Roadmap

This page shows what we are working on next in Guard Dog, and roughly in what order.

It is deliberately light on dates. Security work has a habit of turning up something that has to jump the queue, and we would rather move an item than miss a promised date. Order can change; the list itself is honest about where each item stands.

Next

More ways to sign in

Guard Dog already supports Google, Microsoft, and Apple sign-in. GitHub and LinkedIn are next.

GitHub in particular is a common request from agencies and developer-heavy teams, where everyone already has an account and nobody wants another password.

As with the current providers, social sign-in stays optional, works alongside two-factor and passkeys rather than replacing them, and never becomes the only way into an account.

Control over every email WordPress sends

The email customizer currently covers Guard Dog's own security emails — two-factor codes, email verification, password expiration, and suspicious-session notices.

We are extending it to the emails WordPress itself sends: password reset, new user welcome, password changed, and email changed. Same customizer, same branding controls, so a password reset email looks like it came from your site rather than from a default install.

Each one will be opt-in. If you already have a plugin handling those emails, Guard Dog will stay out of its way.

Planned

A CAPTCHA that never phones home

Every CAPTCHA Guard Dog supports today — reCAPTCHA, hCaptcha, Turnstile — sends your visitors' data to a third party. That is a reasonable trade for a lot of sites, and those options are not going anywhere.

But it is a genuine problem for some. If you are subject to GDPR, if you have a privacy policy you actually intend to honor, or if you simply do not want a third party in your login flow, every current option asks you to accept something you would rather not.

We are adding ALTCHA: a self-hosted proof-of-work challenge. No third-party request, no tracking, no data leaving your site. Your visitors' browsers solve a small puzzle, your server checks the answer, and nobody else is involved.

Facebook sign-in

Planned, but behind the others, and for a reason worth being open about.

Facebook does not tell us whether a user's email address has actually been verified. Linking an unverified address to an existing WordPress account is the kind of shortcut that turns into a security incident, so we are not taking it.

Facebook sign-in will confirm the address itself before linking anything. That is more work than simply adding the provider, which is why it sits after the others rather than alongside them.

Recently added

• Magic Login — optional single-use email sign-in links for existing accounts, with two-factor still enforced. Useful as a passkey recovery path.
• Passkey cleanup — supporting password managers are now asked to stop offering a passkey once its owner deletes it, instead of leaving an orphaned entry behind.
• Login screen theme headers and footers — independent header and footer options for login screen customization, supporting both classic and block themes.
• Broader IP address matching — IPv4 access rules also match IPv4-mapped IPv6 visitor addresses, so a rule written for 203.0.113.0/24 matches a visitor reported as ::ffff:203.0.113.5. Genuine IPv6 addresses still need their own rule.
• Fully translatable activity log — all 121 built-in event types can now be translated, rather than only 7.

Have an opinion?

This list is shaped by what people actually ask for. If something here matters to you, or something missing matters more, we would rather hear it early than guess.

The fastest way to influence the order is to tell us which of these you would actually turn on, and why.