WordPress plugins
Every plugin here came out of manual security work: a check worth running on every site, a question a client could not answer, or an alert nobody was reading. All three are published on WordPress.org under the GPL, cost nothing, have no premium tier, and require no account. They are written and maintained by G. Schad, the specialist behind WP Server Guard.
The plugins
They answer three different questions: how is this site configured, what changed on it, and who is going to read the alert.
WordPress.org · Posture audit
Scores a site 0–100 on core file integrity, public exposure, security headers, update and administrator posture, salts, and hosting signals — weighted by exploitability, not by the number of checks. Runs on demand, sends nothing anywhere, and ships WP-CLI commands for agencies and CI pipelines.
Read the Lockora Security Audit pageWordPress.org · Activity log
A searchable, tamper-evident audit trail with field-level diffs for posts, options, users, plugins, and settings, classifying each event as normal, unusual, or dangerous. It is the record you need when something changed and nobody remembers doing it.
View Who Changed It? on WordPress.orgWordPress.org · Alert routing
Forwards completed Wordfence scan findings from every site to one WPSecureOps dashboard instead of one email per site per scan, so an agency can triage a fleet from a single place rather than from an inbox nobody reads.
View WPSecureOps Connector on WordPress.orgUsing them together
Lockora tells you how the site stands right now. Who Changed It? tells you what changed to put it there — which administrator edited which option, when, and what the previous value was. The connector makes sure the Wordfence result from either discovery actually reaches somebody. Run one, two, or all three; none of them depends on the others.
A common sequence on a site somebody else built: run Lockora to get the posture score and the list of failing checks, use the activity log to find when the risky setting was introduced and by whom, then fix the setting and re-run the score to confirm it moved.
Common questions
No. All three are GPL, published on WordPress.org, and complete as published. There is no paid tier, no licence key, and no account. The manual services on this site are a separate thing you can hire, not an unlock.
No. Lockora scans locally and only calls WordPress.org for core checksums and PHP support data, plus an AI provider you configure yourself if you enable the optional report wording. Who Changed It? writes only to your own database. WPSecureOps Connector sends Wordfence scan results to the dashboard you point it at, which is the whole purpose of installing it.
No. None of them is a firewall or a malware scanner. Lockora audits configuration and exposure, Who Changed It? records changes, and the connector routes the alerts your scanner already produces. Run them alongside whatever protection you use.
No. They can show you evidence that a site is compromised — a modified core file, PHP where none belongs, an administrator you did not create — but a finding is not a cleanup. If any of them surfaces signs of compromise, treat the site as an incident and follow the malware-removal guidance on this site.
Yes, and that is what the WP-CLI commands and the connector exist for. wp lockora scan and wp lockora report --format=json run across a fleet from one shell session or a pipeline, and the connector collapses per-site Wordfence email into a single dashboard.