Most WordPress security plugins do keyword matching on SQL injection: if the request contains "UNION" and "SELECT," block it. They false-positive on legitimate blog comments and miss most real attacks. GuardPress uses grammar-based detection across all 7 classical injection vectors, plus a real WAF, malware scanner, per-role 2FA, file integrity monitoring, security headers, and 30-day audit log. 100% server-side, no cloud dependency. Premium from $59/yr.
Hey Product Hunt! I'm Jameson, solo dev at Royal Plugins.
Every WordPress security plugin I've tried falls into one of two camps. Either it has 47 settings tabs you'll never understand, or it's so aggressive it breaks your site the first week.
GuardPress is built around what you actually need, and nothing else.
Clean UI. One dashboard. Each module has a single page, sensible defaults, a clear on/off toggle. You shouldn't need a tutorial to find your firewall settings.
Plays nice with the rest of your stack. WooCommerce, MemberPress, BuddyPress, Paid Memberships Pro, custom theme login forms all supported out of the box. Session start is scoped to wp-login.php only, so your caching layer (WP Rocket, LiteSpeed, W3 Total Cache, ForgeCache, Cloudflare APO) keeps working the way it should. No cache-busting headers on logged-out traffic.
Not overly aggressive. The WAF uses grammar-based SQL injection detection across 7 classical vectors instead of greedy keyword matching, so a legitimate blog comment with "select" or "from" in it doesn't trip the firewall. Per-role 2FA means you can require it for admins without forcing your subscribers to set up TOTP. Brute force lockout is rate-limited, not nuclear.
What's in it:
WAF (SQL injection, XSS, SSRF, dangerous schemes)
Malware scanner + WP core file verification against wordpress.org checksums
Per-role 2FA (TOTP)
Brute force protection with username enumeration block
File integrity monitoring + 30-day audit log
Security headers (CSP, HSTS, X-Frame-Options)
Outdated software check (flags abandoned plugins, pending updates, hardening misconfigs)
One-click migration from the two leading security plugins
100% server-side. No cloud. Runs entirely on your hosting.
$59/yr (1 site), $149 (5 sites), $299 (100 sites). Free version covers firewall, scanner, 2FA, brute force, login hardening, headers. 30-day money-back on Pro.
Question: Which WP security plugin has caused you the most "I can't believe it blocked that" pain? Bonus points if it was a customer trying to check out.
Report
No reviews yetBe the first to leave a review for Guardpress- Security WP Plugin