This product website
This static website package does not include analytics, advertising scripts, tracking pixels, third-party fonts or a cookie-consent platform. The support form prepares a message in the visitor’s own email application and does not submit the form contents to the website.
The hosting provider may still process standard technical server logs, such as the requesting IP address, date and time, requested URL, response status and browser information, for security, reliability and abuse prevention. The website operator is responsible for documenting the actual hosting configuration and retention period.
Links to GitHub, PayPal, Cloudflare, country.is, WordPress.org or other external websites are governed by the privacy practices of those providers after a visitor follows the link.
Plugin overview
Hard Guard Security is designed to process security data primarily within the WordPress installation on which it is installed.
The plugin does not send telemetry, usage statistics, settings, website content, scan results or installed software inventory to the plugin developer. Vulnerability Monitoring can download a signed public threat-intelligence database from the Hard Guard website; matching remains local and the request does not contain the site URL, installed plugin/theme names or versions, scan results, file paths or file contents.
Locally stored security data
Depending on the enabled modules, Hard Guard Security may store the following information in the local WordPress database:
- IP addresses;
- usernames and WordPress user identifiers;
- login attempts, authentication results and lockout information;
- security event type, severity, date and time;
- user role, affected object and request path without query parameters;
- Application Password security events and the last resolved IP address associated with a credential;
- country code and country-data source;
- antispam risk score, detection reasons and detected language;
- a keyed one-way hash of a submitted email address and its domain;
- an optional short excerpt of submitted spam content;
- scanner results, file paths, checksums, database table/record identifiers, matched rules, line numbers and short escaped excerpts;
- vulnerability and outdated-software findings, advisory identifiers, affected/fixed versions and threat-database snapshot metadata;
- plugin configuration and notification recipients.
Known password, authorization, cookie, nonce, token and API-key fields are redacted from Audit Log context before storage.
Active Sessions reads existing WordPress login-session metadata only when an authorized administrator opens that screen. Live Traffic is on-demand and temporary: while its administration tab is open, short browser heartbeats can contain a temporary visitor identifier, resolved IP address, logged-in WordPress identity when applicable, current page path, browser/device information and last-seen time. This temporary state expires automatically, is not added to Audit Log history and is not sent to the plugin developer. Sensitive query-parameter values such as passwords, tokens, nonces and API keys are redacted.
The administrator controls applicable retention periods through the plugin settings. Some temporary security information is automatically removed after expiration.
Client IP and proxy diagnostics
Hard Guard Security uses a resolved visitor IP for security functions such as login limiting, Audit Log records, Antispam, GeoIP rules, Application Password events and optional Turnstile verification.
New installations use the direct server value REMOTE_ADDR by default. When the website is behind a trusted reverse proxy, CDN or load balancer, the administrator can explicitly select X-Forwarded-For, X-Real-IP, CF-Connecting-IP or RFC 7239 Forwarded. A forwarded source is considered only when REMOTE_ADDR matches a configured trusted proxy.
For chain-based headers, the plugin validates and walks the proxy chain from the server side toward the visitor, with a 4 KB header limit and a 32-hop limit. Invalid or unsafe input falls back to REMOTE_ADDR.
The Proxy diagnostics table displays the current direct peer, trust state, selected source, received proxy headers, resolved visitor IP and any fallback reason to an administrator on the local WordPress Settings page. These diagnostic values are not sent to the plugin developer.
Two-factor authentication
When two-factor authentication is enabled, Hard Guard Security may store the selected authentication method, an authenticator secret, one-way hashes of recovery codes, the last accepted TOTP counter and an optional setup deadline in WordPress user metadata.
New authenticator secrets require Sodium or OpenSSL encryption support and are encrypted before storage. Recovery codes are stored as one-way password hashes. Email authentication codes are sent through the website’s configured WordPress mail system or SMTP provider.
Scanner and quarantine
Scanner results are processed and stored on the website’s own server. File scanning may store file paths, file metadata, SHA-256 hashes, matched rule identifiers, line numbers, risk scores and short escaped excerpts of suspicious code.
The optional read-only Database Malware Scanner runs only when an administrator enables it for a manual Quick or Full scan. It may store database table and record identifiers, matched rules, severity and short escaped excerpts. Known credential and token fields are redacted. Database records are never modified by the scanner.
Files placed in quarantine remain on the website server in a protected, non-executable location until an administrator restores or manually removes them.
country.is GeoIP service
Country-based access control and Antispam country rules are optional and disabled by default.
Hard Guard Security uses the country.is IP-to-country API as its only country source. The plugin does not use Cloudflare country headers, server-provided GeoIP variables or a local GeoIP database.
When a country lookup is required, the visitor’s resolved IP address — determined by the configured Client IP source — is sent through an encrypted HTTPS request to https://api.country.is/. The service returns a two-letter country code. Comment content, registration data, usernames, email addresses, scan results and other website content are not sent to country.is.
A lookup can occur when an active site-wide GeoIP rule or Antispam country policy evaluates a request, the administrator runs the country-detection test, the administrator changes an active GeoIP policy and the safety check evaluates the current country, or the Antispam page checks service status while country rules are active.
Successful results are cached locally for 24 hours. Failed lookups are cached for 10 minutes. The cache key is generated from a keyed one-way hash of the IP address rather than including the IP address directly.
The endpoint is fixed by the plugin. There is no setting or constant for replacing country.is with Cloudflare, server GeoIP data or an alternative endpoint.
If country.is is unavailable, site-wide GeoIP Access Control allows requests for which the country cannot be determined. Antispam applies the administrator-selected action for unavailable country information.
Cloudflare Turnstile
Cloudflare Turnstile protection is optional and disabled by default. When enabled, the visitor’s browser loads the official Turnstile JavaScript from Cloudflare. Cloudflare may process technical information required to distinguish legitimate users from automated traffic.
During server-side validation, Hard Guard Security sends the one-time Turnstile response token, the visitor’s resolved IP address, the administrator-configured Turnstile secret and technical request information required for validation to Cloudflare Siteverify. Cloudflare returns the validation result, action and hostname. Failed or unavailable validations may be recorded in the local Audit Log.
Website administrators should review Cloudflare’s current Turnstile Privacy Addendum and applicable terms before enabling the feature and reference Cloudflare in their own privacy policy where required.
SMTP and email notifications
Hard Guard Security can use either the standard WordPress mail system or an SMTP server configured by the website administrator.
When SMTP is selected, the plugin connects directly to the configured provider. The provider may receive sender and recipient addresses, message subject and content, delivery metadata, IP address, username, event type or other details included in a notification, and one-time authentication codes when email-based 2FA is used.
SMTP credentials are stored in the local WordPress database. A new SMTP password requires Sodium or OpenSSL support and is encrypted before storage.
WordPress.org checksum service
File Integrity can request official WordPress core checksums from WordPress.org for the installed WordPress version and locale. The request does not include scan results, website content or the contents of local files.
Administrators should review the current WordPress.org privacy information if this on-demand connection is relevant to their website disclosures.
Hard Guard vulnerability intelligence database
When Vulnerability Monitoring and automatic database updates are enabled, Hard Guard Security periodically downloads a signed compressed threat-intelligence database from the Hard Guard website. Administrators can disable automatic downloads and request a manual refresh instead.
The default feed is https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz with a detached signature at https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.sig.txt. Requests use a neutral Hard-Guard-Security/<version> User-Agent.
The request does not include the website URL, installed plugin/theme inventory, installed versions, scan results, file paths or file contents. Matching against installed software is performed locally. The server hosting the feed can still receive ordinary HTTPS connection metadata such as the requesting IP address, request time and technical request headers.
The database retains source attribution and can include data derived from public vulnerability sources such as the CVE Program/CVE List V5, optional NIST NVD enrichment, GitHub Advisory Database and CISA Known Exploited Vulnerabilities.
PayPal donations
Hard Guard Security includes an optional voluntary Donate link in its own administration screens and plugin row. No PayPal scripts, images or tracking pixels load before the administrator clicks that link.
After the click, the browser opens PayPal in a new tab and submits the hosted-button identifier. PayPal processes the visit and any donation under its own privacy policy and terms. Donations do not unlock plugin functionality.
Antispam
When enabled, the Antispam module may store local incident records for protected comments, registrations and WooCommerce lost-password requests. Records can contain the IP address, submitted identity or username, a keyed one-way hash of a submitted email address where available, email domain, detected country and language where applicable, risk score and reasons, request path, related WordPress object ID and an optional comment-content excerpt of up to 500 characters.
The full submitted email address is not stored in the Hard Guard Security antispam quarantine table. Native WordPress comments may still retain the original comment data in the standard comments table.
The optional Math CAPTCHA is generated and validated locally by the WordPress site for eligible protected comments, registration forms and WooCommerce lost-password requests. Its signed, time-limited challenge does not use an external CAPTCHA provider and does not send the visitor's answer or submitted form content to the plugin developer.
Audit Log
When enabled, Audit Log records security and administrative events in the local WordPress database. Records may include IP address, username, user ID, role, authentication result, request method, request path without query parameters, affected object, event details and technical context.
Retention can be configured separately according to event severity. Administrators can export or manually remove Audit Log records.
The separate Live Traffic view does not create permanent Audit Log records for ordinary browsing. It is activated only while an authorized administrator is viewing the Live Traffic tab and automatically stops shortly after that tab is left.
WordPress personal-data tools
Hard Guard Security registers callbacks for Tools → Export Personal Data and Tools → Erase Personal Data. Export can include matching plugin security data associated with the user.
Erasure removes user-specific plugin metadata and matching antispam and lockout records. Matching Audit Log events are anonymized so non-personal security metadata can be retained.
Retention and uninstallation
Deactivation does not automatically remove all stored plugin data. If the administrator enables the permanent cleanup option before uninstalling Hard Guard Security, the uninstaller removes plugin tables, settings, transients, user metadata, logs and safely validated Scanner quarantine files, including across Multisite.
Quarantine files and security records that are not subject to automatic retention remain until they are removed by the administrator or by the configured uninstall cleanup.
Website operator responsibility
Hard Guard Security provides technical security features and suggested privacy-policy information. The website owner or operator determines why and how the features are used and remains responsible for selecting a legal basis, configuring retention, informing visitors and users, handling personal-data requests, evaluating providers, updating the website privacy policy and complying with applicable law.