=== Aegis User Guard ===
Contributors: WP_Shibly
Tags: security, two factor authentication, login security, password policy, user management
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress identity policies for password rules, login lockouts, two-factor authentication, IP controls, and Administrator oversight.

== Description ==

Aegis User Guard is a single, self-contained security console that adds the identity-policy controls most sites end up needing eventually: password expiration and complexity, inactivity lockout, brute-force protection, two-factor authentication, an IP allow/block list, and full oversight of every Administrator account. It does not replace WordPress's login system or session handling; it layers policy and visibility on top of it, and every control can be switched off independently.

Everything lives on one native-feeling admin screen, organized into tabs:

* **Core controls** — the identity policies below, each with its own on/off switch.
* **Recently added** — a quick pulse of the newest accounts and their status.
* **Email notifications** — the shared template and recipient list for Administrator security alerts.
* **Administrator directory** — every Administrator, their last sign-in, active sessions, and one-click actions.
* **Access & IPs** — a manual IP allow/block list.
* **Checklist** — a read-only audit of common WordPress hardening gaps, with one-click fixes where Aegis can apply them.
* **Activity log** — a chronological, exportable record of every security event Aegis observed.

= Identity policies =

* **Password freshness** — prompt users to rotate their password after a configurable age (default 180 days).
* **Password complexity** — require a minimum length and, optionally, mixed case, a number, and a symbol, enforced on password reset and profile changes.
* **Inactive account lockout** — pause login access after a configurable period of inactivity (default 90 days).
* **Brute-force lockout** — lock an account and its originating network after repeated failed sign-ins, independent of whether the attempted username exists.
* **Two-factor authentication (TOTP)** — self-service setup from any user's own profile (manual-entry key, no third-party QR service), with one-time backup codes and an option to require it for all Administrators.
* **REST API user-list restriction** — block anonymous requests to `/wp-json/wp/v2/users` so usernames cannot be enumerated, while leaving authenticated requests untouched.
* **Administrator alerts** — independently alert all or selected Administrators when a user is created, signs in, changes username, changes email address, or changes password. Administrator promotions remain covered as well.
* **New-device sign-in alerts** — email a user when their own account signs in from an IP address not seen before.

= Administrator oversight =

* A live directory of every Administrator account: last sign-in, status, active session count, and CSV export.
* Manual Pause access / Reactivate access for any account, with native WordPress session termination.
* A "Force password reset" action that requires a new password on next login and signs the account out everywhere.
* A one-click "Sign out everywhere" action to end every active session for an account immediately.
* A pending-Administrator review queue: new or newly promoted Administrators are blocked from signing in until an existing Administrator grants access.

= Access control =

* A manual IP allow/block list — block a network outright, or exempt a trusted IP from brute-force lockouts.
* Individual failed-sign-in logging, alongside every lockout, pause, and policy change, in the Activity log.

= Hardening checklist =

A read-only audit covering file-editing access, debug output exposure, HTTPS on wp-admin, a default "admin" username, the two-factor requirement, REST API user enumeration, and pending core/plugin updates — each with a plain-language fix, and a direct link into the relevant Aegis setting where Aegis can apply it itself.

= Everything native =

Aegis stores its data in standard WordPress options and user meta, uses native password-reset and session-termination APIs, and never introduces its own authentication layer. Disabling or deleting the plugin returns the site to stock WordPress behavior.

== Features ==

* Configurable password-expiration policy (default 180 days).
* Configurable password-complexity policy (length, case, number, symbol).
* Configurable inactivity lockout (default 90 days).
* Configurable brute-force lockout, per account and per originating network.
* Optional two-factor authentication (TOTP) with one-time backup codes, self-service from each user's own profile.
* Optional REST API restriction to stop anonymous username enumeration via `/wp-json/wp/v2/users`.
* Event-level Administrator email alerts for account creation, successful sign-in, username, email, and password changes, with selectable recipients and a shared editable template.
* Optional email alert to a user on sign-in from a new IP address.
* Pending-Administrator review queue for new or newly promoted Administrators.
* Administrator directory with last sign-in, live session counts, and CSV export.
* "Force password reset" and "Sign out everywhere" actions for any account.
* Security status column and manual Pause access / Reactivate access on the Users screen.
* Manual IP allow/block list.
* Read-only security hardening checklist with one-click fixes.
* Chronological, searchable, exportable Activity log.
* A single top-level, native-feeling WordPress admin screen — no external APIs are required for Aegis's security controls, and the optional Gravatar avatar lookup is documented below.

== External services ==

This plugin optionally uses the Gravatar service, operated by Automattic, to display profile images for Administrators in the Administrator directory. Gravatar is not required for Aegis's security controls; the plugin displays its bundled placeholder image if a Gravatar image is unavailable.

When an Administrator directory is opened and WordPress has a Gravatar URL for an Administrator, the visitor's browser requests the image from `secure.gravatar.com` (or the Gravatar URL returned by the site's WordPress configuration). The request URL contains a hash of the Administrator's normalized email address so Gravatar can select the associated image. The browser also sends normal HTTP request information, such as its IP address and user-agent, to the service. The request is made only to load that optional avatar image; Aegis does not send the Administrator's raw email address to Gravatar.

Gravatar is provided by Automattic. See Gravatar's [Terms of Service](https://wordpress.com/tos/) and [Privacy Policy](https://automattic.com/privacy/) for information about the service's terms and data handling.

== Screenshots ==

1. Core controls for password, inactivity, brute-force, and two-factor policies.
2. Chronological Activity log with searchable security events.
3. Access IP rules for allow/block policy management.
4. Configurable Administrator email notifications and recipients.
5. Users status view with account access and security state.
6. Recently added Administrator accounts awaiting review.
7. Administrator directory with sign-in, session, and access details.
8. Read-only security hardening checklist with actionable fixes.

== Installation ==

1. Upload the `aegis-user-guard` folder to `wp-content/plugins/`, or upload the plugin ZIP from Plugins > Add New > Upload Plugin.
2. Activate Aegis User Guard from the Plugins screen.
3. Open the Aegis User Guard menu item in the main admin sidebar to review the default policies and adjust them to your site.
4. Use the Administrator directory tab, or Users > All Users, for per-account status and manual access controls.

== Frequently Asked Questions ==

= Does this replace WordPress's login system? =

No. Aegis adds policy checks and visibility on top of native WordPress authentication, session handling, and password reset — it does not introduce its own login form, session store, or password hashing.

= What happens to existing accounts when I activate the plugin? =

Nothing changes immediately. Accounts are initialized with current timestamps on their next successful login, so no one is locked out by policies that were not in effect when they last signed in.

= Does two-factor authentication use a third-party service? =

No. Setup uses a manual-entry secret key compatible with any standard TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.); no QR code service or external API is involved.

= What does "Sign out everywhere" actually do? =

It destroys every active WordPress session token for that account using the native session-token API, the same mechanism behind core's own "Log Out Everywhere Else."

= Does disabling a policy delete its saved settings? =

No. Turning a rule's "Enforce rule" switch off keeps its configured value (days, attempts, minimum length, etc.) saved and simply stops it from being evaluated at login until you turn it back on.

= Is any data sent off-site? =

Aegis stores its settings and activity log in standard WordPress options and user meta on your own database. Email notifications are sent through your site's normal `wp_mail()` configuration. If the Administrator directory displays a Gravatar avatar, the visitor's browser also requests that image from Gravatar as described in the External services section above.

== Changelog ==

= 1.3.2 =
* Documented the optional Gravatar avatar service, its data transfer conditions, and its legal links.

= 1.3.1 =
* Removed admin notice suppression so native WordPress and other plugin notices remain visible.
* Removed inline admin style and script output and tightened request-validation ordering.
* Updated plugin contributor metadata for the WordPress.org owner account.

= 1.3.0 =
* Refactored the plugin bootstrap and core class structure for WordPress coding standards compliance.
* Added complete PHPDoc coverage and improved translation annotations across the PHP codebase.
* Improved output escaping, native WordPress hook handling, and standards-compliant input processing.
* Consolidated the packaged HTML documentation and retina screenshots under the `documentation` folder.

= 1.2.0 =
* Added WPML compatibility metadata for translating saved Administrator email subject and message settings.
* Localized dynamic admin JavaScript dialogs, validation messages, pagination, notification emails, and CSV exports.
* Added locale-aware notification email markup and completed the translation coverage for the plugin's runtime interface.

= 1.1.0 =
* Added five independently configurable Administrator alert events for account creation, successful sign-in, username changes, email changes, and password changes.
* Extended the Email notifications template and recipient settings to every Administrator alert event.
* Added a responsive event-selection interface to Core controls.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.3.2 =
Documents the optional Gravatar avatar lookup used by the Administrator directory.

= 1.3.1 =
Improves WordPress.org guideline compliance by preserving native admin notices, using enqueued admin assets, and tightening request validation.

= 1.3.0 =
Improves WordPress/WPCS compliance, PHP documentation, input handling, output escaping, and packaged documentation structure.

= 1.2.0 =
Adds WPML-ready translation support across the admin interface, email notifications, CSV exports, and saved email templates.

= 1.1.0 =
Adds granular user-account security alerts using your existing email notification settings.

= 1.0.0 =
Initial release.
