The agent is what you talk to. Guardian is what runs when you are not in chat. It is an optional, local security engine — firewall, scanner, identity, patching and recovery — that starts disabled and only acts inside the mode you choose.
Guardian inspects login, REST and anonymous traffic before it becomes a problem. Limits, lockouts and blocks are configured as policy, not as a pile of separate plugins.
Guardian keeps a live ring of WordPress requests so you can watch traffic, slow endpoints and firewall decisions without opening a log file. Public page views are sampled. Request bodies are never stored.
A full assessment walks configuration, installed components, database content and the filesystem in bounded batches, so a large site does not time out mid-scan. Official WordPress core and plugin checksums sit alongside heuristic PHP and JavaScript detection.
Administrators get TOTP two-factor authentication with encrypted secrets, WebAuthn passkeys, and lockouts that never apply to admin accounts. Sessions and application passwords can be revoked from the same screen.
Installed core, plugins and themes are compared against a signed advisory feed, the public WPVulnerability catalog and cloud AI source analysis. Version-range matching tells you what is actually affected — not a generic score.
Every repair is previewed, actor-bound and backed up into an encrypted vault before a byte is written. Official core and plugin files can be restored from upstream, encoded scripts cleaned from posts, and executable uploads quarantined. AI-generated plugin patches go through two LLM review passes, PHP syntax checks and a bootstrap health probe — then roll back automatically if the site fails that probe.
Four modes set the ceiling: Monitor records, Protect enforces, Maintain adds allowlisted plugin updates inside a UTC window, and Respond can quarantine an executable upload only when a fresh scan also confirms request-controlled execution. Playbooks are bounded — one action per run, never arbitrary code.
Guardian keeps a live ring of WordPress requests so you can watch traffic, slow endpoints and firewall decisions without opening a log file.
Public GET traffic is sampled at 10%. Errors, admin, sign-in and writes are always kept. Open any row for the firewall decision, duration and a hashed client address.
Monitor · Protect · Maintain · Respond
Config · Components · Database · Files
TOTP · WebAuthn passkeys
Core · Plugin · Post · Quarantine · AI patch
Manual · Hourly · Twice daily · Daily
Login, REST and anonymous request windows
Live ring · 10% public GET sample · bodies never stored
For most sites, yes. Guardian covers request protection, scanning with official checksums, account hardening, vulnerability matching and reversible repair. You can still run a specialist firewall or WAF in front if you want defence in depth — Guardian is the WordPress-layer piece.
Scans are resumable and bounded, so they yield rather than lock the request. Request logging samples ordinary GET traffic and stores compact summaries, not bodies. Page-load timing is opt-in sampling. The firewall work is the same class of check a dedicated security plugin already runs on every request.
Compact summaries of PHP requests that reached WordPress: method, path, status, duration, kind and a hashed client address. Request bodies are never stored. Routine public GET traffic is sampled at 10%; errors, admin, sign-in and writes are always kept. Static files that never reach PHP stay outside this log, and the ring lives in a local file — not the database.
Yes, but only through dedicated repair tools in a local chat session. The agent can inspect, preview, apply and roll back a Guardian repair with the same approval cards as any other high-impact action. Remote and scheduled agents cannot use those tools, and one chat session cannot see another session’s repairs.
Scanning, firewalling, 2FA and the recovery vault stay on your WordPress install. Connecting Talos Cloud shares software inventory and receives vulnerability summaries and uptime on heartbeat. AI plugin patches send the affected source files to Talos Cloud for generation and review; source is not persisted in a shared catalog. Independent recovery export is opt-in and encrypted.
Modes, per-tool policy, approval gates, roles and budgets.
Read moreBefore-and-after snapshots, checksums and drift-checked rollback.
Read moreSuspect your WordPress site is compromised? Talos scans plugin and theme source for injected code, cites the exact file and line, and captures every cleanup step for rollback.
Read moreSpend less time clicking through admin and more time moving your site forward.
