Read the terms and risks.

TERMS OF USE / 2026.11.10

JAFA SafeGuard Terms of Use — full text

Features, user preparations, limitations and responsibility.

1. Scope and operator

These terms govern the JAFA SafeGuard plugin, independent recovery agent, remote advisory service and website provided by JAFA Co., Ltd. (ジャファ株式会社, “we”). Install only on a site you are authorized to administer, after reviewing the terms and supported scope. See our company information for general contact details. We currently provide a free beta; paid signup is closed. Seller details, service conditions, payment and delivery timing, cancellation, refunds and contact methods will be shown before any paid application.

2. Software license

The plugin and covered source are licensed under GPL-2.0-or-later. These terms do not restrict rights of use, copying, modification or redistribution granted by that license; the GPL prevails for those licensing matters if they conflict. Remote-service and billing conditions are separate from the software license. Trademarks and third-party material remain the property of their owners.

3. Provided features and scope

1. Basic protection: a MIME-related header, optional login throttling and XML-RPC pingback disable.
2. Attack patterns: limited bundled patterns for SQL/script injection, unsafe PHP wrappers and sensitive-file path operations in requests that reach the plugin inside WordPress; record-only or HTTP 403 blocking.
3. With consent, remote comparison of WordPress, plugin and theme identifiers and versions against known-vulnerability data.
4. Local hash comparison for selected core files, plugin entry files and theme functions.php/style.css files.
5. Optional administrator emails, one-generation SafeGuard settings rollback and protection disable.
6. A separately installed, authenticated and tested recovery agent that renames a fixed SafeGuard folder.

This is not a server-wide WAF, a PHP fix, a virtual patch for every CVE, staffed continuous monitoring, incident-response service, intrusion investigation or maintenance contract. Check the release and guide for implemented scope and limits.

4. Installation and operation

You must verify installation authority, supported software and compatibility with existing WAF, cache, login, payment, form and API functionality. Keep working backups and an SFTP or hosting-panel fallback. Update PHP, WordPress, operating systems and related products; secure accounts, permissions and credentials. Review findings and decide on appropriate action.

Install, update and change settings using your own judgment and responsibility. Depending on the environment and settings, pages may fail to display, logins, inquiries, bookings or purchases may stop working, and data may be corrupted or lost. Back up and test in staging first. Recovery success and uninterrupted operation are not guaranteed. Responsibility for failures and loss is governed by section 11 and applicable law.

5. Free beta, pricing and paid availability

The future remote advisory service price is JPY 1,980 excluding tax / JPY 2,178 including 10% tax per WordPress installation per month. The per-site service unit does not restrict GPL rights in local software. We will announce applicable changes to prices or tax conditions in advance.

The beta, including remote checks, is currently free. Its end date and paid start date are not yet determined. Dates and conditions will be announced in advance on this website and to confirmed notice subscribers. Using the beta or registering an email does not create a payment obligation or automatic charge. Paid use requires a separate explicit application.

Notice signup is optional and requires confirmation through email. You can unsubscribe from notice emails; otherwise check this website for updates. After paid availability, a subscription exists only when you explicitly apply through Stripe after reviewing price, start date, renewal interval, recurring charges and cancellation. Under an accepted paid subscription, recurring charges continue until cancellation takes effect. Paid signup and payments are currently disabled.

6. Expiry, connection failures and billing

New remote advisory retrieval may stop after a trial or service period ends. Local protection, attack-pattern checks, file-change checks, settings rollback and independent disable are not stopped solely because of service expiry or billing status. External API or payment connection failures do not cause billing-based blocking of your website. Local and independent features still depend on PHP, the web server, permissions, storage and other operating conditions.

7. Blocking, false positives and compatibility

Legitimate form values, searches, HTML, source code or API traffic may match attack patterns and be incorrectly recorded or blocked. Start in record-only mode, check normal business functions and perform an actual independent recovery drill before enabling blocking. If legitimate traffic is blocked, turn blocking off and use settings rollback or emergency disable as needed.

Item count, nesting, value and total-size limits may cause checks to be skipped. Authenticated administrators, CLI, scheduled tasks, sensitive fields such as passwords, cookies, headers, uploaded-file contents and XML bodies are excluded. Code running before the inspection point, traffic outside WordPress and unknown or obfuscated attacks may not be detected or blocked. A rule match does not establish an actual attack or successful intrusion.

8. Advisory and file-change limitations

Data coverage, freshness, service failures, component identification, privately distributed products and version comparison can cause false positives or missed findings. “Unverified” or “no findings” does not prove safety. An already-compromised initial baseline or a problem in an excluded file may not be detected. Legitimate updates also change hashes. Review original vendor information and update the baseline only after verifying the changes are legitimate.

9. Recovery limitations

Rollback restores only the previous generation of SafeGuard settings. It does not restore WordPress, other plugins, databases, posts or customer data. Independent recovery needs prior separate installation, dedicated authentication, HTTPS, permissions, protected storage and an actual drill. It may fail if PHP or the web server is unavailable, storage is full, permissions are insufficient or the server is compromised. It may not resolve failures caused by other software. We do not provide or guarantee backups, full restores, WordPress-update rollback, infection removal or prevention of reinfection.

10. No guaranteed outcomes

We do not guarantee prevention of every attack, intrusion, unauthorized login, malware infection, disclosure, corruption or loss; absence of false positives, missed detections, vulnerabilities or defects; suitability for every purpose or environment; immediate, complete or perfectly accurate checks and data; email delivery or exact scheduled execution; uninterrupted operation, unlimited capacity, a particular response time or low load on every host; successful or time-bounded recovery, existing clean backups or complete restoration; or compliance with insurance, audit, customer standards, GDPR, Japanese privacy law or certification requirements. See section 11 for liability and exclusions.

11. Liability and exclusions

We accept no liability for damages suffered by users or third parties in connection with the use, installation, update, configuration, suspension, interruption or termination of this service, or inability to use it.

Even if we are held liable for damages, our total liability is capped at the service fee we actually received for the affected site for the most recent one-month service period before the loss occurred. The cap is zero if no fee was received for that month, including use of the free beta.

12. Incidents and mitigation

If you notice a problem, preserve relevant logs and settings safely and take reasonably available steps such as disabling protection, using independent disable or contacting your host. Do not post passwords, API keys, payment details, raw personal data or confidential logs publicly; arrange a secure exchange when necessary. Responsibility and compensation depend on causes, causation, each party’s conduct and applicable law. A late report alone does not automatically remove all your rights.

13. Cancellation and refunds

Withdraw remote-check consent to stop using that optional service. After paid availability, use the Stripe Customer Portal or the contact method shown at signup. Cancellation timing, the next payment, refunds and prorating will be stated before signup. Deactivation, deletion or site closure alone does not cancel a paid subscription; cancel separately. Statutory cancellation/refund rights and claims for our non-provision, duplicate or incorrect charges are not categorically excluded. Unsettled future refund conditions do not justify charging for today’s free use. Paid applications are currently closed.

14. Personal, confidential and other data

See Privacy and data for categories, purposes, retention, transfers, deletion and consent withdrawal. Remote checks require explicit consent and send component identifiers, versions and a random installation key. Site content, database dumps, credentials, API keys and file contents are not designed to be sent to JAFA. Pattern checks run in local memory and retain only minimal recent rule IDs, times and detect/block states, without raw attack input, URLs or IPs in that event record. Normal server logs and other products may process data separately. Site operators must assess their own processing purposes, legality, notices and processor arrangements; this does not shift our own legal, confidentiality or security obligations to you.

15. Credentials and independent recovery

Protect installation keys, administrator and SFTP access and recovery keys. Avoid unnecessary sharing, embedding credentials in URLs or logging them publicly. Keep private recovery storage outside every web-accessible root and alias. Removing the plugin or ending a contract does not remove the recovery endpoint. A server administrator must identify and remove its specific public and private files when no longer needed.

16. Prohibited conduct

Do not attack others, install or inspect without authority, gain unauthorized access, overload remote services, steal credentials, unlawfully evade payment, abuse trials, infringe rights or break the law. This does not prohibit analysis, modification or redistribution allowed by the GPL, authorized testing or vulnerability reporting.

17. Maintenance, changes and suspension

Features or remote services may change or stop for maintenance, security, external-service or legal reasons. We consider user impact and, where possible, announce the change, reason and timing in advance; emergency notice may follow the event. Payment adjustments for paid-service non-provision or termination follow applicable law and the conditions shown at signup; “no refunds under any circumstances” is not automatically applied.

18. Changes and severability

Changes follow applicable law, taking necessity, reasonableness and user impact into account, with advance notice of the content and effective date. We obtain individual consent where required and do not retrospectively waive liability already incurred. If a clause is invalid, remaining provisions continue to apply without removing statutory rights.

19. Governing law and disputes

Japanese law governs these terms without excluding mandatory protections applicable to you. Parties should first discuss disputes in good faith. Jurisdiction otherwise follows applicable law, without restricting consumers’ statutory rights to bring proceedings or complaints.

20. Contact and effect

Product: JAFA SafeGuard. Operator: JAFA Co., Ltd. (ジャファ株式会社). General contact and company information: official company website. Product/privacy contact: jafasafeguard@worldscene.net. Paid-service contact and seller disclosures will appear in Sales information before opening. Established November 6, 2026; last revised November 10, 2026. These terms cover the current free service and do not open paid sales. This English version describes the same current service conditions as the Japanese version; it does not establish additional guarantees.