Every feature, in plain language
Each tier includes everything in the tier before it. Every feature below says what it actually does — no unexplained jargon.
Scanning
Curated definitions, not a firehose
Every signature is normalized into our own format, de-duplicated, and false-positive tested against a clean WordPress corpus before it reaches your site. Fewer false alarms on legitimate plugin code.
The engine is pure PHP — no ClamAV or YARA binaries required, so it runs on shared hosting where most scanners can't.
scan results screenshot
(real UI pending — website.md §15)
firewall / blocked-requests screenshot
(real UI pending — website.md §15)
Firewall
Attacks stop before WordPress runs
The web application firewall inspects requests and blocks common attack patterns before WordPress ever executes them. Pro adds virtual patching — a known plugin vulnerability is shielded at the firewall until the author ships a fix.
On Pro, addresses attacking one IronGuard site are blocked across the whole network.
Reporting
Findings you can actually act on
Every result says what happened, why it matters, and the recommended next step. No raw rule IDs, no unexplained jargon.
A single security score prioritizes what to fix first, and one-click hardening handles the common mistakes attackers rely on.
security score screenshot
(real UI pending — website.md §15)
Full feature matrix
Cumulative — each tier includes everything in the tier before it.
| Feature | What it does | Free | Plus | Pro |
|---|---|---|---|---|
| Signature malware scan | Checks your files against known malware signatures and flags anything that matches. | Included in Free | Included in Plus | Included in Pro |
| Core integrity check | Compares WordPress core files against the official versions to spot tampering. | Included in Free | Included in Plus | Included in Pro |
| Login limiting | Locks out an attacker after repeated failed logins so brute-force attacks fail. | Included in Free | Included in Plus | Included in Pro |
| Security score | A single score with a prioritized list of what to fix first. | Included in Free | Included in Plus | Included in Pro |
| Basic hardening | One-click fixes for the common WordPress mistakes attackers rely on. | Included in Free | Included in Plus | Included in Pro |
| Full / deep scan | Scans themes, plugins, uploads, and the database — not just core files. | Not included in Free | Included in Plus | Included in Pro |
| Real-time monitoring | Watches for file changes as they happen instead of waiting for the next scan. | Not included in Free | Included in Plus | Included in Pro |
| Web application firewall | Blocks malicious requests before WordPress ever runs them. | Not included in Free | Included in Plus | Included in Pro |
| IP allow / block + auto-blocking | Manual allow and block lists, plus automatic blocking of attacking addresses. | Not included in Free | Included in Plus | Included in Pro |
| Two-factor authentication | A second step at login so a stolen password is not enough. | Not included in Free | Included in Plus | Included in Pro |
| Security headers | Adds the HTTP headers that defend against clickjacking and content injection. | Not included in Free | Included in Plus | Included in Pro |
| Virtual patching | Shields a known plugin vulnerability at the firewall until the author ships a fix. | Not included in Free | Not included in Plus | Included in Pro |
| Shared threat feed | Addresses attacking one IronGuard site are blocked across the whole network. | Not included in Free | Not included in Plus | Included in Pro |
| Geo-blocking | Blocks traffic from countries you do not do business with. | Not included in Free | Not included in Plus | Included in Pro |
| Compromised password check | Warns when a user's password appears in a known breach. | Not included in Free | Not included in Plus | Included in Pro |
| Vulnerability alerts | Tells you when a plugin or theme you run has a newly disclosed CVE. | Not included in Free | Not included in Plus | Included in Pro |
| Auto-remediation | Cleans or repairs infected files automatically, with a restore point first. | Not included in Free | Not included in Plus | Included in Pro |
| Multi-site management | All your sites and their security status in one dashboard. | Not included in Free | Not included in Plus | Included in Pro |
| Scheduled reports | Emailed security summaries — useful for client reporting. | Not included in Free | Not included in Plus | Included in Pro |
| Definition updates | How quickly new malware signatures reach your site. | Weekly | Daily | Real-time |