Install step by step.
You do not need to edit code to upload the plugin. You do need a working backup and a fallback before changing protection settings.
If you do not have a server administrator, leave blocking and login throttling off. Independent emergency disable needs separate server setup and a real test.
1. Check your backup and access
Make sure you can sign in as a WordPress administrator. Ask your host or site manager to confirm a recent, restorable backup and SFTP or hosting-panel access. Test changes on a staging copy first.
2. Download the English ZIP
Open the download page, read the full terms and risks, and tick both agreement boxes if you agree. Download jafa-safeguard-0.2.1-en.zip. Keep it as a ZIP: do not unzip it or run it as a desktop program. Email notice registration is optional and separate.
3. Upload it inside WordPress
Open your WordPress dashboard. Choose Plugins → Add New Plugin → Upload Plugin. Choose the ZIP you downloaded, then click Install Now. When installation finishes, click Activate Plugin. Menu names may vary with WordPress version or language. If Plugins is missing, ask your administrator about permissions or hosting restrictions.
4. Open SafeGuard settings
Choose Settings → JAFA SafeGuard. The default is record-only; keep blocking and login throttling unchecked. Run the important-file check and review results. An initial baseline is not proof that files are clean. Legitimate updates also change files.
5. Choose optional checks and alerts
Remote advisory checks require separate consent; they are free during the beta. Optional finding alerts use your existing WordPress administrator email and normal WordPress mail delivery. That address is not automatically registered with JAFA. For beta-end and pricing notices, use the separate email signup and confirm the email link.
If a setting causes a problem
If admin still opens, choose “Restore the previous SafeGuard settings” or “Turn off all SafeGuard protection settings.” Rollback restores only one previous generation of SafeGuard settings. If admin will not open, use the separately prepared emergency route or ask your server administrator to rename the jafa-safeguard folder through SFTP.
Switching the plugin language
The Japanese and English editions use the same plugin folder, options and recovery target. Back up and download the desired language ZIP, upload it through the same WordPress screen, and review WordPress’s replacement prompt. Replace the existing copy; do not create another folder or run both editions. Changing the WordPress interface language alone does not switch this edition.
For server administrators: independent emergency disable
Follow recovery/README.md inside the English ZIP. Place private configuration, sessions and implementation outside every web root and alias; expose only the generated bootstrap. Use HTTPS with certificate verification, correct PHP execution and least-privilege permissions. Generate a dedicated strong recovery key, keep it offline, and maintain SFTP fallback.
Perform an actual disable/reinstall drill in staging while WordPress is broken. The endpoint renames only the fixed jafa-safeguard folder; it does not restore files or databases. Authentication/session tests alone do not prove a real disable works. PHP/web-server failure, full storage, missing permissions or a compromised host can prevent recovery. This is an independent entry point, not a guaranteed trust boundary against a compromised server.
Verify the ZIP SHA-256 against the published checksum. Set up reliable WP-Cron where required; its timing depends on site traffic unless server scheduling is configured. Neither edition edits .htaccess, wp-config.php or WAF rules. Test existing login, WAF, cache, proxy, contact-form and payment flows. Remove private and public recovery files separately when no longer needed.