LUA Guard

Protect your character. Protect your settings. Know what your addons are doing.

LUA Guard is a security-focused addon for World of Warcraft: The Burning Crusade Classic Anniversary designed to provide an additional layer of protection against malicious or compromised WeakAuras and addons.

WeakAuras are incredibly powerful because custom Lua can interact with many parts of the WoW client. That power can also be abused. LUA Guard monitors high-impact Lua API calls, scans WeakAuras for suspicious behavior, and can stop potentially destructive actions before they reach the game API.

🛡️ What LUA Guard Protects

LUA Guard focuses heavily on actions that should never happen silently without the player knowing.

Protection includes:

• Profession Protection — Blocks attempts to abandon your professions.
• Pet Protection — Helps prevent addons or WeakAuras from permanently abandoning your Hunter pet.
• Chat Protection — Blocks unauthorized attempts to send messages as your character.
• Settings & Graphics Protection — Guards CVars, graphics settings, resolution changes, console commands, and other client settings.
• Macro Protection — Guards against creating, editing, or deleting your macros.
• Keybind Protection — Prevents unauthorized changes to your keybindings.
• Quest Protection — Guards against automated quest abandonment.
• Guild Protection — Protects dangerous guild actions such as leaving, disbanding, kicking members, changing leadership, and modifying guild information.
• Mail & Trade Protection — Monitors potentially dangerous mail and trade actions.
• Channel Protection — Guards against addons silently joining or manipulating custom chat channels.
• Equipment & Talent Protection — Protects equipment sets and several potentially destructive talent-related actions.

Additional compatibility-sensitive protections are available through Maximum Protection Mode.

🔍 WeakAura Security Scanner

LUA Guard includes a scanner specifically designed to inspect WeakAuras containing custom Lua.

It looks for combinations of potentially dangerous behavior such as:

• Destructive WoW API calls
• Runtime Lua execution
• Encoded or unusually opaque payloads
• Compression/decompression routines
• Serialization/deserialization
• WeakAura installation behavior
• Suspicious loader-style code

When LUA Guard identifies a dangerous WeakAura, it can quarantine the aura by preventing it from loading and immediately display the finding for review.

🔒 WeakAura Install Firewall

One of LUA Guard's most important protections is its WeakAura Install Firewall.

Some malicious designs may attempt to use one WeakAura as a loader that receives or reconstructs additional data and then programmatically installs another WeakAura.

LUA Guard monitors supported WeakAuras installation paths and scans incoming aura data before allowing it through.

When a dangerous loader-style installation is detected, LUA Guard can block the installation before it reaches the normal WeakAuras installation function.

This creates multiple layers of defense:

Suspicious WA → Scan → Quarantine

Loader attempts installation → Scan → Block

Dangerous API attempted → Runtime Guard → Block

🚨 Security Review

When LUA Guard actually blocks something, the Security Review window can automatically open so you know exactly what happened.

The interface separates information into two categories:

Protection

Shows the APIs and actions LUA Guard is currently protecting.

Seeing something here does not mean an attack occurred. It simply shows your active protection coverage.

Caught

Shows actual intercepted actions and suspicious WeakAura findings.

You can inspect:

• The addon or WeakAura involved
• The API it attempted to use
• Why the action is considered dangerous
• Risk level
• Whether the WeakAura was quarantined
• Whether an installation attempt was blocked
• When the event occurred

Hover over entries for additional explanations.

⚙️ Balanced & Maximum Protection

Balanced Mode — Default

Designed for everyday use.

High-impact and destructive APIs are protected while compatibility-sensitive functions commonly used by legitimate addons are allowed.

Maximum Mode

Adds additional protection around areas such as:

• Auction House actions
• Vendor interactions
• Action-bar manipulation
• Group and raid management
• Social functions
• Addon enable/disable controls

Maximum Mode provides stronger coverage but may require allowing specific functionality for trusted addons.

✅ Granular Permissions

LUA Guard doesn't require you to blindly trust an entire addon.

If a legitimate addon needs access to something LUA Guard blocks, you can approve the specific addon + specific API combination.

For example, allowing a trusted addon to use a particular settings function does not automatically give that addon permission to abandon professions, delete macros, send chat messages, or perform unrelated protected actions.

WeakAuras can also be individually reviewed and trusted.

🖥️ Commands

Open LUA Guard with:

/luaguard

or:

/lg

Switch protection modes:

/lg mode balanced

/lg mode maximum

WeakAura Install Firewall:

/lg wa firewall on

/lg wa firewall off

WeakAura obfuscation scanning:

/lg wa obfuscation on

/lg wa obfuscation off

⚔️ Designed for TBC Classic Anniversary

LUA Guard was built specifically around protecting players from the kinds of high-impact Lua actions available in The Burning Crusade Classic Anniversary environment.

The goal isn't to replace WeakAuras or prevent legitimate addons from doing their jobs.

The goal is simple:

A WeakAura shouldn't be able to permanently alter your character or silently perform dangerous actions just because you imported it.

Important Security Notice

LUA Guard provides defense-in-depth, not an absolute security sandbox.

World of Warcraft addons share the game's Lua environment, and Blizzard does not provide addons with true process-level isolation from one another. A sufficiently sophisticated malicious addon specifically designed to bypass LUA Guard may potentially find methods outside its current protections.

LUA Guard should therefore be used as an additional security layer, not as a reason to install WeakAuras or addons from sources you do not trust.

Stay protected. Know what's running. Keep control of your character.