Bacon's Method
Every SafeGuard check emits one of three outcomes:
- Admit innocents (green) — no problem found
- Warn the suspect (yellow) — unusual but not blocking
- Convict the guilty (red) — installation or activation is blocked
Per-plugin verdicts aggregate to the worst of any single check. One red beats many greens.
Check types
| Check | What it looks at |
|---|---|
| Integrity | File hashes vs shipped manifest |
| Malware signatures | Known attack patterns (eval-base64, RFI, shell uploads) |
| Plugin conflicts | Overlapping database tables, shortcodes, hooks |
| PHP compatibility | Required PHP version vs server's actual |
| Dependency validation | Required modules/extensions active? |
The pre-activation gate
Any time a user tries to install or activate a plugin through Wigmorean Connect, SafeGuard runs a synchronous preflight. Green passes the install through; yellow passes with a warning; red blocks with a specific reason.
SafeGuard also gates standard plugins.php activations via the activate_plugin hook — so if a user tries to bypass Connect, the gate still applies.
Scheduled sweeps
By default, SafeGuard runs a full scan every 24 hours. Configure in Wigmorean → SafeGuard → Settings:
- Frequency — hourly, daily (default), weekly
- Notification — email on any finding, on red only, or never
- Pattern refresh — how often to pull the latest malware signatures from Cloud
Hooks for module authors
// Add a custom check
add_filter( 'wigmorean_safeguard_checks', function( $checks ) {
$checks['my-check'] = [
'label' => 'My custom check',
'runner' => 'my_safeguard_runner',
];
return $checks;
} );
// Inject a custom verdict
add_filter( 'wigmorean_safeguard_verdict', function( $verdict, $slug ) {
if ( $slug === 'my-plugin' ) $verdict['verdict'] = 'yellow';
return $verdict;
}, 10, 2 );Suite vs Standalone
The Protector standalone overlaps SafeGuard on a few checks. Pick one — running both wastes cycles. Suite sites use SafeGuard; standalone WordPress installs use Protector.