Uninstall

Deactivating Qartvelo Guard never deletes data: it stops the scheduled scans and switches the early guard off, and everything comes back when you activate it again. Deleting the plugin removes its data only if you asked for that.

Keep or delete the data

The choice is under Settings > Advanced > Data > On uninstall: "Delete all plugin data when the plugin is deleted". It is off by default.

What is always removed

The backups of wp-config.php the plugin made before editing it, because they contain your database password.

What "Delete all data" also removes

• The plugin's database tables (items, file fingerprints, allowlist, activity log), its options, transients and scheduled events, on every site of a network.
• The plugin's user preferences (dismissed notices, diff layout).
• The data folder with the quarantine, stored copies, scan state and guard configuration: wp-content/uploads/qartvelo-guard/ in a folder with a random name (older installs are moved there automatically, from wp-content/wpcybersec or from wp-content/uploads/qartvelo-guard/ itself as version 1.1.0 used it), a folder moved with the one-click button, or the fallback folder in uploads. Moved and fallback folders are removed only when they carry this site's marker.
• The guard lines it wrote: the Qartvelo Guard Guard block in .user.ini and in .htaccess of the WordPress folder (and of the front controller folder, if different). A file that becomes empty is deleted.
• The Qartvelo Guard block in wp-content/uploads/.htaccess.
• The lines it added to wp-config.php and marked as its own: WPCYBERSEC_HMAC_KEY and DISABLE_WP_CRON. Only when wp-config.php parses without errors.
• Backups of an earlier clean core reinstall.
• wpcybersec-guard.php, but only when nothing points auto_prepend_file at it any more.

What stays

• A data folder you set yourself with WPCYBERSEC_DATA_DIR. Delete it by hand.
• wpcybersec-guard.php while auto_prepend_file still points to it, and always when you uninstall with WP-CLI. Without the plugin it does nothing; remove the auto_prepend_file line first, then the file. See Remove it safely.
• Settings you added by hand or in a panel: auto_prepend_file lines, PHP-FPM or nginx rules, cron jobs. Remove the cron jobs too, or they print an error every time they run.
• Changes made in place that were not added lines: the wp-config.php permissions (640) and a DISALLOW_FILE_EDIT switched from false to true.

Remove the cron jobs

If you added the real cron lines, open your panel's cron page (or crontab -e) and delete the lines with qartvelo-guard/bin/cron.php or wp wpcybersec. If you switched off WP-Cron by hand, keep the wp-cron.php line or remove DISABLE_WP_CRON from wp-config.php, so WordPress's own scheduled tasks keep running.