SPP Guardian Security & Maintenance

SPP Guardian is a standalone, local-first WordPress security and maintenance plugin built for site owners who need clear explanations rather than raw technical alerts.

Every security finding answers five questions:

• What happened?
• Where is it?
• How serious is it?
• How could it affect the website?
• What is the safest next action?

The scanner combines official WordPress core checksums, local file-change baselines, offline signatures, code and path heuristics, selected database inspection, administrator-account monitoring, cron inspection, update awareness, safe quarantine, restore, and verified core-file repair.

No account, licence server, telemetry service, or cloud scanner is required. The plugin does not automatically delete suspicious content.

Main features

• On-demand and scheduled resumable scans.
• Standard and low-resource scan profiles.
• WordPress core checksum verification.
• WordPress.org-hosted plugin checksum verification with cached official data.
• Local file integrity baselines.
• PHP-in-uploads and disguised-executable detection.
• Web-shell markers, decoded execution chains, command-execution patterns, hidden iframes, and obfuscated JavaScript checks.
• Selected posts, comments, options, administrator, and cron inspection.
• Separate severity and detection-confidence values.
• Protected quarantine with hash verification and restoration.
• Official-package repair for eligible WordPress core files.
• Update, PHP, cron, HTTPS, file-editor, debug-display, inactive-plugin, and scan-freshness maintenance checks.
• Rate-limited email alerts that never contain executable evidence.
• Audit log, REST endpoints, and WP-CLI commands.
• Conservative uninstall option: keep data by default or delete everything explicitly.
• Optional Protection & Firewall module, off by default, with independent switches for brute-force login protection, GET/POST request filtering, REST API rate limiting and anonymous user-enumeration blocking, and XML-RPC restriction.
• Manual IP allow and block lists, an activity log of what the firewall did and why, and a one-click unlock for an automatic login lockout.

Important limitation

No malware scanner can guarantee detection of every malicious file, database payload, zero-day exploit, hosting compromise, encrypted payload, or attacker-controlled server condition. SPP Guardian provides layered risk detection and guided remediation. It does not replace off-site backups, hosting security, server EDR, a WAF/CDN, log monitoring, or professional incident response.

External services

SPP Guardian works locally without telemetry or a SPP Guardian cloud service.

When core or WordPress.org plugin checksum verification runs, WordPress may request checksum data for the installed WordPress version and locale from the official WordPress.org API. Core checksum requests identify the WordPress version and locale. Plugin checksum requests identify the public plugin slug and installed version. SPP Guardian does not send site files or database content.

When an authorised administrator explicitly chooses “Repair from official package”, SPP Guardian downloads the matching WordPress package from an official WordPress.org download URL, extracts the requested file locally, verifies it against the official checksum, backs up the current file, writes the replacement, and verifies the result.

PHP maintenance guidance links to the official PHP supported-versions page only when the administrator chooses Review. No data is sent by SPP Guardian merely for displaying the link.

WP-CLI

• wp sppgusem-guardian status --format=json
• wp sppgusem-guardian scan --profile=standard --wait
• wp sppgusem-guardian findings --status=open --format=table
• wp sppgusem-guardian quarantine <finding-id> --yes

REST API

Authenticated routes use the namespace sppgusem/v1 and require SPP Guardian capabilities. Available routes include status, scans, findings, quarantine, core repair, restore, resolve, ignore, and settings. If the Protection & Firewall module’s REST rate limiting or authentication requirement is enabled, those settings apply uniformly to all REST API traffic, including requests to these SPP Guardian routes.

Privacy

Normal scans run locally. SPP Guardian stores scan metadata, file paths, hashes, short redacted excerpts, issue records, protected remediation copies, settings, and audit events. It does not store passwords, cookies, full API tokens, or complete malicious payloads in ordinary findings. Protected copies remain on the server until restored or removed during an explicitly configured uninstall.

When the optional Protection & Firewall module is enabled, SPP Guardian also records the visitor IP address, request method, a short redacted excerpt of the request path, and the matched rule for requests it blocks or logs, so the activity can be reviewed and understood later. This activity log is stored locally, is never sent anywhere, and is pruned automatically after the configured retention period.