Modern WordPress security, without the bloat.
SentriGuard protects authentication, monitors WordPress Core and file integrity, and tells you when something needs attention — with a dashboard built for real production sites.
- Two-factor authentication
- Brute-force protection
- File integrity monitoring
- Security audit logs
- Advanced hardening
- Cloudflare integration
- Real-time alerts
Free on WordPress.org · No credit card required · No aggressive automation
Security shouldn't slow down your website.
Most WordPress security plugins try to do everything at once. SentriGuard focuses on the controls that actually reduce risk.
The common pattern
- Bloated with features most sites never use
- Difficult to configure correctly
- Resource intensive on shared hosting
- Noisy — constant alerts nobody reads
- Built as an all-in-one antivirus, not a focused toolset
What SentriGuard focuses on
- Authentication protection that stops the attacks that matter
- Integrity monitoring you can actually understand
- Audit logs that explain what changed and who changed it
- Alerts that arrive only for events worth reviewing
- A dashboard that reflects real security posture, not vanity metrics
Install. Configure. Monitor. Respond.
Install SentriGuard
Add the plugin from WordPress.org or upload it directly — no external account required to get started.
Enable the protections you need
Turn on 2FA, login protection, integrity monitoring and hardening for the roles and areas that matter.
SentriGuard monitors continuously
Authentication, WordPress Core, plugins, themes and file changes are watched in the background.
Respond to what matters
Receive Email or Telegram alerts, review the audit log, and — with Pro — block malicious traffic through Cloudflare.
The controls that matter for WordPress security
Every feature exists to protect authentication, preserve integrity, or improve visibility — nothing else.
Two-Factor Authentication
Protect administrator and selected user roles with TOTP-based 2FA and recovery codes.
Login Protection
Limit failed login attempts, automatically lock malicious IP addresses, and protect both wp-login.php and XML-RPC authentication.
Security Audit Log
Track logins, user changes, plugin and theme activity, security settings, 2FA events and integrity alerts.
WordPress Core Integrity
Compare WordPress Core files against official checksums to detect modified, missing or unexpected files.
File Change Monitoring
Monitor plugins, themes and WordPress Core, and detect files that are added, modified or deleted.
REST API Protection
Restrict unauthenticated REST access and prevent user enumeration without breaking WordPress administration.
XML-RPC Protection
Defend against brute-force authentication, system.multicall abuse and pingback exploitation.
User Enumeration Protection
Block common username discovery techniques, including ?author=1 requests and unauthenticated REST user lookups.
Security Hardening
Review and harden common WordPress attack surfaces with configurable, transparent controls.
One screen. Real security posture.
SentriGuard summarizes authentication, integrity and traffic signals into a single dashboard — no guesswork about what's actually protected.
92 / 100
Security Score
Enabled
2FA
Healthy
Core Integrity
Active
Login Protection
Protected
REST API
Hardened
XML-RPC
14
Blocked IPs
7
Recent Events
2 min ago
Last Scan
Recent Events
- 2 min agoIntegrity scan completed — no changes detected
- 41 min agoLogin lockout triggered for 203.0.113.44
- 3 hr agoAdministrator 2FA re-verified
- YesterdayPlugin "contact-form" updated (files changed: 6)
- 2 days agoCloudflare block triggered for repeat offender
Know exactly what changed.
SentriGuard compares WordPress Core files against official checksums and watches plugins, themes and uploads for changes that shouldn't be there.
- Detect modified, missing or unexpected WordPress Core files
- Monitor plugin and theme files for additions, edits and deletions
- Flag unexpected files in uploads and other writable directories
- Review changes in the audit log — nothing is removed automatically
2 files flagged for review · last scan completed in 8.2s
3 IP addresses locked in the last hour · escalation to Cloudflare available in Pro
Stop credential attacks at the login form.
Brute-force attempts, weak passwords and exposed usernames are still the most common way WordPress sites get compromised.
- TOTP-based two-factor authentication with recovery codes
- Automatic lockouts after repeated failed login attempts
- Protection applied to both wp-login.php and XML-RPC authentication
- Every lockout and 2FA event recorded in the security audit log
Know when something changes.
SentriGuard notifies administrators when important security events occur — over email or Telegram, sent asynchronously so nothing blocks the page load.
- WordPress core file modified
- New administrator account created
- Brute-force attack detected
- Two-factor authentication disabled
- Suspicious login activity
- Integrity scan failure
- Cloudflare block triggered
SentriGuard Alerts
Telegram Bot
CRITICAL SECURITY ALERT
WordPress core file modified
wp-includes/version.php
Immediate review recommended.
14:32
Stop attacks before they reach WordPress.
SentriGuard can escalate malicious IP addresses from a local WordPress lockout to edge-level blocking in Cloudflare — so repeat offenders never make it back to wp-login.php.
Cloudflare integration is optional. SentriGuard works fully without it.
Least-privilege API tokens — SentriGuard only requests the permissions it needs.
Security without dangerous automation.
Administrators stay in control of production websites. SentriGuard is designed to be predictable, not to make unattended changes.
What SentriGuard will never do
- SentriGuard detects and reports suspicious file changes.
- It does not automatically delete files based only on heuristics.
- It does not modify WordPress Core.
- It does not silently edit wp-config.php.
- It does not introduce magic security bypass URLs.
Your site data stays yours
- License validation sends only minimal installation and license information.
- Security logs stay inside your WordPress database unless you configure otherwise.
- Cloudflare, Telegram and Email integrations are entirely optional.
- No unnecessary external data collection.
Security shouldn't become a performance problem.
SentriGuard avoids heavy security operations during normal frontend requests. External API calls stay outside the critical request path.
Asynchronous notifications
Email and Telegram alerts are dispatched outside the request lifecycle.
Background integrity scans
Core and file checks run on a schedule, never during a visitor's page load.
Batched file scanning
Large file sets are processed in batches to avoid memory and timeout issues.
Minimal frontend overhead
Login protection and hardening add negligible weight to normal requests.
Built for administrators and developers.
SentriGuard is scriptable, hook-driven and designed to fit into real deployment and monitoring workflows.
- WP-CLI support for status, scans, license and Cloudflare state
- Modular architecture built around standard WordPress hooks
- No WordPress Core modifications, ever
- Reverse proxy support with trusted proxy validation
- IPv4 and IPv6 aware, including Cloudflare-fronted environments
- WordPress Multisite support where applicable
$ wp sentriguard statusCore Integrity Protected2FA EnabledLogin Protection Active$ wp sentriguard scanScanning core, plugins and themes...1,842 files checked · 2 flagged for review$ wp sentriguard license statusPlan: Pro · Status: Active · Expires: 2027-01-14$ wp sentriguard cloudflare statusConnection: OK · Escalated IPs: 14
Start free. Upgrade when you need more control.
The Free plan covers the core protections every WordPress site should have. Pro adds the controls agencies and businesses need at scale.
Free
WordPress.orgCore protection for every WordPress site.
- Two-Factor Authentication
- Basic Login Protection
- Basic Audit Log
- Manual Core Integrity Scan
- Basic REST API Protection
- Security Dashboard
Pro
Choose a licenseAdvanced controls for agencies, developers and businesses.
- Everything in Free
- Advanced Hardening
- Cloudflare Integration
- Scheduled Integrity Monitoring
- Advanced File Monitoring
- Advanced XML-RPC Protection
- Extended Audit Retention
- Advanced Security Reports
- Advanced Security Policies
- Priority Updates
Licensing
Pro licenses are managed by the SentriGuard License Server: secure activation, multiple installation support per license, and a grace period if the license server is temporarily unavailable.
1 Site
For a single production website.
5 Sites
For small teams managing several sites.
Agency
For agencies managing many client sites.
Built for whoever owns the risk.
For Site Owners
Protect administrator accounts and know when critical files change.
For Developers
Audit important changes and investigate unexpected behavior.
For Agencies
Manage consistent security controls across customer sites.
For DevOps
Integrate security monitoring with Cloudflare and command-line workflows.
Security is only part of the stack.
Built by engineers who work with real production infrastructure. Beyond SentriGuard, we build custom WordPress, security and infrastructure solutions for teams that need something a generic plugin can't cover.
Have a WordPress, security or infrastructure problem that needs a custom solution? We focus on reliability, security, maintainability and performance — not generic freelance work.
Talk to UsTalk to us about a custom solution
Tell us about your WordPress, security or infrastructure problem and we'll follow up.
Frequently asked questions
Take control of your WordPress security.
Protect authentication. Monitor critical changes. Know when something goes wrong — before it becomes a bigger problem.