# Wingman

> Wingman is a free WordPress security and SMTP plugin by Codepilots: malware scanner, web application firewall, brute-force login protection, shared threat intelligence (the Wingman Network), hardening switches and simple SMTP — in one lightweight plugin. No account, no license key. GPL-2.0-or-later. Requires WordPress 6.0+ and PHP 7.4+.

Wingman is built and maintained by Codepilots (https://codepilots.io), a Danish web agency. The plugin is distributed from this site rather than wordpress.org and keeps itself up to date.

## Install

- [Latest release zip](https://wingman.codepilots.io/wingman.zip): stable URL, always the newest version

WP-CLI (recommended for agents):

    wp plugin install https://wingman.codepilots.io/wingman.zip --activate

Idempotent, safe on a site that already has Wingman:

    wp plugin is-installed wingman || wp plugin install https://wingman.codepilots.io/wingman.zip
    wp plugin is-active wingman || wp plugin activate wingman

Manual: download the zip, upload under Plugins → Add New → Upload Plugin, activate. Plugin slug and directory: `wingman`.

## Documentation

- [Reference (Markdown)](https://wingman.codepilots.io/llms-full.txt): features, settings, privacy and FAQ
- [Release notes](https://wingman.codepilots.io/changelog/): what each version brought
- [Homepage](https://wingman.codepilots.io/): features, install steps and FAQ

## Key facts

- Protection is on by default after activation: login protection, firewall, hardening switches, datacenter and geo login blocks. The first scan starts within a minute.
- Scans run on a schedule in the background (every 2 hours by default, configurable).
- Automatic bans are by IP only, never by username, so an attacker cannot lock the owner out. Logged-in users are never geo- or datacenter-blocked.
- The firewall fails open: if anything goes wrong it lets the request through rather than breaking the site.
- Data sent to Codepilots: an anonymous daily ping with the site URL, plugin version and last scan time, plus confirmed attacker IPs if the Wingman Network is enabled. No content, users, settings or visitor data.
- Monitoring endpoint: GET /pingman on any Wingman site returns a small JSON status (1 = OK, 2 = warning, 3 = critical).
- Wingman may block non-browser requests to a protected site's login and XML-RPC endpoints — that is by design; manage the site via WP-CLI or wp-admin.

## Optional

- [Security contact](https://wingman.codepilots.io/.well-known/security.txt)
- [Codepilots](https://codepilots.io/): the agency behind Wingman