Hard Guard Security is a free WordPress security plugin with malware scanning, vulnerability scanning, two-factor authentication (2FA), brute force login protection, audit logs, file integrity monitoring, security hardening, and database malware scanning.
The plugin does not lock features behind payment, require a license key, or send telemetry, scan results, or website files to its author. A voluntary PayPal donation link appears only on Hard Guard Security screens and in the plugin row.
https://www.youtube.com/watch?v=CKiPjClNP9A
Login Security & Brute Force Protection
- Progressive login lockouts by IP address, username, or both.
- IPv4 and IPv6 whitelist, blacklist, CIDR, and hardened trusted-proxy client-IP resolution with explicit header selection.
- Optional custom login URL with safety checks, rollback, and emergency recovery.
Two-Factor Authentication (2FA)
- Email-code and RFC 6238 TOTP two-factor authentication.
- Per-user methods, role policies, setup grace periods, recovery codes, and administrator reset.
- Application Password policies, inventory, revocation, inactivity cleanup, and security alerts.
Audit Log & Live Traffic
- Searchable Audit Log with severity, category, action, result, retention, alert rules, CSV/JSON export, redaction, and Multisite aggregation.
- Read-only Active Sessions view loaded only when opened, plus on-demand Live Traffic that runs only while an administrator is watching the tab and keeps no traffic history.
Malware Scanner & Vulnerability Scanner
- Quick and Full malware scans performed locally with scan history, SHA-256 ignore rules, quarantine, and restoration.
- Optional read-only Database Malware Scanner for manual Quick/Full scans with separate SQL findings and context-aware behavioural heuristics.
- Full and Automatic scans include a separate Vulnerabilities & updates stage for WordPress Core, plugins, and themes.
- Known-vulnerability matching is performed locally against a signed Hard Guard threat-intelligence database; plugin/theme inventory and scan results are not sent to Hard Guard.
- Outdated components are identified separately from known vulnerabilities using WordPress' existing local update cache, without Hard Guard forcing an additional inventory request.
- WordPress Core integrity checks using official WordPress.org checksums.
- File-permission diagnostics and checks for unexpected executable files.
Antispam & Country Blocking
- Local antispam for native comments, WooCommerce reviews using the comment system, native registration, WooCommerce My Account registration, and WooCommerce lost-password requests.
- Optional Math CAPTCHA for protected interactive forms with Off, Always, and Only for suspicious visitors modes.
- Separate per-IP rate limiting for WooCommerce lost-password requests; WooCommerce checkout and Store API registration are not intercepted.
- Optional country allow/block rules using country.is, with IP/CIDR recovery exceptions and fail-open handling.
SSL Security & WordPress Hardening
- SSL certificate, HTTPS redirect, mixed-content, and live security-header diagnostics.
- HSTS, upgrade-insecure-requests, MIME-sniffing, Referrer-Policy, frame protection, Permissions-Policy, and X-Powered-By controls.
- XML-RPC, REST user listing, author enumeration, user sitemap, directory indexing, sensitive-file, uploads PHP, and file-editor hardening.
- Daily Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks, with safety-check rollback.
- Upload Directory Shield adds a second managed .htaccess layer directly in WordPress uploads on Apache/LiteSpeed.
- Suspicious .htaccess detection identifies dangerous PHP/CGI execution directives during daily checks and manual malware scans.
- Dedicated SMTP settings used only for Hard Guard Security messages.
- Settings export/import and optional complete data cleanup during uninstall.
- Personal-data exporter and eraser integration under WordPress Tools.
- The administration interface follows each user’s WordPress dashboard language. Translations are supplied through WordPress.org language packs when available and are not bundled in the plugin ZIP.
Important: Hard Guard Security reduces selected risks but cannot guarantee that a website is secure or malware-free. Keep verified backups, install updates, use secure hosting, and test high-risk changes on a staging site.
1.17.3
- Added optional Antispam protection for the classic WooCommerce My Account registration form.
- Added optional Antispam protection and a separate per-IP rate limit for the classic WooCommerce lost-password request form.
- Extended Math CAPTCHA to protected registration and lost-password forms while leaving WooCommerce checkout and Store API flows untouched.
- Updated the WordPress.org compatibility declaration to Tested up to WordPress 7.1.
1.17.2
- Added an optional Math CAPTCHA for native WordPress comments and WooCommerce reviews with Off, Always, and Only for suspicious visitors modes.
- Suspicious mode uses recent local spam/reject history for the visitor IP and proximity to the configured comment rate limit without external CAPTCHA services.
- Math challenges are signed, time-limited, and validated server-side without exposing the expected answer in HTML or JavaScript.
1.17.1
- Improved the WordPress.org short description and feature headings to better highlight malware scanning, vulnerability scanning, 2FA, brute-force login protection, audit logging, and hardening.
- Updated the plugin display name to highlight Malware Scanner, 2FA, and Login Protection.
- Updated the plugin contact email shown in the administration footer.
1.17.0
- Added an optional Data hiding setting to disable public RSS and Atom feeds, remove feed discovery links, and return 404 for feed requests.
- Added read-only Active Sessions view under Audit Log. Session data is loaded only when the tab is opened.
- Added lightweight on-demand Live Traffic. Monitoring starts only while the Live Traffic tab is open, keeps no traffic history, and stops automatically shortly after the tab is closed.
- Live Traffic shows guest/logged-in status, resolved IP, current page, browser/device, and last activity; sensitive query parameters are redacted.
1.16.2
- Reduced malware-scanner false positives in risky
.htaccess FilesMatch analysis by evaluating each block independently and ignoring comment-only public grants.
- Reworked request-controlled
include/require detection to use PHP language tokens, preventing identifiers such as require_jetpack_authentication() from being misclassified as PHP require statements.
- Refined file-scan scoring so filename/location-only indicators remain High instead of becoming Critical through score aggregation; PHP files and double-extension PHP files in uploads remain strong High findings.
- Changed hidden PHP markers inside static/media files from automatic Critical to High unless stronger execution behaviour is also detected.
- Recalculate active severity counters after false-positive, ignore, quarantine, and restore actions so non-open findings no longer inflate Critical/High notification counts.
1.16.1
- Reworked filesystem location resolution to use WordPress path APIs and plugin-file-derived paths instead of operational ABSPATH and WordPress filesystem plugin-directory helpers.
- Improved support for non-standard WordPress core, content, plugins, themes, uploads, and home-directory layouts, including safer .htaccess location handling.
- Reworked direct database queries to use prepared wpdb statements, including %i placeholders for table and column identifiers and placeholders for all dynamic values.
- Added safe failure handling when required WordPress paths or .htaccess marker helpers cannot be resolved.
1.16.0
- Added optional read-only Database Malware Scanner to manual Quick and Full scans.
- Added separate Database findings results, severity counts, scan-history counts, and JSON report output.
- Added context-aware behavioural detection and safe explicit-payload decoding without requiring a remote database-malware signature feed.
- Quick database scans inspect
wp_options; Full database scans additionally inspect wp_posts.post_content and wp_postmeta.meta_value in bounded batches.
1.15.1
- Added a persistent current-results snapshot for the automatic Suspicious .htaccess Scanner.
- Added an expandable findings table under System Tweaks → Server Rules Protection showing severity, file path, line number, detected rule, and the matched/redacted directive.
- Kept Audit Log as the historical event record while the System Tweaks table reflects only the most recently completed automatic scan.
- Added upgrade-safe messaging for 1.15.0 scan summaries that did not yet store file-level finding details.
1.15.0
- Added Server Rules Integrity + Auto-Heal, Upload Directory Shield, and the daily Suspicious .htaccess Scanner.
- Integrated suspicious .htaccess analysis into manual Quick and Full malware scans when enabled.
1.14.4
- Removed the plugin-only interface language selector so the administration interface follows the locale selected by WordPress for each user.
- Removed the separate Email language setting. Global security emails use the WordPress site language, while user-specific 2FA messages use the recipient’s WordPress language.
- Replaced custom text-domain gettext overrides with WordPress native just-in-time language-pack loading and locale switching.
- Kept compatibility handling for language-dependent event and scan text stored by older plugin versions without bundling translation catalogs.
1.14.3
- Removed all bundled compiled translation catalogs; runtime translations now come from WordPress.org language packs.
- Removed direct uses of WordPress internal plugin/content directory constants and switched directory resolution to WordPress APIs.
- Updated plugin-name lookup to use WordPress plugin metadata instead of constructing plugin file paths manually.
- Clarified the Hard Guard vulnerability intelligence external-service disclosure, including a direct service URL and privacy-information link.
- Changed automatic Hard Guard vulnerability-feed downloads to opt-in for new installations; the default is now disabled until an administrator enables them.
- Corrected the WordPress.org checksum disclosure to describe the Core checksum request actually performed by this release.
1.14.2
- Fixed the per-user interface language selector regression introduced in 1.14.0.
- Restored the bundled
.l10n.php runtime catalogs required when the selected Hard Guard Security language differs from the WordPress dashboard locale.
- Installed WordPress.org language-pack messages take precedence over bundled messages while the bundled catalog remains a fallback.
1.14.0
- Prepared the package for WordPress.org review: removed bundled compiled translation catalogs and the obsolete
load_plugin_textdomain() call.
- Updated country.is documentation to the current source repository and clarified service usage/privacy information.
- Removed the global PHP
ini_set() error-display override; System Tweaks now reports those values diagnostically only.
- Replaced the plugin-managed front-end
ob_start() callback with WordPress' managed template enhancement output buffer.
- Replaced hardcoded
wp-includes path segments with the native WPINC constant where applicable.
- Switched the emergency login redirect to WordPress
site_url() handling so subdirectory installations resolve the core login endpoint correctly.
- Expanded external-service disclosure for the signed Hard Guard vulnerability intelligence feed.
1.13.1
- Added a privacy-preserving signed version index to the threat-intelligence feed so outdated WordPress.org plugins, themes and Core can be detected locally without transmitting installed inventory.
- Kept the feed schema backward-compatible: older 1.13.0 clients accept the extended signed feed and ignore the optional version index.
- Vulnerable components can now also be reported as Outdated instead of suppressing the update finding.
- Added version-index status and a clear warning when a production feed has not yet been rebuilt with version records.
1.13.0
- Added local Vulnerability Monitoring for WordPress Core, plugins, and themes as a separate Full/Automatic Scan stage.
- Added separate Vulnerable and Outdated result categories so available updates are never mislabeled as known security vulnerabilities.
- Added optional signed Hard Guard vulnerability-database updates every 12 hours, immutable hash-addressed local cache files, anti-rollback checks, and fail-safe retention of the previous verified database.
- Feed downloads use a neutral Hard-Guard-Security User-Agent and do not send the site URL, plugin/theme inventory, installed versions, file names, or scan results.
- Added Critical/High/Medium/Low vulnerability counts, CVE/HGSA identifiers, CVSS, fixed version, active/inactive status, and known-exploited flags.
- Added new/changed vulnerability state tracking so email alerts are not repeated unchanged on every automatic scan.
- Added local Outdated detection using WordPress' existing update transients without initiating an additional update request.
- Added a manual signed-database refresh control, automatic-update toggle, database generation/advisory status, stale/bootstrap warnings, and per-scan threat-database snapshot metadata.
- Added a server-side feed-builder package for CVE List V5, GitHub Advisory Database, CISA KEV, reviewed WordPress mappings, and optional NVD enrichment.
1.12.0
- Added Scanner mode selection: MANUAL or AUTOMATIC.
- Automatic mode runs a Full Scan every configurable 1–365 days; the default interval is 7 days.
- Automatic scans run in bounded WP-Cron batches and continue through single scheduled step events instead of requiring one long PHP request.
- Added a database advisory lock around the automatic runner to prevent overlapping cron workers from processing the same scan concurrently.
- Added next automatic scan status and a warning when built-in WP-Cron spawning is disabled.
- Manual Quick Scan and Full Scan remain available while Automatic mode is enabled.
- Scan results and history now identify whether each run was Manual or Automatic.
- Switching back to Manual mode cancels pending automatic scan jobs and safely stops a running automatic scan.
1.11.0
- Added explicit hardened client-IP sources: REMOTE_ADDR, X-Forwarded-For, X-Real-IP, CF-Connecting-IP, and RFC 7239 Forwarded.
- X-Forwarded-For and Forwarded chains are now evaluated from the trusted server side toward the visitor, stopping at the first untrusted hop.
- Malformed, oversized, incomplete, or excessively long forwarded chains fail safely to REMOTE_ADDR.
- Added Proxy diagnostics showing the direct peer, trusted-proxy state, selected source, received headers, resolved visitor IP, and fallback reason.
- New installations default to REMOTE_ADDR only; upgraded sites with existing trusted proxies retain pre-1.11 behavior in a clearly marked Legacy automatic mode until an explicit source is selected.
- Added Polish translations for the new proxy hardening and diagnostics interface.
1.10.36
- Added dedicated Audit Log → Logins & IP blocks statistics for 24 hours, 7 days, and 30 days.
- Added failed-login and lockout trend chart, suspicious IP ranking, and current active IP lockout table.
- Updated Dashboard security KPIs with unique blocked IPs and current active lockouts; statistics are now linked to detailed Audit Log views.
- Changed Audit Log Overview IP ranking to count only suspicious authentication and blocking activity.
- Added Polish translations for the new login-security statistics interface.
1.10.35
- Prepared the free WordPress.org edition.
- Added a voluntary PayPal donation panel limited to Hard Guard Security screens and a Donate link in the plugin row.
- Added WordPress personal-data exporter and eraser integration.
- Added Plugin URI and Author URI and shortened the plugin header description.
- Removed the network-only header so the plugin can be activated per site or network-wide.
- Expanded external-service and privacy disclosures.
- Split the long historical changelog into
changelog.txt and reduced readme.txt size.
- Updated bundled translation catalogs for the new donation interface.
For earlier releases, see
changelog.txt included with the plugin.
Threat-intelligence signing: the detached Ed25519 signature covers the canonical JSON payload. Gzip is transport/storage compression only, so transparent HTTP decompression does not affect signature verification.