Turbo Guard – Security & Malware Scanner

Turbo Guard is a comprehensive WordPress security plugin built by a team that manages WordPress sites. It solves real problems: malware removal, Japanese/Chinese SEO spam cleanup, vulnerability alerts, file integrity monitoring, and bot protection. Every scan, detection, and list is 100% free — you can clean up to 3 files for free.

Upgrade to Turbo Guard Pro to unlock unlimited cleanup, Live Traffic Monitor, AI Security Advisor, and Geo-Fence.

Malware Scanner

• Full-site scan: PHP, JavaScript, HTML files across wp-content, wp-admin, wp-includes, and WordPress root

• WordPress Core File Manifest check — compares every file in wp-admin and wp-includes against the official WordPress.org checksums API

• Detects 50+ malware patterns: eval+base64, C99/R57/WSO/b374k/ALFA web shells, hidden iframes, pharma spam, code obfuscation

• Detects Japanese, Chinese, and Korean SEO spam text inside PHP files

• Scans the WordPress database (wp_posts, wp_options) for injected content and rogue admin accounts

• PHP-in-uploads detection, PHP-in-core-asset-dirs detection

• Polyglot image backdoor detection — scans image files for embedded PHP

• Smart false-positive prevention: trusted plugins and themes are never flagged for translation text

• Chunked AJAX scanning with live progress bar — handles 10,000+ file sites without timeout

File Integrity and Change Detection

• Verifies every WordPress core file against official WordPress.org MD5 checksums

• Detects modified or missing core files

• File watcher runs every 6 hours via WP-Cron — detects new, modified, and deleted files

• Baseline snapshot of all wp-content PHP/JS files with MD5 comparison

• Email alert when new files appear

One-Click Bulk Malware Cleanup

• Shows every infected file with path, threat name, severity, and file size

• Select All Critical button — delete multiple files at once

• Automatic ZIP backup before any deletion

• Quarantine option — moves files to a protected directory

Web Application Firewall

• Blocks SQL injection, XSS, directory traversal in real time

• Prevents PHP file uploads

• Advanced IP blocking: exact IP, CIDR, ranges, wildcards

• Rate limiting (120 requests per minute per IP)

• Bad bot blocker: blocks known attack tools (SQLMap, Nikto, WPScan, Nuclei, and more) while always allowing verified search-engine crawlers

Geo-Fence and Trusted Location

• Restrict WordPress admin access to specific IP addresses

• Country-based admin lock: only allow access from your country

• Block file uploads from untrusted countries

• One-click trusted IP setup

Login Security

• Brute force protection with configurable thresholds and lockout duration

• Login attempt logging with IP, timestamp, and user agent

• Email alert when admin logs in from unrecognised IP

• Auto-blocks attacker IPs in firewall after brute force detection

Two-Factor Authentication (2FA)

• TOTP/RFC 6238 — compatible with Google Authenticator, Authy, and all TOTP apps

• Manual secret key setup on user profile page

• Recovery codes (8 single-use)

• Per-user enable/disable

Vulnerability Scanner

• Checks all plugins, themes, and WordPress core against WPScan vulnerability database

• CVSS severity scoring, CVE links, version-aware matching

• Requires a free WPScan API key for detailed CVE data; without one it falls back to WordPress.org status (flags removed/closed plugins & themes)

• Email alert when new vulnerabilities are found

Live Traffic Monitor

• Logs every HTTP request with bot/human detection

• Identifies 30+ bots including AI crawlers (GPTBot, ClaudeBot, PerplexityBot)

• 24-hour stats: total requests, humans, bots, blocked, errors

• Paginated — handles large traffic volumes

• One-click IP block from any traffic row

Site Hardening

• HTTP security headers (X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy)

• Hide WordPress version, block user enumeration

• Optional: disable XML-RPC, restrict REST API, disable file editor

Google Search Console Cleanup

• Scans your sitemap for spam URLs with zero setup — no Google account needed

• Optional Google Search Console connection to see the URLs Google has actually indexed

• Detects Japanese/Chinese, doorway, and brand-keyword spam URLs

• Generates.htaccess 410-Gone blocking rules so Google permanently de-indexes spam

• Sitemap resubmission after cleanup

Privacy

Turbo Guard does not send your website files to any external server. Vulnerability checks send only plugin/theme slugs and versions to the WPScan API — and only on manual scans or when scheduled vulnerability scans are enabled in Settings (off by default). The SEO spam scanner reads your site’s own sitemap via a local request to the site itself — no external service is contacted.

co when enabled. 2FA is fully local: TOTP secrets are entered manually in your authenticator app and no QR service is used. GSC integration uses your own Google OAuth credentials.

AI analysis (optional OpenAI) sends only anonymised threat type data. No telemetry. No tracking.

No account required.

External Services

This plugin connects to external services for certain features. All connections require explicit user action or opt-in.

WordPress.org API

Used to verify WordPress core file integrity by comparing checksums.

* Data sent: WordPress version and locale

* When: Only when the user runs a malware scan or a file integrity check (including scheduled scans)

org/

org/about/privacy/

WPScan Vulnerability Database

Used to check plugins and themes for known security vulnerabilities.

* Data sent: Plugin/theme slugs and versions

* When: Only when the user runs a manual vulnerability scan, or when scheduled vulnerability scans are enabled in Settings (off by default)

com/

com/terms

com/privacy/

ipapi.co (Geo-Fence)

Used for IP geolocation to support country-based access and upload controls (Geo-Fence).

* Data sent: Visitor IP address

* When: Only when geo-fence country features are enabled

co/

co/terms/

co/privacy/

OpenAI API

Used to provide AI-powered security analysis and recommendations.

* Data sent: Anonymized scan results (no personal data or site content)

* When: Only when user explicitly clicks “AI Analysis” (requires user-provided API key)

com/

com/policies/terms-of-use

com/policies/privacy-policy

Google APIs (Search Console)

Used for Google Search Console integration to detect SEO spam and manage indexed URLs.

* Data sent: OAuth tokens, site URL for search analytics queries

* When: Only when user connects their Google account and initiates GSC features

com/webmaster-tools

com/terms

com/privacy