WordPress security plugin by Codiffy
Guardian Shield Lite locks your site's code, removes known malware only after saving the evidence, guards your administrator accounts and reports every site to a hub we watch.
Why we built it
In 2026 we investigated and cleaned up attacks on WordPress and WooCommerce sites we look after. We found administrator accounts that came back after they were deleted, fake plugins that hid themselves from the Plugins screen, small web shells that rebuilt themselves on the next page view, credential stealers, and fake “verify you are human” checks aimed at visitors. Some of it survived a full change of every password.
The usual security plugins had not stopped it. So we wrote our own. Guardian Shield Lite starts from one idea: an attacker’s code should not be able to run on your site in the first place. Every lesson from those incidents became a rule in the plugin, and every rule has a test that must pass before a new version ships.
What it does
Installing or uploading plugins and themes, the file editors and code uploads are blocked by default. Changes happen in short unlock windows that are time-limited, limited to what the job needs, recorded and reported.
Must-use plugins and drop-ins, the places attackers like to hide, are zero trust. A file runs only after it is approved by name and fingerprint, and a changed file goes back for review.
Only exact, confirmed malware is removed, and only after a protected copy has been saved. If the copy fails, nothing is deleted. Anything that merely looks suspicious is reported to a person, never deleted.
New administrators and promotions are blocked while the site is locked, unapproved administrators are demoted, and known malicious accounts are removed. Logins from new places are reported, XML-RPC is closed and new application passwords are blocked or reported.
WordPress core files are compared with the official checksums, and plugins from wordpress.org with their official checksums every 12 hours. Sensitive files such as wp-config.php and .htaccess are watched against a trusted baseline.
Application passwords, WooCommerce API keys and webhooks are listed and every change is reported, with webhooks to known data-theft services flagged. After a removal, Guardian writes an incident report: when the file arrived, which requests came in around it, and which access survives a password change.
How it works
Guardian Hub
Every site running Guardian reports to our hub. We see each site’s status, its last full scan, files waiting for approval and anything that needs a person, all on one screen.
Built to be trusted
Sites fetch new signatures every 6 hours and updates from the hub. Everything the hub publishes is signed with Ed25519 and checked before it is used; the hub never pushes code to a site.
A release is built only when every protection of the one before is still in it, and every automated test suite passes. A fix shipped once cannot quietly disappear.
Every check that runs on a visitor’s request is wrapped so that a problem inside Guardian does not break the page. When a PHP fatal error happens on a page Guardian can see, it is emailed at once with its file and line.
Guardian emails only what a person must act on now. Routine events are recorded for the report instead, so a real alert is never lost in noise.
For site owners
From the Guardian page, a site owner can download a PDF report of the last 30 days: what was found, what Guardian fixed, and what still needs attention. It shows only activity that was actually recorded, and when the report is made, Guardian checks each earlier finding against the site again, so something that is gone is listed as resolved.
If an owner is ever locked out while working on their own site, the Guardian page can email a step-by-step unlock guide to an administrator address registered for that site.
Honest limits
A plugin cannot catch an error in a WordPress core file that loads before plugins do. That is why the hub checks every front page from the outside.
Broad “looks suspicious” rules only raise an alert. Deleting is reserved for exact, confirmed malware, so nothing legitimate is removed by mistake.
Guardian keeps evidence of what it removes, not a copy of your site. Keep regular backups alongside it.
How to get it
Guardian Shield Lite is not sold as a download. It comes with our website security and maintenance services: we install it, set it up for your site, connect it to the hub and act on what it reports. If your site has already been attacked, we start with a malware cleanup and leave Guardian in place to keep it clean.
Guardian Shield Lite is developed by Codiffy under the direction of our Security Lead, Muhammad Haroon Ur Rasheed. How Codiffy approaches security
The WordPress security plugin Codiffy built after investigating and cleaning up real attacks in 2026. It keeps code changes locked, removes exact known malware after saving evidence, guards administrator accounts and reports every site to the Guardian hub.
It starts from zero trust. Code changes stay locked, new files in the places attackers hide must be approved before they run, and removal is limited to exact, confirmed malware with a protected copy saved first. Every site also reports to a hub we watch.
It is built not to. Only exact matches of confirmed malware are removed, a protected copy is saved first, and the removal is cancelled if that copy fails. Anything that only looks suspicious is reported to a person.
In short, time-limited unlock windows that are limited to the job, recorded and reported. When we look after your site, we handle updates as part of maintenance.
Yes. Guardian runs on WordPress with or without WooCommerce, and also watches WooCommerce API keys and webhooks for changes.
Not as a download. It comes with Codiffy website security and maintenance services: we install it, set it up, connect it to the hub and act on what it reports.
No. Guardian keeps evidence of what it removes, not a copy of your site. Keep regular backups alongside it.
Guardian Shield Lite comes with our website security and maintenance plans: we install it, set it up and watch it for you. Book a free 30-minute call and we will look at your site.
Book my free call
