Every layer of your fleet, protected by default

Why it matters: Most WordPress breaches don’t start with a sophisticated hacker — they start with a known, published vulnerability in a plugin or theme nobody got around to updating.

How WP Warden helps: WP Warden scans every plugin, theme, and WordPress core version across your entire fleet daily, matching exact installed versions against live CVE databases. Each result comes with a severity score and the exact version that fixes it, so you know precisely what to update and why it matters.

Why it matters: A compromised site rarely announces itself. Attackers who get in often make quiet changes to keep their access — a modified core file, a hidden backdoor script — long before anything looks visibly wrong.

How WP Warden helps: Every core, plugin, and theme file is fingerprinted and compared against a known-good baseline on every scan. Core files are also checked against WordPress.org’s official file list, so tampering is caught even on the very first scan, before you’ve established your own baseline.

Why it matters: File-change detection alone can miss malicious code that was already sitting there before monitoring started.

How WP Warden helps: Independently of file-change detection, WP Warden scans file contents for known malicious code patterns — the kind of disguised, self-executing code webshells use — so a compromise is caught whether it shows up as a change or not.

Why it matters: Signature-based scanning can only catch what it’s already seen — a sample that encodes its payload in a way no existing pattern recognizes slips through undetected, and closing that exact gap is what attackers count on.

How WP Warden helps: When the scanner flags a suspicious file, you can optionally connect your own AI provider — Claude, ChatGPT, Gemini, or even a locally-hosted model — for an independent second opinion. The AI reasons about what the code actually does rather than matching a fixed pattern, and can quarantine a confirmed threat directly on the site. Nothing is sent anywhere unless you connect a provider yourself, and every call is billed to your own account with that provider, never ours.

Why it matters: The uploads folder has to stay writable for your site to function, which makes it the single most common place attackers hide malicious files.

How WP Warden helps: WP Warden’s plugin adds a server-level rule that blocks any script file placed in your uploads folder from ever being executed — so even a file that slips past scanning still can’t run.

Why it matters: Automated bots probe WordPress logins around the clock, and a single guessed or reused password is often the only thing standing between an attacker and full control of a site.

How WP Warden helps: Repeated failed logins from the same address are automatically rate-limited and locked out. If the same attacker targets several sites in your fleet within an hour, WP Warden raises one combined alert instead of leaving you to piece together scattered warnings.

Why it matters: A lesser-known WordPress feature called XML-RPC can be abused to bounce traffic off your server at someone else — turning your client’s site into an unwilling participant in an attack on a third party.

How WP Warden helps: WP Warden disables the specific XML-RPC methods that enable this abuse, closing the door without breaking any legitimate use of the feature.

Why it matters: A missing email authentication record can let anyone send email that looks like it came from your client’s domain, and an expired SSL certificate quietly breaks visitor trust the moment it lapses.

How WP Warden helps: Every six hours, WP Warden checks DNS records, SSL certificate validity, and email authentication (SPF, DKIM, DMARC), scores each site out of 100, and gives you the exact record values to add if something’s missing.

Why it matters: A site that’s down is also a site that’s unmonitored — and the longer an outage or a compromise goes unnoticed, the worse the damage.

How WP Warden helps: WP Warden probes every site every five minutes from its own servers, completely independent of anything running on the WordPress site itself, so you’re alerted within minutes, not whenever the site next checks in.

Why it matters: Some problems, including some compromises, show up as something looking visibly wrong on the page, not as a file that technically changed.

How WP Warden helps: WP Warden automatically captures a screenshot before and after every update and compares them pixel by pixel, flagging anything that looks meaningfully different so you catch it before a client does.

Why it matters: Detecting a problem matters, but having a clean, recent copy to restore from is what actually gets a client’s site back online fast.

How WP Warden helps: Backups run on your schedule, and updates applied through WP Warden are wrapped in a safety net: a snapshot is taken first, and if the after-update screenshot looks broken or new critical issues appear, the change is automatically rolled back.

Why it matters: A password alone isn’t enough anymore — phishing and password reuse mean the accounts that control your entire client fleet deserve a second layer of protection.

How WP Warden helps: Team members can enable authenticator-app or email-based 2FA, backed by one-time backup codes for account recovery, with automatic lockout after repeated failed attempts.

Why it matters: Even a strong password can be guessed, phished, or leaked — and a session that never expires is a session that’s still valid long after it should be.

How WP Warden helps: Repeated failed logins lock an account out automatically. Every active session is tracked, with configurable limits on simultaneous logins and an idle timeout that signs a forgotten session out on its own.

Why it matters: Every site you manage talks to WP Warden constantly. If that channel could be spoofed or replayed, an attacker wouldn’t need to touch your dashboard at all.

How WP Warden helps: Each site connects with its own unique key, and every single request is cryptographically signed with a timestamp, so a captured request can never be reused later and an unsigned request is rejected outright.

Why it matters: Not everyone on your team needs the same level of access, and one client’s data should never be visible to another, even by accident.

How WP Warden helps: Granular roles control exactly what each team member can see and do, and every piece of data is scoped to your agency account at the database level — so there’s no path for information to cross between tenants.

Why it matters: Clients and regulators can ask for a copy of everything held about them, and scrambling to assemble that manually wastes time and risks missing something.

How WP Warden helps: Account owners can download a complete, structured export — settings, users, clients, sites, backup metadata, activity logs, alerts, and security events — as a single file, supporting the right to access and data portability.

Why it matters: The right to erasure means having a real way to permanently remove an account and its data, not just deactivate it.

How WP Warden helps: Account owners can permanently delete their account, cascading the erasure through sites, backups, clients, tickets, and logs, plus local backup files and screenshots on disk — with password and account-name confirmation required first.

Why it matters: Keeping data longer than necessary is itself a risk, and a core data-minimization principle is not holding onto it past its useful life.

How WP Warden helps: Logs, alerts, and analytics snapshots are automatically pruned on a schedule after defined retention windows, rather than accumulating indefinitely.

Why it matters: Agencies serving EU clients often need backup data to stay within the EU specifically, not wherever a provider’s default region happens to be.

How WP Warden helps: Backups can be configured to store in EU-region storage, giving you control over where that copy of your data physically lives.