Hard Guard Security is a free WordPress security plugin with malware scanning, vulnerability scanning, two-factor authentication (2FA), brute force login protection, audit logs, file integrity monitoring, security hardening, and database malware scanning.
The plugin does not lock features behind payment, require a license key, or send telemetry, scan results, or website files to its author. A voluntary PayPal donation link appears only on Hard Guard Security screens and in the plugin row.
https://www.youtube.com/watch?v=CKiPjClNP9A
Login Security & Brute Force Protection
- Progressive login lockouts by IP address, username, or both.
- IPv4 and IPv6 whitelist, blacklist, CIDR, and hardened trusted-proxy client-IP resolution with explicit header selection.
- Optional custom login URL with safety checks, rollback, and emergency recovery.
Two-Factor Authentication (2FA)
- Email-code and RFC 6238 TOTP two-factor authentication.
- Per-user methods, role policies, setup grace periods, recovery codes, and administrator reset.
- Application Password policies, inventory, revocation, inactivity cleanup, and security alerts.
Audit Log & Live Traffic
- Searchable Audit Log with severity, category, action, result, retention, alert rules, CSV/JSON export, redaction, and Multisite aggregation.
- Read-only Active Sessions view loaded only when opened, plus on-demand Live Traffic that runs only while an administrator is watching the tab and keeps no traffic history.
Malware Scanner & Vulnerability Scanner
- Quick and Full malware scans performed locally with scan history, SHA-256 ignore rules, quarantine, and restoration.
- Optional read-only Database Malware Scanner for manual Quick/Full scans with separate SQL findings, context-aware behavioural heuristics, and SC-family persistence indicators in options/database triggers.
- Full and Automatic scans include a separate Vulnerabilities & updates stage for WordPress Core, plugins, and themes.
- Known-vulnerability matching is performed locally against a signed Hard Guard threat-intelligence database; plugin/theme inventory and scan results are not sent to Hard Guard.
- Outdated components are identified separately from known vulnerabilities using WordPress' existing local update cache, without Hard Guard forcing an additional inventory request.
- WordPress Core integrity checks using official WordPress.org checksums.
- File-permission diagnostics and checks for unexpected executable files.
Antispam & Country Blocking
- Local antispam for native comments, WooCommerce reviews using the comment system, native registration, WooCommerce My Account registration, and WooCommerce lost-password requests.
- Optional Math CAPTCHA for protected interactive forms with Off, Always, and Only for suspicious visitors modes.
- Separate per-IP rate limiting for WooCommerce lost-password requests; WooCommerce checkout and Store API registration are not intercepted.
- Optional country allow/block rules using country.is, with IP/CIDR recovery exceptions and fail-open handling.
SSL Security & WordPress Hardening
- SSL certificate, HTTPS redirect, mixed-content, and live security-header diagnostics.
- HSTS, upgrade-insecure-requests, MIME-sniffing, Referrer-Policy, frame protection, Permissions-Policy, and X-Powered-By controls.
- XML-RPC, REST user listing, author enumeration, user sitemap, directory indexing, sensitive-file, uploads PHP, and file-editor hardening.
- Daily Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks, with safety-check rollback.
- Upload Directory Shield adds a second managed .htaccess layer directly in WordPress uploads on Apache/LiteSpeed.
- Suspicious .htaccess detection identifies dangerous PHP/CGI execution directives during daily checks and manual malware scans.
- Dedicated SMTP settings used only for Hard Guard Security messages.
- Settings export/import and optional complete data cleanup during uninstall.
- Personal-data exporter and eraser integration under WordPress Tools.
- The administration interface follows each user’s WordPress dashboard language. Translations are supplied through WordPress.org language packs when available and are not bundled in the plugin ZIP.
Important: Hard Guard Security reduces selected risks but cannot guarantee that a website is secure or malware-free. Keep verified backups, install updates, use secure hosting, and test high-risk changes on a staging site.
1.18.4
- Fixed a Database Scanner false positive where standard WordPress oEmbed markup was rated High because WordPress intentionally hides the embed iframe before JavaScript sizes it.
- Only the native WordPress oEmbed pattern is exempt from the hidden-external-iframe rule; unrelated hidden iframes remain fully detected.
1.18.3
- Added a Suspicious finding for unknown PHP-like files placed directly in wp-content, while expected WordPress drop-ins and common cache configuration files are exempt from this location-only heuristic.
- Added a High finding for hidden dot-prefixed PHP-like files inside mu-plugins. Normal must-use plugin PHP files remain allowed by location.
- Location exemptions never skip content analysis; legitimate drop-in paths are still scanned for malware signatures.
1.18.2
- Fixed malware-scanner self-detection of the SC auto-prepend signature in Hard Guard Security's own signature definitions.
- The SC marker is now assembled at runtime, so the scanner still detects the real contiguous marker in other files and database records without embedding that same IOC literally in its own scannable source.
1.18.1
- Added automatic scanner-engine state migration during updates.
- Unfinished legacy scans are closed cleanly and the temporary scan-file queue is reset without deleting settings, completed findings, quarantine records, or ignored hashes.
- Scanner schema migration retries automatically if the database cannot complete the reset on the first request.
1.18.0
- Rebuilt the malware-scanner startup path as a local-only incremental engine; manual scans no longer call the WordPress checksum API before local file scanning begins.
- Removed the remote Core checksum/allowlist dependency from malware scanning. Core integrity remains available separately in Tools > File Integrity.
- File discovery is now bounded by directory-entry count and resumes large directories across multiple AJAX requests instead of processing an entire large directory in one request.
- Locally discovered scan candidates are queued with bulk INSERTs instead of per-file SELECT + INSERT queries, reducing shared-hosting timeouts and database load.
- Core-directory files are content-scanned locally without being classified as unexpected merely because a remote filename manifest is unavailable.
- Legacy in-progress checksum stages are migrated directly into local discovery without contacting an external service.
1.17.7
- Harden scanner AJAX parsing against warnings/HTML surrounding otherwise valid WordPress JSON responses.
- Start scanner response buffering during plugin bootstrap so output emitted before the AJAX handler can be discarded.
- Batch WordPress core allowlist inserts to avoid thousands of SQL queries in the 2% checksum stage on shared hosting.
- Retry/recover scanner status instead of freezing after a single lost step response.
1.17.6
- Made scanner step/status AJAX responses resilient to PHP notices, warnings, and stray output that would otherwise corrupt JSON while the scan itself continues.
- Scanner UI now recovers from a single lost/invalid step response by re-reading the active scan status and continuing automatically instead of stopping at a stale percentage.
- Unexpected AJAX output is discarded from the browser response and, when WP_DEBUG_LOG is enabled, recorded in the PHP debug log for diagnosis.
1.17.5
- Added SC detection for the hidden
wp-content/.anything directory observed on an infected site, including an alert even when the directory is empty.
- Added generic detection for executable PHP-like files inside any hidden dot-prefixed directory directly under
wp-content, so randomized hidden directory names remain detectable.
- Hidden-directory findings are informational scan objects and are not offered to bulk quarantine; contained suspicious files remain individually actionable.
1.17.4
- Added targeted detection for the SC self-healing WordPress malware family described by Sucuri in September 2026.
- File Scanner now checks SC persistence indicators including hidden
wp-content PHP loaders, SC auto-prepend marker, suspicious auto_prepend_file directives, known hyper-engine-kit paths, random hex ZIP restore bundles, drop-in/theme rebuild behavior, and shared-memory API use.
- Database Malware Scanner now flags
sc_*, _transient_sc_*, and _transient_timeout_sc_* option names, detects gzip+Base64 option payloads that decompress to PHP, checks SC markers in cron/options, and performs a best-effort read-only audit of database triggers on WordPress user tables.
- SC option-name matches are High by themselves to limit false positives; stronger payload/loader indicators can elevate the same infection to Critical.
1.17.3
- Added optional Antispam protection for the classic WooCommerce My Account registration form.
- Added optional Antispam protection and a separate per-IP rate limit for the classic WooCommerce lost-password request form.
- Extended Math CAPTCHA to protected registration and lost-password forms while leaving WooCommerce checkout and Store API flows untouched.
- Updated the WordPress.org compatibility declaration to Tested up to WordPress 7.1.
1.17.2
- Added an optional Math CAPTCHA for native WordPress comments and WooCommerce reviews with Off, Always, and Only for suspicious visitors modes.
- Suspicious mode uses recent local spam/reject history for the visitor IP and proximity to the configured comment rate limit without external CAPTCHA services.
- Math challenges are signed, time-limited, and validated server-side without exposing the expected answer in HTML or JavaScript.
1.17.1
- Improved the WordPress.org short description and feature headings to better highlight malware scanning, vulnerability scanning, 2FA, brute-force login protection, audit logging, and hardening.
- Updated the plugin display name to highlight Malware Scanner, 2FA, and Login Protection.
- Updated the plugin contact email shown in the administration footer.
1.17.0
- Added an optional Data hiding setting to disable public RSS and Atom feeds, remove feed discovery links, and return 404 for feed requests.
- Added read-only Active Sessions view under Audit Log. Session data is loaded only when the tab is opened.
- Added lightweight on-demand Live Traffic. Monitoring starts only while the Live Traffic tab is open, keeps no traffic history, and stops automatically shortly after the tab is closed.
- Live Traffic shows guest/logged-in status, resolved IP, current page, browser/device, and last activity; sensitive query parameters are redacted.
1.16.2
- Reduced malware-scanner false positives in risky
.htaccess FilesMatch analysis by evaluating each block independently and ignoring comment-only public grants.
- Reworked request-controlled
include/require detection to use PHP language tokens, preventing identifiers such as require_jetpack_authentication() from being misclassified as PHP require statements.
- Refined file-scan scoring so filename/location-only indicators remain High instead of becoming Critical through score aggregation; PHP files and double-extension PHP files in uploads remain strong High findings.
- Changed hidden PHP markers inside static/media files from automatic Critical to High unless stronger execution behaviour is also detected.
- Recalculate active severity counters after false-positive, ignore, quarantine, and restore actions so non-open findings no longer inflate Critical/High notification counts.
1.16.1
- Reworked filesystem location resolution to use WordPress path APIs and plugin-file-derived paths instead of operational ABSPATH and WordPress filesystem plugin-directory helpers.
- Improved support for non-standard WordPress core, content, plugins, themes, uploads, and home-directory layouts, including safer .htaccess location handling.
- Reworked direct database queries to use prepared wpdb statements, including %i placeholders for table and column identifiers and placeholders for all dynamic values.
- Added safe failure handling when required WordPress paths or .htaccess marker helpers cannot be resolved.
1.16.0
- Added optional read-only Database Malware Scanner to manual Quick and Full scans.
- Added separate Database findings results, severity counts, scan-history counts, and JSON report output.
- Added context-aware behavioural detection and safe explicit-payload decoding without requiring a remote database-malware signature feed.
- Quick database scans inspect
wp_options; Full database scans additionally inspect wp_posts.post_content and wp_postmeta.meta_value in bounded batches.
1.15.1
- Added a persistent current-results snapshot for the automatic Suspicious .htaccess Scanner.
- Added an expandable findings table under System Tweaks → Server Rules Protection showing severity, file path, line number, detected rule, and the matched/redacted directive.
- Kept Audit Log as the historical event record while the System Tweaks table reflects only the most recently completed automatic scan.
- Added upgrade-safe messaging for 1.15.0 scan summaries that did not yet store file-level finding details.
1.15.0
- Added Server Rules Integrity + Auto-Heal, Upload Directory Shield, and the daily Suspicious .htaccess Scanner.
- Integrated suspicious .htaccess analysis into manual Quick and Full malware scans when enabled.
1.14.4
- Removed the plugin-only interface language selector so the administration interface follows the locale selected by WordPress for each user.
- Removed the separate Email language setting. Global security emails use the WordPress site language, while user-specific 2FA messages use the recipient’s WordPress language.
- Replaced custom text-domain gettext overrides with WordPress native just-in-time language-pack loading and locale switching.
- Kept compatibility handling for language-dependent event and scan text stored by older plugin versions without bundling translation catalogs.
1.14.3
- Removed all bundled compiled translation catalogs; runtime translations now come from WordPress.org language packs.
- Removed direct uses of WordPress internal plugin/content directory constants and switched directory resolution to WordPress APIs.
- Updated plugin-name lookup to use WordPress plugin metadata instead of constructing plugin file paths manually.
- Clarified the Hard Guard vulnerability intelligence external-service disclosure, including a direct service URL and privacy-information link.
- Changed automatic Hard Guard vulnerability-feed downloads to opt-in for new installations; the default is now disabled until an administrator enables them.
- Corrected the WordPress.org checksum disclosure to describe the Core checksum request actually performed by this release.
1.14.2
- Fixed the per-user interface language selector regression introduced in 1.14.0.
- Restored the bundled
.l10n.php runtime catalogs required when the selected Hard Guard Security language differs from the WordPress dashboard locale.
- Installed WordPress.org language-pack messages take precedence over bundled messages while the bundled catalog remains a fallback.
1.14.0
- Prepared the package for WordPress.org review: removed bundled compiled translation catalogs and the obsolete
load_plugin_textdomain() call.
- Updated country.is documentation to the current source repository and clarified service usage/privacy information.
- Removed the global PHP
ini_set() error-display override; System Tweaks now reports those values diagnostically only.
- Replaced the plugin-managed front-end
ob_start() callback with WordPress' managed template enhancement output buffer.
- Replaced hardcoded
wp-includes path segments with the native WPINC constant where applicable.
- Switched the emergency login redirect to WordPress
site_url() handling so subdirectory installations resolve the core login endpoint correctly.
- Expanded external-service disclosure for the signed Hard Guard vulnerability intelligence feed.
1.13.1
- Added a privacy-preserving signed version index to the threat-intelligence feed so outdated WordPress.org plugins, themes and Core can be detected locally without transmitting installed inventory.
- Kept the feed schema backward-compatible: older 1.13.0 clients accept the extended signed feed and ignore the optional version index.
- Vulnerable components can now also be reported as Outdated instead of suppressing the update finding.
- Added version-index status and a clear warning when a production feed has not yet been rebuilt with version records.
1.13.0
- Added local Vulnerability Monitoring for WordPress Core, plugins, and themes as a separate Full/Automatic Scan stage.
- Added separate Vulnerable and Outdated result categories so available updates are never mislabeled as known security vulnerabilities.
- Added optional signed Hard Guard vulnerability-database updates every 12 hours, immutable hash-addressed local cache files, anti-rollback checks, and fail-safe retention of the previous verified database.
- Feed downloads use a neutral Hard-Guard-Security User-Agent and do not send the site URL, plugin/theme inventory, installed versions, file names, or scan results.
- Added Critical/High/Medium/Low vulnerability counts, CVE/HGSA identifiers, CVSS, fixed version, active/inactive status, and known-exploited flags.
- Added new/changed vulnerability state tracking so email alerts are not repeated unchanged on every automatic scan.
- Added local Outdated detection using WordPress' existing update transients without initiating an additional update request.
- Added a manual signed-database refresh control, automatic-update toggle, database generation/advisory status, stale/bootstrap warnings, and per-scan threat-database snapshot metadata.
- Added a server-side feed-builder package for CVE List V5, GitHub Advisory Database, CISA KEV, reviewed WordPress mappings, and optional NVD enrichment.
1.12.0
- Added Scanner mode selection: MANUAL or AUTOMATIC.
- Automatic mode runs a Full Scan every configurable 1–365 days; the default interval is 7 days.
- Automatic scans run in bounded WP-Cron batches and continue through single scheduled step events instead of requiring one long PHP request.
- Added a database advisory lock around the automatic runner to prevent overlapping cron workers from processing the same scan concurrently.
- Added next automatic scan status and a warning when built-in WP-Cron spawning is disabled.
- Manual Quick Scan and Full Scan remain available while Automatic mode is enabled.
- Scan results and history now identify whether each run was Manual or Automatic.
- Switching back to Manual mode cancels pending automatic scan jobs and safely stops a running automatic scan.
1.11.0
- Added explicit hardened client-IP sources: REMOTE_ADDR, X-Forwarded-For, X-Real-IP, CF-Connecting-IP, and RFC 7239 Forwarded.
- X-Forwarded-For and Forwarded chains are now evaluated from the trusted server side toward the visitor, stopping at the first untrusted hop.
- Malformed, oversized, incomplete, or excessively long forwarded chains fail safely to REMOTE_ADDR.
- Added Proxy diagnostics showing the direct peer, trusted-proxy state, selected source, received headers, resolved visitor IP, and fallback reason.
- New installations default to REMOTE_ADDR only; upgraded sites with existing trusted proxies retain pre-1.11 behavior in a clearly marked Legacy automatic mode until an explicit source is selected.
- Added Polish translations for the new proxy hardening and diagnostics interface.
1.10.36
- Added dedicated Audit Log → Logins & IP blocks statistics for 24 hours, 7 days, and 30 days.
- Added failed-login and lockout trend chart, suspicious IP ranking, and current active IP lockout table.
- Updated Dashboard security KPIs with unique blocked IPs and current active lockouts; statistics are now linked to detailed Audit Log views.
- Changed Audit Log Overview IP ranking to count only suspicious authentication and blocking activity.
- Added Polish translations for the new login-security statistics interface.
1.10.35
- Prepared the free WordPress.org edition.
- Added a voluntary PayPal donation panel limited to Hard Guard Security screens and a Donate link in the plugin row.
- Added WordPress personal-data exporter and eraser integration.
- Added Plugin URI and Author URI and shortened the plugin header description.
- Removed the network-only header so the plugin can be activated per site or network-wide.
- Expanded external-service and privacy disclosures.
- Split the long historical changelog into
changelog.txt and reduced readme.txt size.
- Updated bundled translation catalogs for the new donation interface.
For earlier releases, see
changelog.txt included with the plugin.
Threat-intelligence signing: the detached Ed25519 signature covers the canonical JSON payload. Gzip is transport/storage compression only, so transparent HTTP decompression does not affect signature verification.