About this plugin
Most security plugins tell you that something is wrong. ClarityGuard tells you what it means and what to do about it.
Free features:
- Outdated WordPress core / plugin detection
- Known-vulnerability lookup (optional, bring your own WPScan API token)
- File permission checks on key WordPress files/folders
- Publicly exposed file detection (debug logs, backup files,.env, etc.)
- Default “admin” username detection
- Weekly automated scan with an email summary
- Plain-English explanation and fix steps for every finding
- “Explain with AI” per finding and an AI-generated incident report, once you add your own API key (Anthropic, OpenAI, or Google Gemini’s free tier) under AI Settings (fully optional — everything else works with zero API keys)
Pro:
- One-click, reversible auto-remediation for safe fixes
- File-integrity checks: WordPress core and WordPress.org-hosted plugins are verified against official checksums, and other code is compared with your site’s own recorded baseline
- “Triage with AI” for file-integrity findings, plus “Accept as new baseline” for legitimate edits to custom code
Planned for Pro: multi-site agency dashboard and scheduled AI risk-posture summaries.
External services
This plugin can optionally connect to the following third-party services. The AI providers and WPScan are never contacted unless you explicitly enable the feature and provide your own API key/token. Every check in the free version runs locally on your site.
org checksum lookup used by the Pro file-integrity check, described last.
Anthropic (Claude) — used to generate the plain-English “Explain with AI” text and AI incident reports, if you choose Anthropic as your AI provider under AI Settings and supply your own API key. When you click “Explain with AI” or “Generate AI Incident Report,” the relevant finding text (issue title, description, and site name) is sent to Anthropic’s API to generate the explanation; no data is sent otherwise.
Anthropic Commercial Terms of Service | Anthropic Privacy Policy
OpenAI — used the same way as Anthropic above, if you choose OpenAI as your AI provider under AI Settings and supply your own API key. ”
OpenAI Terms of Use | OpenAI Privacy Policy
Google Gemini — used the same way as Anthropic and OpenAI above, if you choose Gemini as your AI provider under AI Settings and supply your own API key. ” Unless the site owner is located in the EU, UK, or EEA, Google may use free-tier API prompts to improve its models — see Google’s terms for current details.
Google APIs Terms of Service | Gemini API Additional Terms of Service | Google Privacy Policy
WPScan — used for the optional known-vulnerability lookup, if you add your own WPScan API token under Settings. When enabled, this plugin sends the slugs of your active plugins to the WPScan API to check them against the WPScan vulnerability database; no other site data is sent.
WPScan Terms of Service | WPScan Privacy Policy (WPScan is an Automattic property)
Pro only: AI triage of file-integrity findings — when you click “Triage with AI” on a file-integrity finding, the finding text and the first part of that file’s contents (up to about 4,000 characters) are sent to the AI provider you chose above, after a confirmation prompt. Nothing is sent unless you click it.
org) — Pro only. org-hosted plugins, so it can tell whether any file differs from the official release. The request includes your WordPress version and locale, and each plugin’s slug and version.
No file contents are sent.
org Privacy Policy