WPGuard watches every WordPress site you manage — logins, plugins, file changes, hidden malware — and alerts you within minutes, with one-click quarantine instead of a 2am SSH session.
A lightweight mu-plugin reports to your dashboard — it never accepts inbound connections, and the dashboard never touches your site's admin credentials. Full technical detail on the Security page.
One PHP file in mu-plugins. No Composer dependencies, PHP 7.4+ compatible, under 64MB memory on every check-in.
Every request is Ed25519-signed with a timestamp and nonce. Replays and unsigned traffic get a silent 404, not a 401.
New admin user, hidden plugin, bot-UA login from 3 IPs at once — critical events reach you in under a minute across email, Slack, or Telegram.
Core, plugin, and theme files checked against official checksums daily — plus regex signatures for obfuscated payloads and webshells.
Plugins are compared from disk AND from get_plugins() — the exact mismatch a self-hiding plugin depends on to stay invisible.
Move a malicious plugin to a deny-all folder instantly — never deleted, always restorable, always logged in an immutable audit trail.
A stolen editor password was escalated to admin and used from three IPs simultaneously, each posing as Googlebot. A fake plugin hid itself from the admin plugin list using a filter hook, injecting an obfuscated script that pulled its payload address from a public blockchain — designed specifically to evade static malware scanners.
No. WPGuard never asks for, stores, or transmits your WordPress admin password. The agent connects using its own Ed25519-signed key pair, generated per site, useless anywhere else if it ever leaked. Full technical explanation on the Security page.
WPGuard checks in with every monitored site every five minutes. If a site misses its check-in window, you get an "agent silent" alert — this often means the server or WordPress itself is down, not necessarily that anything is wrong with WPGuard.
WPGuard runs as a lightweight agent that reports out continuously, with the dashboard living entirely outside the WordPress install being monitored — so even a fully compromised site can't silence its own alarm. Disk-vs-database inventory checks also catch plugins that hide themselves from wp-admin, a technique most in-WordPress scanners miss by design.
Yes — one site per workspace stays free with no time limit and no credit card required, with the same real-time monitoring, alerts, and file-integrity checks as a paid site. See the Pricing page for full details.
Yes. Every downloadable maintenance report supports your own logo and a choice of layout from Report Branding, so what your client sees looks like it came from you, not a third-party tool.
Set your own price per client site — WPGuard bills you once per workspace, you bill your clients however you already do.
See pricing →