Bacon's Method
SafeGuard borrows its verdict model from a Baconian approach to evidence: every check produces one of three outcomes, and they aggregate to a final verdict per plugin:
- Admit innocents (green) — the check found no problem
- Warn the suspect (yellow) — the check found something unusual but not blocking
- Convict the guilty (red) — the check found a clear problem and installation / activation is blocked
The aggregate verdict is the worst of any single check — one red beats many greens.
Integrity checks
For every installed plugin, SafeGuard compares file hashes against what the plugin shipped with:
- Wigmorean plugins — hashes come from the Wigmorean Cloud catalog
- WordPress core — hashes come from
api.wordpress.org - Third-party plugins — hashes come from the WP.org API when available
Any file modified after install lights up yellow. Extra files (not in the manifest) light up yellow. Missing files light up red.
Malware patterns
SafeGuard scans PHP files for known attack signatures:
- Obfuscated payloads (long base64 →
eval) - Remote includes from user input
- Shell upload artifacts (WSO, r57, c99)
- Hidden admin user creation
- SEO spam injections in post content
Matches are red-flagged with the offending line number and a human-readable explanation.
Scheduled scans
By default, SafeGuard runs a full scan every 24 hours via WP-Cron. Configure in SafeGuard → Settings:
- Scan frequency — hourly, daily (default), weekly
- Email notifications — on any finding, only on red, or never
- Pattern updates — how often to refresh the malware signature list from Cloud (default: weekly)
The preflight before install
When Connect installs a new plugin, SafeGuard runs a synchronous preflight first:
- Connect posts the candidate plugin's slug + installed slugs to
/wp-json/wigmorean-cloud/v1/safeguard-check - The server checks for known conflicts between that plugin and anything already on your site
- The verdict comes back green, yellow, or red
- Green → install proceeds. Yellow → install proceeds with a warning. Red → install is blocked with an explanation.