Installation, License Activation, and First-Run Settings
This is the precondition for everything else in the GuardPress support hub. Upload the ZIP from your my.royalplugins.com account, activate your license, do one Cloudflare pre-flight check if you’re behind a CDN, and confirm what auto-enables at activation. Once you’re done here, Quick Start takes you from installed to fully protected in about 30 minutes.
Installing GuardPress
You install GuardPress manually from the ZIP file linked in your account:
Download the ZIP from your account
Sign in at my.royalplugins.com, open Downloads, and download the current GuardPress ZIP. The link stays available while your license is active, so you can re-download the latest version any time.
Upload the ZIP
Plugins → Add New → Upload Plugin button at the top → Choose File → select the ZIP → Install Now. When install finishes, click Activate.
Activate your license (next section)
All protection modules stay locked behind a “License required” notice until you paste your license key into the License page.
Enable auto-updates for GuardPress under Plugins → Installed Plugins → Enable auto-updates. Security plugins are one of the few categories where you actively want the latest version delivered automatically. Rule updates land, vulnerability data stays fresh, and bug fixes reach you without you having to check for them.
Activating your license
Open GuardPress → License in the WP admin sidebar. You’ll see a single input for your license key and an Activate button.
Get your license key
From my.royalplugins.com → Licenses. Each license shows the key, the sites it’s currently activated on, and how many activations remain on your plan.
Paste and click Activate
Activation is a one-time HTTP round-trip to the license server. If it succeeds, you’ll see a green “License active” badge and every protection module unlocks immediately (no page reload needed; the settings page just now shows the full set of toggles).
Understand what the license binds to
The license activation binds to the current site URL (protocol + host, without the path). Moving the site to a new URL, changing between HTTP and HTTPS, or migrating to a new host all invalidate the binding and require re-activation. If you’re doing a staging → production promotion, expect to re-activate once you’re on the production URL.
If your host has trouble reaching the license server (rare, but happens on locked-down infrastructure), you’ll see a specific error naming the failure. Common causes: outbound HTTPS blocked at the firewall, a proxy that drops User-Agent: WordPress/*, or a cURL install too old to negotiate TLS 1.2+. See Licensing troubleshooting if activation keeps failing.
What auto-enables at activation
Seven modules turn on automatically at the moment you activate GuardPress. You don’t need to configure any of them for baseline protection. Here’s the full list:
| Module | What it does | Default |
|---|---|---|
| Firewall | Blocks SQL injection, XSS, path traversal, file inclusion, malicious-bot signatures with a 403 before WordPress loads. | ON |
| Brute-Force Protection | Locks out IPs that fail 5+ login attempts in 15 minutes. | ON |
| Malware Scanner | Daily background PHP-file scan against signature list + behavior heuristics. | ON |
| File Integrity Monitor | Watches WordPress core files for unauthorized changes. | ON |
| XMLRPC Protection | Blocks the XML-RPC brute-force amplification attack vector. | ON |
| WP Version Hiding | Strips the WP version from HTML source so attackers can’t filter targets by known-vulnerable version. | ON |
| File Editing Lockdown | Sets DISALLOW_FILE_EDIT, disabling the built-in theme/plugin file editor in wp-admin. | ON |
These stay off until you set them up:
| Module | Why it’s off | Default |
|---|---|---|
| Two-Factor Authentication | Requires your phone and stored backup codes so you don’t lock yourself out. | Off |
| Email Alerts | Needs an email address and a working SMTP path to be useful. | Off |
| Uptime Monitoring | Optional; enable once your alerts are working so downtime pings go somewhere. | Off |
| Security Headers | Optional; some headers (CSP especially) need per-site tuning so they’re not one-size-fits-all safe defaults. | Off |
| Spam Protection | Optional; useful mainly if you have comment forms or user registration open to the public. | Off |
The next stop is Quick Start, which walks through enabling 2FA, wiring email alerts, and doing the first-week review pass.
Pre-flight checks before Quick Start
Two things to verify before you start flipping settings, because they affect how every other feature behaves.
1. Cloudflare / CDN real-IP resolver
If your site sits behind Cloudflare, BunnyCDN, Sucuri, KeyCDN, or another edge proxy, every incoming request looks like it comes from the CDN’s IPs unless you configure the real-IP resolver. Without that, your brute-force lockouts count Cloudflare as the offender, your geographic rules never match a real country, and your IP whitelist can’t match a real user.
GuardPress detects a Cloudflare-fronted install on activation and shows a warning. Follow Country Blocking and the Cloudflare Real-IP Gotcha to enable the resolver. This is a five-minute change and it’s the highest-leverage thing you can do before starting Quick Start.
2. An SMTP delivery plugin (for email alerts)
Most shared hosts drop wp_mail() calls silently. If you plan to enable email alerts in Quick Start step 4 (you should), install and configure an SMTP delivery plugin now. Options: Royal SMTP, WP Mail SMTP, FluentSMTP, or Post SMTP. Pair it with a real sending provider (SendGrid, Postmark, Amazon SES, Mailgun, Resend) so the alerts actually reach your inbox.
Common installation errors
“Destination folder already exists” when uploading the ZIP
Means an old copy of the plugin is still on disk from a previous install or a failed update. Deactivate and delete GuardPress under Plugins → Installed Plugins first, then upload the new ZIP. If the plugin isn’t showing up in the list but the folder still exists, use SFTP to remove wp-content/plugins/guardpress/ (or guardpress-pro/) and re-upload.
ZIP upload times out or fails partway through
Your host’s PHP upload limit is smaller than the plugin ZIP. Two fixes: bump upload_max_filesize and post_max_size in php.ini (or ask your host to), or SFTP the extracted plugin folder directly into wp-content/plugins/ and activate from there.
“This plugin does not have a valid header”
Usually means the ZIP got double-zipped by macOS or Safari on download. Extract the outer ZIP, and inside you’ll find the actual plugin ZIP to upload. Alternatively, re-download the ZIP with the right-click “Save Link As” menu instead of a normal click.
License activation returns “URL mismatch”
You’re trying to activate on a URL that doesn’t match what’s registered. Common cause: your WordPress URL includes www. but the license was originally activated on the non-www version (or vice-versa). Open the license in your my.royalplugins.com account, revoke the old binding, then re-activate on the current URL.
License activation returns “too many activations”
Your plan allows a fixed number of active sites (see the pricing page for the current per-plan site limits). If you’ve hit the limit, either revoke an old binding you no longer need from the my.royalplugins.com dashboard, or upgrade your plan.
WordPress Multisite installs
GuardPress works with WordPress Multisite in two modes:
Network activation (recommended for most)
Activate GuardPress at the Network Admin → Plugins level. Every subsite inherits the network-wide settings. This is the right choice for a network of client sites that should all have identical security posture.
Per-subsite activation
Leave GuardPress deactivated at the network level and activate it on individual subsites. Each subsite manages its own config independently. Right choice for networks where different subsites have different security needs (a public-facing marketing site plus an internal-only staging subsite, for example).
Your license covers multisite installs; the license binds to the network’s primary domain regardless of activation mode.
Once the plugin is installed, the license is activated (if Pro), and the Cloudflare real-IP resolver is set up (if applicable), you’re ready for:
- Quick Start: Your First 30 Minutes With GuardPress: the 5-step walkthrough to enable 2FA, wire email alerts, run the first manual malware scan, and review the IP Management page
- Country Blocking and the Cloudflare Real-IP Gotcha: the pre-flight check named above, plus the geo-rule setup
- Setting Up Two-Factor Authentication: the safe way to enable 2FA without locking yourself out
- Understanding the Security Dashboard and Security Score: what the dashboard is showing after activation and how the score is calculated
- Licensing troubleshooting: what to do if activation fails, sites won’t bind, or you need to move a license between hosts