Àpèjúwe
AI CyberGuard is one complete, AI-powered security solution for WordPress — combining a firewall, malware scanner, login protection, file-integrity monitoring and safety snapshots in a single plugin, with clear, actionable guidance instead of cryptic alerts.
Key Features
- Firewall (Lite) Ìtumọ̀ Yorùbá: – front-end URL & query-string filter Ìtumọ̀ Yorùbá: – a front-end request filter (Monitor or Enforce) that acts on your local IP blocklist plus an optional small set of high-confidence URL/query signatures (SQL injection, path traversal, local file inclusion, XSS, PHP code injection and reconnaissance probes). It inspects only the request URL and query string on front-end page loads. It does NOT inspect POST bodies, request headers or cookies, and it does not filter the admin area, AJAX, XML-RPC, WP-Cron or the login entry point; logged-in admins and whitelisted IPs are always exempt. REST API requests ARE inspected, by the same URL and query-string checks as any front-end request: WordPress does not mark a request as REST until after the firewall has run, so it cannot be exempted. With the signature rules off (the default) that means your IP blocklist applies to /wp-json/ too. Test Enforce mode on staging. (PRO adds an always-on, auto-updating WAF that inspects POST bodies and headers in real time.)
- Login Security Ìtumọ̀ Yorùbá: – Brute-force lockout, privacy-first CAPTCHA (honeypot / Cloudflare Turnstile), and breached-password checks
- Two-Factor Authentication (2FA) Ìtumọ̀ Yorùbá: – Per-user TOTP (Google Authenticator / Authy) with backup codes
- Safety Snapshots Ìtumọ̀ Yorùbá: – Point-in-time copies of critical files; to restore, download a verified clean copy and place it back yourself (automatic in-place restore is disabled for security)
- Hardening & Hide Login Ìtumọ̀ Yorùbá: – One-click hardening (XML-RPC, user enumeration, file editor) plus a custom login URL
- Security Hub & Score Ìtumọ̀ Yorùbá: – Security grade, Quick Wins, 7-day event log, weekly email reports, and an on-device AI Assistant
- File Integrity Monitoring Ìtumọ̀ Yorùbá: – Create a baseline of your files and detect any changes
- Scheduled Scans with Malware Alerts Ìtumọ̀ Yorùbá: – Automatic background scans compare your files against the baseline and then malware-scan the files that changed or were added, so a backdoor that arrives on your site is found without you having to remember to scan. Findings appear on the dashboard; if you switch Email Alerts on (they are off by default) a confirmed threat is also emailed to you straight away, without waiting for the usual rate limit. Bounds, so you know what a quiet scan does and does not mean: a scheduled run inspects up to 300 changed files per run (the rest are reported as not-yet-inspected and picked up on later runs) and skips files over 2 MB Ìtumọ̀ Yorùbá: – both are stated in the alert itself. To check every file on the site, run a Malware Scan from the dashboard.
- Malware Pattern Detection Ìtumọ̀ Yorùbá: – Scan for known malicious code patterns: 100+ built-in patterns, expanded to thousands via the optional weekly threat feed
- Repository Comparison Ìtumọ̀ Yorùbá: – Compare plugins against WordPress.org checksums
- File Change Details Ìtumọ̀ Yorùbá: – See which files changed, when, and their before/after checksums
- Clear Reports Ìtumọ̀ Yorùbá: – Human-friendly explanations, not cryptic alerts
- Smart Filtering Ìtumọ̀ Yorùbá: – Reduces false positives with context-aware analysis
- Database Scanner Ìtumọ̀ Yorùbá: – Check for suspicious content in your database
- Security Checklist Ìtumọ̀ Yorùbá: – Quick overview of your siteÌtumọ̀ Yorùbá: ’s security status
- MalwareBazaar Integration Ìtumọ̀ Yorùbá: – Verify threats against known malware database
How It Works
- Create Baseline Ìtumọ̀ Yorùbá: – AI CyberGuard takes a snapshot of your current files
- Run Scans Ìtumọ̀ Yorùbá: – Use Quick Malware Scan for a focused malware check, Deep Scan for the entire site, and Regular or Full Scan for file changes
- Review Changes Ìtumọ̀ Yorùbá: – See exactly what changed, when, and why it matters
- Take Action Ìtumọ̀ Yorùbá: – Clear guidance on what to do with each finding
Repository Comparison
AI CyberGuard can compare your plugins against official WordPress.org checksums to detect modifications. This works for plugins hosted on WordPress.org only. Themes and premium plugins are scanned using pattern-based detection.
Privacy & External Services
GuardPress is the service platform that provides optional external services for AI CyberGuard at guardpress.ai.
IMPORTANT: This plugin makes no external network connections to GuardPress servers until you take an action that requires them (enabling AI Analysis, enabling Threat Feed updates, or clicking “Refresh Threats”). Activation itself does not contact any external server.
External connections to third-party security databases (MalwareBazaar, ipinfo.io) and WordPress.org infrastructure happen only during scans or admin dashboard rendering, as listed below.
1. GuardPress Server Registration (guardpress.ai/api/register/free/)
- Triggered: lazily, the first time you perform a user action that needs the GuardPress server Ìtumọ̀ Yorùbá: – running an AI Analysis (after enabling AI), or enabling / refreshing the Threat Feed. Simply switching AI on in Settings does not register on its own; the first Analyze does.
- Data sent: random installation UUID + plugin version
- Data NOT sent: site URL, file contents, personal data, email
- Purpose: issues a per-installation HMAC secret used for all later API authentication (so the plugin is not bundled with a shared salt)
- Privacy: https://guardpress.ai/privacy
2. Threat Signatures (guardpress.ai/api/signatures/) Ìtumọ̀ Yorùbá: – OPTIONAL, Disabled by Default
- Status: Must be enabled manually in Settings Privacy & External Requests
- Purpose: Download latest malware signatures
- Data sent: HMAC-signed request carrying installation UUID + plugin version
- Data NOT sent: site URL, file contents, personal data
3. AI Analysis (guardpress.ai/api/ai-service) Ìtumọ̀ Yorùbá: – OPTIONAL, Disabled by Default
- Status: Must be enabled manually in Settings Privacy & External Requests
- Purpose: Deep code analysis for complex threats
- Data sent, when you click “Analyze”: the fileÌtumọ̀ Yorùbá: ’s content (sensitive credentials redacted before transmission), plus the file name, its path relative to your WordPress root, the file type/extension, and your WordPress version. NOT sent: the absolute server path, host name, or any OS username.
- Requires explicit user action Ìtumọ̀ Yorùbá: – never automatic
4. WordPress.org APIs (api.wordpress.org, downloads.wordpress.org) Ìtumọ̀ Yorùbá: – Used During Scans
- Purpose: Verify WordPress core and installed-plugin file integrity (checksums + ZIP comparison)
- Data sent: WordPress core version, plugin slugs and versions
- These are the official WordPress.org APIs
5. MalwareBazaar (mb-api.abuse.ch) Ìtumọ̀ Yorùbá: – OPTIONAL, only when the Threat Feed is enabled
- Opt-in: runs only during a malware scan, and only while the Threat Intelligence Feed is enabled (off by default)
- Purpose: Confirm known malware by hash lookup
- Data sent: SHA256 hash of suspicious files only
- Data NOT sent: file contents, filenames, site URL
- Privacy: https://abuse.ch/privacy
6. URLhaus Ìtumọ̀ Yorùbá: – NOT USED
- This plugin does NOT contact URLhaus and does NOT send any URL from your files anywhere. Earlier versions of this document described a URLhaus lookup; that lookup is not performed by the plugin, so the entry has been removed rather than left as an inaccurate disclosure.
7. IPinfo (ipinfo.io) Ìtumọ̀ Yorùbá: – OPTIONAL, Disabled by Default
- Purpose: Look up the country of blocked IPs so the dashboard “Live Attack Map” can plot them (display only)
- Opt-in: OFF by default. No IP is ever sent unless you enable “Attack-map location lookup (GeoIP)” under Settings & Security Privacy & External Requests. While off, the map shows only countries already cached locally.
- Data sent: IP addresses that have already been blocked by your site (not arbitrary IPs), only when you open the dashboard, rate-limited
- Data NOT sent: file contents, account data, site URL
- Privacy: https://ipinfo.io/privacy
8. Pwned Passwords (api.pwnedpasswords.com) Ìtumọ̀ Yorùbá: – OPTIONAL, Disabled by Default
- Status: Used only if you enable the breached-password check
- Purpose: Warn when a login password appears in a known data breach
- Data sent: Only the first 5 characters of the passwordÌtumọ̀ Yorùbá: ’s SHA-1 hash (k-anonymity model) Ìtumọ̀ Yorùbá: – never the password, username, or full hash
- Data NOT sent: the password, the full hash, site URL, personal data
- Privacy: https://haveibeenpwned.com/Privacy
9. Cloudflare Turnstile (challenges.cloudflare.com) Ìtumọ̀ Yorùbá: – OPTIONAL, Disabled by Default
- Status: Used only if you enable Turnstile CAPTCHA on the login form
- Purpose: Privacy-friendly bot / CAPTCHA verification on login
- In the visitorÌtumọ̀ Yorùbá: ’s browser: CloudflareÌtumọ̀ Yorùbá: ’s Turnstile script and challenge widget load from challenges.cloudflare.com using your public site key, the same as any site that embeds Turnstile
- Sent from your server (only to verify a solved challenge): your private secret key and the one-time challenge-response token
- Data NOT sent from your server: the visitorÌtumọ̀ Yorùbá: ’s IP address, file contents, passwords, usernames, or other personal data
- Privacy: https://www.cloudflare.com/privacypolicy/
Server-side requests (items 1-8 above) use the WordPress HTTP API over HTTPS with certificate verification enabled, collect no telemetry or tracking data, and honour WordPress Site Health and the WP_HTTP_BLOCK_EXTERNAL constant for sites that prefer to disable all outbound traffic. The one exception is Cloudflare Turnstile (item 9): its script and challenge load in the visitorÌtumọ̀ Yorùbá: ’s browser (not via the WordPress HTTP API), only when you enable Turnstile, and are therefore not governed by WP_HTTP_BLOCK_EXTERNAL.
External services
This plugin can connect to the services below. Every one of them is optional and off until you turn it on; installing and activating the plugin contacts nothing. The full detail Ìtumọ̀ Yorùbá: – exactly what is sent, when, and the providerÌtumọ̀ Yorùbá: ’s terms Ìtumọ̀ Yorùbá: – is in the “Privacy & External Services” section above.
- guardpress.ai (the plugin authorÌtumọ̀ Yorùbá: ’s own service) Ìtumọ̀ Yorùbá: – registration, AI Analysis and the Threat Feed. Contacted only after you enable AI Analysis or the Threat Feed and then perform the action. Terms: https://guardpress.ai/terms/ Ìtumọ̀ Yorùbá: – Privacy: https://guardpress.ai/privacy/
- MalwareBazaar (mb-api.abuse.ch) Ìtumọ̀ Yorùbá: – looks up the SHA-256 hash of a suspicious file against a public malware database, during a scan, when the Threat Feed is enabled. Only a hash is sent, never file contents. Terms: https://abuse.ch/terms/ Ìtumọ̀ Yorùbá: – Privacy: https://abuse.ch/privacy/
- ipinfo.io Ìtumọ̀ Yorùbá: – resolves the country of an attacking IP address for the dashboardÌtumọ̀ Yorùbá: ’s attack map, when that panel is displayed. Only the IP address is sent. Terms: https://ipinfo.io/terms-of-service Ìtumọ̀ Yorùbá: – Privacy: https://ipinfo.io/privacy-policy
- api.wordpress.org Ìtumọ̀ Yorùbá: – WordPress.orgÌtumọ̀ Yorùbá: ’s own checksum service, used to compare your core and plugin files against the official releases. This is WordPress infrastructure, contacted only during a scan.
- api.pwnedpasswords.com (Have I Been Pwned) Ìtumọ̀ Yorùbá: – optional breached-password check at login, disabled by default. Uses k-anonymity: only the first five characters of the passwordÌtumọ̀ Yorùbá: ’s SHA-1 hash are sent, never the password. Terms: https://haveibeenpwned.com/API/v3 Ìtumọ̀ Yorùbá: – Privacy: https://haveibeenpwned.com/Privacy
- challenges.cloudflare.com / www.google.com/recaptcha Ìtumọ̀ Yorùbá: – loaded on your login form only if you choose Turnstile or reCAPTCHA as the CAPTCHA provider and enter your own keys. The default provider is a self-hosted honeypot that contacts nothing. Cloudflare terms: https://www.cloudflare.com/website-terms/ Ìtumọ̀ Yorùbá: – Privacy: https://www.cloudflare.com/privacypolicy/ Ìtumọ̀ Yorùbá: – Google terms: https://policies.google.com/terms Ìtumọ̀ Yorùbá: – Privacy: https://policies.google.com/privacy
Àwọn àwòrán ìbòjú
Ìgbéwọlẹ̀
- Upload the
ai-cyberguardfolder to/wp-content/plugins/ - Activate the plugin through the ‘Plugins’ menu in WordPress
- Go to AI CyberGuard in your admin menu
- Run a Quick Malware Scan
- Review the scan results and confirm that the site is clean
- Click Create Baseline to record the current clean state
FAQ
-
Will this slow down my site?
-
Scans run only when you request one or on the scheduled cron job, never on a visitor page load. The firewall does run on front-end requests Ìtumọ̀ Yorùbá: – that is what a firewall is Ìtumọ̀ Yorùbá: – but it only inspects the request URL and query string, with no database scan and no file scan. If you would rather it did nothing at all on the front end, set it to Monitor mode or turn it off in Settings.
-
What is the difference between the scan types?
-
AI CyberGuard includes two different groups of scans:
- Quick Malware Scan: Performs a focused malware check of the most relevant executable WordPress areas.
- Deep Scan (entire site): Performs a broader malware scan across the full WordPress installation and may take longer.
- Regular Scan: Compares the usual WordPress files against your saved file-integrity baseline.
- Full Scan: Performs the broader file-change comparison across all files and is slower.
Malware scans look for dangerous code and known threat patterns. Regular and Full scans look for files that were added, modified or deleted since the baseline was created.
Scheduled scans run the file-change comparison and then malware-scan the files they find changed or added (up to 300 per run; larger sets are picked up on later runs, and files over 2 MB are skipped and reported as such). Confirmed threats appear on the dashboard, and are emailed to you as well if you switch Email Alerts on Ìtumọ̀ Yorùbá: – they are off by default. That covers malware that ARRIVES on your site after the baseline exists. It does not re-inspect files that did not change, so malware that was already present when you created the baseline is found by running a Malware Scan yourself Ìtumọ̀ Yorùbá: – the dashboard reminds you when one has never been run or is out of date.
-
How accurate is the malware detection?
-
AI CyberGuard aims for high-confidence detection with documented boundaries rather than a promise to catch everything Ìtumọ̀ Yorùbá: – no scanner can honestly make that promise. Concretely: when malicious code hides the name of the function it calls behind a string transformation, the scanner resolves a curated list of those transformations (decoders, case and trim helpers, string and path builders, and array literals) and reports the result as a confirmed threat. Transformations outside that list, and code whose behaviour depends on values computed earlier at runtime, are documented boundaries rather than covered cases. Findings are separated into confirmed threats (a known-malware hash, or code that provably executes attacker-controlled input) and review items (patterns that are worth a look but are also used by legitimate plugins, such as a code-snippet plugin that evaluates code by design). Only confirmed threats are counted as malware, so a site full of legitimate premium plugins does not read as a wall of alarms. Files that could not be read are reported as a coverage gap rather than silently counted clean.
-
Does AI CyberGuard automatically delete files?
-
No. AI CyberGuard is a detection tool Ìtumọ̀ Yorùbá: – it shows you what changed and why it might be suspicious. You decide what action to take. This prevents accidental deletion of legitimate files.
-
Can I compare my theme files against a repository?
-
Theme checksum comparison is not available because most themes are not hosted on WordPress.org. Themes are scanned using pattern-based detection instead.
-
What if I get false positives?
-
Use the “Ignore” feature to exclude known legitimate files. You can also configure exclusion patterns for directories like caches and logs.
Àwọn àgbéyẹ̀wò
Kò sí àwọn àgbéyẹ̀wò fún plugin yìí.
Àwọn Olùkópa & Olùgbéejáde
“AI CyberGuard Ìtumọ̀ Yorùbá: – Firewall, Malware Scanner & Login Security” jẹ́ ètò ìṣàmúlò orísun ṣíṣí sílẹ̀. Àwọn ènìyàn wọ̀nyí ti ṣe ìkópa sí plugin yìí.
Àwọn Olùkópa
Túmọ̀ “AI CyberGuard Ìtumọ̀ Yorùbá: – Firewall, Malware Scanner & Login Security” sí èdè rẹ.
Ṣe o nífẹ̀ẹ́ sí ìdàgbàsókè?
Ṣàwárí koodu, ṣàyẹ̀wò ibi ìpamọ́ SVN, tàbí ṣe àgbékalẹ̀ sí àkọsílẹ̀ ìdàgbàsókè nípasẹ̀ RSS.
Àkọsílẹ̀ àwọn àyípadà
1.0.2
- Performance: the security engine now loads only where it is needed, so front-end pages are lighter and use less memory.
1.0.1
- Minor improvements.
1.0.0
Initial release on WordPress.org.