=== Blog Cutter Smart Security Management ===
Contributors: blgctterai
Tags: security, firewall, login, captcha, 2fa
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.1.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Helps reduce automated abuse with a visitor challenge, login shields, optional two-factor authentication, local hardening, and logs.

== Description ==

Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.

The plugin can:

* Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes
* Rate-limit unique URLs per IP and log the event
* Add a math check and lockout to the login form
* Hide wp-login.php behind a secret slug (optional)
* Protect comments and user registration with a math check and honeypot
* Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)
* Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers
* Block common exploit probes in the request URI (local pattern list)
* Store security events (IP, user agent, URL) in your database for a limited time
* Run a local health checklist and let administrators revoke sessions

This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.

= How to configure =

1. After activation, open **Blog Cutter Security** in the admin menu.
2. Review **Settings**. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).
3. Optional: enable two-factor authentication on each administrator **Profile**.
4. Optional: **Magic Login** — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.
5. If you hide the login URL, bookmark the secret slug. Locked out? Add `define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );` to wp-config.php, or deactivate the plugin over FTP / file manager.

= Privacy =

When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools → Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.

= Third-party services =

None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only.

== Installation ==

1. Upload the `blog-cutter-smart-security-management` folder to `/wp-content/plugins/`
2. Activate **Blog Cutter Smart Security Management**
3. Open **Blog Cutter Security** and review Settings, Health, and Logs
4. Enable two-factor authentication from your Profile if you want it

== Frequently Asked Questions ==

= Will search engines still index the site? =

Trusted crawler user agents can skip the visitor gate. Optional reverse-DNS verification is available for stricter checks.

= Can I require a challenge for every guest? =

Yes. Set Gate mode to “Always challenge guests”.

= Why is REST lockdown off by default? =

Locking the REST API for anonymous users can break forms, blocks, and shopfronts. Enable it only if you have tested those features.

= Does this plugin update itself from another server? =

No. Updates should come from WordPress.org after the plugin is hosted there, or from the zip you install.

= I hid the login URL and cannot sign in =

Add `define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );` to wp-config.php, or deactivate the plugin over FTP / file manager.

== Screenshots ==

1. The dashboard shows protection status and events from the last 24 hours.
2. Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication.
3. Security logs stay in your database. Filter them and export a CSV.
4. Magic login stays locked until an email delivery test succeeds.
5. The health screen runs local checks and does not contact a remote service.
6. Administrators can review and revoke active sessions.

== Changelog ==

= 2.1.4 =
* Prevent early translation loading notice in WordPress 6.7+ by moving cron scheduling to the init hook
* Guarded cron_schedules display text to avoid calling translation functions before the init hook
* Guarded early firewall block messages against early translation calls

= 2.1.3 =
* Resolved activation fatal error by ensuring BLOGCUSM_Uploads::ensure_uploads_rules() is defined
* Safely preserves and appends existing rules in uploads/.htaccess using WordPress core markers (insert_with_markers)
* Cleans up plugin rules and markers upon deactivation and uninstall

= 2.1.2 =
* Removed standalone emergency unlock helper file in compliance with directory guidelines
* Removed disallow_file_mods setting to ensure uninterrupted WordPress core and plugin updates
* Replaced runtime secret login define with static request state
* Added file extension validation for settings JSON import
* Added HTML escaping for challenge fields

= 2.1.1 =
* Replaced runtime constant defines (DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS) with WordPress core map_meta_cap and file_mod_allowed filters
* Comprehensive input sanitization and validation across $_SERVER, $_POST, and $_FILES arrays
* Safe settings import using WordPress core wp_json_file_decode

= 2.1.0 =
* Unique 8-character plugin prefix, nonce checks on form handlers, and admin notices limited to plugin/profile screens

= 2.0.0 =
* Aligned headers, readme, and copy with WordPress.org plugin guidelines
* Added local TOTP two-factor authentication, health checks, session revocation, and GDPR export/erase
* Added registration and password-reset protection, optional login alerts, and settings export/import
* Safer defaults for anonymous REST lockdown, application passwords, and HSTS
* Magic login now requires a confirm click; emergency unlock no longer disables other plugins
* Challenge tokens no longer use Base64; styles are printed through WordPress APIs

= 1.1.1 =
* Hidden login, WAF, and hardening updates

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 2.1.4 =
Prevents WordPress 6.7+ early translation notices by moving cron scheduling to init and guarding cron schedules.

= 2.1.3 =
Fixes activation fatal error and safely preserves and appends uploads/.htaccess configuration using WordPress core markers.

= 2.1.2 =
Removes legacy helper file, removes file mod restrictions to maintain core update support, and eliminates automatic uploads filesystem writes.

= 2.1.1 =
Uses WordPress core capability and file_mod_allowed filters for file editing and modification restrictions, and strengthens input sanitization.

= 2.1.0 =
Uses a longer unique prefix for functions, options, and hooks. Existing settings are migrated automatically.

= 2.0.0 =
Adds two-factor authentication, a local health check, and privacy tools. Review Settings after update. Magic login links now require a confirm click.
