ED Site Guard – Annual Licence

Description

WordPress intrusion defence that catches the hack, not just the symptoms.

Most WordPress compromises follow the same pattern: a backdoor plugin is dropped in, a rogue administrator account is created, and malicious code is injected into your pages or database. Spam links are hidden off-screen, or your whole page is blanked behind a fake “captcha”. ED Site Guard is built to detect and stop exactly that.

What it does

• Scans for backdoors. It checks plugin, theme, uploads and root files for known backdoor signatures, obfuscated code, code that runs remote or request-supplied data, and PHP files that shouldn’t exist.
• Verifies WordPress core. It compares your core files with the official wordpress.org checksums and flags anything modified or added.
• Scans your database. It looks through options and posts for injected scripts, page-hiding CSS, hidden spam link blocks and leftover backdoor settings.
• Tells you what is real. Every finding gets a verdict – very likely malicious, suspicious, unusual or probably legitimate – with the reasons behind it, a plain-English explanation, a recommended action and a read-only preview of the file or database value. Harmless plugin files can be cleared in one click, and infected files are linked to the database entries they belong to.
• Cleans the front end as a safety net. If injected content is found in a page, it is stripped before visitors see it, so your site stays usable while you track down the source.
• Blocks rogue administrators. Admin accounts created or promoted outside a logged-in admin session are stopped, demoted and emailed to you. Suspicious existing admins are flagged for review.
• Detects change. Save a trusted baseline and any new or modified code file is flagged. Files updated through the normal dashboard update process are accepted automatically.
• Stays up to date. A signed security feed adds new detection rules and warns you about known-vulnerable plugin and theme versions. Pending plugin, theme and WordPress updates are listed after every scan.
• Hardens the site. It can block PHP execution in uploads, disable the theme and plugin file editor, turn off XML-RPC, and stop user enumeration.
• Alerts you. It emails you about new findings, blocked admin attempts, and plugin or theme installs, activations and switches.
• Choose who receives alerts and reports, plus optional automatic plugin and theme updates with rollback, an update history and a PHP version warning.
• Branded PDF security report and an optional SiteGuard Protected footer badge.
• Optionally attach the full security report to scheduled report emails.

How it works

1. Install and activate, then enter your licence key. A Site Guard menu appears in your admin.
2. Run a scan. It works in short chunks, so it is safe on shared hosting, and it re-runs automatically every six hours.
3. Review the findings, ranked by severity. Fix them in one click where it is safe to: quarantine a plugin or file, or back up and remove a malicious database option. Both can be undone.
4. Confirm your real administrators, then save a baseline.
5. From then on, Site Guard watches for new threats and tells you when something changes.

Built to be safe

Every action needs an admin login and a security nonce. Nothing is deleted – items are moved to a locked quarantine folder, and removed options are backed up. Apart from the official WordPress core checksum check, the plugin only contacts plugin-hub.co.uk, to validate your licence and fetch the signed security feed. Feed updates are cryptographically verified, so a tampered feed is rejected.

Requirements: WordPress 5.6+, PHP 7.2+. Works on Apache and LiteSpeed (the uploads lock needs an equivalent rule on nginx).

ED Site Guard complements, not replaces, regular updates, backups and strong passwords.