WP Guardian

WP Guardian Skip to content Documentation About Initializing search WP Guardian Documentation WP Guardian WP Guardian About About Table of contents Overview Connecting Servers to WP Guardian Prerequisites Connecting a server to WP Guardian: Connecting a Plesk server to WP Guardian: Connecting a cPanel server to WP Guardian: Connecting a DigitalOcean server to WP Guardian Disconnecting servers from WP Guardian: Updating the List of WordPress Websites Updating the list of hosted WordPress websites: Detaching WordPress Websites from WP Guardian Detaching a WordPress website from WP Guardian: Keeping WordPress Websites Secure Updating all WordPress Websites Hosted on Specific Servers Updating all WordPress websites hosted on specific servers: Updating Multiple WordPress Websites Updating Individual WordPress Websites Updating an individual WordPress website: Protecting Against Specific Vulnerabilities Updating all WordPress websites affected by specific vulnerabilities: Protecting Against Actively Exploited Vulnerabilities Updating all WordPress websites affected by actively exploited vulnerabilities: Enabling backups before updates Enabling backups before updates for a specific WordPress website: Enabling backups before updates for all WordPress websites hosted on a specific server: Enabling Virtual Patching Enabling virtual patching for specific WordPress websites: Enabling virtual patching for all WordPress websites hosted on a specific server: Disabling virtual patching for a specific WordPress website: Disabling virtual patching for all WordPress websites hosted on a specific server: Managing Email and UI Notifications Selecting which notifications to receive: Changing the email address to receive notifications to: WP Guardian API Knowledge Base Knowledge Base Uninstalling WP Guardian agent Logging in to WP Guardian from DigitalOcean Securing WordPress Websites With WP Guardian¶ Like any other type of website, WordPress websites can be hacked. Attackers can use known vulnerabilities in WordPress, and also WordPress plugins and themes to steal confidential information, deface WordPress websites, make them install malware on visitors' devices, or to compromise other websites hosted on the same server. WP Guardian offers both free and paid features to help you monitor WordPress websites for vulnerabilities, and also to mitigate them. In this topic, you will learn how to connect servers hosting WordPress websites to WP Guardian. You will also learn how to evaluate the security of WordPress websites at a glance, and how to mitigate known WordPress vulnerabilities using WP Guardian. Overview¶ A successful attack against your WordPress website can cause you financial damage, hurt your reputation, make the website blacklisted by search engines, and more. On servers hosting multiple WordPress websites, even a single vulnerable website may allow an attacker to compromise the entire server. One of the major attack vectors is known vulnerabilities in WordPress, and also WordPress plugins and themes. WP Guardian was created to help you keep your WordPress websites up to date and secure. Here's how WP Guardian does it: WP Guardian regularly scans all WordPress websites hosted on connected servers. For each website, WP Guardian keeps track of its WordPress core version, and also of the versions of all installed plugins and themes. WP Guardian maintains a comprehensive and up-to-date database of all known WordPress vulnerabilities. It gathers information from both Patchstack and WordFence, leading WordPress security services. WP Guardian marks every website running a vulnerable WordPress core version, or a vulnerable version of a plugin or theme. WP Guardian lists all known WordPress vulnerabilities affecting one or more WordPress websites hosted on connected servers. WP Guardian notifies you about events that demand your attention. For example, you can be notified about actively exploited vulnerabilities being used to compromise WordPress websites. WP Guardian enables you to secure vulnerable WordPress websites by updating WordPress core on those websites, and also by updating or disabling vulnerable WordPress plugins and themes installed on those websites. WP Guardian gives you access to virtual patching (powered by Patchstack), a way of protecting against known unpatched vulnerabilities in both WordPress core and its plugins and themes. Before you can start securing your WordPress websites, you need to add the server or servers hosting them to WP Guardian. Connecting Servers to WP Guardian¶ You can connect any number of servers to WP Guardian. When you connect a server to WP Guardian, it is scanned for existing WordPress websites. All WordPress websites hosted on the server appear on the "WordPress Sites" tab. Prerequisites¶ You can only connect servers running one of the following OS to WP Guardian: CentOS 7 CloudLinux 7 CloudLinux 8 CloudLinux 9 AlmaLinux 8 AlmaLinux 9 AlmaLinux 10 Rocky Linux 8 Rocky Linux 9 Rocky Linux 10 Ubuntu 18.04 Ubuntu 20.04 Ubuntu 22.04 Ubuntu 24.04 Debian 10 Debian 11 Debian 12 Debian 13 KUSANAGI 9 If your configuration is missing from the list, you can contact us using the LiveChat widget in WP Guardian or by filling the contact form. The TCP port 878 must be open (forwarded in case NAT is used) on servers you want to connect to WP Guardian. Warning When you connect a server, make sure that the required TCP port is open on your server: Plesk servers: port 8443 cPanel servers: port 2087 Other servers: port 878 (opened automatically by the installation script) For security reasons, we strongly recommend allowing incoming connections to required TCP port only from the following IP addresses: 34.254.37.129 52.51.23.204 52.213.169.7 Connecting a server to WP Guardian:¶ Note The procedure below applies to servers with Plesk or cPanel installed. However, for automation, we recommend that you use the specific procedures for Plesk and cPanel. Log in to the WP Guardian website. Click Connect. Click the Copy button to copy the WP Guardian Agent installation script to the clipboard. Log in to the server you want to connect via SSH. Paste the WP Guardian Agent installation script into the console, and then press the "Enter" key. The installation of the WP Guardian Agent begins on the server. Once the installation is finished, WP Guardian scans the server for WordPress websites. You can find the added server on the "Servers" tab, and all WordPress websites hosted on it on the "WordPress Sites" tab. Note Scanning for WordPress websites can cause noticeable increase in CPU and disk I/O consumption. We recommend that you do not connect servers or scan for new WordPress websites during peak hours. Connecting a Plesk server to WP Guardian:¶ Note If you have already generated a token in WP Guardian or Plesk 360 and used the token to connect your Plesk server to Plesk 360, go straight to step 8. Log in to your WP Guardian account. In the top right corner of the screen, click your profile name, and then click API tokens. Click Generate API token, give your token a recognizable name, and then click Generate. Copy the token to clipboard, save the token in a safe place, and then click Close. Note You can see and copy the token only once when it is generated. Log in to your Plesk server via SSH. Create a file, paste the token copied during step 4, and then save the file. Note Make sure the token file has read and write permissions (chmod 600). Connect your Plesk server to Plesk 360 by running the command in the following pattern: plesk ext platform360 --connect-server -p360-key-file /path/to/file/with/token Connect your Plesk server to WP Guardian by running the command in the following pattern: plesk ext platform360 --wpguardian-setup -p360-key-file /path/to/file/with/token Congratulations! Your Plesk server is now connected to WP Guardian. Connecting a cPanel server to WP Guardian:¶ Log in to your WP Guardian account. In the top right corner of the screen, click your profile name, and then click API tokens. Click Generate API token, give your token a recognizable name, and then click Generate. Copy the token to clipboard, save the token in a safe place, and then click Close. Note You can see and copy the token only once when it is generated. Log in to your cPanel server via SSH. Create a file, paste the token copied during step 4, and then save the file. Note Make sure the token file has read and write permissions (chmod 600). Download the cPanel plugin installer and connect the cPanel server to Plesk 360 by running the command in the following pattern: sh <(curl 'https://repo.platform360.io/cpanel-plugin-installer.sh' || wget -O - 'https://repo.platform360.io/cpanel-plugin-installer.sh') && platform360-cpanel-plugin connect-server --api-key-file /path/to/file/with/token Connect your cPanel server to WP Guardian by running the command in the following pattern: platform360-cpanel-plugin wpguardian-setup --api-key-file /path/to/file/with/token Congratulations! Your cPanel server is now connected to WP Guardian. Connecting a DigitalOcean server to WP Guardian¶ You can connect a DigitalOcean server (or as DigitalOcean calls it, a droplet) like any other server using the procedure described above. But the integration between WP Guardian and DigitalOcean streamlines how you buy a WP Guardian license and then connect a droplet. See the procedure below: Log in to your DigitalOcean account. Click Add WP Guardian. Select a WP Guardian subscription price, select the "I agree to WP Guardian by WebPros's Terms of Service and End User License Agreement" checkbox, and then click Add WP Guardian. Go to SaaS Add-Ons. There you will see the added WP Guardian subscription. To log in to WP Guardian, click "View WP Guardian" link, and then click Continue. You will be asked to enter a 6-digit code sent from WP Guardian. To do so, check the mailbox associated with your DigitalOcean account, find the email with the code, and then copy it to clipboard. Paste the copied code, and then click Continue. Under "1. Copy the following snippet", click Copy. Return to your DigitalOcean account > Droplets, and then click the name of the droplet you want to connect to WP Guardian. Click "Console". In the opened droplet console, paste the snippet copied earlier and wait a while until it is executed. Return to the WP Guardian tab. Congratulations! You can now see the connected droplet on the "Servers" tab, and all WordPress websites hosted on it on the "WordPress Sites" tab. Note You can also watch the video instruction of how to connect a DigitalOcean server to WP Guardian (steps 8-12). Disconnecting servers from WP Guardian:¶ Log in to the WP Guardian website. Select one or more servers from the list, and then click Disconnect. Confirm the disconnection. The selected servers and all WordPress websites hosted on it disappear from WP Guardian. The websites remain operational and are not affected in any way by the disconnection. The WP Guardian Agent remains installed and running on the disconnected servers. Learn how to uninstall the WP Guardian Agent manually. Updating the List of WordPress Websites¶ When you connect a server to WP Guardian, it is scanned for existing WordPress websites. However, over time, existing WordPress websites may be removed from the server, and new ones may be created. Before you can start monitoring and securing those websites, they need to be added to WP Guardian. Connected servers are scanned for new WordPress websites every 24 hours. You can also update the list of hosted WordPress websites manually at any time. Updating the list of hosted WordPress websites:¶ Log in to the WP Guardian website. Select one or more servers from the list, and then click Find New Sites. All WordPress websites created since the last time the selected servers were scanned are added to WP Guardian. They can be found on the "WordPress Sites" tab. Detach…