# Wingman — reference Wingman is a free, lightweight WordPress security and SMTP plugin made by Codepilots (https://codepilots.io), a web agency in Denmark. This is the plain-text reference for people and AI agents: what Wingman does, how to install and configure it, and what data leaves the site. Site: https://wingman.codepilots.io Short overview: https://wingman.codepilots.io/llms.txt Release notes: https://wingman.codepilots.io/changelog/ Download (always latest): https://wingman.codepilots.io/wingman.zip License: GPL-2.0-or-later. Plugin slug: wingman. ## Requirements - WordPress 6.0 or newer. PHP 7.4 or newer. - Works on any host. Where a particular protection cannot be applied on a server, Wingman says so on its status page and everything else keeps working. - WP-Cron must be able to run, normally or via a real cron job. Scans and scheduled tasks depend on it. - No account, license key, API key or signup. Nothing is paid. ## Install WP-CLI: wp plugin install https://wingman.codepilots.io/wingman.zip --activate Idempotent (safe to re-run): wp plugin is-installed wingman || wp plugin install https://wingman.codepilots.io/wingman.zip wp plugin is-active wingman || wp plugin activate wingman Manually: download https://wingman.codepilots.io/wingman.zip, then in wp-admin go to Plugins → Add New → Upload Plugin, choose the zip, install and activate. On activation Wingman schedules its scans, installs the firewall and turns on the default protections. The first scan starts within about a minute. ## Updates Wingman is distributed from wingman.codepilots.io rather than wordpress.org. Updates appear in wp-admin like any other plugin and install with one click. Self-update (Settings → Security, on by default) also applies releases automatically, so security fixes always arrive. ## Admin interface Wingman adds a sidebar menu in wp-admin with three pages: - Status: at-a-glance boxes for Scans, Activity and SMTP, the latest results, a Needs review list of suspicious files, the hardening overview, Wingman Network status and a Check for updates button. A dot on the menu means the last scan found something. - Logs: full history for scans, activity and mail, each entry expandable for details. - Settings: Security (scan interval, alert emails, login protection, hardening switches, Wingman Network, self-update, firewall), SMTP (server settings, test email, mail diagnostics) and Blocked logins (view, add and remove bans). A dashboard widget summarises the last scan. ## Features Malware scanner. Scheduled scans (every 2 hours by default, configurable from 1 to 168 hours, or on demand with Scan now) check WordPress core, plugins and every PHP file for tampering, webshells and hidden payloads, and watch key configuration files. Scans run in short chunks in the background so they never time out on shared hosting. Suspicious files go on a Needs review list that stays until the file is cleaned, deleted or explicitly ignored, and a knowledgebase of known false positives helps triage. Findings are emailed to the alert addresses configured under Settings → Security (falling back to the site admin email). User watch. New administrator accounts, privilege escalations and suspicious usernames are reported. Login protection. Rate limiting with automatic lockouts, escalation to bans for repeat offenders, immediate bans for bots, and optional datacenter and geo blocking that keep automated attacks from ever reaching the login page. Automatic bans are by IP only, never by username, so the owner cannot be locked out of their own account. Logged-in users are never blocked by the datacenter or geo protections. Attempted passwords are never logged. Bans can be viewed, added and removed under Settings → Blocked logins. Web application firewall. A lightweight firewall runs before WordPress loads and blocks common exploit attempts, known scanning tools and banned addresses. It is designed to fail open, so a problem in the firewall lets a request through rather than taking the site down. Blocks appear in the activity log. Works behind Cloudflare. The Wingman Network. Sites running Wingman share confirmed attacker IPs. When several independent sites confirm the same attacker, every site is protected from it. Only IP addresses are shared; no content, users, settings or visitor data. Enforcement uses a local copy so logins never wait on the network. Toggle: Settings → Security → Share threat data (on by default). Hardening switches (all on by default, each a single toggle): block PHP execution in uploads, disable the plugin/theme file editor, firewall, login rate limiting, disable XML-RPC, block user enumeration, block datacenter IPs from login, limit logins to the US and Western Europe. Activity log. Failed logins, lockouts, bans, firewall blocks and plugin/theme installs and activations, with email alerts for installs and activations. Lifetime counters are shown on the status page. SMTP. Under Wingman → Settings → SMTP: host, port, encryption, username, password, from address and name. The password is stored encrypted. All WordPress email is then delivered through that server. Includes a mail log of recent messages, one-click test emails, and diagnostics that show what is handling the site's email. Monitoring endpoint. Every Wingman site answers GET /pingman (or /?pingman=1) with a small JSON document: {"status": 1|2|3, "msg": "..."} where 1 is OK, 2 is a warning and 3 is critical. The message is deliberately generic and never includes file paths, usernames or findings. Built for the Pingman uptime monitor and usable by any monitoring tool. ## Data sent to Codepilots An anonymous install ping, at most once a day: the site URL, the plugin version and the time of the last scan, plus a few flags about update settings so Codepilots can see whether a site can receive security fixes. If the Wingman Network is enabled, confirmed attacker IPs are shared as described above. Nothing else: no content, users, settings, findings or visitor data. ## Uninstall Deleting Wingman from the Plugins screen removes its database tables, options and scheduled events. The firewall is removed on deactivation. ## Compatibility notes - Wingman can run alongside other security plugins, but avoid running two firewalls or two login limiters at once. - Wingman is not a backup plugin. Keep backups. - Wingman may block non-browser requests to the login page, XML-RPC and admin endpoints. That is by design; automate through WP-CLI or an authenticated wp-admin session instead. ## Frequently asked questions Is Wingman free? Yes. Free, open source (GPL-2.0-or-later), no account, no license key, no paid tier. Does it slow down my site? No measurable impact. The firewall is extremely fast, scans run in short background chunks, and Wingman adds no front-end CSS or JavaScript. Can it lock me out? Automatic bans are by IP only, never by username. Logged-in users are never geo- or datacenter-blocked, the firewall fails open, and every protection can be switched off under Settings → Security. WP-CLI keeps working. Where do I report a security issue? See https://wingman.codepilots.io/.well-known/security.txt. Who makes Wingman? Codepilots, https://codepilots.io, a web agency in Denmark.