What the Guardhouse site check does

The Guardhouse site check reads the public pages of a website and writes a short report. This page explains exactly what it does. It is written for website owners and for the people who look after their servers.

The short version

It only reads public pages, the way a search engine or a visitor would.
It is passive. It never tries to log in, break in, or test whether anything can be exploited.
It looks at no more than 15 pages.
It follows your robots.txt file, with one exception: the homepage.
You can opt out at any time. See How to opt out.

How we identify ourselves

Every request from the check uses this User-Agent:

GuardhouseSiteCheck/1.0 (+https://useguardhouse.com/help/site-check)

That link points to this page. If you see this name in your server logs, a Guardhouse site check ran against your site.

What the check fetches

Your homepage.
Sitemap files, if they exist: /wp-sitemap.xml, /sitemap_index.xml, /sitemap.xml, and any sitemap listed in your robots.txt.
Up to 15 pages on the same hostname, found through links on the homepage or in the sitemaps.

Limits on each check:

Only http and https, on the default ports.
Hostnames only. No IP addresses, and no usernames or passwords in the address.
8 seconds maximum per request.
At most 3 requests at the same time.
45 seconds maximum for the whole check.
robots.txt is respected for every page except the homepage.

We also limit how often one visitor can run checks, and we cache a report for 24 hours per domain, so we do not hit your site repeatedly.

What the check looks for

All of this comes from the pages we fetched. No AI is involved in this step.

Platform. Whether the site runs on WordPress, or another platform such as Wix, Squarespace, Webflow, Shopify, Drupal, Joomla, GoDaddy Website Builder, or Weebly.
Versions. The WordPress version (from the generator tag, asset version numbers, and the RSS feed), and the PHP and server versions if your server reveals them in its response headers. Many servers hide these. We say “not visible” when that is the case.
Plugins and theme. Names and versions that appear in the page’s public links, such as /wp-content/plugins/<name>/...?ver=1.2.3. We only see what is linked from the pages we fetch.
Features. Whether the site has an online store, member logins, plugin-based booking, forms, donation tools, events, translations, a page builder, SEO tools, or newsletter signups. See What we can move.
Size. How many pages and posts the site has, based on sitemaps and links.
Page details. For each page we read: the title, description, headings, approximate word count, and the number of forms and embedded frames. We keep the visible text, trimmed to roughly 1,500 words per page.

We keep the raw page HTML for 30 days for troubleshooting, and then it is deleted.

What the check never does

The check never:

guesses at hidden plugin or file addresses that your pages do not link to
requests /wp-login.php, /xmlrpc.php, or anything under /wp-admin/
lists your users, including through /wp-json/wp/v2/users
submits forms
sends anything meant to test whether a weakness can be exploited
ignores your robots.txt, except for the homepage

Where the information comes from

After reading your pages, we compare what we found against these sources:

WordPress.org. The Plugins API tells us the latest version of each plugin, when it was last updated, and whether it was removed. The core version-check API tells us the latest WordPress version. Plugins that are not listed there (paid plugins) are reported as “commercial plugin, version status unknown.”
Wordfence Intelligence. A database of known WordPress vulnerabilities. See Wordfence attribution below.
Google PageSpeed Insights. A mobile speed test of your homepage. Google runs this test. If it is slow or unavailable, the report says so and continues without it.
PHP support status. A table we maintain of which PHP versions still receive security fixes.
Anthropic Claude. After all of the above, an AI model (Claude, from Anthropic) turns the findings into a plain-English write-up. It receives the extracted facts and trimmed page text. It does not choose what to fetch, and it does not change the eligibility or price, which come from fixed rules.

Wordfence attribution

Vulnerability information in our reports comes from the Wordfence Intelligence Vulnerability Data Feed, provided by Defiant, Inc. (the makers of Wordfence). Use of the feed is governed by the Wordfence Intelligence Terms and Conditions (last updated January 26, 2026).

Wordfence grants a license to reproduce, display, and distribute this data, as long as every copy includes Defiant’s copyright notice and license. The license text that comes with each record also asks that we include a hyperlink to the vulnerability record. Where a record includes MITRE CVE data, we also reproduce MITRE’s copyright notice and license.

On each report, every vulnerability links to its Wordfence record, and the copyright notice and license that came with that record are shown with it.

How to opt out

You are in control of whether we check your site.

Stop checks on all pages except the homepage. Add this to your robots.txt:
```
User-agent: GuardhouseSiteCheck
Disallow: /
```
We still request the homepage, because that is the page a person asked us to look at. We will not fetch anything else.
Block the whole domain. Email hello@useguardhouse.com and tell us the domain. We will stop all future checks of it.

Questions

If a check looks wrong, or you want something removed, email hello@useguardhouse.com.