Root Guard

Root Guard enables an administrator to enforce the root bridge placement in the network. Service providers that connect switches to customer networks are often interested in this technology because they want to ensure that no customer device inadvertently or otherwise becomes the root of the spanning tree. Root Guard ensures that the port on which Root Guard is enabled is the DP. If the switch receives superior STP BPDUs on a Root Guard–enabled port, the port is moved to a root-inconsistent STP state. This root-inconsistent state is effectively equal to the Listening port state. No traffic is forwarded across this port. This protects the current placement of the root bridge in the infrastructure.
We can enable this feature on a port with the following interface configuration command:

spanning-tree guard root