Getting started

Install Alovio Protect, let it install its crash-guard drop-in, and see what runs out of the box and what each module does.

Alovio Protect is a free security plugin for WordPress, built around one idea: never claim protection that is not there. Every screen says what it actually knows, and says plainly when it does not.

It does five things:

Keeps the site up when something fatals — it catches a fatal error, blames the plugin or theme responsible, and if the same component fatals again it pauses that one component and replays the request.
Checks files against the official record — WordPress core and plugins published on WordPress.org are compared against the official checksums.
Scores every PHP file for malware — each file is read without being run and scored on what it contains, with the rule, the line and the code shown rather than a verdict.
Hardens login — failed sign-ins are rate limited and the form stops saying which usernames exist.
Keeps restore points — a copy of a plugin or theme is kept before it updates, so a bad update can be put back on its own.

There is no account, no licence key and no server of ours the plugin depends on to work.

Requirements

WordPress 6.0 or later.
PHP 7.4 or later.

Install

Download the plugin zip from alovio.org.
In wp-admin go to Plugins → Add New → Upload Plugin, choose the zip, install and activate.
On activation the crash guard installs its files. Open Alovio Protect in the admin menu to check it reported no problem.
Run the first file check from the File integrity tab.

Alovio Protect runs the moment it is active. There is nothing to buy and nothing to enter.

What it writes to disk

The plugin keeps its state in files, not the database — so the crash guard still works when the database is what broke. It writes to:

wp-content/alovio-protect/ — its state folder (pause state, findings, login counters, restore points).
wp-content/fatal-error-handler.php — the crash guard’s runtime handler.
wp-content/mu-plugins/alovio-protect-guard.php — the must-use plugin that keeps a paused extension out of the load order.

Both drop-ins are standard WordPress extension points. If the web server cannot write to one of them, the screen says which file and which user account owns it. If another plugin already owns fatal-error-handler.php, Alovio Protect does not overwrite it — the screen names the other plugin and leaves the choice to you. See The crash guard.

Where to find it

Alovio Protect sits at the top level of the admin menu under a shield icon. A count next to the name means something needs a person — a paused component, a guard that is not running, or an unreviewed finding — so you can tell without opening it.

Inside, the screen has its own tabs:

Tab	What it is for
Overview	Whether the site is all right, at a glance, with the one thing most worth doing
Crash guard	The state of the guard files, and the record of fatal errors
File integrity	The file check against WordPress.org and your own baseline
Malware	The PHP scan and its findings
Login	Rate limiting, the username-error fix, and the optional login address
Incidents	Recent fatal errors in full
Restore points	Saved copies you can put back
Settings	Unattended scanning, the WP-Cron tool, and the module switches

What runs out of the box

The crash guard is always on. It cannot be switched off, because switching it off would mean deleting the drop-ins — which is what deactivating the whole plugin already does.
File integrity and malware are on, but idle. Neither costs anything until a scan starts, so they wait until you — or the schedule — ask for one.
Login protection is on.
Unattended scanning is set to daily. It runs the file and malware scans on their own and emails you when they find something. You can change it to weekly or off on the Settings tab.
A copy is kept before each update, so a bad plugin or theme update can be rolled back.

Every module except the crash guard can be switched off on the Settings tab.

Try it live

Open the Alovio Protect demo to see the screens with a site behind them.