WordPress hardening: presets, audit log, modern UI. Free core rules; Pro adds scanning & CDN/DNS.

phantomguard

PhantomGuard helps you harden WordPress without editing code by hand. Pick a preset (Basic, Recommended, or Advanced), turn rules on or off, and review activity in the audit log—all from a modern admin interface.
What you get in the free version
<ul>
<li>Security presets — Start with Basic, Recommended, or Advanced and adjust as needed.</li>
<li>Core hardening rules — Force HTTPS for the admin area, hide the WordPress version, enable audit logging, and obscure login feedback to reduce information leaks.</li>
<li>Clear dashboard — Overview, onboarding, settings, and support in one place.</li>
<li>Plugin vulnerability check — Compares installed plugins against public advisories (WPVulnerability API) and links to WordPress updates when a fix is available.</li>
<li>Translations — Admin UI available in English, German, and Italian.</li>
</ul>
PhantomGuard Pro (optional license) adds malware scanning, extended hardening rules, DNS/CDN management, traffic analytics, and more. You can enter a license key in the plugin when you’re ready.
Legal
By using PhantomGuard you agree to our <a href="https://phantomguard.io/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://phantomguard.io/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Source code</h3>
The admin area is built with React and webpack. The files shipped in this plugin (<code>assets/js/*.js</code>, <code>assets/css/*.css</code>) are minified for performance.
Full source code (readable and forkable) is here: 
https://github.com/bitninjaio/PhantomGuardFree
Build from source (developers)
<ol>
<li>Clone the repository and <code>cd</code> into the plugin directory.</li>
<li>Run <code>npm install</code></li>
<li>Run <code>npm run build</code> for production assets, or <code>npm run build:dev</code> / <code>npm run dev</code> for development builds.</li>
</ol>
See README.md in the repository for more detail.
<h3>External services</h3>
PhantomGuard loads Google Fonts (Mulish) for the admin UI. Loading fonts may involve a request to Google; see their terms and privacy policy linked below.
PhantomGuard Pro may connect to additional services when you use a license (scanning, 2FA QR, license checks, CDN/DNS, etc.). Details:
<h4>WPVulnerability API (www.wpvulnerability.net)</h4>
<ul>
<li>What it does: Supplies vulnerability metadata used to flag plugins that may need updates on the dashboard.</li>
<li>Data sent: For each installed plugin, the plugin slug is requested in the URL path (no WordPress content or credentials).</li>
<li>When: When you open the PhantomGuard dashboard (or when the dashboard requests a refresh of this data).</li>
<li>Terms: See the service operator’s site for current terms.</li>
<li>Privacy: See the service operator’s site for their privacy policy.</li>
</ul>
<h4>Google Fonts (fonts.googleapis.com)</h4>
<ul>
<li>What it does: Loads the Mulish font for the plugin’s admin screens.</li>
<li>Data sent: No site content—only font requests (Google may log IP per their policy).</li>
<li>When: While using PhantomGuard in the WordPress admin.</li>
<li>Terms: https://developers.google.com/fonts/faq</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>BitNinja API (api.bitninja.io) — Pro only</h4>
<ul>
<li>What it does: Malware scanning, quarantine, license validation, and related Pro features.</li>
<li>Data sent: May include file hashes, file content for deep scans, license key, site domain, and server IP as needed for the feature you use.</li>
<li>When: While using Pro features that rely on the API.</li>
<li>Terms: https://bitninja.com/terms-and-conditions/</li>
<li>Privacy: https://bitninja.com/privacy-policy/</li>
</ul>
<h4>GoQR API (api.qrserver.com) — Pro only</h4>
<ul>
<li>What it does: Generates QR codes for two-factor authentication setup.</li>
<li>Data sent: OTP Auth URI in the request URL only (no separate account with GoQR required for basic use).</li>
<li>When: Enabling 2FA in Pro hardening options.</li>
<li>Terms: https://goqr.me/legal/tos-api.html</li>
<li>Privacy: https://goqr.me/privacy-safety-security/</li>
</ul>
<h4>IPify (api.ipify.org) — Pro only</h4>
<ul>
<li>What it does: Helps determine the server’s public IP for license validation.</li>
<li>Data sent: Minimal request; response is your public IP.</li>
<li>When: License validation in Pro.</li>
<li>Terms: https://geo.ipify.org/terms-of-service</li>
<li>Privacy: https://geo.ipify.org/privacy-policy/</li>
</ul>
<h4>WordPress.org (api.wordpress.org, downloads.wordpress.org) — Pro only</h4>
<ul>
<li>What it does: Core/plugin checksum checks during scanning workflows.</li>
<li>Data sent: WordPress version and plugin slug as needed for the check.</li>
<li>When: During relevant Pro scan steps.</li>
<li>Terms: https://wordpress.com/tos/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>Consent</h4>
The dashboard plugin check uses WPVulnerability as described above. Using a PhantomGuard Pro license and Pro features means those additional services may process data as described above. Core free hardening does not require a license.

Alternatives to PhantomGuard

Top alternatives