WordPress & WooCommerce plugins · by operators
Your site breaks quietly. We make it loud.
Eleven single-purpose plugins that keep WordPress sites and WooCommerce stores safe, fast, watched, and heard, built by the team that runs them in production, not a plugin farm. No SaaS behind them, no telemetry, and every one ships safe by default.
- Safe by default, observe first
- No telemetry, data stays on your site
- GPL-2.0 licensed
- 60-day money-back guarantee
The catalog
Eleven plugins, one enemy: the failure you don't see.
Silent checkout breakage, card-testing bursts, leaked coupon codes, a staging clone emailing real customers, bandwidth you cannot account for, media nobody dares delete, the PHP upgrade nobody can size, and the products your social accounts never hear about. The expensive problems are the quiet ones. Each plugin takes one of them off your plate.
For WooCommerce stores
6 plugins
For any WordPress site
5 plugins, no WooCommerce required
The Storm Kit
Every paid WooCommerce plugin: the full perimeter for one store, and the megaphone on top of it.
Save $155 vs. buying separately
Preflight and Dry Run are free plugins with paid add-ons; the Kit covers both add-ons. Featherweight is free for everyone, always.
The Nest Kit
Every paid WordPress plugin, for the people who maintain the site rather than sell through it.
Save $67 vs. buying separately
Built for agencies and maintainers: what your bandwidth went on, what your uploads are made of, what is safe to remove, and what breaks on the next PHP version.
Pick Any 3: Any three paid plugins, your choice, one license. $99/yr
Save $38 to $98 vs. buying separately, depending on your picks. Mix across WordPress and WooCommerce freely. Tell us your three at checkout; you can swap a pick at renewal.
How buying works today: secure online checkout is coming soon. Until it lands, click Buy and tell us which plugin you want, we deliver the plugin zip and an invoice by email within one business day, covered by the same 60-day guarantee.
Start free
Three of them cost nothing, and always will.
Not trials, and not crippled demos. Featherweight is free outright, and Preflight and Dry Run are free plugins with an optional paid add-on for professional workflow. In every case the core promise sits on the free side.
The house rule
Safe by default. Armed when you say so.
A protection tool that guesses wrong on day one costs you real orders. So every Lightningbyrd plugin activates in a mode that records what it would do, and enforces nothing until you've seen a week of receipts and armed it yourself.
Pulse
Observe mode by default
Activation records events and sends nothing. No email or webhook leaves the site until alerts are explicitly armed, so you calibrate against real traffic before a single notification fires.
IP Shield
Dry-run by default
Fresh installs start in Easy Mode with dry-run ON, activating the plugin never enforces anything until you say so. The velocity rule also ships in dry-run, so you see what it would ban before arming it.
Coupon Fence
Log-only by default
Activation never blocks a shopper or sends an email until you explicitly switch to Enforce. The Activity tab shows would-block verdicts in Log-only, a week of receipts before you enforce anything.
Featherweight
Dry-run by default
Every cleanup only reports what it would delete until you untick dry-run. Plus hard-coded guarantees: nothing younger than its retention, pending jobs sacred, and orders, products, customers and users never touched at all.
Ledger
Ships unarmed
Nothing is read until an administrator confirms a log path, and saving settings can never arm or disarm by side effect. The log is opened read-only: Ledger has no code path that touches a live request, so it cannot block, throttle, redirect or modify traffic.
Holdback
Report-only until the self-test passes
Holdback quarantines one disposable file of its own and requests it over loopback before it will touch your media. If interception did not work here, it refuses to quarantine and stays in report-only mode. Cleanup then moves files rather than deleting them, and permanent deletion is manual, one item at a time, behind a retention window.
X-Ray
Read-only until armed
The audit never moves a file, in any mode, armed or not. Retirement is disarmed on activation and stays disarmed until you change it, thumbnail and full are permanently protected in code, and every operation has one Undo button that does not expire.
Molt
Observe-only default
Capture is sampled and observe-only on activation, and all four network-touching opt-ins ship switched off. Suppression is off until you turn it on, applies per fingerprint, and can never apply to a fatal: that guard is in code, not in a setting.
Preflight
Read only by design
Nothing changes, so there is no reason to wait for a maintenance window. The free plugin writes two options of its own and nothing else: no WooCommerce setting, no product, no coupon, no order. The Sell Test rehearses a purchase behind a guard that refuses outbound mail and HTTP and aborts if anything tries to insert an order.
Dry Run
Activation enforces nothing
Activation detects and reports: nothing blocked, no gateway touched, no order stamped, nobody emailed. Enforcement starts only when an administrator arms it, can never arm on a site scored as production or on one the detector cannot decide about, and every override, arm and disarm is written to an audit trail that survives deletion.
Songbird
Sandbox rehearsal by default
Activation publishes nothing and can publish nothing: no account is connected, live mode is unarmed, every trigger is off. Sandbox publishes log the exact Graph API payloads and send nothing, and the copy-guard refuses live publishing from a site that reports a non-production environment or that Lightningbyrd Dry Run scores as a copy, with a logged override for deliberate exceptions.
Built by operators
Born on a production store, not a whiteboard.
IP Shield started life ending a real card-testing incident on a production WooCommerce store we run, and it’s armed on that store right now. The rest of the suite came from the same place: problems we hit operating stores, researched across operator forums and public issue trackers, then solved properly.
- Every claim on these pages is honest, no fabricated reviews, no invented install counts, no named-competitor trash talk.
- Every plugin ships with its manual inside wp-admin, a real changelog, and unit tests that run green before release.
- Need it installed, tuned, or watched for you? The same team builds and maintains WooCommerce stores for a living.
60-day money-back guarantee
Full refund within 60 days of purchase. No questions, no forms, no hard feelings. If a plugin isn’t the right fit for your store, you shouldn’t pay for it.
What's next
Coming soon, and what we cancelled.
Three plugins in research and development right now, same brand rules: single-purpose, safe by default, no SaaS strings. The roadmap page also lists the two we announced, researched properly, and killed.
In developmentTick
scheduled-job absence watchdog
A failed job is loud. A job that stopped existing is silent, and silence is the one thing software is much better at noticing than people are. Tick learns each job's rhythm, then tells you the moment one goes quiet. No SaaS account, no per-job setup.
ResearchingTally
per-plugin resource ledger
You can name the plugin your host complained about, but not the one actually costing you. Tally watches production over days, not one request in a dev panel, and hands you a ranked ledger of who spent what.
ResearchingKeyring
privileged-account hygiene
The account nobody remembers creating is the one that gets used. Keyring keeps a standing inventory of privileged access and flags what has drifted, without touching your login flow or replacing your security plugin.
Questions
The suite, straight answers.
How does buying work before your checkout launches?
Click Buy on any plugin and send us the contact form, we deliver the plugin zip and an invoice by email within one business day. Every purchase is covered by the 60-day money-back guarantee. Featherweight, Preflight and Dry Run are free direct downloads today, no form needed.
What does a license include?
One year of updates and support for one site, at the listed price. The plugins are GPL-2.0 licensed and keep working if you don't renew, renewal covers continued updates, compatibility, and support.
Do you offer 5-site or agency licenses?
Yes, multi-site licensing is available at roughly 2× the single-site price. Tell us how many stores you run and we'll sort you out.
Will these plugins slow my store down?
No measurable effect on the visitor path, by design. Each plugin is single-purpose: cached lookups, indexed queries, no external calls, and zero JavaScript on your checkout. Scans and log ingestion run on cron or on an explicit click, never on a page load, and they run in bounded batches with a time budget. The exact performance notes are on every product page.
Do the plugins send my data anywhere?
No. There is no SaaS behind them, no telemetry, and no account with us, ever. Everything, events, bans, logs, scans, is stored in your own database and pruned on retention windows. One honest nuance: Songbird publishes to Facebook and Instagram, so it talks directly to Meta's API with credentials you own. There is still no Lightningbyrd service in the middle, and your tokens live in your database, not ours.
Why do they all start in observe / dry-run mode?
Because a protection tool that guesses wrong on day one costs you real orders. Every Lightningbyrd plugin records what it would do against your real traffic first, and enforces only when you explicitly arm it.
Do they work together?
They're built as a suite. On a store: Preflight proves it can take an order, Pulse detects a failed-order spike, IP Shield bans the source, Coupon Fence guards the coupons the attacker probes next, and Dry Run makes sure the staging copy never emails a real customer. On any site: Ledger accounts for the bandwidth, X-Ray explains what the uploads folder is made of, Holdback removes media safely, Molt sizes the next PHP upgrade, and Featherweight keeps the database lean. Each also stands completely alone.
What about the block-based (Store API) checkout and HPOS?
Every WooCommerce plugin in the suite is classic + block checkout aware and HPOS compatible, orders are only ever read through WooCommerce's supported APIs. The WordPress plugins do not touch WooCommerce at all, though Featherweight and X-Ray understand it when it is present.
Ready when you are
Put a bird on the wire.
Start with one of the free ones, or take the Kit for your platform and get the whole perimeter. Either way, every paid plugin is covered by the 60-day no-quibble guarantee.