=== ClarityGuard ===
Contributors: RFDizon, freemius
Tags: security, scanner, vulnerability, ai, hardening
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.5.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scans your WordPress site for security issues and explains them in plain English — with one-click fixes on Pro.

== Description ==

Most security plugins tell you *that* something is wrong. ClarityGuard tells you what it means and what to do about it.

**Free features:**

* Outdated WordPress core / plugin detection
* Known-vulnerability lookup (optional, bring your own WPScan API token)
* File permission checks on key WordPress files/folders
* Publicly exposed file detection (debug logs, backup files, .env, etc.)
* Default "admin" username detection
* Weekly automated scan with an email summary
* Plain-English explanation and fix steps for every finding
* "Explain with AI" per finding and an AI-generated incident report, once you add your own Anthropic API key under AI Settings (fully optional -- everything else works with zero API keys)

**Pro:**

* One-click, reversible auto-remediation for safe fixes
* AI-generated, client-ready incident reports
* Malware / file-integrity diffing with AI-assisted triage
* Multi-site agency dashboard

== Installation ==

1. Upload the `clarityguard` folder to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress.
3. Go to "ClarityGuard" in the admin menu and click "Run Scan Now".

== Frequently Asked Questions ==

= Does this replace Wordfence/Sucuri? =

No — this is not a firewall or malware scanner replacement. It's a plain-English triage and remediation layer, and works well alongside a firewall plugin.

= Does the free version require any API keys? =

No. Every free-tier check runs entirely locally. The known-vulnerability lookup is optional and only runs if you add your own WPScan API token in settings.

== External services ==

This plugin can optionally connect to the following third-party services. None of them are contacted unless you explicitly enable the feature and provide your own API key/token — every free-tier scan and check runs entirely locally with zero external calls.

**Anthropic (Claude)** — used to generate the plain-English "Explain with AI" text and AI incident reports, if you choose Anthropic as your AI provider under AI Settings and supply your own API key. When you click "Explain with AI" or "Generate AI Incident Report," the relevant finding text (issue title, description, and site name) is sent to Anthropic's API to generate the explanation; no data is sent otherwise.
[Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) | [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy)

**OpenAI** — used the same way as Anthropic above, if you choose OpenAI as your AI provider under AI Settings and supply your own API key. The same finding text is sent to OpenAI's API only when you click "Explain with AI" or "Generate AI Incident Report."
[OpenAI Terms of Use](https://openai.com/policies/row-terms-of-use/) | [OpenAI Privacy Policy](https://openai.com/policies/row-privacy-policy/)

**WPScan** — used for the optional known-vulnerability lookup, if you add your own WPScan API token under Settings. When enabled, this plugin sends the slugs of your active plugins to the WPScan API to check them against the WPScan vulnerability database; no other site data is sent.
[WPScan Terms of Service](https://wpscan.com/terms/) | [WPScan Privacy Policy](https://automattic.com/privacy/) (WPScan is an Automattic property)

== Screenshots ==

1. The security report: findings grouped by severity, each with a one-click AI explanation and, on Pro, a one-click Auto-Fix button.
2. AI Settings: choose Anthropic or OpenAI, paste your own API key, and use the built-in guide if you have never created one before.

= 0.5.1 =
* Fixed leftover "Security Copilot" text from the pre-rename plugin name still showing in the admin menu and two AI-provider error messages.
* Live-verified real Freemius licensing end to end: opt-in, license activation, and Auto-Fix correctly unlocking on Pro.

= 0.5.2 =
* Moved uninstall cleanup (dropping plugin tables, deleting options) from a standalone uninstall.php into Freemius's after_uninstall hook, per their deployment requirements. No user-facing change.

= 0.5.3 =
* Renamed all internal identifiers (classes, functions, options, database tables, AJAX actions) from the CG_/cg_ prefix to CGARD_/cgard_, to meet the WordPress.org four-character-minimum prefix guideline. No user-facing change.
* Auto-remediation ("Auto-Fix"/"Undo") is now packaged as Pro-only code that is not included in the free version at all, rather than being included but disabled by a license check, per WordPress.org's guidelines on locked functionality. Free-tier scanning, AI explanations, and reports are unaffected.
* Documented all third-party services (Anthropic, OpenAI, WPScan) this plugin can optionally connect to, including what data is sent and links to each provider's terms and privacy policy.
* Removed a few unnecessary WordPress core file includes and a hardcoded wp-content path assumption; removed the now-unnecessary load_plugin_textdomain() call (translations are loaded automatically for WordPress.org-hosted plugins since WP 4.6).

= 0.5.4 =
* All custom-table SQL now uses $wpdb->prepare()'s %i identifier placeholder for table names instead of interpolating them directly into the query string, closing several PreparedSQL findings from an automated Plugin Check scan. Raised "Requires at least" to WP 6.2, since %i requires it.
* No user-facing change.

== Changelog ==

= 0.5.5 =
* Fixed: the outdated-plugins check could keep reporting "no findings" even when updates were genuinely available, because it relied on WordPress core's own throttled update check (wp_update_plugins()), which silently reuses whatever it found on its last run for up to 12 hours -- including a stale empty result. "Run Scan Now" now forces a fresh check every time via delete_site_transient('update_plugins') before checking, so results are always live.

= 0.5.0 =
* Added Freemius licensing integration scaffold: CG_License::is_pro() now checks a live Freemius license first (once the SDK is installed and configured — see FREEMIUS-SETUP.md), falling back to the existing developer constant / filter seam so nothing changes for sites that don't have it configured yet.
* No visible changes for existing installs until Freemius credentials are added; this lays the groundwork for real Pro purchases/renewals instead of the CG_FORCE_PRO developer-only override.

= 0.4.0 =
* Added one-click Auto-Fix for safe, narrowly-scoped findings: file permission fixes (fully reversible via an Undo button), deleting known-safe exposed files (stock readme.html, debug.log), and plugin auto-updates.
* Every applied fix is written to an audit log (new cg_fix_log table) with before/after state, whether or not it's revertible.
* Deliberately left unfixable from here: the default-admin-username finding, core version updates, and CVE findings, plus .env / wp-config.php.bak (too risky to auto-delete something that might be the only copy of a needed secret/backup).

= 0.3.0 =
* AI layer is now provider-agnostic: choose Anthropic (Claude) or OpenAI on the AI Settings page. Existing v0.2.0 Anthropic keys keep working automatically.

= 0.2.0 =
* Added optional AI layer: per-finding "Explain with AI" and a one-click AI-generated incident report, backed by the Anthropic Messages API.
* New AI Settings page for the API key/model (or define CG_AI_API_KEY in wp-config.php to keep it out of the database).
* AI responses are cached (30 days) per finding/report so repeat views don't re-spend API calls.

= 0.1.0 =
* Initial MVP: core scanner, five checks, admin report page, weekly email summary.
