Plugiva ClientGuard

Plugiva ClientGuard helps prevent unintended changes in the WordPress admin by adding practical guardrails around sensitive operations, settings, content, and administration areas.

It is designed for situations where site owners, clients, teams, or automated tools need to work in WordPress without accidentally changing something important.

ClientGuard combines Client Mode with operation-level protection. Client Mode provides a simplified admin experience by hiding selected administration areas, while protection is applied to sensitive operations themselves rather than relying only on whether an admin interface is visible.

You can protect plugin and theme operations, critical settings, protected content, and other sensitive WordPress operations while keeping the rest of the admin area usable.

Client Mode can also be locked via configuration to prevent it from being disabled from the admin interface:

define( 'PCGD_LOCK_CLIENT_MODE', true );

This can be added in wp-config.php or defined programmatically in custom code.

When enabled, Client Mode is forced on and cannot be turned off from the dashboard, helping maintain consistent protection.

ClientGuard also provides Sentinel, an activity and lifecycle event log for protected operations, configuration changes, bypass activity, and other ClientGuard events. Sentinel helps make changes and protection activity visible rather than leaving them unexplained.

On multisite installations, ClientGuard supports site-specific protection and Sentinel event handling while also covering relevant network-level operations.

Instead of blocking access aggressively, ClientGuard applies practical guardrails that let users continue working while reducing the chance of unintended changes.

ClientGuard is ideal for:

• Site owners managing their own WordPress site
• Developers handing off sites to clients
• Teams that want a simplified and safer admin experience
• Sites where administrative changes need to remain controlled and observable

Client Mode

Enable Client Mode to apply ClientGuard’s protection controls with one click:

• Restricts plugin installation, deletion, activation, deactivation, and editing
• Restricts theme installation, deletion, switching, and editing
• Restricts Appearance management, including Menus, Widgets, Customizer, and Site Editor
• Protects critical site settings and homepage assignments
• Governs WordPress AI and Connector administration areas when available
• Hides selected administrative areas to simplify the dashboard
• Protects important content from unintended edits, trashing, and permanent deletion
• Hides the ACF admin area automatically when ACF is active

Individual Protections

If Client Mode is not enabled, each protection can be managed independently.

• Lock Theme Switching – Prevents switching, installing, deleting, and editing themes.
• Lock Appearance Management – Restricts Appearance management capabilities, including Menus, Widgets, Customizer, and Site Editor access.
• Lock Plugin Installation – Prevents installing, deleting, and editing plugins.
• Allow Plugin Activation – Allows administrators to activate or deactivate installed plugins while installation protections remain in place.
• Protect Site URLs – Protects selected site configuration areas such as permalink management.
• Content Protection – Prevents editing, trashing, and permanent deletion of selected pages.
• Menu Hiding – Removes selected administrative menus from the dashboard interface.

Sentinel

Sentinel records ClientGuard-related activity to make protection and configuration events visible.

It records events related to:

• Configuration and protection state changes
• Client Mode changes
• Plugin activation policy changes
• Protected content changes
• Blocked, bypassed, and violation events
• ClientGuard lifecycle activity

Sentinel event history is site-scoped and can be managed from the ClientGuard administration area.

• View recorded events with pagination
• Configure event retention
• Clear Sentinel logs when needed
• Export Sentinel event history
• Handle site-specific event history on multisite installations

Sentinel focuses on activity relevant to ClientGuard and is not intended to provide a site-wide activity or security audit log.

Key Features

• One-click Client Mode for a simplified and safer admin experience
• Operational protection for plugin installation, deletion, activation, and deactivation
• Operational protection for theme installation, deletion, and switching
• Protection for critical settings, including Site URLs and Permalinks
• Protection for selected pages from editing, trashing, and permanent deletion
• Protection for Site Editor and sidebar widget operations
• Protection for theme and plugin editor operations
• WordPress AI and Connector governance through operational workflow protection
• Sentinel event logging for ClientGuard-related configuration, operational, bypass, and lifecycle activity
• Site-scoped Sentinel logs with retention, clearing, and export tools
• Multisite-aware protection and Sentinel event handling
• ACF-aware administration controls
• Configuration lock for Client Mode
• Safe defaults with no changes on activation

What This Plugin Is NOT

• Not a security or firewall plugin
• Not a role or permission editor
• Not designed to block administrators entirely

Plugiva ClientGuard focuses on preventing unintended changes, not replacing WordPress security or permission systems.

Developer Hooks

Plugiva ClientGuard provides developer-friendly filters and actions for customizing certain protection behaviors and responding to ClientGuard events.

Available hooks include:

• pcgd_protected_site_identity_options – Customize the site identity options protected by ClientGuard.
• pcgd_protected_permalink_options – Customize the permalink-related options protected by ClientGuard.
• pcgd_protection_state_changed – Respond to protection state changes.
• pcgd_client_mode_changed – Respond to Client Mode changes.
• pcgd_plugin_activation_policy_changed – Respond to changes to the plugin activation policy.
• pcgd_protected_content_added – Respond when protected content is added.
• pcgd_protected_content_removed – Respond when protected content is removed.
• pcgd_protection_blocked – Respond when ClientGuard blocks a protected operation.
• pcgd_protection_bypassed – Respond when a protected operation is bypassed.
• pcgd_protection_violation – Respond to a protection violation.

For Sentinel event handling, these hooks can be used to observe ClientGuard-related configuration and operational activity.

Additional hooks may be introduced in future versions.