Hear about the vulnerability before the hacker does.
New vulnerabilities in plugins, themes and shop platforms are published every day. Most do not concern you. Guard sees what your shop runs and alerts you only about the ones that affect it, in plain words, with the exact steps to fix it.
Part of the E-shop Guru platform.
Sample alert
ExampleWooPayments 5.6.1 · CVE-2023-28121
An attacker could get into the shop as an administrator, without needing an account.
What to do today
- Take a backup.
- Plugins → update WooPayments to 5.6.2 or newer.
- Check that the cart and checkout work.
A real 2023 vulnerability, used in mass attacks.
The problem
Attacks are not looking for you. They are looking for the plugin you forgot to update.
Once a vulnerability is published, automated tools scan the whole internet for shops running the vulnerable version. Whether you hear about it in an hour or in a month is the difference between an update and stolen customer cards.
Thousands of vulnerabilities a year
Thousands are published every year for WordPress plugins alone. Nobody has time to read them all.
Few concern you
A vulnerability in a plugin you do not have, or in a version you have already updated past, is noise. Guard filters it out.
Some are urgent
Those already used in attacks (CISA KEV list) reach you by email at once, not in the morning summary.
How it works
Three steps, every day, without you lifting a finger
-
1
We identify what you run
From the shop's public files we see the platform, plugins, theme and libraries, with their versions. On WordPress you can also connect an Application Password for exact versions.
-
2
We compare with the vulnerability databases
Every night we update from NVD, CISA KEV, the GitHub Advisory Database and WPVulnerability, and check whether your version falls inside the affected range.
-
3
We tell you what to do
For every finding: what could happen to the shop, who could exploit it, and the steps for your platform. Once you update, the alert closes by itself.
What we check
Beyond vulnerabilities: the configuration mistakes that open doors
No risk to the shop
We look at what every visitor sees. Nothing more.
Guard does not try attacks, guess passwords or submit forms. It only reads public pages and files, one request at a time, respects robots.txt and puts no load on your server.
- Read-only requests (GET) to public addresses only
- No exploits, no password guessing, no “penetration test”
- If we find an exposed file, we keep only the fact that it exists, never its contents
- The WordPress connection password (optional) is stored encrypted and only reads the plugin list
Latest vulnerabilities
What was recently published for e-shop platforms
Questions
FAQ
- Do I need to install anything?
- No. You enter the shop's address and the first check starts straight away. On WordPress you can optionally create an Application Password, so we see the exact version of every plugin.
- Is this the same as a penetration test?
- No, and deliberately so. A penetration test tries attacks and needs your agreement each time. Guard only looks at what you run and compares it with published vulnerabilities, every day, with no risk to the shop.
- How sure is it that a vulnerability affects me?
- Every finding shows where we found the version and how sure we are. With a WordPress connection versions are exact. Without a version we send no alert: we would rather not bother you about something that may not apply.
- Will it flood me with email?
- No. Anything urgent (actively exploited or critical) arrives at once. Everything else comes in one morning summary, and only when there is something new.
- Where does the data come from?
- From the National Vulnerability Database (NVD), CISA's Known Exploited Vulnerabilities catalogue, the GitHub Advisory Database, and WPVulnerability for WordPress plugins and themes.
Your shop's next check could run tonight.
Switch Guard on from your E-shop Guru account, or talk to us.