Login protection & 2FA
Progressive lockouts, custom login URL, TOTP, email codes, recovery codes and role-based enforcement. Login rate limiting also protects standard WooCommerce My Account login forms.
Read documentation →Free & open-source WordPress security · v1.18.14.5
Free WordPress Security Plugin with Malware Scanner & 2FA.
Hard Guard Security is a free WordPress security plugin with malware scanning, vulnerability detection, 2FA, brute-force login protection, audit logging and WordPress hardening — without subscriptions, license keys, developer telemetry or paid feature unlocks.
GitHub downloads are provided by the project’s published releases. Verify that the release asset matches the displayed version before installing.
Local-first processing. Clearly disclosed external services are used only when configured or required by an enabled feature.
No telemetryLocal inventory matching
Local scannerFiles stay on your server
Free & open sourceNo license key or paid features
Multisite readyPer-site or network activation
Complete visibility
One free WordPress security plugin. Six layers of protection.
Use only the modules your site needs. Each area is designed around clear controls, actionable events and documented recovery procedures.
Audit Log & live visibility
Track security events, review active WordPress sessions and watch current visitors on demand without keeping a permanent traffic history.
Read documentation →Malware scanner & quarantine
Run local incremental file and optional database malware scans, detect WordPress administrator persistence and tampered security settings, verify official WordPress.org plugin files, and check Core integrity, permissions, vulnerabilities and suspicious server rules. File Permissions Scan now keeps complete paginated results ordered Critical → Warning → Good, while location-aware rules keep malware findings reviewable before quarantine.
Read documentation →GeoIP access control
Apply country allowlists or blocklists using country.is, with caching, safe failure and recovery exceptions.
Read documentation →Application Password control
Control creation and use, log credential events and associate the last resolved IP with a credential.
Read documentation →Hardening & recovery
SSL diagnostics, security headers, server-rule integrity with Auto-Heal, uploads protection, optional RSS/Atom feed disabling, a read-only default admin username check, emergency bypasses and safe configuration transfer.
Read documentation →Authentication
Stop automated attacks without locking yourself out.
Progressive lockouts adapt to repeat failures while explicit client-IP sources, trusted-proxy validation, proxy diagnostics, recovery URLs and staged login-path changes help preserve administrator access.
- IP, username or combined attempt counting
- Role-enforced TOTP or email 2FA
- Cloudflare Turnstile on supported login forms
- Recovery codes and emergency access guidance
Failed attempts27
Active lockouts3
2FA coverage100%
Login blocked after progressive threshold2 min ago
TOTP verification completed11 min ago
New recovery codes generatedToday
Detection
Investigate files, database content, vulnerabilities and server rules.
Version 1.18 uses a local-only incremental malware-scanner startup that discovers and queues files in bounded steps, reducing long-request pressure on shared hosting. Core integrity is checked separately; the Plugins file integrity tool can also verify official WordPress.org plugin checksums. Since 1.18.9, targeted file heuristics flag plugins hidden from the installed-plugins list and heavily obfuscated JavaScript loaders. In 1.18.11, behavior-based checks also flag hidden administrator persistence, self-replicating PHP backdoors, suspicious loaders and tampering with Wordfence scan exclusions. The standard malware scan checks dangerous uploads/.htaccess PHP handlers. Full and Automatic scans also compare installed Core, plugin and theme versions locally against a signed Hard Guard threat-intelligence database.
- Incremental local malware scanning with location-aware PHP checks
- Detect hidden WordPress plugins and obfuscated JavaScript loaders
- Identify hidden administrator persistence, PHP replication and malicious loader chains
- Check dangerous administrator registration settings and broad Wordfence scan exclusions
- Targeted detection for hidden SC-family persistence indicators
- Optional read-only Database Malware Scanner for manual scans
- Separate Core and WordPress.org plugin integrity checks, Vulnerable and Outdated findings
Files checked12,481
Vulnerable2
Outdated5
Plugin version matches a known advisoryHigh
WordPress component update availableUpdate
Unexpected PHP file in uploadsHigh
Privacy focusedNo telemetry.
No telemetry.
Local security decisions.
Audit logs, scan results, inventory matching and quarantine data remain on the WordPress server. Active Sessions is read only when opened, and Live Traffic uses temporary on-demand state only while an administrator is watching. External connections, including the signed vulnerability feed, are documented and limited to the data required for each request.
Review privacy detailsLocal security recordsAudit, antispam and scanner information is stored in the site database or filesystem.
Country lookupOnly the resolved IP is sent to country.is when an active country rule requires it.
Optional TurnstileCloudflare verification is used only after the administrator enables and configures it.
Your mail providerNotifications and email 2FA use WordPress mail or administrator-configured SMTP.
Signed vulnerability feedHard Guard downloads threat intelligence without sending the site URL, installed inventory, versions, scan results, file paths or file contents.
Safe deployment
Configure deliberately. Recover confidently.
Security features can change authentication, access rules, server directives and files. Hard Guard Security documents the high-risk steps and provides recovery mechanisms.
Back up
Create and verify a complete backup before changing access or server-level settings.
Configure
Enable only the required modules and review every warning displayed in the admin panel.
Test
Use staging, a private browser and a separate administrator session to verify critical changes.
Monitor
Review Audit Log, alerts and scan findings rather than treating security as a one-time setup.
Product overview
See the complete security suite at a glance.
From authentication and activity monitoring to local file scanning, country controls and recovery, Hard Guard Security brings the essential workflows into one WordPress administration experience.
Compatibility
Clear requirements. No hidden platform dependency.
System requirements
- WordPress
- 7.0 or newer · tested through 7.1
- PHP
- 7.4 or newer
- Encryption
- Sodium or OpenSSL for secure storage of TOTP, SMTP and Turnstile secrets
- Filesystem
- Read access for scans; write access for quarantine and selected managed rules
- Multisite
- Supported
Optional connections
External services are contacted only by configured or explicitly requested functionality.
See the privacy page for the data involved and the relevant trigger for each connection.
Recent releases
Actively maintained and transparently documented.
- Optional detection of administrator permissions added directly in the WordPress database outside the normal user interface, with audit events and email alerts when configured.
- Also includes new administrator creation/promotion notifications, a separate read-only database scan, and optional anonymous
/wp-adminblocking from earlier local builds. - Database checks run approximately every five minutes via traffic-dependent WP-Cron; initial enablement creates a baseline and does not report existing administrators.
- Retains the repaired WordPress-specific malware heuristics and local PHP sibling-loader detection.
- Prevents redundant database migrations on repeat activation of an already-configured 1.18.14 installation. No new malware rules or schema changes.
- Avoids unnecessary full database migrations on complete 1.18.11 installations.
- Preserves the repaired heuristics module and detection of relative-path PHP sibling loaders.
- Added PHP behavior heuristics for hidden administrator accounts, self-replicating backdoors, injected loaders and malicious REST access.
- Checks broad Wordfence exclusions, unsafe administrator registration defaults and uploads
.htaccessPHP handlers.
- Generic
sc_*database option names without other malware indicators now receive Low (score 10) instead of High. - Confirmed SC-family indicators keep their previous ratings; Low findings remain visible in scan results.
- Detects WordPress plugins that hide themselves from the installed Plugins list using
all_plugins. - Detects obfuscated inline JavaScript loaders that combine numeric arrays, XOR, Base64 and dynamic execution.
FAQ
Questions before installation.
Hard Guard does not send telemetry, usage statistics, scan results, website content or the installed software inventory to the developer. When vulnerability-database updates are enabled, it downloads a signed feed from the Hard Guard website; that request can expose normal connection metadata such as the requesting IP and time, but it does not include the site URL, installed plugin/theme names or versions, scan results, file paths or file contents.
No. File scanning and optional Database Malware Scanner processing are performed on the WordPress server. Findings and quarantine files remain local.
No security product can provide that guarantee. Hard Guard Security reduces selected risks and improves visibility, but it does not replace updates, backups, secure hosting, a WAF or professional incident response.
Site-wide GeoIP access control fails open so an external lookup outage does not block the whole website. Antispam follows the unknown-country action selected by the administrator.
Yes. All included features are available without payment, a license key, a trial period or a quota. Donations are voluntary and do not unlock functionality.
Yes. It can be activated per site or network-wide and includes Multisite-aware settings, Audit Log aggregation and cleanup behavior. Review the documentation before network-wide deployment.
Download the free WordPress security plugin.
Visit GitHub Releases to download the latest published Hard Guard Security package. Version 1.18.11 introduces expanded malware detection; availability of that version depends on its GitHub release being published. All features are free and open source, with no license key, trial period or paid unlock. View the source code on GitHub.