Security

We designed this for people who don't trust security tools.

You're trusting WPGuard with visibility into every site you manage. Here's exactly how the system works, so you don't have to take that on faith.

The model, in six guarantees

What's actually enforced, not just promised.

We never see your WordPress passwords

WPGuard's dashboard has no mechanism to store, request, or use a WordPress admin password. There is nothing to steal from us, because it was never given to us in the first place.

Every message is signed, not just encrypted

Each site gets its own Ed25519 key pair. Your site's agent signs every request it sends; our dashboard signs every command it sends back. A stolen network connection alone is useless without the private key.

The agent only ever sends

Your WordPress site never accepts an inbound connection from us to run arbitrary code. Commands are limited to 7 specific, narrowly-scoped actions — never eval, never shell access, never a file upload.

Replay protection built in

Every signed message carries a timestamp and a one-time nonce. Anything older than 5 minutes, or any nonce reused within that window, is rejected — a captured request can't be replayed later.

Invalid requests get a 404, not a 401

An attacker probing our API — or your agent's own command endpoint — can't tell "wrong signature" from "this route doesn't exist." There's no error message handing them a foothold.

Quarantine, never delete

When WPGuard acts on a suspicious plugin, it moves it to a deny-all-access folder with its own .htaccess block — it is never deleted. A false positive costs you nothing to undo.

What data we store

WPGuard stores what it needs to detect and alert on the specific attack patterns it watches for, and nothing beyond that:

  • Heartbeats — WordPress/PHP/MySQL versions, agent version, and a hash of the agent's own files (to detect tampering with the monitoring agent itself).
  • Events — login attempts, user and role changes, plugin/theme activity, and the specific option changes known to matter for security (never full site content).
  • Inventory — which plugins/themes exist on disk versus what WordPress itself reports, plus their versions.
  • File hashes — not file contents, for core/plugin/theme integrity checking against official checksums.

Full detail on retention and handling of this data lives in our Privacy Policy.

The 7 allow-listed remote actions

These are the only actions a signed command from the dashboard can ever trigger on your site — this list is fixed in the agent's code, checked before signature verification even runs, so a compromised dashboard could never smuggle a new command type into an already-installed agent:

  • run_scan — trigger an on-demand inventory/integrity scan
  • refresh_inventory — re-check plugins/themes/users
  • destroy_sessions — log out all active sessions for a user
  • force_password_reset — invalidate a user's password and sessions
  • quarantine_plugin — move a plugin to the deny-all quarantine folder
  • restore_plugin — move a quarantined plugin back
  • set_role — change a user's WordPress role

Read more about why we built it this way.

The full story →