- Two builds of the free plugin: the free plugin ships as the *wordpress.org package* (Plugins → Add New, from the wordpress.org directory) and as the *Avakode build* (the free zip that Avakode distributes itself: the “Zip” button next to Guard Forge under Free downloads on https://avakode.com/download/, or “Download the zip” on guardforge.app/download). The wordpress.org package makes no request except the checksum lookup at wordpress.org, which runs while the file-integrity monitor is switched on and when somebody presses “Run scan now”, so four parts of the free plugin are not in it and exist in the Avakode build only: the free vulnerability feed, the “Explain this event” button, one-click restore of a core file, and the Forge Suite screen with its feedback card. In the wordpress.org package a modified or missing core file is named with its verdict and a link to Dashboard → Updates (reinstall WordPress) instead of a Restore button, and the Vulnerabilities screen says the advisory database is served by GuardForge Pro.
- Two plugins, not a flag:
guardforge(Free; in the WordPress.org directory as “GuardForge”, https://wordpress.org/plugins/guardforge/, and a direct download from https://avakode.com/download/) contains no Pro code at all and, since 1.6.0, no licence class or key handling either;guardforge-prois a separate add-on that requires the free core (Requires Plugins: guardforge) and carries the licence layer. At the time of writing the free plugin is 1.6.2 and the add-on 1.4.3. - Free (both builds): hardening (XML-RPC and REST with an allow-list, version hiding, file-edit lock, user-enumeration block, security headers, an optional login math-captcha,
.htaccessprotection for sensitive files, directory listing off, comment honeypot, bad-bot user agents); brute-force lockout with a login log; file integrity against the official wordpress.org checksums; the hash-chained audit log with “Verify chain”; TOTP two-factor with single-use recovery codes for every logged-in role; a hardening score out of a hundred with a published weight table and an optional public letter-grade badge; a report-only Content-Security-Policy; and staging / development mode. - Free, Avakode build only (the wordpress.org package does not carry them): the vulnerability feed (public advisories, seven days behind, off until you switch it on in Settings), one-click restore for a core file, “Explain this event” at one AI credit a press, and the Forge Suite screen.
- Pro: the require-2FA-for-administrators policy, alerts to Telegram / Slack / a signed webhook (encrypted secrets, per-channel severity, digest, quiet hours, a real test send), lockdown mode and auto-lockdown, the vulnerability database in real time, patch by update, Geo-IP block or allow lists, Cloudflare firewall sync with a daily refresh of Cloudflare’s published edge ranges, a ten-rule WAF, an eight-signature malware scanner, audit-log export (CSV, streamed), and hourly AI threat analytics.
- Free, and often assumed to be Pro: two-factor authentication itself (only the enforce-for-administrators *policy* is Pro), file integrity over plugins and themes as well as core, the audit-log hash chain and its verifier, the hardening score and the public badge, and staging mode. In the Avakode build the vulnerability feed and the per-event “Explain” button are free too.
- Credits: exactly two things spend Forge credits, and they are the same metered action (
threat_analyze, mirrored inGUARDFORGE_Forge_API::CREDIT_COSTS) at 1 credit each — the free “Explain this event” button of the Avakode build (1 credit per press, printed on the button before the click, the answer cached against the event’s content so re-reading is free) and the Pro hourly AI threat verdict (1 credit per batch); the wordpress.org package has only the second. Nothing else in either package costs a credit: the integrity scan, the chain verifier, the WAF, the scanner, the alerts and patch-by-update are all free of credits, and so are the Avakode build’s advisory feed and core restore. - The licence gate (
GUARDFORGE_License::$features, a class of the Pro add-on since 1.4.0) lists exactly twelve Pro keys:two_factor_policy,alerts_telegram,alerts_slack,alerts_webhook,lockdown,vuln_db,geo_ip,cloudflare_sync,waf,malware_scanner,ai_threat,audit_export. Anything not on that list is Free. - Pricing (annual, Forge Builder): Personal $59/yr (1 site), Professional $129/yr (5 sites), Agency $219/yr (unlimited sites). Sets of two or more Forge tools take a ladder discount (2 tools 15%, 3 tools 25%, 4 or more 35%) that stays on every renewal.
- Priority email support: Available with any active Pro license. It ends when the license expires and comes back on renewal.
- Where to buy: avakode.com/pricing (single tool or a set). Checkout and VAT are handled by Paddle. Keys arrive by email and live in the Avakode dashboard.
- License keys:
FRG-…keys. The licence layer is part of GuardForge Pro (add-on 1.4.0, free 1.6.0): the free plugin carries no licence class or key handling. Without the add-on there is no GuardForge → License item at all, no upgrade button and no plan badge in the header, and the Lockdown, Geo-IP, Malware scanner and Cloudflare screens only say they are part of GuardForge Pro, a separate plugin, and link to its page; nothing on them is locked or greyed out. With the add-on installed, GuardForge → License (the add-on’s own item, the last in the menu after Alerts) shows the plan (Pro active, Trial, or an Upgrade to Pro button) and, from add-on 1.4.1, the Connect to Avakode button; there is no key field. To activate, install the Pro add-on (1.4.1 or newer), open GuardForge → License and click Connect to Avakode: the browser goes to avakode.com to sign in and approve, the site swaps the one-time token it is handed for the licence key, claims a place for the site on that licence and comes back to the same screen with a banner (connected, licence moved, licence already active on another site with a button that leads to your Avakode dashboard, or the error text), and the screen then says GuardForge Pro is active. The button is on that screen whatever the plan says and whether or not a key is saved, next to either package, as long as the add-on has started (it needs the free plugin 1.6.0 or newer); with a key saved it reads Reconnect, with a Disconnect beside it that gives the place back. A single-tool licence connected from there activates Guard Forge only; a bundle licence activates the other Forge tools on the account too. This is how a site on the wordpress.org package connects. In the Avakode build the Forge Suite screen has the same Connect button and is a second way in. Add-on 1.4.0 has the License screen without the button, so next to the wordpress.org package it cannot connect: update the add-on. While the licence is not active the Pro screens say “GuardForge Pro is installed on this site, but its licence is not active, so this stays switched off” and link to License. Deactivate on one site to move it to another; site limits follow the plan. - Requirements: WordPress 6.5+, PHP 7.4+.
- Add-on floor: free 1.6.0 and later require GuardForge Pro 1.4.0 or newer (
GUARDFORGE_MIN_PROinplugin/guardforge.php); free 1.3.0 to 1.5.x asked for GuardForge Pro 1.2.0 or later (an add-on from before 1.2.0 had never heard of staging mode, so on a clone of your site it would have gone on mailing alerts while the banner promised silence). An add-on below the floor is reported ABSENT, not warned about, so alerts to Telegram, Slack or a webhook, the Cloudflare firewall push, automatic lockdown, patch by update, the WAF, malware scanning, AI threat analysis, required 2FA and audit export stop the moment the free plugin is updated. Since free 1.6.0 such an add-on is also kept from starting: the licence class moved into the add-on, and an older one would look for it in the free plugin and fatal. Your logs, baselines and settings are kept. A red admin notice, shown to anyone who can update plugins, names the installed version, the required one and what stopped, and says where to get the package when Dashboard → Updates lists none (Avakode dashboard → Downloads, then upload it over the old copy); installing the current add-on brings it all back. The floor runs the other way too: GuardForge Pro 1.4.0 requires GuardForge 1.6.0 or newer (GUARDFORGE_PRO_MIN_COREinguardforge-pro.php); beside an older free plugin it does not start and shows a notice. - Money-back: 14 days, as on every Forge tool (the Avakode refund policy).