This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Security Guard
Find ClickFix and EtherHiding malware on WordPress sites
A WordPress plugin that scans your own site for injected-script malware: fake ClickFix verification boxes, EtherHiding blockchain loaders, web shells, PHP hidden in uploads, new administrators and changed core files. The scan is read-only and sends no site files anywhere. A filter strips known loader scripts from your pages, and a Content-Security-Policy starts in report-only mode until its log is clean.
I'm Mugees from PluginSprout, the plugin side of DistroCode, a WordPress agency in Sterling Heights, Michigan. We wrote Security Guard after an injected-script infection hit a production WordPress site.
That kind of malware hides well. It rarely sits in a file you can spot by name. It is a few lines of script in a post, an option or a must-use plugin, and it often shows its payload only to visitors. One version puts up a fake "Verify you are human" box that asks the visitor to paste a command into the Windows Run dialog (ClickFix). Another reads its next stage from a public blockchain, so there is no bad domain to block (EtherHiding).
What Security Guard does:
• A read-only scan of plugin, theme and must-use code, the uploads folder, the database, administrator accounts and core files. It never deletes or edits a file it flags.
• A baseline you save while the site is clean. Later scans flag any added or changed code file and any new administrator, even when nothing matches a known pattern.
• A filter that takes known loader scripts out of your pages and logs each removal.
• Six hardening switches, all on by default, and an event log of the newest 200 events.
The scan works in short steps, one request at a time, so slow hosting doesn't hit a time limit. It also runs once a day. Nothing is uploaded.
A licence is $49 a year for one site, $89 for five and $149 for unlimited sites. Every plan has every feature, and there's a 14-day money-back guarantee.
If your visitors have reported a fake Cloudflare check on your site, I'd like to hear what you found.
No comment highlights available yet. Please check back later!
About Security Guard on Product Hunt
“Find ClickFix and EtherHiding malware on WordPress sites”
Security Guard was submitted on Product Hunt and earned 0 upvotes and 1 comments, placing #195 on the daily leaderboard. A WordPress plugin that scans your own site for injected-script malware: fake ClickFix verification boxes, EtherHiding blockchain loaders, web shells, PHP hidden in uploads, new administrators and changed core files. The scan is read-only and sends no site files anywhere. A filter strips known loader scripts from your pages, and a Content-Security-Policy starts in report-only mode until its log is clean.
Security Guard was featured in WordPress (21.6k followers), Developer Tools (522.9k followers) and Security (3k followers) on Product Hunt. Together, these topics include over 102.3k products, making this a competitive space to launch in.
Who hunted Security Guard?
Security Guard was hunted by Mugees Ahmed. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how Security Guard stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Mugees Ahmed
I'm Mugees from PluginSprout, the plugin side of DistroCode, a WordPress agency in Sterling Heights, Michigan. We wrote Security Guard after an injected-script infection hit a production WordPress site.
That kind of malware hides well. It rarely sits in a file you can spot by name. It is a few lines of script in a post, an option or a must-use plugin, and it often shows its payload only to visitors. One version puts up a fake "Verify you are human" box that asks the visitor to paste a command into the Windows Run dialog (ClickFix). Another reads its next stage from a public blockchain, so there is no bad domain to block (EtherHiding).
What Security Guard does:
• A read-only scan of plugin, theme and must-use code, the uploads folder, the database, administrator accounts and core files. It never deletes or edits a file it flags.
• A baseline you save while the site is clean. Later scans flag any added or changed code file and any new administrator, even when nothing matches a known pattern.
• A filter that takes known loader scripts out of your pages and logs each removal.
• Six hardening switches, all on by default, and an event log of the newest 200 events.
The scan works in short steps, one request at a time, so slow hosting doesn't hit a time limit. It also runs once a day. Nothing is uploaded.
A licence is $49 a year for one site, $89 for five and $149 for unlimited sites. Every plan has every feature, and there's a 14-day money-back guarantee.
If your visitors have reported a fake Cloudflare check on your site, I'd like to hear what you found.