CodeCanvas Guard
CodeCanvas Guard is a local-first WordPress security suite built around reviewable changes and safe recovery. Core features include: Safe, Balanced, and Strict protection profiles. A recovery-first custom login route with browser verification before activation. Username-and-IP rate limiting, CIDR al
About this tool.
CodeCanvas Guard is a local-first WordPress security suite built around reviewable changes and safe recovery.
Core features include:
- Safe, Balanced, and Strict protection profiles.
- A recovery-first custom login route with browser verification before activation.
- Username-and-IP rate limiting, CIDR allow/block rules, a login honeypot, and generic login errors.
- TOTP two-factor authentication with encrypted secrets and one-use recovery codes.
- Optional role-based 2FA enforcement and optional Cloudflare Turnstile.
- REST user protection, author-enumeration blocking, XML-RPC and pingback controls, security headers, and file-editor protection.
- WordPress core and eligible WordPress.org plugin checksum checks.
- Local suspicious-PHP patterns, executable uploads, unsafe permissions, recent sensitive-file changes, and known-vulnerability matching.
- Critical, High, Medium, Informational, and Unavailable findings with exact reasons and evidence.
- Administrator-reviewed findings, exact-file hash approvals, filters, and protected CSV/JSON exports.
- Scheduled scans and priority-aware file monitoring with explicit coverage reporting.
- Administrator-approved trusted repairs, protected recovery points, quarantine, restore, and rollback.
- Security activity logs, update awareness, session review, and optional email alerts.
Scheduled scans do not modify files. Repair, quarantine, restore, and rollback actions require an authenticated administrator action and nonce. Guard does not send telemetry to CodeCanvas.
Emergency Recovery
The dashboard can create a one-time emergency login link. The link expires after 30 minutes and opens a 15-minute recovery session.
For hosting-level recovery, add the following above the stop-editing comment in wp-config.php :
define( 'CODECANVAS_GUARD_DISABLE', true );
Remove the line after access is restored and the configuration is corrected.
External Services
CodeCanvas Guard uses external services only for the features described below.
