WordPress security without turning WordPress into a security appliance
Scantide Guard for WordPress 0.9.9.2 gives WordPress its own application-aware security layer: local attack detection and blocking, grouped incidents, active-block visibility, WordPress-specific site auditing, software/CVE/lifecycle intelligence, authenticated Global Blacklist protection and reporting. It works on shared hosting, works without Guard, and becomes richer when connected to Scantide services or Guard/Datacenter.
Useful on shared hosting
No root account or host firewall is required for the local WordPress protections. The plugin can observe WordPress-level activity, block qualifying hostile requests at the application layer, retain evidence, send reports and audit the site within the permissions allowed by the hosting provider.
Application-aware evidence
Instead of showing a line for every request, repeated activity is grouped into incidents by source and rule family. You still retain the underlying raw events for investigation, while the operational view remains readable.
Intelligence without lock-in
Scantide provides CVE, lifecycle, reputation and correlation services when licensed and reachable. Local checks remain available if those services are unavailable, and optional third-party integrations stay clearly identified by source.
Protection, visibility, audit and intelligence in one lightweight plugin
Detection & local blocking
WordPress login abuse, XML-RPC activity, username enumeration, web reconnaissance and high-confidence attack patterns can be detected locally. Blocking policy remains deterministic and explainable, with manual and learned trust taking precedence.
500-event evidence window
Up to 500 recent raw security events are retained. The Events view groups them into incidents while preserving severity and outcome membership so operators can filter by what actually happened without losing the underlying evidence.
Active Blocks with source context
Active local blocks show source IP context such as country/flag, city or region, ASN/provider, reverse DNS and reputation data where available. Enrichment is informational only and never decides whether a request is blocked.
Global Blacklist & reputation
Licensed sites can consume the authenticated Scantide Global Blacklist, cache block-feed changes locally and search exact IPv4/IPv6 addresses with confidence, observation, installation and account context. Credentials are provisioned automatically from the active Scantide enrollment; administrators do not manage HMAC client secrets manually.
Verified crawler safety
Google and Bing crawler exemptions use forward-confirmed reverse DNS. A matching User-Agent alone is never trusted. This reduces false positives without creating an easy bypass for scanners pretending to be search engines.
Editable web-rule behavior
Reconnaissance and public-discovery checks remain deterministic, while administrators can review and adjust selected web-rule paths from the WordPress UI. Public-discovery custom paths are separated from canonical-path burst logic so normal site behavior is less likely to be misclassified.
Tor & Geo policy
Tor exit nodes can be monitored or blocked using a locally cached list. Country policy supports deny/allow and monitor/block behavior with fail-open handling for unknown Geo results, private addresses and proxy ambiguity.
More than a vulnerability list
The Site Audit looks at WordPress as a running application, not just a package/version list.
Core integrity & files
Checks WordPress core files against official checksums where available and surfaces missing, changed or unexpected files with deterministic evidence.
WP-Cron health
Highlights overdue jobs, suspiciously frequent schedules, stale hooks and other cron behavior that deserves review.
REST & XML-RPC exposure
Inventories REST namespaces/routes and reports XML-RPC reachability and security-relevant exposure so operators can see what is actually available from the application.
Privileged accounts
Surfaces security-relevant privileged-account state, including administrative users and application-password visibility where WordPress exposes it.
Plugin provenance & special files
Shows plugin/theme provenance where possible and explicitly inventories must-use plugins and WordPress drop-ins such as object-cache.php, advanced-cache.php and db.php.
Database & dependencies
Provides useful visibility into WordPress database/options behavior and external dependencies without attempting exploit-style validation or malware cleanup.
CVE and lifecycle evidence with provider provenance
WordPress core, plugins, themes, PHP and supported surrounding runtime components can be evaluated against Scantide intelligence. Results keep CVE evidence, lifecycle state and provider/source information separate so an operator can see why a component is being flagged and whether the finding belongs to the WordPress layer or the hosting/runtime layer.
Version-aware CVE applicability
WordPress-specific matching evaluates the installed component version rather than assuming that a historical advisory applies forever. Provider wildcard records can be reconciled against stronger bounded applicability evidence.
Lifecycle community observations
With lifecycle sharing enabled, anonymized product/publisher/version observations can contribute to the Scantide community lifecycle dataset. Community-observed latest versions are displayed separately from authoritative vendor support/EOL declarations.
Offline/unavailable behavior
If Scantide intelligence cannot be reached, local inventory and local security functions remain available. The UI distinguishes cached, unavailable and community-observed information instead of pretending that missing vendor lifecycle data means a component is unsupported.
Simple status first, technical details only when you need them
The Integrations view is organized around clear service status instead of presenting every credential and threshold at once.
Scantide services
License/site enrollment, software intelligence and Global Blacklist credentials are tied to the active Scantide site identity. Existing-license reconnect can automatically provision the Global Reputation client without exposing secrets in the UI.
Threat-intelligence providers
AbuseIPDB, AlienVault OTX and Wordfence Intelligence remain optional. Each provider can be enabled, tested and saved independently, with explicit success/failure feedback and source provenance preserved in the UI and reports.
Global Blacklist state
The UI distinguishes credentials configured from Global Blacklist enabled. Manual refresh explicitly enables and applies the authenticated feed when a valid provisioned credential is present, avoiding silent “configured but disabled” states.
Scantide-first enrichment with sensible fallbacks
Licensed/enrolled sites ask Scantide for IP context before consuming public enrichment services. This keeps third-party rate limits away from busy WordPress sites whenever Scantide already has the data.
Use WordPress mail or a Scantide SMTP override
Immediate alerts, scheduled statistics and Site Audit reports can be delivered through the site's normal wp_mail() transport or through the optional Scantide SMTP override. SMTP credentials are stored encrypted and are not rendered back into the browser. The Reports tab keeps the main Run actions at the top for quick access while also retaining the matching action inside each report section.
| Mode | Behavior |
|---|---|
| Normal WordPress transport | Uses the host's normal WordPress/PHP mail path or any SMTP plugin already installed. |
| Scantide SMTP override | Scantide applies the saved SMTP host, port, TLS/authentication and sender configuration as the final PHPMailer configuration for Scantide-generated mail. |
| Hosting-provider restriction | Shared hosts may block or restrict outbound SMTP ports or require their own relay. The plugin cannot bypass a provider-level network restriction; use the host-supported transport in that case. |
| Report actions | Site Audit, external posture, software intelligence and statistics can be launched from the top of the Reports tab, with the relevant run button repeated inside each section for convenience. |
Download Scantide Guard for WordPress
Download the ZIP and install it from WordPress Admin → Plugins → Add Plugin → Upload Plugin. Existing installations can be upgraded by replacing the plugin with the new package; saved settings are retained by WordPress. Reinstalling from scratch creates a new local installation identity, while normal upgrades retain the existing one.
Download WordPress plugin (.zip)
Filename: scantide-guard-wordpress-0.9.9.2.zip
SHA-256: 1c591e71237a9a73922cb82ade37b6a879c2bd6cbab5c119f7653f47ec05c53d
What changed in 0.9.9.x
Reliable Global Blacklist enrollment
Existing-license enrollment consumes the Global Reputation provisioning object, stores the HMAC credential locally in encrypted form and signs feed/report requests using the full API path required by the Scantide reputation protocol.
Cleaner integration workflow
Integration testing is hardened so provider failures return proper JSON instead of generic WordPress critical-error HTML. AbuseIPDB, OTX and Wordfence live-test handlers are present and report provider-specific results.
Better operational UX
The Integrations tab starts with concise status cards, advanced GBL diagnostics stay tucked away until needed, and the Reports tab surfaces run actions both at the top and within each report section.
Shared hosting, self-hosted WordPress, or Guard/Datacenter
| Deployment | What remains local | What Scantide/Guard adds |
|---|---|---|
| Shared hosting | Application events, local blocking, Tor/Geo policy, active blocks, site audit, software inventory, local reports, cached evidence and WordPress/PHP-based diagnostics. | Licensed Scantide intelligence, backend-first IP context, automatically provisioned Global Reputation credentials, authenticated Global Blacklist feeds and cloud/site entitlement services. |
| Self-hosted without Guard | All WordPress plugin capabilities plus anything the PHP runtime is permitted to observe locally. | Optional Scantide services remain available without requiring Guard. |
| Self-hosted + Guard | The WordPress plugin still understands the application layer and can enforce locally. | Guard/Datacenter can correlate WordPress evidence with host-level collectors, firewall blocking and centralized operations. |
Not a WAF. Not a malware-cleanup suite. Something deliberately different.
Scantide Guard for WordPress focuses on deterministic evidence, application-aware blocking, posture visibility and useful intelligence. It does not try to become a giant rule engine, replace normal patching, exploit the site to prove a finding, or pretend that every unknown component is vulnerable.