GuardPress System Requirements
The versions of WordPress and PHP that GuardPress needs to run, plus the versions you actually want if you care about the full feature set and modern hosting-provider support.
Minimum requirements
| Component | Minimum | Why |
|---|---|---|
| WordPress | 5.8 | Uses block-editor filter APIs and the modern REST auth surface introduced in 5.8. Older WP versions are also EOL from a security-patch standpoint. |
| PHP | 7.4 | Uses arrow functions and typed properties. 7.4 is the floor; 7.3 and earlier will not activate. |
| MySQL / MariaDB | MySQL 5.7 / MariaDB 10.3 | Any WordPress-compatible database engine works. UTF8MB4 charset required for the audit log and finding-hash columns. |
| HTTPS | Strongly recommended | Not a hard requirement, but security headers, secure-cookie enforcement, and Cloudflare Turnstile all assume the site is served over HTTPS. |
| License | Active | Required to unlock the Pro modules (Firewall, Malware Scanner, 2FA, File Monitor, Database Security, Spam Protection) and to receive plugin updates. |
Recommended versions
The minimums keep the plugin running, but the full feature set assumes modern versions of everything below:
- WordPress 6.4 or newer so the vulnerability scanner’s plugin-metadata lookups can rely on the recent WP.org API shape and the file integrity monitor can compare against the current core-checksum service.
- PHP 8.1 or newer so you’re inside the active PHP-core security-patch window. PHP 7.4 has been end-of-life since November 2022 and no longer receives security patches from the PHP team, even though GuardPress will still run on it.
- MySQL 8.0+ or MariaDB 10.5+ for the query-performance improvements the audit log and traffic log benefit from at high write volume.
- An outbound HTTPS connection to
my.royalplugins.comso license activation, plugin auto-update, and the CISA KEV vulnerability feed can reach the update server. Hosts with locked-down egress firewalls sometimes need to allow-list this domain.
Hosting tier notes
Shared hosting
GuardPress runs fine on shared hosting. Two caveats: (1) many shared hosts drop outbound wp_mail() silently, so email alerts don’t arrive unless you install an SMTP delivery plugin (Royal SMTP, WP Mail SMTP, FluentSMTP), and (2) if the host applies aggressive PHP memory or execution-time limits, the malware scanner may need to run in smaller chunks. The scanner adapts automatically but expect slower full-site scans on the lowest hosting tiers.
Managed WordPress hosting
Managed hosts (WP Engine, Kinsta, Cloudways, Pressable, Rocket.net, SiteGround Managed WordPress) are the smoothest experience. Modern PHP, working SMTP, adequate memory, and stable WP-Cron all come out of the box. The one thing to verify on every managed host is the Cloudflare / CDN real-IP resolver. See Country Blocking and the Cloudflare Real-IP Gotcha.
VPS / self-managed
VPS / self-managed hosting works well because you control every PHP setting, but you’re also responsible for keeping PHP patched and for making sure WP-Cron actually fires. Some sysadmins disable the default WP-Cron trigger without setting up a replacement; GuardPress needs at least one working cron path for the scheduled scans.
WordPress Multisite
Multisite is supported. Two activation modes work:
- Network-activate from Network Admin → Plugins to manage settings network-wide. Every subsite inherits the same protection posture.
- Activate per-subsite if different subsites need different security settings. Each subsite manages its own configuration independently.
The license covers multisite installs regardless of activation mode. The license binds to the network’s primary domain.
Once you’ve confirmed the stack is compatible:
- Installation, License Activation, and First-Run Settings: the actual install steps
- Quick Start: Your First 30 Minutes: the walkthrough that follows installation