime Alerts
• Firewall Summary Notifications

Each individual alert includes a preview option so administrators can review the email layout before using it. The global email notification settings form allows administrators to set the default frequency and recipient email for alerts in one place. White Label Branding White Label Branding is one of the standout features of Site Lockdown Security because it lets agencies and service providers present security work under their own brand. Administrators can customize branding text, colors, icons, dark icons, banners, email imagery, and dashboard presentation. White Label settings can be exported to a JSON file and imported on another site, making it easier to reuse the same branding across multiple installations. The Reset Settings option restores the default Site Lockdown theme and brings back the default support contact button when branding is returned to its original values. Plugin Refresher Plugin Refresher helps reinstall fresh copies of WordPress.org plugins. This can be useful when a plugin may have been modified, corrupted, or affected by suspicious files. Site Lockdown Security uses native WordPress upgrade handling for safer refresh workflows and supports both individual and bulk plugin refreshes. Theme Refresher Theme Refresher helps reinstall fresh copies of WordPress.org themes. It includes version information, update status, WordPress.org availability detection, and support for individual or bulk theme refresh workflows. Password Reset Enforcement Require selected user roles to change their password. Active sessions for those users are logged out immediately, and their next valid login attempt shows a clear password-change message with a secure reset link. Public File Exposure Check Test whether sensitive backup, log, configuration, database, and metadata files can be accessed publicly from the website URL. File Finder and Removal Tool Quickly scan for specific files or identify extensionless files that may require review or removal. No shell commands or complex server tasks are required. Login Security Login Security helps protect the WordPress login area with protected login URL controls, login attempt limits, activity tracking, session controls, and role-based expiration options. Permissions Check Permissions Check reviews important WordPress files and folders and compares current permissions against recommended values. It helps identify writable files, risky permissions, and items that may need attention. When Site Lock protects a file or folder, permissions results account for that protected status. Software Health Software Health checks installed plugins and themes for maintenance signals that may indicate abandoned or outdated software. It helps administrators identify items that may need updates, replacement, removal, or closer review. Risk Review Risk Review checks local site risk signals and common security configuration concerns. It includes severity sorting, ignore/include controls, scheduled checks, and optional email alerts. Setup Guide The Setup Guide helps administrators complete recommended Site Lockdown Security settings. Setup items include Site Lock, scheduled infection scans, automated reports, file change baselines, file change notifications, core change notifications, software health alerts, risk review alerts, firewall settings, login protection, and branded email notifications. Progress tracking helps administrators see which recommended protection steps are complete.

9.1.1

• Improved Firewall UI and functions to allow even when Cloudflare is not setup

9.1

• Improved Firewall UI and functions

9.0

• Added a dedicated Firewall Security section under Secure & Protect.
• Added a new Firewall Control Center with firewall mode status, blocked request totals, critical request totals, and latest event timing.
• Added Smart Block mode to block high-confidence malicious traffic while preserving normal WordPress compatibility.
• Added Monitor Only mode to log matching threats without blocking so rules can be tuned before enforcement.
• Added Emergency Shield mode to temporarily block public access during active attacks while keeping admin access available.
• Added Trusted IP Allowlist controls for IPs or CIDR ranges that should bypass firewall enforcement.
• Added Immediate IP Blocklist controls for IPs or CIDR ranges that should be blocked before other firewall rules run.
• Added a customizable Blocked Request Page with editable title, subtitle, message, footer note, button label, button URL, and live preview.
• Added logic to hide the Return to Site button when Emergency Shield blocks the entire site.
• Added firewall rules for exploit payloads, dangerous HTTP methods, scanner signatures, bot signatures, XML-RPC abuse, REST API exposure, suspicious query strings, and excessive request rates.
• Added configurable Rate Limit Protection with per-IP request limits and custom time windows.
• Added a dedicated Firewall Event Timeline with searchable and filterable firewall events.
• Added timeline filters for blocked, monitored, critical, and today’s firewall events.
• Added timeline pagination with page navigation and Show All support.
• Added manual IP allow/block actions directly from firewall timeline events.
• Removed internal Changed actions from the event timeline so settings updates and internal system actions do not clutter firewall logs.
• Added Cloudflare-aware IP detection using trusted Cloudflare visitor IP headers.
• Added Cloudflare event detail support including Ray ID, country, and edge IP information.
• Added Cloudflare API credential testing for validating Zone ID and API token access.
• Added automatic Cloudflare edge actions for confirmed firewall blocks.
• Set Managed Challenge at Cloudflare edge as the default automatic Cloudflare edge action.
• Added Cloudflare duplicate rule protection by checking for an existing matching IP/action rule before creating another.
• Removed the Cloudflare edge push transient so rules can be recreated if deleted from Cloudflare and triggered again.
• Added an Automatic Edge Action IPs management card showing IPs automatically sent to Cloudflare.
• Added the ability to remove automatically created Cloudflare edge rules directly from the website without logging into Cloudflare.
• Added local cleanup when automatically created Cloudflare edge rules are removed from the website.
• Prevented Emergency Shield blocks from creating Cloudflare edge rules.
• Added firewall email notification settings for blocked requests, critical severity events, rate limit events, emergency shield events, Cloudflare edge actions, and manual firewall changes.
• Added configurable local timeline storage limits and event retention settings.
• Added firewall setup/status indicators for active mode, core protections, Cloudflare integration, logging, and alerts.

8.7

• Added a dedicated Login Security section under Secure & Protect.
• Added custom login URL protection with a configurable login slug and options for handling direct wp-login.php access.
• Added login attempt protection controls with configurable failed-attempt limits, tracking rules, lockout windows, XML-RPC failure counting, and REST authentication failure counting.
• Added tooltip descriptions to the Login Attempt Protection and Login Hardening settings.
• Added login activity logging with filters, refresh controls, pagination, and manual log clearing.
• Added active session management with grouped user/IP session rows, session revoke, session block, ignore user/IP pair, clear ignored pairs, and revoke-all controls.
• Added protections so “Revoke All Sessions” does not revoke the current admin’s active session.
• Added role-based session expiration so different user roles can have different maximum login durations.
• Added administrator login email alerts and lockout email alerts.
• Moved “Limit login attempts” and “Block login with email address” out of User Security and into the new Login Security section.
• Added a new Login card to the Secure & Protect overview page.
• Improved Login Security pagination with page numbers, previous/next controls, and direct “go to page” jumping.
• Added refresh buttons for Login Activity and Active Sessions that update through AJAX without reloading the page or moving the user back to the top.
• Added modal feedback while refreshing Login Activity and Active Sessions.
• Improved active session display by grouping matching username/IP sessions together and showing the newest login time with the soonest expiration time.
• Added safer session discovery using indexed/recent login session users instead of relying only on full user scans.
• Added a safer login security helper that loads on public login requests so login protections can run before the heavier admin only stack.
• Added safe unserialize handling for stored scanner data to reduce object injection risk when reading saved scan results.
• Strengthened MainWP bridge security with generated per-child bridge tokens instead of the previous shared token value.
• Changed MainWP lock/unlock bridge actions to require POST requests for state-changing actions.
• Added safer bridge token validation through the X-WPFA-Token header.
• Improved MainWP update auto-unlock checks so unauthenticated heuristic update detection is disabled by default.
• Added Redirect Monitor resumable AJAX batch scanning for more reliable scans on large sites.
• Added Redirect Monitor safe fallback scanning when a full browser-based scan cannot complete.
• Added Redirect Monitor progress details showing scan tasks, current URL, profile checks, errors, and completion progress.
• Updated Redirect Monitor to test the homepage, login page, saved custom paths, and same-site navigation menu URLs.
• Added a hard Redirect Monitor scan cap of 25 URLs to prevent oversized scan jobs.
• Removed the Facebook visitor profile from Redirect Monitor scans.
• Removed the Redirect Monitor “Scan Coverage” setting in favor of the fixed menu-focused URL selection strategy.
• Improved Redirect Monitor handling when WP-Cron is disabled so manual scans and settings can still be saved.
• Added Redirect Monitor warnings when scans complete with request errors.
• Improved Watch Dog baseline creation with true server-side progress tracking.
• Added Watch Dog baseline batch processing so large baselines can be built with better progress visibility.
• Improved shared modal progress styling for Redirect Monitor and Watch Dog actions.
• Improved Update Monitor by clearing update caches before forcing update checks.
• Improved Update Monitor and Risk Review so stale update entries are ignored when the related plugin or theme is no longer installed.
• Improved admin access control so newly added feature tabs are automatically available to admins who previously had access to every available area, while restricted/custom admins do not receive new areas automatically.
• Added Login Security to the admin tab access system.
• Improved Security hub layout and wording for the Secure & Protect area.
• Improved Watch Dog file change action button spacing and table layout.
• Removed the old bundled Security-Report.html helper report file.

8.6.1

• Removed the Facebook visitor profile from Redirect Monitor scans.
• Redirect Monitor now uses desktop, mobile, Googlebot, and Google Search visitor profiles only.

8.6.5

• Redirect Monitor now uses a fixed menu-focused URL selection strategy instead of a Scan Coverage setting.
• Added a hard 25 URL scan cap so very large websites cannot create oversized Redirect Monitor jobs.
• Redirect Monitor now tests homepage, login page, saved custom paths, and same-site navigation menu URLs before a small no-menu fallback sample.

8.6.4

• Reverted the Redirect Monitor scan modal contrast treatment back to the original themed modal styling.
• Kept the updated Redirect Monitor Scanning modal title.

8.6.1

• Added resumable Redirect Monitor AJAX batch scanning for large-site reliability.
• Added dynamic Redirect Monitor progress details during manual scans.

8.6

• Added Password Reset Enforcement
• Added Public File Exposure Check
• Ignored audit flag on default index.php files
• Re-styled menu for cleaner navigation

8.5.1

• Added Redirect Monitor
• Added Update Monitor
• Improved targeted unlocking for single targets

8.5

• Fixed lock and unlock actions that trigger outside of WordPress install

8.0.1

• Fixed stale lock/unlock request error in admin bar actions
• Updated endpoints for MainWP extension

8.0

• Added unique White Label Branding options designed for agencies, developers, support providers, and client maintenance teams.
• Added White Label settings export so current branding options can be downloaded as a JSON file.
• Added White Label settings import so saved branding options can be restored or moved to another site.
• Added custom branding support for text, colors, icons, dark icons, banners, and email imagery.
• Improved White Label reset behavior so resetting settings restores the default Site Lockdown theme.
• Fixed White Label reset behavior so the Site Lockdown support contact button displays again after settings return to defaults.
• Added safer validation and sanitization for imported White Label settings.
• Fixed a WordPress security coding standards warning for White Label settings sanitization.
• Improved White Label settings saving performance by avoiding unnecessary option updates when settings have not changed.
• Improved White Label asset cache handling so cache versions are only refreshed when branding image assets change.
• Moved Watch Dog protected baseline storage from wp-content/uploads/guard-dog/watch-dog/ to wp-content/uploads/site-lock/watch-dog/.
• Added automatic Watch Dog baseline storage migration for sites updating from the older Guard Dog storage path.
• Added safe cleanup for the old Watch Dog storage folder after the baseline is successfully moved and verified.
• Updated Site Lock exclusions so the new Watch Dog baseline storage folder remains writable while uploads are protected.
• Improved Watch Dog storage exclusions so baseline files are not reported as suspicious upload files.
• Restored the animated magic.webp asset and added targeted cache busting for that image only.
• Improved email alert preview modals with cleaner close button styling.
• Improved email notification Save and Preview button alignment.
• Removed the Preview button from the global email notification settings form.
• Improved individual email alert previews so each preview better matches the real notification type being sent.
• Improved preview email font rendering so modal previews look closer to the actual delivered emails.
• Added preview layouts for plugin update, security snapshot digest, scheduled infection scan, automated security report, file change, core change, software health, and risk review emails.
• Fixed JavaScript and PHP syntax validation issues found during testing.
• Added additional admin styling refinements for email notification controls.

7.7.4

• Improved AJAX loading when navigating between tabs
• Fixed page reload on plugin and theme refresher tabs
• Added LOCKED status to table items when they are locked
• Fixed security report generation
• Fixed some styling issues on many buttons

7.7.3

• Style corrections

7.7.2

• New CSS methods for WordPress 7.0

7.7.1

• Fixed ManageWP connection

7.7

• Made WordPress 7.0 ready

7.6

• Massive overhaul of infection scanner
• Added infection scan results to security report

7.5.2

• Made correction to Site Lock error on SiteGround servers

7.5.1

• Fix Site Lock critical error issue on sites with large file counts

7.5

• Added a new Setup Guide page with recommended Site Lockdown security setup steps, progress tracking, completion percentage, and quick actions.
• Added setup cards for Auto Site Lock, Folder & File Audit, Scheduled Infection Scans, Automated Security Reports, File Change Baseline, File Change Notifications, Core Change Notifications, Software Health Alerts, and Risk Review Alerts.
• Added dismiss, undo, completed, recommended, and dismissed states for Setup Guide items with live AJAX progress updates.
• Added a recommended setup banner when setup is incomplete, plus automatic redirect to the Setup Guide after plugin activation.
• Added a global Email Notification Settings form to apply the same notification frequency and recipient email for all alert notifications.
• Added a combined Site Lockdown Security Summary digest to reduce multiple scheduled alert emails being sent at the same time.
• Added a new Watch Dog Software Health tool to identify installed plugins and themes that may no longer be maintained.
• Added scheduled Software Health checks with optional email alerts.
• Added Software Health delete actions for abandoned plugins and themes, including bulk delete support with safety checks.
• Added a new Watch Dog Risk Review tool for local site risk checks.
• Added scheduled Risk Review checks with optional email alerts.
• Added Risk Review severity sorting, ignore/include controls, and bulk ignore/include actions.
• Added direct Setup Guide actions for enabling Auto Site Lock and building the File Change Baseline without leaving the Setup Guide page.
• Added Watch Dog Defense as the updated Watch Dog section label with a new four-card layout.
• Updated plugin navigation labels, including Hub, Audit, Secure, Watch Dog, Tools, and Scan.
• Updated Site Lockdown left admin submenu labels for clearer section naming.
• Removed Dashboard from the Site Lockdown left admin submenu and made the main Site Lockdown menu open the Hub/dashboard tab.
• Updated Audit and Tools dropdowns into cleaner two-column layouts.
• Standardized Site Lockdown admin styling with consistent purple accents, green action buttons, card borders, shadows, and branded layouts.
• Standardized Save Settings button styling across plugin admin pages.
• Removed folder path and copy button clutter from Site Lock folder/file cards.
• Added Site Lock modal behavior for blocked plugin uploads when the uploads folder is locked.
• Updated permissions results so Site Lock-protected files and folders are not flagged as high risk.
• Added Protected by Site Lock status handling for locked files and folders.
• Improved permissions results layout by removing extra columns, improving permission number display, and prioritizing actionable results.
• Added Lock buttons for permission entries that are not already protected by Site Lock.
• Added bulk Ignore All support for non-core root files.
• Added Delete All support for orphaned plugin and theme folders.
• Disabled Delete All actions when Site Lock is active for protected areas.
• Improved Watch Dog baseline rebuilding so existing baselines are reused safely, replacements are built before old baselines are removed, and only one baseline file is kept at a time.
• Improved Watch Dog baseline storage compatibility with locked uploads folders, FTP filesystem transports, and Site Lock exclusions.
• Kept Watch Dog baseline storage in wp-content/uploads/guard-dog/watch-dog/ while keeping the uploads root locked.
• Updated Watch Dog scans to exclude media files and ZIP archives while keeping uploaded PHP, JS, and other non-media files visible.
• Fixed Watch Dog review actions so deleting or approving detected files immediately refreshes counts and tables without a full browser tab reload.
• Confirmed core, plugin, theme, upload, and delete actions rebuild the Watch Dog baseline immediately without relying on the auto-rebuild cron fallback.
• Added translator comment fixes and Plugin Check compatibility improvements.

7.1

• Added Plugin Refresher tool to securely refresh WordPress.org plugins with clean copies.
• Added queued native WordPress upgrader process for safer and more reliable plugin refreshes.
• Added bulk plugin refresh support with selectable plugins.
• Added individual plugin refresh support with branded progress feedback.
• Added branded Bulk Refresh Running window with progress tracking.
• Added refreshed count, remaining count, percentage complete, and progress bar to bulk refresh progress.
• Added navigation protection during bulk refreshes to help prevent users from leaving before completion.
• Added automatic window close behavior once refresh processes complete.
• Added installed version and available version details to the Plugin Refresher table.
• Added Update column to show whether each plugin is current or needs an update.
• Added Last Updated column using WordPress.org plugin data.
• Added separate manual refresh/install table for plugins not available on WordPress.org.
• Added stronger detection for WordPress.org plugin availability.
• Added Theme Refresher tool to securely refresh WordPress.org themes with clean copies.
• Added queued native WordPress upgrader process for safer and more reliable theme refreshes.
• Added bulk theme refresh support with selectable themes.
• Added individual theme refresh support with branded progress feedback.
• Added installed version and available version details to the Theme Refresher table.
• Added Update column to show whether each theme is current or needs an update.
• Added Last Updated column using WordPress.org theme data.
• Added separate manual refresh/install table for themes not available on WordPress.org.
• Added stronger detection for WordPress.org theme availability.
• Added Theme Refresher card to the main Tools page.
• Added Theme Refresher item to the Tools dropdown menu.
• Added Permissions Check tool to review important WordPress file and folder permissions.
• Added Permissions Check card to the main Tools page.
• Added Permissions Check item to the Tools dropdown menu.
• Added permission status counts for Good, Needs Attention, and High Risk items.
• Added current and recommended permission values to the Permissions Check table.
• Added Actions column to the Permissions Check table.
• Added permission repair actions for files and folders that can be safely updated.
• Added 403-safe fallback handling for permission repair requests blocked by admin-ajax.php.
• Added special handling for wp-config.php permission checks.
• Added support for detecting wp-config.php in the WordPress root or parent directory.
• Added High Risk status for wp-config.php when permissions are not set to 0644.
• Added High Risk status for unsafe writable files.
• Added Needs Attention status for folders that are not using recommended permissions.
• Added sorting to show High Risk items first, then Needs Attention, then Good.
• Improved Plugin Refresher table styling and layout.
• Improved Plugin Refresher helper text to better explain its infection-cleanup purpose.
• Improved bulk refresh messaging and completion behavior.
• Improved button hover styling so text and icons remain readable.
• Improved Theme Refresher table styling and layout to match Plugin Refresher.
• Improved Watch Dog baseline exclusion handling.
• Improved dashboard badge icon contrast.
• Improved Tools page card layout for a cleaner six-tool grid.
• Improved Plugin Check compatibility by adding missing translator comments.
• Improved Plugin Check compatibility by escaping settings page output.
• Improved Plugin Check compatibility by sanitizing request values.
• Improved Plugin Check compatibility by cleaning nonce handling warnings.
• Improved Plugin Check compatibility by cleaning prefix and naming warnings.
• Removed unnecessary summary stat cards from the Plugin Refresher page.
• Removed plugin folder slugs from the Plugin Refresher table for a cleaner interface.
• Removed Recommended Baseline card from Permissions Check.
• Removed bottom “No obvious world-writable wp-content items found” card from Permissions Check.
• Excluded Support Plugin - WP Fix It from the manual fresh install list.
• Excluded Site Lockdown Security from the Plugin Refresher table.
• Changed inactive status icons from a dash to an X.
• Changed Permissions Checker text to Permissions Check.
• Changed Blacklist Checker text to Blacklist Check.
• Changed SSL Checker text to SSL Information.
• Reordered navigation so Scanner appears after Tools in both the top menu and WordPress admin side menu.
• Reordered Tools menu items so File Finder & Remover appears after Theme Refresher.
• Added File Finder & Remover card ordering improvements on the main Tools page.
• Fixed scanner success messages so they only display on the Scanner page.
• Fixed Watch Dog handling for wp-config.php review actions.
• Fixed wp-config.php exclusion saving and detection behavior.
• Fixed Site Lock menu icon hover color behavior.
• Fixed Theme Refresher fatal error caused by loading WordPress theme install functions more than once.
• Fixed visible translator comment text appearing on the dashboard.
• Fixed mixed line ending warnings across plugin files.
• Improved PHPCS compliance across refreshed plugin files.

7.0

• Added Watch Dog File Change Monitor.
• Added trusted file baseline creation and rebuild workflow.
• Added file change scanning for new, modified, and deleted files.
• Added scheduled Watch Dog file change scans.
• Added branded email alerts when file changes are detected.
• Added Watch Dog detected changes review table with view, download, approve, delete, and bulk actions.
• Added file details modal with readable size and modified date values.
• Added expandable file paths for long detected file paths.
• Added baseline exclusions for folders, individual files, wildcards, and server paths.
• Added protected Watch Dog baseline storage under wp-content/uploads/guard-dog/watch-dog/.
• Added Site Lock compatibility for Watch Dog storage while Site Lock is enabled.
• Added automatic internal exclusions for Watch Dog storage, report helpers, and error_log files.
• Added AJAX actions and loading overlays for baseline creation, baseline deletion, baseline rebuilds, and change scans.
• Added scan completion scrolling and success confirmation messages.
• Added Watch Dog Core Check.
• Added WordPress core file verification against the official WordPress.org checksum API.
• Added detection for modified, missing, unreadable, and unexpected WordPress core files.
• Added Core Check review actions to view, download, delete, and ignore reported files.
• Added scheduled Core Check scans.
• Added branded Core Check email alerts when core issues are found.
• Added dedicated Core Check settings for scan frequency, email alerts, and recipient.
• Updated Watch Dog navigation with File Change Monitor and Core Check tools.
• Improved Watch Dog styling, buttons, cards, status badges, modals, and admin workflow.
• Improved AJAX navigation and pagination handling.
• Improved compatibility with Plugin Check security and coding standard recommendations.

6.8

• Now compatible with hosting environments that auto lock WordPress core files.
• Improved site lock conditions to isolate certain folders and files.

6.7

• Removed Site Lock status in admin bar on site frontend.
• Added bulk database actions to infection scanner.
• Added select file actions to file remover tool.

6.6

• Fixed auto lock/unlock with MainWP.

6.5

• Made plugin code run only in admin area where needed.

6.4

• Fixed styling issue on scanner page.

6.3

• Added a database infection scanner to find harmful data.
• Added a setting to disable the admin bar Site Lock status display.

6.2

• Corrected typo in plugin description.

6.1

• Added AJAX loading content notice.

6.0

• Changed user interface to AJAX for faster navigation on Site Lockdown pages.
• Added SSL checker tool to get details about the site SSL certificate.
• Improved infection scanner and added saved previous scan view.
• Made all tables responsive on all screen sizes.
• Improved blacklist checker tool.

5.6

• Added scheduled infection scans emailed directly to designated email addresses.

5.5

• Added additional lock exceptions for folders that need write permissions.

5.4

• Improved API REST endpoint call for cache bypass.

5.3

• Fixed permissions issue with Site Lock and MainWP.

5.2

• Added integration with MainWP to manage Site Lock during remote updates.

5.1

• Added a plugin refresher to reinstall fresh plugins when the current version is corrupted.

5.0

• Added an all-new Tools section to expand WordPress site auditing capabilities.
• Introduced the Find & Remove Files tool for locating, filtering, and deleting unwanted or suspicious files.
• Added a built-in Blacklist Checker to scan URLs, domains, and site status against major reputation lists.
• Added internal optimizations for future feature expansion.

4.9.2

• Can now exclude single plugins from Site Lock.

4.9.1

• Added new infection patterns to reduce false positives.

4.9

• Added new infection patterns to find bad files.

4.8

• Added new infection patterns to find bad files.

4.7

• Improved scanner performance.

4.6

• Added new infection patterns to find bad files.

4.5

• Temporarily removed MainWP integration to correct timeout issues during updates.

4.4

• Added new infection patterns to find bad files.

4.3

• Set up MainWP bridge for unlock/relock when running updates.

4.2

• Minor style changes.

4.1

• Added Site Lock Auto Enable.
• Added automated security reports.

4.0

• Rebranded plugin as a full security suite.

3.7

• Updated infection scanner patterns.

3.6

• Added infection scanner for site files.

3.5

• Fixed bulk delete action.
• Updated button styling.

3.4.4

• Fixed report fatal error.

3.4.3

• Fixed report hyperlinks.

3.4.2

• Fixed font styling on report download.

3.4.1

• Fixed typo.

3.4

• Added ability to download folder audit and security report.

3.3

• Added per-folder lock exclusion.
• Added new UI on main menu.

3.2

• Added locked item count to dashboard display.

3.1

• Fixed Site Health issue when Site Lock is on.

3.0

• Added user security settings to lock down account attacks.

2.9.4

• Added Site Lock under Tools menu.
• Added area for new settings tab.
• Added dropdown to security tab.
• Added style changes.

2.9.3

• Corrected bulk delete actions.

2.9.2

• Enhanced Site Lock conditioning.

2.9.1

• Fixed conflict with WP Rollback.

2.9

• Added view file action buttons.

2.8

• UI improvements.

2.7

• Fixed security header defaults.

2.6

• Fixed bulk ignore and delete functions.

2.5

• Added security area to lock folders and files and set security headers.

2.0

• New UI.

1.3.1

• Improved plugin header and descriptions.
• Added Author URI and GPL license URI.
• Enhanced escaping for better security compliance.

1.3.0

• Added auditing of wp-content and WordPress root folder.
• Improved error handling for unreadable directories.

1.2.0

• Added uploads and themes auditing.
• Improved plugin rows to match the Plugins screen exactly.

1.0.0

• Initial release. Added plugin folder auditing.