Name: Hard Guard Security – Malware Scanner, 2FA & Login Protection
Availability: InStock
Author: endriu777

Free WordPress security plugin with malware scanner, vulnerability scanner, 2FA, brute force &amp; login protection, audit log and hardening.

Hard Guard Security – Malware Scanner, 2FA & Login Protection

<p>Hard Guard Security is a free WordPress security plugin with malware scanning, vulnerability scanning, two-factor authentication (2FA), brute force login protection, audit logs, file integrity monitoring, security hardening, and database malware scanning.</p>
<p>The plugin does not lock features behind payment, require a license key, or send telemetry, scan results, or website files to its author. A voluntary PayPal donation link appears only on Hard Guard Security screens and in the plugin row.</p>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/CKiPjClNP9A?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<h4>Login Security &amp; Brute Force Protection</h4>
<ul>
<li>Progressive login lockouts by IP address, username, or both.</li>
<li>IPv4 and IPv6 whitelist, blacklist, CIDR, and hardened trusted-proxy client-IP resolution with explicit header selection.</li>
<li>Optional custom login URL with safety checks, rollback, and emergency recovery.</li>
</ul>
<h4>Two-Factor Authentication (2FA)</h4>
<ul>
<li>Email-code and RFC 6238 TOTP two-factor authentication.</li>
<li>Per-user methods, role policies, setup grace periods, recovery codes, and administrator reset.</li>
<li>Application Password policies, inventory, revocation, inactivity cleanup, and security alerts.</li>
</ul>
<h4>Audit Log &amp; Live Traffic</h4>
<ul>
<li>Searchable Audit Log with severity, category, action, result, retention, alert rules, CSV/JSON export, redaction, and Multisite aggregation.</li>
<li>Read-only Active Sessions view loaded only when opened, plus on-demand Live Traffic that runs only while an administrator is watching the tab and keeps no traffic history.</li>
</ul>
<h4>Malware Scanner &amp; Vulnerability Scanner</h4>
<ul>
<li>Quick and Full malware scans performed locally with scan history, SHA-256 ignore rules, quarantine, and restoration.</li>
<li>Optional read-only Database Malware Scanner for manual Quick/Full scans with separate SQL findings and context-aware behavioural heuristics.</li>
<li>Full and Automatic scans include a separate Vulnerabilities &amp; updates stage for WordPress Core, plugins, and themes.</li>
<li>Known-vulnerability matching is performed locally against a signed Hard Guard threat-intelligence database; plugin/theme inventory and scan results are not sent to Hard Guard.</li>
<li>Outdated components are identified separately from known vulnerabilities using WordPress&#8217; existing local update cache, without Hard Guard forcing an additional inventory request.</li>
<li>WordPress Core integrity checks using official WordPress.org checksums.</li>
<li>File-permission diagnostics and checks for unexpected executable files.</li>
</ul>
<h4>Antispam &amp; Country Blocking</h4>
<ul>
<li>Local antispam for native comments, WooCommerce reviews using the comment system, native registration, WooCommerce My Account registration, and WooCommerce lost-password requests.</li>
<li>Optional Math CAPTCHA for protected interactive forms with Off, Always, and Only for suspicious visitors modes.</li>
<li>Separate per-IP rate limiting for WooCommerce lost-password requests; WooCommerce checkout and Store API registration are not intercepted.</li>
<li>Optional country allow/block rules using country.is, with IP/CIDR recovery exceptions and fail-open handling.</li>
</ul>
<h4>SSL Security &amp; WordPress Hardening</h4>
<ul>
<li>SSL certificate, HTTPS redirect, mixed-content, and live security-header diagnostics.</li>
<li>HSTS, upgrade-insecure-requests, MIME-sniffing, Referrer-Policy, frame protection, Permissions-Policy, and X-Powered-By controls.</li>
<li>XML-RPC, REST user listing, author enumeration, user sitemap, directory indexing, sensitive-file, uploads PHP, and file-editor hardening.</li>
<li>Daily Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks, with safety-check rollback.</li>
<li>Upload Directory Shield adds a second managed .htaccess layer directly in WordPress uploads on Apache/LiteSpeed.</li>
<li>Suspicious .htaccess detection identifies dangerous PHP/CGI execution directives during daily checks and manual malware scans.</li>
<li>Dedicated SMTP settings used only for Hard Guard Security messages.</li>
<li>Settings export/import and optional complete data cleanup during uninstall.</li>
<li>Personal-data exporter and eraser integration under WordPress Tools.</li>
<li>The administration interface follows each user’s WordPress dashboard language. Translations are supplied through WordPress.org language packs when available and are not bundled in the plugin ZIP.</li>
</ul>
<p>Important: Hard Guard Security reduces selected risks but cannot guarantee that a website is secure or malware-free. Keep verified backups, install updates, use secure hosting, and test high-risk changes on a staging site.</p>
<h3>External services</h3>
<p>Hard Guard Security operates primarily on the local site. The following connections occur only when the related feature is enabled or manually run.</p>
<h4>country.is IP-to-country API</h4>
<p>When GeoIP or Antispam country rules require a lookup, the visitor IP is sent to <code>https://api.country.is/{ip}</code>. Country results are cached for 24 hours, failures for 10 minutes, and unknown countries fail open.</p>
<p>Service: https://country.is/<br />
Terms of use / usage conditions and rate limits: https://country.is/<br />
Privacy / request logging information: https://country.is/<br />
Source and self-hosting information: https://github.com/lineofflight/country</p>
<h4>Cloudflare Turnstile</h4>
<p>Turnstile is optional and disabled by default. When enabled, the browser loads JavaScript from Cloudflare and the plugin sends the challenge token, client IP address, configured secret, and verification metadata to Cloudflare Siteverify.</p>
<p>Service documentation: https://developers.cloudflare.com/turnstile/<br />
Privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/<br />
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/</p>
<h4>WordPress.org checksum services</h4>
<p>When an administrator runs the WordPress Core integrity check, the plugin requests official checksum data for the installed WordPress version and locale. Website file contents are not sent to WordPress.org.</p>
<p>WordPress.org privacy policy: https://wordpress.org/about/privacy/<br />
Core checksum reference: https://developer.wordpress.org/reference/functions/get_core_checksums/</p>
<h4>Hard Guard vulnerability intelligence database</h4>
<p>Vulnerability Monitoring can use a signed compressed database downloaded from the Hard Guard website. Automatic database downloads are disabled by default and start only after an administrator explicitly enables automatic updates; an administrator can also request a one-time manual refresh. The request uses a neutral <code>Hard-Guard-Security/&lt;version&gt;</code> User-Agent and does not include the website URL, installed plugin/theme inventory, installed versions, scan results, file paths, or file contents. Matching against installed software is performed locally. The server hosting the feed can still receive normal connection metadata such as the requesting IP address and request time.</p>
<p>Default feed: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz<br />
Detached signature: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.sig.txt</p>
<p>Data sent and when: only a normal HTTPS GET is made when automatic database updates run or an administrator requests a manual refresh. No site URL, software inventory, installed versions, scan results, file paths, or file contents are added to the request. As with ordinary web hosting, the feed server can receive connection metadata such as the requesting IP address, request time, requested URL, HTTP headers, and the Hard-Guard-Security User-Agent. The downloaded database is public security data and matching is performed locally.</p>
<p>Service endpoint: https://cve.wp-hard-guard.ma7.eu/vulnerabilities-v1.json.gz<br />
Service privacy information: https://github.com/endriu7777/WP-Hard-Guard#privacy-conscious-operation<br />
Service implementation/source project: https://github.com/endriu7777/WP-Hard-Guard</p>
<p>The Hard Guard database is built from public vulnerability sources and retains source attribution. The 1.13.0 feed format supports CVE Program / CVE List V5, optional NIST NVD enrichment, GitHub Advisory Database (CC BY 4.0), and CISA Known Exploited Vulnerabilities (CC0). Ambiguous WordPress component mappings should be reviewed before publication rather than guessed. The ZIP does not bundle a vulnerability database. Known-vulnerability coverage becomes active after an administrator enables automatic database updates or requests a manual refresh and a valid signed production feed is downloaded. Hard Guard clearly warns when production coverage is unavailable and never treats a missing database as a clean result.</p>
<h4>PayPal donations</h4>
<p>After an administrator clicks Donate, the browser submits the hosted-button identifier to PayPal in a new tab. No PayPal scripts, images, or tracking pixels load before the click. PayPal processes the visit and payment under its own terms.</p>
<p>PayPal privacy statement: https://www.paypal.com/privacy<br />
PayPal user agreement: https://www.paypal.com/legalhub/paypal/useragreement-full</p>
<h4>Administrator-configured SMTP server</h4>
<p>When custom SMTP is enabled, Hard Guard Security connects to the configured server to deliver alerts and email 2FA codes. The provider receives message content and delivery metadata under its own terms.</p>
<h4>The administrator&#8217;s own website</h4>
<p>SSL certificate checks, live security-header scans, mixed-content front-end scans, redirect tests, and server-rule safety checks make HTTP or TLS requests only to the current website configured in WordPress. These requests are initiated by an administrator or by a safety check connected to a setting change.</p>
<h3>Privacy</h3>
<p>Hard Guard Security stores security data locally. Depending on enabled modules, this can include IP addresses, usernames, login results, event times, administrative actions, request paths without query strings, antispam incident details, file paths, checksums, database table/record identifiers, matched scanner rules, and short escaped excerpts. Database content is inspected only when an administrator explicitly enables Database Malware Scanner for a manual scan and is not uploaded to Hard Guard.</p>
<p>Known password, token, nonce, cookie, authorization, and API-key fields are redacted before Audit Log storage. Plaintext Application Passwords and their hashes are not written to Hard Guard Security logs. TOTP secrets and SMTP passwords are encrypted when Sodium or OpenSSL is available; recovery codes are stored as one-way hashes.</p>
<p>Active Sessions reads existing WordPress login-session metadata only when an authorized administrator opens that tab. Live Traffic is temporary and on-demand: while the tab is open, short browser heartbeats can contain the resolved IP address, logged-in WordPress identity when applicable, current page path, user agent, and last-seen time. This temporary state is not added to Audit Log history and expires shortly after monitoring stops. Sensitive query parameters are redacted.</p>
<p>Retention controls are available for Audit Log, Antispam, scanner history, and other records. WordPress privacy-policy suggestions are added under Settings &gt; Privacy. Personal-data export and erasure callbacks are registered under Tools &gt; Export Personal Data and Tools &gt; Erase Personal Data. Erasure removes user-specific plugin metadata and matching antispam and lockout records, while matching Audit Log events are anonymized so non-personal security metadata can be retained.</p>
<p>Quarantined files remain on the server until restored, manually deleted, or removed during uninstall when complete cleanup is enabled. Scanner file contents and Database Malware Scanner content are not uploaded to an external malware-scanning service. Vulnerability matching also remains local: Hard Guard downloads a signed public database but does not upload installed plugin/theme inventory, versions, scan results, file names, or file contents.</p>


Alternative Plugins for

Discover the Lists with Hard Guard Security – Malware Scanner, 2FA & Login Protection