Update Guard: check premium plugin updates before they reach your client sites

Your security plugin can’t protect you when the malware is the plugin update.

That’s how a supply-chain attack works. Attackers don’t break into your client’s site. They break into a vendor’s build or update server and slip their code into a real release. Every site that updates automatically then installs it, signed and delivered by the vendor itself.

This has been happening to WordPress plugins. Rank Math recently reported that a Rank Math PRO release was compromised for around 11 hours before a clean version replaced it. Any site that auto-updated in that window installed the bad release, and nothing on the site saw anything wrong: to WordPress and to the security plugin, it looked like a normal update from a trusted source.

Update Guard adds a check between “an update is available” and “the update is installed”.

What it does

When a premium plugin on one of your client sites has an update waiting, ToggleWP Cloud checks the new version before the site installs it:

1. It compares the update with what’s installed. The site sends Cloud a list of the plugin’s current files, each with a fingerprint (a checksum). Cloud downloads the new version and works out exactly which files were added, changed or removed.
2. It looks for the tell-tale signs of tampering. For example:
   • a brand new top-level folder
   • hidden files
   • PHP code tucked inside an images or fonts folder
   • a changed author or update address
   • code that decodes and runs hidden instructions
   • code that creates admin accounts
   • code that calls out to a domain the plugin never used before
3. It asks AI about anything suspicious. If an update looks risky, Cloud sends the new and changed code (as a diff, so it’s only what’s new) to Claude for a security review. The review comes back as a plain-English verdict: clean, suspicious or malicious, and why.
4. It holds automatic updates until the update is cleared. A clean update installs as normal. A suspicious one waits. You get an email and see it in your dashboard with the findings, the AI’s summary and the code it looked at, and you approve it when you’re happy.

Ordinary releases go straight through. You only hear about the ones that need a look.

Making sure the site installs what was checked

Checking a download only helps if the site installs that same download. Every Update Guard verdict is tied to the exact package that was checked.

When the site downloads the update itself, it checks that the file matches. If it doesn’t (because the vendor served Cloud and the site different files, or the package changed in between), the update is held and the site’s copy is checked too. A package that differs from the vendor’s own release is itself a warning sign, and Update Guard flags it.

Premium plugins only, on purpose

Plugins from wordpress.org already go through the plugin directory’s own review and security checks. Update Guard concentrates on the plugins that don’t: premium and commercially licensed plugins that update from the vendor’s own servers.

Some vendors only let a licensed site download its updates. When that happens, the site downloads the update itself, reads it without unpacking or running anything, and sends Cloud the same file list and changed code to check. Either way you get the same verdict.

What your clients see

Nothing changes for the client unless something needs attention:

• Automatic updates wait for a clean result. Most take a few minutes longer to arrive.
• Manual updates still work, so you are never locked out of your own sites. If someone updates a held plugin by hand, WordPress shows an Update Guard warning in the updater, and the Plugins screen lists any updates held for review.

In your ToggleWP Cloud dashboard

Update Guard has its own tab under Vulnerabilities. It lists every premium plugin update that has been checked, which sites it applies to, its risk level and its status: clean, held, approved or waiting. For any update you can see:

• what changed: files added, changed and removed, plus any new folders
• each finding and why it matters
• the AI review and the code it read
• the sites the update applies to

Approving an update releases it to every one of those sites at once, and the approval is recorded in your activity log. You can put an update back on hold, or run the check again, at any time.

Why it matters for agencies

• One check protects every site. Your sites with the same plugin and version share one check, so a suspicious release is caught once and held everywhere.
• Keep auto-updates off. Agencies often switch auto-updates off for premium plugins because they don’t trust what’s coming, then fall behind on security fixes. Update Guard lets you keep automatic updates on without installing them blind.
• Evidence, not just a gut feeling. When you hold an update, you can show the client exactly what changed and why it was stopped.
• It covers what security plugins can’t. A security plugin running on the site has to trust the updates it’s given. Update Guard checks the update before it gets anywhere near the site.
• Protection from every agency on ToggleWP Cloud. When an update is found to contain malicious code for any agency, the malicious files themselves are remembered. The same files in another agency’s update are held straight away, even if the vendor packaged each customer’s copy differently. Only fingerprints of the code are shared, never your sites or your clients.

Getting Update Guard

Update Guard will be an additional paid add-on for ToggleWP Cloud. Each check involves a download and, for suspicious updates, an AI review, so it’s switched on per agency. Get in touch and I’ll turn it on for you.

Once it’s on, your sites need the latest ToggleWP plugin and the Vulnerability Monitor feature in their Feature Set. There’s nothing else to set up. You can choose whether automatic updates are held and who gets the alert emails under Vulnerabilities → Settings.

No single check can promise to catch every attack. But a hacked update has to get past a comparison with the copy you already trust, automated checks for the usual signs of tampering, and an AI security review before it reaches a client’s site. Supply-chain attacks are now a real risk for WordPress sites, and that makes Update Guard a strong extra layer of protection.