GuardForge hardens your WordPress site against common attacks without requiring an account or an API key. It applies proven hardening rules on activation, monitors for brute-force login attempts, protects your own account with two-factor authentication, checks your files against the build wordpress.
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.5 and PHP 7.4.
SourceWordPress plugins · Oct 19, 2026
01 / Source details
About this tool.
GuardForge hardens your WordPress site against common attacks without requiring an account or an API key. It applies proven hardening rules on activation, monitors for brute-force login attempts, protects your own account with two-factor authentication, checks your files against the build wordpress.org actually published, and keeps an audit log whose rows are hash-chained — so a line edited or deleted after the fact is detectable rather than deniable.
Nothing in the Free list below is capped, timed, or unlocked by paying. One thing in it reaches the network, it is off until you switch it on, and External services below describes it exactly: the file-integrity scan asks wordpress.org what your WordPress and your wordpress.org plugins are supposed to contain, so it can tell you when a file is not part of the official build — it sends a version number and a plugin slug, never your site’s address and nothing about your content.
Free
Hardening score — twenty-one checks of your own installation, scored 0-100, with each row stating exactly how many points it is worth and linking to the screen that fixes it. No outbound request: every check reads this site.
Staging / development mode — GuardForge notices when it is running on a copy of your site and stops acting on the world: lockouts are recorded but not enforced, and no notification e-mail, alert or firewall rule leaves the copy. Nothing that can switch it on survives a database copy, so a dump from staging can never disarm your live site.
Login brute-force protection with per-IP lockout and automatic unblock
Two-factor authentication for your own account — TOTP, a login challenge, and single-use recovery codes. Every logged-in user can reach the 2FA screen and protect their own login, not just administrators: editors, authors and shop managers hold accounts worth phishing too. The enrolment QR is drawn on your own server: no image is fetched from anywhere, so your secret never leaves the site.
File integrity against the official checksums — off until you switch the monitor on in Settings, because the comparison asks wordpress.org for the hashes. Once on: every core file, and every plugin hosted on wordpress.org, is compared against the hashes wordpress.org publishes for that exact release. So the screen can say more than “this changed since yesterday”: it separates files that are official, modified, missing, and not in the official build at all — which is what a backdoor looks like, and which no scan-to-scan comparison can ever see, because a shell that was already there when the baseline was taken looks like every other unchanged file.
A premium or custom plugin, and any theme, has no published hashes anywhere. Those files are marked “no reference” and stay on the scan-to-scan comparison. They are never counted as clean — a tick beside something nothing checked is worse than no tick at all.
A core file that is modified or missing is named on the screen with its verdict, next to a link to Dashboard → Updates: re-installing WordPress is what puts core files back, and this plugin does not write into wp-admin or wp-includes itself.
Audit log, hash-chained — it records logins, failed attempts, option changes, plugin and theme activity, and user and role changes, and every row carries the hash of the row before it. Press “Verify chain” and the table is walked: change one field on one row and that row no longer matches its own hash; delete a row and the next one points at a hash nothing in the table produces. Neither is visible in the table itself, which is the point — an audit log an intruder can tidy up afterwards is decoration. Reading and verifying are free; only streaming it out as CSV is a Pro feature.
Security hardening: disable XML-RPC, remove version headers, protect wp-config.php via .htaccess
Content-Security-Policy header — your policy, sent report-only by default so a wrong rule cannot break the site
IP management — allowlist, lift a lockout, login-log browser
Spam-bot honeypot on the comment form
WordPress core file protection rules (.htaccess)
Pro
GuardForge Pro is a separate add-on (installed alongside this free plugin) that adds:
Two-factor enforcement policy — require every administrator to be enrolled before they can use the admin
Alerts to Telegram, Slack and a signed webhook — a card per channel rather than a box of JSON, each with its own minimum severity, a “Send test” that really sends through the same dispatcher, and a digest you can leave immediate or batch hourly or daily. Quiet hours hold the ordinary traffic until morning, while a lockdown or a malware finding goes straight through them. Bot tokens, Slack URLs and HMAC secrets are encrypted on your own site and the form never prints one back — it shows the last four characters and nothing else
Lockdown mode — one switch that closes registration, comments, XML-RPC and anonymous REST writes. It can also throw itself, if you ask it to: twenty different addresses locked out inside ten minutes, or a finding from the malware scanner. An automatic lockdown lifts itself after an hour, writes both ends to the audit log, e-mails you, and never fires on a copy of your site
Vulnerability database — published advisories for WordPress, your plugins and your themes, matched against what is installed here, in real time as they are issued
Patch by update — off until you switch it on: when an advisory names the version that fixes it and WordPress is offering an update that reaches it, GuardForge installs that update on cron, one plugin per run, with an allow list and a deny list, and tells you by e-mail and in the audit log. Never on a staging copy, never on a plugin directory that is a symbolic link, and never twice in a day after a failure
Geo-IP blocking — block or allowlist whole countries
Cloudflare Firewall Sync — push locked IPs into your own Cloudflare zone, with your own scoped token. Cloudflare’s published list of edge addresses is refreshed daily, IPv6 included, so a site behind a newer edge does not quietly start logging, counting and geo-locating every visitor as the edge itself
Malware scanner — heuristics + signature-based scanning across wp-content
AI Threat Analytics — a batched summary of security incidents with recommendations, written by an AI service the add-on calls (the add-on’s own readme lists what it sends)
Audit log export (CSV, streamed — a year of log does not have to fit in memory)
Priority email support with an active Pro licence
GuardForge is part of the Forge Suite . Learn more and get Pro at https://avakode.com.
External services
This plugin reaches wordpress.org, and nothing else. Activating it contacts nobody and schedules nothing that would — the file-integrity monitor is off on a fresh install, and switching it on is what puts the daily lookup on the schedule. The only outgoing request it ever makes is the checksum lookup below, it happens only while the file-integrity monitor is switched on, and it asks a public catalogue a question that names nothing of yours.
wordpress.org, for the file-integrity scan. Off until you switch the monitor on in GuardForge > Settings. Then once a day, and whenever you press “Run scan now”, GuardForge asks api.wordpress.org for the checksum list of your WordPress version and locale, and downloads.wordpress.org for the checksum list of each installed plugin it hosts (its folder name and version number). Those are public catalogues: the request carries the version, the locale and the slug, and nothing else — not your site’s address, not your user list, not your content, not a licence key. Answers are cached, and one scan makes at most ten requests, so a site with sixty plugins is covered over a few days rather than in one burst. Switch the file-integrity monitor off in Settings and none of this happens.
WordPress.org privacy policy: https://wordpress.org/about/privacy/ (wordpress.org publishes no separate terms page for this lookup)
Nothing about your site is sent on a schedule or in the background. A fresh install makes no request at all and schedules none; with the file-integrity monitor switched on it has one daily request — the checksum lookup, while that monitor is on — and it asks a public catalogue a question that names nothing of yours. Switch the file-integrity monitor off and this plugin makes no outgoing request at all.
Uninstalling
Deleting GuardForge always removes one thing: your two-factor enrolments. That table holds TOTP shared secrets and single-use recovery codes — credential material — and once the plugin is gone nothing can use them, while a database that outlives the plugin gets backed up, exported and copied to staging. Reinstalling means enrolling again, which takes half a minute; leaving shared secrets behind has no upside at all.
Everything else stays by default: your login log, file-integrity snapshots, audit trail and settings all survive a delete, so removing the plugin by accident does not take your history with it. If you want a clean slate, tick Delete GuardForge data on uninstall in GuardForge → Settings before you delete.
When the last Forge plugin or add-on on a site is deleted, everything Forge stored on the site is removed, on every site of a network: the statistics settings and the install ID, the shared job queue with its scheduled events, and the other settings and caches the Forge plugins share. While another Forge product stays, only this plugin’s own share goes. The paragraphs above are about this plugin’s own content.
The hardening score
GuardForge → Hardening score works out one number from twenty-one checks of this installation. Every check reads your own site — options, constants, your .htaccess, your user list, WordPress’s own update transients. Nothing is fetched from anywhere, which is also why the score cannot verify a heade
See it in action
Screenshots & previews.
Hardening score: checks of your own installation scored 0–100, recorded once a day so you can see the trend.The checklist behind the score: every row says what it found, how many points it is worth, and links to the setting that changes it.File integrity against the checksums wordpress.org publishes: here a PHP file that is not part of the official WordPress build, found in wp-includes.Login log: failed attempts per address, and the lockout once the threshold is reached.Hash-chained audit log: user, role, option and plugin changes, and "Verify chain" confirming every row still points at the one written before it.Two-factor authentication for your own account: the enrolment QR code is drawn on your own server, nothing is fetched from anywhere.
02 / Source details
Getting started.
01Upload the guardforge folder to /wp-content/plugins/ , or install through Plugins → Add New.
02Activate GuardForge through the Plugins menu.
03Open GuardForge → Settings to review the hardening options.
04Visit GuardForge → File integrity to create the initial baseline, and GuardForge → 2FA to protect your own login. Point your other users at GuardForge → 2FA as well — it is the one GuardForge screen every logged-in role can open, and it only ever touches the account of whoever is looking at it.
03 / Source details
Frequently asked questions.
Do I need an account or API key for the free version?
No. Every protection runs on your own server, and the one thing that reaches the network needs no account: the file-integrity scan asks wordpress.org for the official checksums of your WordPress version and your wordpress.org plugins, and says nothing about you. See External services above. Nothing else in this plugin ever leaves your site.
How do I get the Pro features?
Pro features ship in a separate “GuardForge Pro” add-on. Install this free plugin first, then add Pro from https://avakode.com.
Does the Pro add-on send my data anywhere?
Only what each feature needs. Nothing about your site reaches Avakode, the company behind GuardForge, from this plugin at all: its one outgoing request is the integrity scan’s checksum lookup, and that goes to wordpress.org. See External services above.
GuardForge Pro is a separate plugin; its own readme lists what it sends and where.
How would I know if somebody edited the audit log?
Press “Verify chain” on the audit-log screen. Every row carries the hash of the row before it, so an edited field breaks its own row, and a deleted row leaves the next one pointing at a hash the table cannot produce — the check names the first row that failed. Restoring a database backup over a live log will break it too, for the same honest reason. On a log larger than fifty thousand rows the check covers the oldest part and says plainly that it was truncated, rather than dying half-way and leaving you an empty screen; there is no resume yet, so lower the retention window if your log is routinely that big.
Will the alerts wake me up at three in the morning?
Only for the things that should. Each channel has its own minimum severity and you can batch the traffic into an hourly or a daily digest instead of sending it as it happens. Quiet hours hold ordinary alerts until the hour you name — but a lockdown and a malware finding are let through immediately, which is why every signal carries a category as well as a severity. Alerts are part of the Pro add-on.
Will GuardForge conflict with other security plugins?
GuardForge is designed to coexist with Wordfence, Sucuri, iThemes Security, and similar plugins. If you notice a conflict, please open a support thread.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
