What is on by default when I activate GuardPress?

Five things turn on automatically at activation: the Firewall, Brute-Force Protection, the Malware Scanner, File Integrity Monitor, XMLRPC protection, WP version hiding, and file-editing lockdown. Two-Factor Authentication and Email Alerts are off by default because they need your input (a phone for 2FA, an email address and working SMTP for alerts). Uptime monitoring and custom security headers are also off by default and can be enabled after the first-week review.

How long does GuardPress take to fully set up?

About 30 minutes end to end. The 2FA setup is the longest step (5-10 minutes to scan the QR code, download codes, and test signing back in). Email alerts take 5 minutes to enable plus however long it takes to install an SMTP delivery plugin if your host doesn't run its own. Everything else is either already on or a one-click confirm.

Do I need to run the Malware Scanner manually or does it run on its own?

It runs daily on its own via WP-Cron. Running it manually the first time is worth it so you know what a clean baseline looks like on your site, and so any pre-existing findings surface immediately instead of waiting for the next scheduled run.

Why is 2FA off by default? Shouldn't it be on?

Because turning it on before the admin has a working authenticator app and backup codes stored somewhere safe is a fast way to lock yourself out of your own site. It's the one setting where the default has to be off and the user has to explicitly opt in with their phone in hand. This article walks through the safe way to enable it.

What if I don't get any email alerts after enabling them?

Two likely causes. Either the throttle window is collapsing multiple alerts into one (working as designed — see the Alert-Throttling guide), or your host isn't sending outbound mail from PHP at all (very common on shared hosts). Install Royal SMTP, WP Mail SMTP, or FluentSMTP with a real sending provider (SendGrid, Postmark, SES, Mailgun) and re-test. The Send Test Email button on GuardPress → Settings → Email Alerts fires a test alert on demand.

Quick Start: Your First 30 Minutes With GuardPress

GuardPress ships with sensible defaults, so a fresh install is already blocking most opportunistic attackers before you touch a single setting. Two modules still need your input to do their job, and one review pass at the end catches anything unusual on your site. This is the exact order, the “why” behind each step, and what a healthy configuration looks like when you’re done.

What’s already on the moment you activate

Before you change anything, five modules turn on automatically at activation. You do not need to configure any of them for basic protection to be live:

Module	What it does	State
Firewall	Inspects every request for SQL injection, XSS, path traversal, file inclusion, malicious-bot signatures. Blocks matches with a 403 before WordPress loads the page.	ON
Brute-Force Protection	Locks out IPs that hammer the login form. Default: 5 failed attempts triggers a 15-minute lockout.	ON
Malware Scanner	Daily background scan of every PHP file against a signature list plus behavior heuristics. Alerts on new suspicious files.	ON
File Integrity Monitor	Watches WordPress core files and reports changes. If someone modifies `wp-login.php` or drops a new file into `wp-includes/`, you find out.	ON
XMLRPC Protection + WP version hiding + file-editing lockdown	Small hardening toggles: blocks the XML-RPC brute-force amplifier, strips the WP version from HTML source (so attackers can’t filter for vulnerable installs by version), and disables the built-in theme/plugin file editor in wp-admin.	ON

The two that don’t turn on automatically both need your input to be useful:

Module	Why it’s off by default	State
Two-Factor Authentication	Turning 2FA on before you have a working authenticator app and stored backup codes is a fast way to lock yourself out of your own site. You have to opt in with your phone in hand.	Setup needed
Email Alerts	GuardPress needs to know which address to email, and your host needs to actually send outbound mail from PHP. Both are things you have to confirm.	Setup needed

Track your progress in the plugin

GuardPress ships a live Quick Start tab inside the admin (GuardPress → Help → Quick Start) with a progress bar counting how many of the 5 core modules are active. Every step below has a matching step in the plugin so you can flip between this article and the live status on your site.

The 5-step walkthrough

Steps 1, 3, and 5 are confirmations (already on, just verify). Steps 2 and 4 are the real setup work.

Confirm the Firewall is running

Open GuardPress → Firewall. The Firewall status should show as enabled. If it is, move on. If it isn’t, enable it from GuardPress → Settings and return to the Firewall page to confirm the ruleset is loaded.

The Firewall page itself is where you review recently blocked requests and tune rules. For the initial setup, the default ruleset is well-calibrated for most sites, so you can leave it as-is and come back to review activity after a day or two of traffic.

Healthy result: Firewall status enabled, ruleset loaded, no rule errors reported.

Set up Two-Factor Authentication

This is the step to slow down on. Do it in this order:

Install a TOTP app on your phone first. Any of these work: Authy, Google Authenticator, 1Password, Bitwarden, Microsoft Authenticator.
Then open GuardPress → Settings → Two-Factor Authentication and enable it.
Scan the QR code with your authenticator app. It adds a “Your Site Name” entry with a rotating 6-digit code.
Save the backup codes. GuardPress shows you a list of one-time backup codes when you enable 2FA. Print them, save them in your password manager, or write them on paper and store them somewhere that isn’t your laptop. If your phone ever gets lost or wiped, these codes are how you get back in.
Sign out, then sign back in and confirm the 2FA prompt works with a code from your app.

For teams: 2FA can be enforced per-role, so you can require it for administrators without forcing every subscriber to configure it. See Per-Role 2FA Enforcement Setup for the multi-user pattern.

Healthy result: you can sign out and sign back in with a TOTP code, and you have backup codes stored somewhere off your primary device.

Run your first Malware Scan

The scanner runs daily on its own, but the first manual run does two useful things. It establishes a baseline (you know your site is clean now, so any future findings are actually new), and it surfaces anything pre-existing that would otherwise wait for the next scheduled run.

Open GuardPress → Malware Scanner and click Run Malware Scan Now. On most sites this finishes in 1–3 minutes.

Expected clean result: zero critical findings, and the scanner’s own PHP files may show up as informational (that’s the scanner detecting itself, which is documented behaviour and can be ignored). If something legitimate does surface (an obfuscated file in a theme you trust, a suspicious pattern in a plugin you know is fine), whitelist it from the results page so it doesn’t alert on every future scan.

Healthy result: scan completes with no critical findings, or every non-critical finding has been reviewed and either whitelisted or removed.

Wire email alerts to your inbox

Open GuardPress → Settings → Email Alerts. Enable the toggle, confirm the email address is correct, and save.

What alerts fire: confirmed attack blocked, IP auto-banned, malware detected, file-integrity change, a plugin gets closed on WordPress.org for a security issue. The throttle window (default 1 hour per attacker IP) collapses attack bursts into a single summary email so your inbox stays usable during a scan wave.

Most hosts don’t send outbound mail from PHP by default

Shared hosts routinely drop wp_mail() calls silently. If you don’t already have an SMTP delivery plugin configured, install one and point it at a real sending provider (SendGrid, Postmark, Amazon SES, Mailgun, Resend). Royal SMTP, WP Mail SMTP, or FluentSMTP all work. GuardPress detects known SMTP plugins and shows a warning on the Email Alerts page if none is active.

Fire a test alert with the Send Test Email button on the Email Alerts settings screen to confirm the whole chain works. If the test email arrives but real alerts don’t, the throttle is likely doing its job. See Quieting the Alert Email Flood for how the throttle windows work.

Healthy result: the test email arrives in your inbox within a minute.

Review the IP Management page and tune

Give the site a day or two of traffic, then open GuardPress → IP Management. You’ll typically see a handful of auto-lockouts already accumulated (opportunistic scanners hitting /wp-login.php).

Three things to do here:

Whitelist your own IPs. Click “Whitelist My IP” if you’re on a stable connection (office, home). Add your CI/CD or deploy hooks’ source IPs, your uptime monitor (UptimeRobot, Better Uptime, etc.), and any payment-gateway callback ranges you use.
Review any legitimate lockouts. If a real user or service tripped brute-force, unblock them and consider whether they need to be whitelisted.
Confirm nothing important got caught. Cross-check against your app’s error log or customer-support tickets. If a paying customer complained they couldn’t log in, their IP is likely on the temporary blocklist.

See IP Blocking, Whitelisting, and Managing Locked-Out IPs for the full workflow, CIDR syntax, and the three-list model (Whitelist, Blacklist, Active Lockouts).

Healthy result: your own IPs are on the Whitelist, no legitimate users are stuck on the Active Lockouts list, and you’ve read what the auto-lockouts are catching.

What a healthy configuration looks like when you’re done

Firewall ON with the default ruleset loaded
Brute-Force Protection ON (default: 5 attempts, 15-minute lockout)
Two-Factor Authentication ON for at least your admin account, with backup codes stored off-device
Malware Scanner ON, first manual scan complete, zero critical findings
File Integrity Monitor ON, baseline established
Email Alerts ON, test alert received, SMTP delivery plugin active
Your office/home IP on the manual Whitelist, no false positives on the Active Lockouts list

The GuardPress dashboard shows a security score that reflects the state of all of these together. See Understanding the Security Dashboard and Security Score for what each widget shows and how the score is calculated.

Common first-week questions

I enabled everything and my dashboard score isn’t 100. Why?

The score also reflects factors outside the Quick Start’s five modules: your WordPress version, PHP version, outdated plugins with known CVEs, SSL certificate state, and a handful of hardening options that are off by default (custom security headers, uptime monitoring, disable-XML-RPC-completely). Full breakdown in Understanding the Security Dashboard. The Quick Start puts you at “protected”, not necessarily at “100.”

My real users are getting locked out. What do I do?

Almost always one of two things. Either the CAPTCHA / Cloudflare Turnstile widget isn’t rendering on the login form they’re using (WooCommerce my-account, MemberPress, a page-builder login widget), or their IP tripped brute-force because they use a corporate NAT that a colleague also uses. See CAPTCHA Blocks WooCommerce/MemberPress Login for the first case and whitelist the shared IP for the second.

I run behind Cloudflare. Anything I need to do differently?

Yes, one important thing. Without configuring the Cloudflare real-IP resolver, every request looks like it’s coming from Cloudflare’s IPs, so brute-force lockouts trigger against Cloudflare and geographic rules never work. See Country Blocking and the Cloudflare Real-IP Gotcha for the setup. This is a pre-flight check before doing anything IP-based.

I’m getting too many alert emails. How do I quiet them?

The throttle window collapses bursts, but if you’re seeing a genuinely large number of unique alerts, you’re probably in an active scan wave. See Quieting the Alert Email Flood for the throttle window controls and the per-category alert toggles.

I use Claude or ChatGPT or n8n to manage my site. Their traffic keeps getting blocked. What do I do?

AI-agent traffic is high-frequency and predictable, so it tends to trip brute-force rate limits fast. Whitelist their known IP ranges (or use Application Passwords with a dedicated user for the agent). See MCP / OAuth Clients Getting Locked Out for the pattern.