AI CyberGuard – Firewall, Malware Scanner & Login Security

AI CyberGuard is one complete, AI-powered security solution for WordPress — combining a firewall, malware scanner, login protection, file-integrity monitoring and safety snapshots in a single plugin, with clear, actionable guidance instead of cryptic alerts.

Key Features

• Firewall (Lite) – front-end URL & query-string filter – a front-end request filter (Monitor or Enforce) that acts on your local IP blocklist plus an optional small set of high-confidence URL/query signatures (SQL injection, path traversal, XSS). It inspects only the request URL and query string on front-end page loads. It does NOT inspect POST bodies, request headers or cookies, and it does not filter the admin area, AJAX, the REST API, XML-RPC, WP-Cron or the login entry point; logged-in admins and whitelisted IPs are always exempt. Test Enforce mode on staging. (PRO adds an always-on, auto-updating WAF that inspects POST bodies and headers in real time.)
• Login Security – Brute-force lockout, privacy-first CAPTCHA (honeypot / Cloudflare Turnstile), and breached-password checks
• Two-Factor Authentication (2FA) – Per-user TOTP (Google Authenticator / Authy) with backup codes
• Safety Snapshots – Point-in-time copies of critical files; to restore, download a verified clean copy and place it back yourself (automatic in-place restore is disabled for security)
• Hardening & Hide Login – One-click hardening (XML-RPC, user enumeration, file editor) plus a custom login URL
• Security Hub & Score – Security grade, Quick Wins, 7-day event log, weekly email reports, and an on-device AI Assistant
• File Integrity Monitoring – Create a baseline of your files and detect any changes
• Malware Pattern Detection – Scan for known malicious code patterns: 100+ built-in patterns, expanded to thousands via the optional weekly threat feed
• Repository Comparison – Compare plugins against WordPress.org checksums
• Visual Diff – See exactly what changed in modified files
• Clear Reports – Human-friendly explanations, not cryptic alerts
• Smart Filtering – Reduces false positives with context-aware analysis
• Database Scanner – Check for suspicious content in your database
• Security Checklist – Quick overview of your site’s security status
• MalwareBazaar Integration – Verify threats against known malware database

How It Works

1. Create Baseline – AI CyberGuard takes a snapshot of your current files
2. Run Scans – Use Quick Malware Scan for a focused malware check, Deep Scan for the entire site, and Regular or Full Scan for file changes
3. Review Changes – See exactly what changed, when, and why it matters
4. Take Action – Clear guidance on what to do with each finding

Repository Comparison

AI CyberGuard can compare your plugins against official WordPress.org checksums to detect modifications. This works for plugins hosted on WordPress.org only. Themes and premium plugins are scanned using pattern-based detection.

Privacy & External Services

GuardPress is the service platform that provides optional external services for AI CyberGuard at guardpress.ai.

IMPORTANT: This plugin makes no external network connections to GuardPress servers until you take an action that requires them (enabling AI Analysis, enabling Threat Feed updates, or clicking ”Refresh Threats”). Activation itself does not contact any external server.

External connections to third-party security databases (MalwareBazaar, ipinfo.io) and WordPress.org infrastructure happen only during scans or admin dashboard rendering, as listed below.

1. GuardPress Server Registration (guardpress.ai/api/register/free/)

• Triggered: lazily, the first time you perform a user action that needs the GuardPress server – running an AI Analysis (after enabling AI), or enabling / refreshing the Threat Feed. Simply switching AI on in Settings does not register on its own; the first Analyze does.
• Data sent: random installation UUID + plugin version
• Data NOT sent: site URL, file contents, personal data, email
• Purpose: issues a per-installation HMAC secret used for all later API authentication (so the plugin is not bundled with a shared salt)
• Privacy: https://guardpress.ai/privacy

2. Threat Signatures (guardpress.ai/api/signatures/) – OPTIONAL, Disabled by Default

• Status: Must be enabled manually in Settings → Privacy & External Requests
• Purpose: Download latest malware signatures
• Data sent: HMAC-signed request carrying installation UUID + plugin version
• Data NOT sent: site URL, file contents, personal data

3. AI Analysis (guardpress.ai/api/ai-service) – OPTIONAL, Disabled by Default

• Status: Must be enabled manually in Settings → Privacy & External Requests
• Purpose: Deep code analysis for complex threats
• Data sent, when you click ”Analyze”: the file’s content (sensitive credentials redacted before transmission), plus the file name, its path relative to your WordPress root, the file type/extension, and your WordPress version. NOT sent: the absolute server path, host name, or any OS username.
• Requires explicit user action – never automatic

4. WordPress.org APIs (api.wordpress.org, downloads.wordpress.org) – Used During Scans

• Purpose: Verify WordPress core and installed-plugin file integrity (checksums + ZIP comparison)
• Data sent: WordPress core version, plugin slugs and versions
• These are the official WordPress.org APIs

5. MalwareBazaar (mb-api.abuse.ch) – OPTIONAL, only when the Threat Feed is enabled

• Opt-in: runs only during a malware scan, and only while the Threat Intelligence Feed is enabled (off by default)
• Purpose: Confirm known malware by hash lookup
• Data sent: SHA256 hash of suspicious files only
• Data NOT sent: file contents, filenames, site URL
• Privacy: https://abuse.ch/privacy

6. URLhaus – NOT USED

• This plugin does NOT contact URLhaus and does NOT send any URL from your files anywhere. Earlier versions of this document described a URLhaus lookup; that lookup is not performed by the plugin, so the entry has been removed rather than left as an inaccurate disclosure.

7. IPinfo (ipinfo.io) – OPTIONAL, Disabled by Default

• Purpose: Look up the country of blocked IPs so the dashboard ”Live Attack Map” can plot them (display only)
• Opt-in: OFF by default. No IP is ever sent unless you enable ”Attack-map location lookup (GeoIP)” under Settings & Security → Privacy & External Requests. While off, the map shows only countries already cached locally.
• Data sent: IP addresses that have already been blocked by your site (not arbitrary IPs), only when you open the dashboard, rate-limited
• Data NOT sent: file contents, account data, site URL
• Privacy: https://ipinfo.io/privacy

8. Pwned Passwords (api.pwnedpasswords.com) – OPTIONAL, Disabled by Default

• Status: Used only if you enable the breached-password check
• Purpose: Warn when a login password appears in a known data breach
• Data sent: Only the first 5 characters of the password’s SHA-1 hash (k-anonymity model) – never the password, username, or full hash
• Data NOT sent: the password, the full hash, site URL, personal data
• Privacy: https://haveibeenpwned.com/Privacy

9. Cloudflare Turnstile (challenges.cloudflare.com) – OPTIONAL, Disabled by Default

• Status: Used only if you enable Turnstile CAPTCHA on the login form
• Purpose: Privacy-friendly bot / CAPTCHA verification on login
• In the visitor’s browser: Cloudflare’s Turnstile script and challenge widget load from challenges.cloudflare.com using your public site key, the same as any site that embeds Turnstile
• Sent from your server (only to verify a solved challenge): your private secret key and the one-time challenge-response token
• Data NOT sent from your server: the visitor’s IP address, file contents, passwords, usernames, or other personal data
• Privacy: https://www.cloudflare.com/privacypolicy/

Server-side requests (items 1-8 above) use the WordPress HTTP API over HTTPS with certificate verification enabled, collect no telemetry or tracking data, and honour WordPress Site Health and the WP_HTTP_BLOCK_EXTERNAL constant for sites that prefer to disable all outbound traffic. The one exception is Cloudflare Turnstile (item 9): its script and challenge load in the visitor’s browser (not via the WordPress HTTP API), only when you enable Turnstile, and are therefore not governed by WP_HTTP_BLOCK_EXTERNAL.