Changelog

Every version, its ZIP file and its SHA-256 checksum are on the releases page. The source code is public on GitHub.

1.1.4

• Strict level: a new version of Qartvelo Guard installed from a ZIP is held as a normal update waiting for approval, no longer as "code that looks unsafe" because of the plugin's own malware signature file.

1.1.3

• Sites that installed version 1.1.0 are moved into the random data folder automatically the next time an administrator opens the plugin; until now they kept wp-content/uploads/qartvelo-guard/ itself.
• The database scan also covers the network-wide snippets table of Code Snippets on multisite.
• Right-to-left languages: the admin pages are mirrored properly.
• The wp-config.php permission advice looks at who owns the file: 600 when PHP is the owner, 640 when it reads the file through its group, and a chgrp step first when it is neither.
• Dashboard: the last scan line separates the scan result from the number of threats still open.

1.1.2

• Reinstalling an installed plugin or theme from a ZIP, including a new version of Qartvelo Guard itself, counts as an update and is no longer held as a new install.
• The scanner recognises callback web shells and request input read through $GLOBALS, and no longer skips code that follows a string containing /*.
• Files in a folder that was unreadable during one scan are no longer reported as new on the next scan.
• Scan alerts repeat only for new threats.
• Clearer Reports actions: Deny asks before deleting a held copy, trusting a new administrator asks first, critical files explain when no official copy exists.
• Accessibility: labelled radio groups, visible keyboard focus on protection cards, column labels in the narrow layout, reduced motion and high contrast support.
• Many smaller fixes to WP-CLI, the dashboard, the setup wizard and the server checks.

1.1.1

• The data folder inside uploads gets a random name (wp-content/uploads/qartvelo-guard/ followed by 32 random characters), so its files have no guessable address on nginx, which ignores .htaccess and web.config.
• No hard-coded uploads path: when WordPress cannot report the uploads folder, the plugin says so instead of guessing.

1.1.0

• CyberGate Security is now called Qartvelo Guard. Settings, held files and approvals are kept.
• The plugin's data folder moved to wp-content/uploads/qartvelo-guard (older installs are moved automatically).
• Fixes from the WordPress.org review.

1.0.3

• The "On the server now" rows on the Antivirus engines page always use the newest ClamAV self-test. "Check again" now tests before the page reads the state, so the clamd row no longer shows an old "Not running".
• A failed ClamAV self-test (for example while clamd restarts or the server is short of memory) is tested again within 15 minutes instead of being kept for 6 hours. Real cron (bin/cron.php) retests it when needed.

1.0.2

• "Code folders other users can write to" also looks one level inside the WordPress folder and wp-content: another WordPress install in a subfolder, translation files (PHP since WordPress 6.5), upgrade, uploads and backup folders. The one-click fix covers them too.

1.0.1

Fixes from a real CyberPanel and OpenLiteSpeed server, and better support for several sites on one server.

• The maldet real-time monitor no longer shows "Not running" on servers that hide other users' processes from PHP (/proc mounted with hidepid). It is detected from maldet's own log, or shown as unknown with the reason and the root command that checks it. See Troubleshooting.
• A site inside a folder the maldet monitor already watches counts as watched. A site that is not watched gets the cgav add-site command.
• ClamAV and maldet are installed once per server, and the cgav script handles several sites. See Several sites on one server.
• New check "Code folders other users can write to", with a one-click fix for the files PHP owns and safe commands for the rest.
• WP-CLI commands the plugin shows (real cron lines, core reinstall checks) use the site's own PHP when the server's default php is another version. See WP-CLI on CyberPanel.
• OpenLiteSpeed and CyberPanel: after the guard is written to .user.ini, the plugin says exactly how to restart lsphp and what to do if it still is not loaded. See Early upload guard.
• A prepend file of another site comes with the command that finds where it is set, and what removing it means for the other site.
• Real cron run with WP-CLI (wp wpcybersec scan or wp cron event run from a crontab) counts as real cron.
• The Allowlist filter "File fingerprints" also lists files approved under executable names.
• GridPane and SpinupWP cron steps list only the two scan jobs they ask for.
• The help text of the guard's "Not checked by the guard" list describes exactly how lines are matched.
• fapolicyd files, the inotify watcher and the HestiaCP template are named per site, so sites on one server do not overwrite each other's.

1.0.0

First release.

• Whole-site malware scan with official WordPress.org checksums for core and plugins.
• Every new upload, plugin and theme install and unknown file held until an administrator approves it, remembered by SHA-256.
• The "what changed" view, Recent changes and the downloadable security report.
• Database scan for injected scripts and the administrator account watch.
• Setup wizard with one-click fixes, protection levels and alerts by email or webhook.
• For system administrators: the early upload guard, real cron, ClamAV and maldet, the cgav server script, freeze mode, clean core reinstall and WP-CLI commands.
• Multisite network mode.

Requires WordPress 6.0 or newer and PHP 7.4 or newer. Tested up to WordPress 7.1.