JAFA SAFEGUARD / FREE BETA

Regular price after paid launch · per site JPY 1,980 / monthbefore tax / JPY 2,178 incl. 10% tax

Currently free during beta · JPY 0Advance notice and a separate signup are required for paid use. No automatic charges.

Protect WordPress
with a plugin.

Check and block selected attack patterns, limit repeated login attempts, check known vulnerabilities and spot changes to important files.
If a SafeGuard setting causes trouble, restore its previous settings.

Start in record-only mode. Blocking requires preparation and testing. No plugin can guarantee protection against every attack. Read the risks and limits.

Download the English plugin ↓How recovery works ↗Open the public test monitor ↗

v0.2.1 · English · Free beta · No card required

World map preview of the WordPress security monitor

See the public attack monitorIllustrative preview · View actual records on the test site

WHAT THIS PLUGIN CAN DO

A problem → a practical response.

Traffic matches an
attack pattern
→
Block requests that
match bundled rules
Record-only by default. Enable blocking only after preparing and testing recovery.
Repeated failed
login attempts
→
Temporarily limit
further attempts
Optional. After 10 failures in a 15-minute window, limit the same connection and username for up to 15 minutes.
Unsure whether installed
software has known issues
→
Check published
vulnerability information
With consent, compare WordPress, plugin and theme identifiers and versions with published advisories.
An important
file changes
→
Show the change;
optionally email an alert
Selected important files only. Legitimate updates also trigger findings. No automatic repair or infection diagnosis.
A SafeGuard setting
causes a problem
→
Restore the previous
SafeGuard settings
Available while the WordPress admin works. One previous generation only; this is not a full-site restore.

Cannot open WordPress admin?

A separate, authenticated recovery endpoint can move SafeGuard aside. Your server administrator must install and test it in advance. It is not installed automatically.

Prepare emergency disable →

No guarantee against every attack. Keep WordPress and PHP updated and maintain working backups.

01 / FEATURES

Understand what your site needs.

Start with checks. Add blocking only after testing a way back.

Check and block selected attacks

Bundled patterns check for selected SQL injection, script injection and unsafe path operations in requests that reach the plugin. Optional login throttling limits repeated failed attempts.

Default: record only. Not a server-wide WAF or a fix for PHP vulnerabilities. False positives are possible.

Check known vulnerabilities

Only with consent, compare installed WordPress, plugin and theme identifiers and versions with published vulnerability information.

Source: WPVulnerability. Missing data, failed connections and uncertain version ranges are unverified, not safe.

Notice important file changes

Compare selected file hashes with a local baseline. Review changes in WordPress admin and optionally receive an email alert.

Not a complete file or malware scan. Legitimate updates change files. No automatic removal, quarantine or repair.

PLEASE READ BEFORE INSTALLING

Your preparation matters.

Install and change settings using your own judgment and responsibility.

Pages may stop displaying. Login, contact forms, bookings or purchases may fail. Data may be corrupted or lost. Make a verified backup and test in staging first.

Protection against every attack, zero false positives, uninterrupted operation and successful recovery are not guaranteed. Rollback affects SafeGuard settings only.

Read the full liability terms →

02 / A WAY BACK

Two ways to stop a setting causing trouble.

WordPress admin works

Restore the previous settings

SafeGuard keeps one previous generation of its own settings before a change. Restore it with one button, or turn protection settings off.

WordPress admin will not open

Independent emergency disable

A separately installed agent authenticates with a dedicated recovery key and moves the SafeGuard folder aside without loading WordPress.

Independent recovery requires prior installation and an actual drill.

Your server administrator must set up HTTPS, PHP execution, protected storage and permissions. Use SFTP if PHP or the web server is unavailable. This may not fix other causes of failure. It does not back up or restore your whole site.

Prepare the independent recovery route ↗

03 / YOUR DATA

Keep site contents inside your site.

File-change checks run locally. Site text, databases, passwords, API keys and file contents are not designed to be sent to JAFA. With explicit consent, remote checks send only a random installation key and software identifiers/versions. Your connection IP may appear in normal service logs.

WordPress administrator alerts and the optional service-notice email signup are separate. Administrator email addresses are not automatically added to a JAFA customer list.

What is stored, why and for how long ↗

04 / FREE BETA

Free while the beta is available.

No card required. No automatic charges. The beta end date and paid availability will be announced in advance. Paid use requires a separate explicit signup.

Get beta and pricing notices by email

Regular price after paid launch / per site

1,980JPY / month before tax

JPY 2,178 including 10% tax

Currently JPY 0 during the free beta.

Prices are in Japanese yen. Paid signup and automatic billing are currently disabled.

05 / FIRST STEPS

New to WordPress plugins?

1
Make sure you have a way back
Check that you can access WordPress admin and that a working backup and SFTP/hosting fallback exist. Ask your site manager if you are unsure.
2
Upload the ZIP and activate
Download the English ZIP after reading and agreeing to the terms. In WordPress, open Plugins → Add New Plugin → Upload Plugin.
3
Start with checks only
Review the initial findings. Keep blocking and login throttling off until your administrator has tested independent emergency disable.

Follow the step-by-step guide ↗

Before you download

Is this approved by WordPress.org?

No. It is a self-distributed GPL-2.0-or-later ZIP. It has not been submitted to or reviewed by the official directory.

Can I switch between the Japanese and English plugin?

Yes. Both ZIPs use the same jafa-safeguard folder and settings. Back up first, then replace the existing plugin with the other language ZIP through the WordPress upload screen. Do not rename the folder or install two copies. The language in your WordPress settings does not automatically switch this fixed-language edition.

Will the end of the beta break my site?

No. Billing or service expiry alone does not stop local protection, change checks, settings rollback or independent disable. Future remote-service availability will be announced separately.

Can I stop updating PHP or WordPress?

No. Keep PHP, WordPress, themes and plugins updated. SafeGuard assists with selected risks; it does not repair vulnerable software or replace backups and maintenance.

Start with a tested way back.

Read the guide, risks and terms before installing. Installation may affect site display, login, forms or purchases. Back up and test first.

Review terms & download English ZIP ↓日本語版 ZIP

v0.2.1 · WordPress 6.4+ · PHP 8.1+ · Single-site only
SHA-256 checksums / Release notes