Qartvelo Company
Qartvelo Guard Docs Start here
Protection levels
Strict, Balanced and Relaxed, what each one holds, and how to fine-tune uploads, installs and file checks.
A protection level is a preset for the settings under Settings > General. Pick one in the setup wizard or on the Settings page, then change single settings if you need to. When your settings no longer match any preset, the level shows as Custom.
The three levels
| Setting | Strict | Balanced | Relaxed |
|---|---|---|---|
| New uploads | Hold every upload | Hold every upload | Hold risky uploads |
| Administrators' clean uploads | Held | Held | Pass |
| Files WordPress downloads from other sites | Held | Held | Not held |
| New plugin and theme installs | Held | Held | Not held |
| New unknown code files | Moved to quarantine | Reported | Reported |
| Critical malware found by a scan | Moved to quarantine | Reported | Reported |
| Scheduled scans | Every hour | Twice a day | Once a day |
| Alerts | Instantly | Instantly | Daily digest |
Balanced is the default and suits most sites. Strict suits sites that rarely change. Relaxed suits busy sites where administrators upload a lot and you only want to review what could be dangerous.
In every level, updates of plugins and themes you already have are not held: they are checked against their official checksums and trusted right away.
Hold every upload, or only risky ones
Under Settings > General > Uploads, "When a file is uploaded" has four choices:
- Hold every upload: every file you have not approved before waits on the Reports page. Safest; best for sites with few uploads.
- Hold risky uploads: ordinary images and documents pass after the malware scan. Held are scripts, archives, SVG and HTML files, files whose content does not match their extension, file types WordPress does not know, and anything that looks malicious.
- Scan only: everything passes except files the scanner rates high or critical.
- Off: uploads are not checked.
The risky file types are: svg, svgz, html, htm, xhtml, shtml, xml, xsl, xslt, js, mjs, swf, hta, zip, rar, 7z, tar, gz, tgz, bz2, xz, jar, war, phar, exe, dll, msi, bat, cmd, com, scr, ps1, vbs, sh, bash, py, pl, rb, cgi, jsp, asp, aspx, htaccess, ini and config. A double extension such as photo.php.jpg counts too.
Fine-tuning
Uploads
- Clean uploads pass for: roles whose uploads pass when the scan finds nothing at all. In the wizard this is the switch "Hold administrators' own uploads too".
- Files downloaded by WordPress: also hold files that WordPress or a plugin downloads from other sites (sideloads).
Plugin and theme installs
- Hold new plugin and theme installs until approved. On by default. After you allow one, install it again and it goes through.
- Also hold updates of installed plugins and themes. Off by default.
WordPress core updates and translations are never held.
File monitor
- New unknown code files: move to quarantine, report only, or off.
- Changed code files: report, or move to quarantine.
- Critical malware: move files with critical malware to quarantine automatically. WordPress core files are not moved this way; use the clean core reinstall for them.
Freeze mode
Under Settings > Advanced > Freeze lock, "Freeze plugins, themes and core" blocks every install, update, delete and code editor action in the dashboard. When you need to make a change, press Unlock for 15 minutes (1 to 240 minutes) and Lock now when you are done. While unlocked, new installs go through without being held.