This guide covers i Guardian 0.4.0 for WordPress. It checks native content exports before WordPress delivers the download.
Free trial and subscription
The initial trial lasts 15 days, once per account, and includes the plugin download for the associated site. Stripe Checkout requires a card with no initial charge. After the trial, the subscription renews automatically at €15 per month per site. The purchase summary shows the first payment date, total and applicable taxes.
A reminder email is scheduled three days before the trial ends. To avoid the first charge, cancel from your account before the deadline. The same account does not receive another initial trial.
What it protects
When someone uses Tools → Export, i Guardian holds the WXR file and notifies the reviewer. A different administrator opens Tools → i Guardian and approves once or denies the request. The requester resumes the download from the original page.
Permission applies to that request, with the same filters and login session. It expires 24 hours after the request and can be used once.
Optional connection controls
Tools → i Guardian can observe the destinations used through the WordPress HTTP API and block unapproved origins after you have checked the required integrations. This control starts off. Approving an origin permits all its paths without certifying the data sent. Blocking mode disables automatic redirects. Test updates, payments, email and backups before enabling it. Direct cURL, sockets and other transports need separate controls.
Site requirements
- Single-site WordPress 7.1.4 or later. Multisite networks are not supported.
- PHP 8.3 or later, with PDO SQLite enabled for the web process.
- A private directory writable by PHP, outside every web-accessible directory.
- Working WordPress email and WP-Cron.
- Two separate accounts, including an administrator authorised to review requests.
1. Prepare private storage
Ask your hosting provider to create the private directory, assign it to the PHP user and protect it. On Unix, use permissions 0700 for the directory and 0600 for the database. Do not use the WordPress Media Library.
In wp-config.php, before wp-settings.php loads, configure the actual path.
define( 'IGUARDIAN_DB_PATH', '/private/path/i-guardian/audit.sqlite' );
define( 'IGUARDIAN_NOTIFY_EMAIL', '[email protected]' );Replace these example values. The notification address is optional; otherwise the plugin uses the site administration email.
2. Install the plugin
Download the ZIP from your account. In WordPress, open Plugins → Add New Plugin → Upload Plugin, select the ZIP and activate it. If an environment check fails, resolve the reported requirement before trying again.
3. Test the full process
- Sign in with the first account and request an export from Tools → Export.
- Confirm the file is held and the reviewer receives the email explanation.
- Sign in as the second administrator and approve the request.
- Return to the original session and resume the download.
- Also test a denied request. No file should be delivered.
Updates and backups
Back up the private database and site before updating. Upload the new ZIP from your account using WordPress’s manual update feature. Keep the configured database path. Automatic vendor updates are not included.
Deactivating the plugin restores ordinary WordPress export and HTTP behaviour. Uninstalling removes scheduled events and connection settings/inventory, while preserving the external audit database for the site operator to manage.
Scope and limits
WooCommerce customer exporters, downloads from other plugins, direct database access and operating-system actions require their own integration. i Guardian cannot protect a path that bypasses its checks. Rules and local statistics do not send contents to an external AI model. Code with the same PHP privileges can bypass or disable the plugin.
If a notification does not arrive
Check the recipient address, spam folder, email service and WP-Cron. The download stays on hold if email delivery fails. The second administrator can still open the request directly in the i Guardian panel.