=== Aardwolf Security Scanner ===
Contributors: aardwolfsec
Tags: security, security scanner, vulnerability, hardening, security audit
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 1.2.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free WordPress security scanner. Audit your site for vulnerabilities, weak settings and exposed files, with a clear fix for every issue found.

== Description ==

Aardwolf Security Scanner checks your WordPress site for the security problems attackers look for first. It runs a set of read-only checks, gives each finding a severity rating, and tells you how to fix it in clear language.

You can run a scan on demand or on a schedule. The plugin does not attack your server or change any files, and it does not send your data anywhere. Every check runs on your own install.

= What it checks =

* Software updates. Outdated WordPress core, plugins and themes, plus inactive plugins and themes that still sit on disk.
* Accounts and authentication. The default "admin" username, username enumeration through author archives and the REST API, risky registration defaults, and missing brute-force protection on the login form.
* Configuration. The dashboard file editor, exposed debug output, missing or placeholder security keys and salts, the default "wp_" table prefix, and whether the admin area is forced over HTTPS.
* Information exposure. A reachable XML-RPC endpoint, the version-leaking readme.html, the generator meta tag, directory browsing, and sensitive files such as debug logs, .git, .env and config backups left in the web root.
* HTTP security headers. Missing X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy and HSTS.
* Transport and environment. Sites still on plain HTTP, and end-of-life PHP versions.
* File permissions. World-readable or world-writable wp-config.php and site root.
* Known vulnerabilities. Installed plugins that have been removed from the WordPress.org directory, which often means a plugin was pulled for an unresolved security issue.

Each finding comes with a severity rating and clear steps to fix it. Every scan produces a security score out of 100 so you can track progress over time.

= Scheduled scans and email alerts =

Run a scan automatically once a day or once a week. The plugin can email you when the score drops, when the number of problems goes up, or when a high-risk issue appears. You can also choose to get an email after every scan.

= Export reports =

Save the latest scan as a CSV file, or open a clean printable report and save it as a PDF from your browser.

= About Aardwolf Security =

This plugin is made by [Aardwolf Security](https://aardwolfsecurity.com/). Automated checks are a good first line of defence, but they are not a replacement for a manual penetration test by a qualified tester.

== External services ==

This plugin connects to one external service, the official WordPress.org Plugin API (https://api.wordpress.org/plugins/info/1.0/).

* What it is used for: the Known Vulnerabilities check asks this API whether any of your installed plugins have been removed from the WordPress.org directory.
* What data is sent, and when: the directory slug of each installed plugin (for example "akismet") is sent when a scan runs. No personal data, site content or credentials are sent. Responses are cached for 24 hours.
* Terms and privacy: this is a WordPress.org service, covered by the [WordPress.org Terms](https://wordpress.org/about/) and [Privacy Policy](https://wordpress.org/about/privacy/).

The plugin also sends requests to your own site (its own URL) to inspect response headers and look for exposed files. These stay on your own server.

== Installation ==

1. Upload the aardwolf-security-scanner folder to /wp-content/plugins/, or install the ZIP from Plugins, Add New, Upload Plugin.
2. Activate the plugin from the Plugins screen.
3. Open Security Scanner in the admin menu and click Run Security Scan.

== Frequently Asked Questions ==

= Is it safe to run on a production site? =

Yes. All checks are read-only. The plugin sends a few requests to your own site to inspect headers and look for exposed files, which is harmless. Keep a current backup before you change any settings, as good practice.

= Does it fix things automatically? =

No. The scanner reports each problem and tells you how to fix it. You make the changes yourself, such as editing wp-config.php, adjusting file permissions, or updating settings.

= Why does a check say it could not complete? =

Some checks send a request to your own site. If your host blocks these requests, those checks are skipped instead of failed, and the result explains what to check by hand.

== Changelog ==

= 1.2.6 =
* Rewrote the readme in plainer language and updated the tags for the plugin directory. No functional changes.

= 1.2.5 =
* Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/wp_print_styles() instead of a hard-coded link tag.

= 1.2.4 =
* Moved the printable report's CSS to a bundled stylesheet (no inline style tag) and removed the inline print-button script.
* Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check.
* Corrected the Contributors username.

= 1.2.3 =
* Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI.

= 1.2.2 =
* Output all logos via escaped image tags for cleaner markup.
* Documented the WordPress.org Plugin API usage under a new "External services" readme section.

= 1.2.1 =
* Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated "Tested up to".

= 1.2.0 =
* Removed the optional WPScan API integration and the one-click hardening feature. These are planned for a future Pro add-on. The free directory-removal check, which needs no API key, remains.

= 1.1.1 =
* Scheduled scans now let you choose the time of day, and the day of the week for weekly scans, in your site timezone.
* Fixed the oversized admin menu icon.
* Failed checks now show a problem-worded title (for example "Usernames are publicly enumerable") instead of the healthy-state wording.
* The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data.

= 1.1.0 =
* Added scheduled scans (daily or weekly) with email alerts on regression.
* Added CSV and printable PDF report export.
* Added a Known Vulnerabilities check.
* Bumped "Tested up to" and refreshed the settings screen.

= 1.0.0 =
* Initial release: security checks across six categories, a security score, and optional one-click hardening.

== Upgrade Notice ==

= 1.2.6 =
Plain-language readme and updated directory tags. No functional changes.

= 1.0.0 =
Initial release.
