For Developers
A WordPress security plugin for developers, built to stay out of your way
A WordPress security plugin for developers has to be predictable. Stack Guard runs on your own server, documents its hooks and constants, gives you a way back in when something locks you out, and never asks you to trust a black box.
Sound familiar?
The problems we hear most
Bloated, all-in-one plugins
Many security plugins load a lot of code and settings you never asked for, and slow every page on a site you are paid to keep fast.
Cloud dependencies you did not choose
Some tools route traffic or scans through a third party. That adds a point of failure and a data-handling question for every client.
Opaque behaviour
When a plugin blocks a request or rewrites a header, you want to know which setting did it and why, not hunt through undocumented options.
Lockouts during development
A hidden login address, two-factor or a firewall rule can lock you out of a site you are working on, with no obvious way back.
No hooks to build on
A plugin you cannot extend or listen to forces you to work around it, or to fork it.
Staging and production drift
Proxies, caching and CDNs differ between environments, and security rules that work on staging can misfire on production.
How Stack Guard helps
What changes with Stack Guard
Runs on your server
Scans, bans, lockouts and backups run inside your WordPress install. Two-factor secrets are encrypted with AES-256-GCM on your own server, and Free needs no key or account.
Learn moreDocumented hooks and constants
Actions and filters for lockouts, firewall blocks, scans, backups, user changes and settings updates, each with its arguments and an example. The developer reference lists them all.
Learn moreA way back in
wp-config.php switches turn off the login guard, two-factor or every blocking feature at once, then you remove the line when you are done. Recovery steps are documented before you need them.
Learn moreWP-CLI restore commands
Check the status of a restore, keep it or roll it back from the command line. Restores are staged and checked before anything live changes.
Learn moreSettings export and import
Export your configuration from one site and import it on another, or reset to defaults. Use it to keep staging and production in step.
Learn moreWhy this WordPress security plugin for developers stays predictable
Stack Guard documents what it does inside the plugin, in plain language, and the developer reference lists every hook, constant and command. You can read the argument list for an action before you rely on it.
Hooks cover the events you are likely to care about: lockouts and blocked requests, scan results, file changes, backup and restore steps, user and role changes, and settings updates. Filters let you adjust backup behaviour and add malware signatures.
- Actions such as smg_ip_locked_out, smg_firewall_block and smg_scan_complete
- Filters such as smg_malware_signatures and the backup tuning filters
- Constants such as SMG_SAFE_MODE, SMG_DISABLE_LOGIN_GUARD and SMG_BACKUP_DIR
Safe on staging, quiet on production
The compatibility check looks for the things that quietly break security plugins: proxies and CDNs, cached sign-in pages, other security plugins, page builders, server type and email delivery. Each finding says what to do.
Trusted proxy and Cloudflare support means Stack Guard reads the real visitor address, so bans and lockouts hit the right person. Pro can also read your Cloudflare settings with a read-only token.
Recover from your own mistakes
Backups are verified before they count, and restores are staged and checked before anything live changes. After a restore you can keep it or roll back for seven days, and the same commands exist in WP-CLI.
If a setting locks you out, the wp-config recovery constants turn off the cause without touching your saved settings, so you can fix it and carry on.
Questions
WordPress security plugin for developers: questions
What makes a WordPress security plugin good for developers?
Predictability. A WordPress security plugin for developers should run on your server, document its behaviour, expose hooks and constants, and give you a recovery path. Stack Guard does each of those.
Does Stack Guard have hooks and filters?
Yes. The developer reference lists actions and filters for lockouts, firewall blocks, scans, file changes, backups, user changes and settings updates, with arguments and examples.
What if I lock myself out during development?
Add a constant to wp-config.php. SMG_SAFE_MODE turns off everything that could keep you out, SMG_DISABLE_LOGIN_GUARD restores the normal login address and SMG_DISABLE_2FA skips the two-factor step. Remove the line when you are done.
Can I manage restores from the command line?
Yes. WP-CLI commands report restore status and let you keep a restore or roll it back, so you can script around it.
Can I copy settings between staging and production?
Yes. Settings export and import is in the free plugin, along with a reset to defaults.
Does it work behind Cloudflare or a reverse proxy?
Yes. Trusted proxy and Cloudflare support lets Stack Guard use the real visitor address, and the compatibility check flags proxy, caching and CDN issues with a suggested fix.
Read the reference, then install it
Every hook, constant and command is documented. Try Stack Guard Free on a staging site and see how it behaves.