Plugiva ClientGuard helps prevent unintended changes in the WordPress admin by adding practical guardrails around sensitive operations, settings, content, and administration areas.

It is designed for situations where site owners, clients, teams, or automated tools need to work in WordPress without accidentally changing something important.

ClientGuard combines Client Mode with operation-level protection. Client Mode provides a simplified admin experience by hiding selected administration areas, while protection is applied to sensitive operations themselves rather than relying only on whether an admin interface is visible.

You can protect plugin and theme operations, critical settings, protected content, and other sensitive WordPress operations while keeping the rest of the admin area usable.

Client Mode can also be locked via configuration to prevent it from being disabled from the admin interface:

define( 'PCGD_LOCK_CLIENT_MODE', true );

This can be added in wp-config.php or defined programmatically in custom code.

When enabled, Client Mode is forced on and cannot be turned off from the dashboard, helping maintain consistent protection.

ClientGuard also provides Sentinel, an activity and lifecycle event log for protected operations, configuration changes, bypass activity, and other ClientGuard events. Sentinel helps make changes and protection activity visible rather than leaving them unexplained.

On multisite installations, ClientGuard supports site-specific protection and Sentinel event handling while also covering relevant network-level operations.

Instead of blocking access aggressively, ClientGuard applies practical guardrails that let users continue working while reducing the chance of unintended changes.

ClientGuard is ideal for:

Site owners managing their own WordPress site
Developers handing off sites to clients
Teams that want a simplified and safer admin experience
Sites where administrative changes need to remain controlled and observable

Client Mode

Enable Client Mode to apply ClientGuard’s protection controls with one click:

Restricts plugin installation, deletion, activation, deactivation, and editing
Restricts theme installation, deletion, switching, and editing
Restricts Appearance management, including Menus, Widgets, Customizer, and Site Editor
Protects critical site settings and homepage assignments
Governs WordPress AI and Connector administration areas when available
Hides selected administrative areas to simplify the dashboard
Protects important content from unintended edits, trashing, and permanent deletion
Hides the ACF admin area automatically when ACF is active

Individual Protections

If Client Mode is not enabled, each protection can be managed independently.

Lock Theme Switching – Prevents switching, installing, deleting, and editing themes.
Lock Appearance Management – Restricts Appearance management capabilities, including Menus, Widgets, Customizer, and Site Editor access.
Lock Plugin Installation – Prevents installing, deleting, and editing plugins.
Allow Plugin Activation – Allows administrators to activate or deactivate installed plugins while installation protections remain in place.
Protect Site URLs – Protects selected site configuration areas such as permalink management.
Content Protection – Prevents editing, trashing, and permanent deletion of selected pages.
Menu Hiding – Removes selected administrative menus from the dashboard interface.

Sentinel

Sentinel records ClientGuard-related activity to make protection and configuration events visible.

It records events related to:

Configuration and protection state changes
Client Mode changes
Plugin activation policy changes
Protected content changes
Blocked, bypassed, and violation events
ClientGuard lifecycle activity

Sentinel event history is site-scoped and can be managed from the ClientGuard administration area.

View recorded events with pagination
Configure event retention
Clear Sentinel logs when needed
Export Sentinel event history
Handle site-specific event history on multisite installations

Sentinel focuses on activity relevant to ClientGuard and is not intended to provide a site-wide activity or security audit log.

Key Features

One-click Client Mode for a simplified and safer admin experience
Operational protection for plugin installation, deletion, activation, and deactivation
Operational protection for theme installation, deletion, and switching
Protection for critical settings, including Site URLs and Permalinks
Protection for selected pages from editing, trashing, and permanent deletion
Protection for Site Editor and sidebar widget operations
Protection for theme and plugin editor operations
WordPress AI and Connector governance through operational workflow protection
Sentinel event logging for ClientGuard-related configuration, operational, bypass, and lifecycle activity
Site-scoped Sentinel logs with retention, clearing, and export tools
Multisite-aware protection and Sentinel event handling
ACF-aware administration controls
Configuration lock for Client Mode
Safe defaults with no changes on activation

What This Plugin Is NOT

Not a security or firewall plugin
Not a role or permission editor
Not designed to block administrators entirely

Plugiva ClientGuard focuses on preventing unintended changes, not replacing WordPress security or permission systems.

Developer Hooks

Plugiva ClientGuard provides developer-friendly filters and actions for customizing certain protection behaviors and responding to ClientGuard events.

Available hooks include:

pcgd_protected_site_identity_options – Customize the site identity options protected by ClientGuard.
pcgd_protected_permalink_options – Customize the permalink-related options protected by ClientGuard.
pcgd_protection_state_changed – Respond to protection state changes.
pcgd_client_mode_changed – Respond to Client Mode changes.
pcgd_plugin_activation_policy_changed – Respond to changes to the plugin activation policy.
pcgd_protected_content_added – Respond when protected content is added.
pcgd_protected_content_removed – Respond when protected content is removed.
pcgd_protection_blocked – Respond when ClientGuard blocks a protected operation.
pcgd_protection_bypassed – Respond when a protected operation is bypassed.
pcgd_protection_violation – Respond to a protection violation.

For Sentinel event handling, these hooks can be used to observe ClientGuard-related configuration and operational activity.

Additional hooks may be introduced in future versions.