PhantomGuard

No. Hardening and the rules listed above work without a license. A PhantomGuard license is only required for Pro features such as malware scanning and advanced tools.

Go to WordPress Admin → PhantomGuard and use Security Hardening (and other tabs as labeled). Presets and individual rules are explained in the interface.

Those require PhantomGuard Pro and a valid license. The free plugin still shows where those features live so you can upgrade when you want full protection.

PhantomGuard focuses on hardening and logging in the free tier. Pro adds scanning and related tools. You can use it alongside other plugins if their features don’t overlap in a conflicting way.

Yes. PhantomGuard loads Google Fonts (Mulish) for the admin UI. Loading fonts may involve a request to Google; see their terms and privacy policy linked below. PhantomGuard Pro may connect to additional services when you use a license (scanning, 2FA QR, license checks, CDN/DNS, etc.). Details: WPVulnerability API (www.wpvulnerability.net) * What it does: Supplies vulnerability metadata used to flag plugins that may need updates on the dashboard. * Data sent: For each installed plugin, the plugin slug is requested in the URL path (no WordPress content or credentials). * When: When you open the PhantomGuard dashboard (or when the dashboard requests a refresh of this data). * Terms: See the service operator’s site for current terms. * Privacy: See the service operator’s site for their privacy policy. Google Fonts (fonts.googleapis.com) * What it does: Loads the Mulish font for the plugin’s admin screens. * Data sent: No site content—only font requests (Google may log IP per their policy). * When: While using PhantomGuard in the WordPress admin. * Terms: https://developers.google.com/fonts/faq * Privacy: https://policies.google.com/privacy BitNinja API (api.bitninja.io) — Pro only * What it does: Malware scanning, quarantine, license validation, and related Pro features. * Data sent: May include file hashes, file content for deep scans, license key, site domain, and server IP as needed for the feature you use. * When: While using Pro features that rely on the API. * Terms: https://bitninja.com/terms-and-conditions/ * Privacy: https://bitninja.com/privacy-policy/ GoQR API (api.qrserver.com) — Pro only * What it does: Generates QR codes for two-factor authentication setup. * Data sent: OTP Auth URI in the request URL only (no separate account with GoQR required for basic use). * When: Enabling 2FA in Pro hardening options. * Terms: https://goqr.me/legal/tos-api.html * Privacy: https://goqr.me/privacy-safety-security/ IPify (api.ipify.org) — Pro only * What it does: Helps determine the server’s public IP for license validation. * Data sent: Minimal request; response is your public IP. * When: License validation in Pro. * Terms: https://geo.ipify.org/terms-of-service * Privacy: https://geo.ipify.org/privacy-policy/ WordPress.org (api.wordpress.org, downloads.wordpress.org) — Pro only * What it does: Core/plugin checksum checks during scanning workflows. * Data sent: WordPress version and plugin slug as needed for the check. * When: During relevant Pro scan steps. * Terms: https://wordpress.com/tos/ * Privacy: https://wordpress.org/about/privacy/

The dashboard plugin check uses WPVulnerability as described above. Using a PhantomGuard Pro license and Pro features means those additional services may process data as described above. Core free hardening does not require a license.

The admin area is built with React and webpack. The files shipped in this plugin (assets/js/*.js, assets/css/*.css) are minified for performance. Full source code (readable and forkable) is here: https://github.com/bitninjaio/PhantomGuardFree Build from source (developers) Clone the repository and cd into the plugin directory. Run npm install Run npm run build for production assets, or npm run build:dev / npm run dev for development builds. See README.md in the repository for more detail.