Guard Forge is a WordPress security plugin. The free core hardens the install, locks out password guessers, gives every logged-in account two-factor authentication, and keeps an audit trail of who changed what — and it does three things a free security plugin usually does not.
It checks files against the build wordpress.org actually published, not against yesterday’s snapshot of the same disk: every core file, and every plugin hosted on wordpress.org, is compared with the checksums published for that exact release, so the screen can name a file that is in no official build at all — which is the shape a backdoor has and the one thing a scan-to-scan diff can never see. It chains the audit log: every row carries the hash of the row before it, so an edited or a deleted line is detectable rather than deniable. And it downloads the published vulnerability advisories once a day and matches them against the plugins and themes actually installed, at their actual versions — free, served seven days behind the licensed feed, with the screen saying which of the two you are reading.
The Pro add-on adds a policy that requires two-factor of administrators, a managed web application firewall, a malware scanner, the same advisories in real time, the update that closes them, country blocking, Cloudflare firewall sync, alerts to Telegram/Slack/a signed webhook with quiet hours and a digest, a lockdown that can throw itself, an audit-log export, and an hourly AI verdict on the site’s own event log.
Everything runs inside the site’s own WordPress installation. Three things reach the network from the free package: the daily checksum lookup at wordpress.org, the daily advisory download from api.avakode.com, and the “Explain this event” button when somebody presses it. Only the last one says anything about the site. Pro adds the licence check, the licensed vulnerability feed, the Cloudflare calls the owner’s own token makes, and — off until enabled — the hourly AI verdict.
Guard Forge is built by Avakode (avakode.com) and is one of the Forge Suite tools, alongside Flow Forge, Velocity Forge, Draft Forge, Lang Forge, Rank Forge, Form Forge, Field Forge, Clearway Forge, Profit Forge and Inclusive Forge. Its landing is guardforge.app.
## Quick facts
- Two plugins, not a flag:
guardforge(Free, WordPress.org channel) contains no Pro code at all;guardforge-prois a separate add-on that requires the free core (Requires Plugins: guardforge). Both are at 1.2.0. - Free: hardening (XML-RPC and REST with an allow-list, version hiding, file-edit lock, user-enumeration block, security headers, an optional login math-captcha,
.htaccessprotection for sensitive files, directory listing off, comment honeypot, bad-bot user agents); brute-force lockout with a login log; file integrity against the official wordpress.org checksums, with a one-click restore for a core file; the hash-chained audit log with “Verify chain”; TOTP two-factor with single-use recovery codes for every logged-in role; the vulnerability feed (public advisories, seven days behind); a hardening score out of a hundred with a published weight table and an optional public letter-grade badge; a report-only Content-Security-Policy; staging / development mode; and “Explain this event” at one AI credit a press. - Pro: the require-2FA-for-administrators policy, alerts to Telegram / Slack / a signed webhook (encrypted secrets, per-channel severity, digest, quiet hours, a real test send), lockdown mode and auto-lockdown, the vulnerability database in real time, patch by update, Geo-IP block or allow lists, Cloudflare firewall sync with a daily refresh of Cloudflare’s published edge ranges, a ten-rule WAF, an eight-signature malware scanner, audit-log export (CSV, streamed), and hourly AI threat analytics.
- Free, and often assumed to be Pro: two-factor authentication itself (only the enforce-for-administrators policy is Pro), file integrity over plugins and themes as well as core, the vulnerability feed, the audit-log hash chain and its verifier, the hardening score and the public badge, staging mode, and the per-event “Explain” button.
- Credits: exactly two things spend Forge credits, and they are the same metered action (
threat_analyze, mirrored inGUARDFORGE_Forge_API::CREDIT_COSTS) at 1 credit each — the free “Explain this event” button (1 credit per press, printed on the button before the click, the answer cached against the event’s content so re-reading is free) and the Pro hourly AI threat verdict (1 credit per batch). Nothing else in either package costs a credit: the advisory feed, the integrity scan, the restore, the chain verifier, the WAF, the scanner, the alerts and patch-by-update are all free of credits. - The licence gate (
GUARDFORGE_License::$features) lists exactly twelve Pro keys:two_factor_policy,alerts_telegram,alerts_slack,alerts_webhook,lockdown,vuln_db,geo_ip,cloudflare_sync,waf,malware_scanner,ai_threat,audit_export. Anything not on that list is Free. - Pricing (annual, Forge Builder): Personal $59/yr (1 site), Professional $129/yr (5 sites), Agency $219/yr (unlimited sites). Sets of two or more Forge tools take a ladder discount (2 tools 15%, 3 tools 25%, 4 or more 35%) that stays on every renewal.
- Where to buy: avakode.com/pricing (single tool or a set). Checkout and VAT are handled by Paddle. Keys arrive by email and live in the Avakode dashboard.
- License keys:
FRG-…keys; activate under GuardForge > License. Deactivate on one site to move it to another; site limits follow the plan. - Requirements: WordPress 6.5+, PHP 7.4+.
- Money-back: 30 days.