=== DamaSoft Email Security ===
Contributors: damasoft
Tags: email security, woocommerce, abandoned cart, disposable email, dns
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Local recipient-domain protection for WordPress mail, WooCommerce checkout and CartFlows abandoned carts. No external web service.

== Description ==

DamaSoft Email Security reduces messages sent to malformed, disposable, blacklisted or mistyped recipient domains. Its core WordPress mail protection works independently and has no required plugin dependency. When WooCommerce or the official CartFlows Cart Abandonment Recovery plugin is present, their specific checkout and recovery flows are protected automatically.

The plugin does not claim to verify whether an individual mailbox exists. That would require sending data to an external verification service. Instead, it combines checks that can run locally and transparently:

* WordPress email-syntax validation.
* Manual address and domain allow/block lists.
* A local list of common disposable-email domains.
* Typo suggestions for well-known providers.
* Cached DNS checks for MX, A and AAAA records.
* Conservative fail-open DNS mode to reduce false positives during temporary resolver outages.

= Outgoing WordPress mail =

The plugin checks To, Cc and Bcc recipients before PHPMailer sends a message. Certainly invalid recipients are removed from mixed recipient lists. When all routing recipients are invalid, the send is intentionally short-circuited as successful so queue and recovery plugins do not retry forever.

= WooCommerce =

This integration is optional. When WooCommerce is active, both classic checkout and the Checkout Block are validated on the server. A lightweight front-end helper can suggest corrections such as `gmail.dcom` to `gmail.com`, but the server remains the source of truth.

= CartFlows Cart Abandonment Recovery =

This integration is optional. When CartFlows Cart Abandonment Recovery is active, verified capture requests are checked before an invalid address reaches the recovery queue. A scheduled cleanup can also mark existing bad rows as unsubscribed without deleting CartFlows statistics. The integration deliberately touches only the official `cartflows_ca_cart_abandonment` table after verifying its schema.

= Smart control centre =

The modern administration area separates the operational dashboard, allow/block rules, settings and filtered security log into focused submenu screens. The dashboard keeps live counters, system health, quick actions and frequent offenders immediately visible. A compact WordPress dashboard widget gives a useful summary without loading assets on unrelated admin pages.

= Privacy by design =

No data is sent to DamaSoft or to an external HTTP service. DNS checks send only the domain portion of an address to the DNS resolver configured by the hosting provider. The security log stores blocked or uncertain addresses only; successful mail is not copied. Checkout IP addresses are anonymized, retention is configurable, and WordPress personal-data export and erasure tools are supported.

== Installation ==

1. Back up the site before replacing a production security plugin.
2. Upload the ZIP through Plugins > Add New > Upload Plugin.
3. Activate DamaSoft Email Security.
4. Open DS Email Security in the WordPress admin menu.
5. Review the allow/block lists and protection settings.

When upgrading from DAMA Email Security 2.x, the new plugin preserves the existing options and `dama_email_logs` table. During activation it deactivates the active 2.x predecessor so the two versions cannot filter the same message twice.

== Frequently Asked Questions ==

= Does this prove that a mailbox exists? =

No. It validates syntax, rules, disposable domains, common provider typos and the recipient domain's public mail records. It never sends a probe message and does not use a third-party verification API.

= Could a temporary DNS problem block a real customer? =

New installations use conservative DNS mode: DNS-only failures are logged as warnings and allowed. Strict DNS mode is available to administrators who explicitly prefer blocking. Upgrades from version 2.x preserve the previous strict behaviour until the setting is changed.

= Does it require WooCommerce or CartFlows? =

No. Core outgoing WordPress mail protection, local rules, disposable-domain checks, typo detection, DNS checks and the security log work on a standard WordPress installation. WooCommerce and CartFlows are optional integrations: the plugin enables their dedicated safeguards only when those plugins are present.

= Does it support WooCommerce Checkout Blocks? =

Yes. The plugin performs server-side validation for Store API checkout requests in addition to the classic checkout hook.

= What happens to a CartFlows abandoned cart? =

A certainly invalid address is prevented from entering a verified capture request. Existing supported rows are marked as unsubscribed, not deleted, so CartFlows statistics remain available and future recovery messages stop.

= Does it send data to DamaSoft? =

No. There is no telemetry and no external HTTP request. DNS lookups use the hosting server's configured resolver and contain only a domain name.

= What is removed on uninstall? =

The plugin removes its scheduled jobs, settings, DNS cache entries and security-log table. Deactivation alone does not remove data.

== Screenshots ==

1. Modern control centre with live metrics and system health.
2. Responsive control centre on a narrow WordPress admin viewport.
3. Compact WordPress dashboard widget with recent blocked events.
4. Local allow and block rules with clear address and domain controls.
5. Filterable security log that separates cases from repeated automatic checks.
6. DNS, WooCommerce, CartFlows, typo-helper and retention settings.

== Changelog ==

= 3.2.0 =

* Clarified that repeated CartFlows and checkout activity represents automatic checks, not people, orders or manual attempts.
* Changed dashboard totals to count distinct daily security cases instead of inflating them with repeated automatic checks.
* Kept the raw check count in the detailed log and now shows both first and latest detection times.
* Separated log grouping by source and stable validation result so unrelated protection flows can no longer merge into one row.
* Fixed all-invalid outgoing mail so WordPress receives an intentional successful short-circuit after recipient filtering, preventing avoidable retry loops.
* Added correct protection for Bcc-only and Cc-only WordPress messages.
* Improved singular Italian status labels and the wording of dashboard, widget, log and privacy information.
* Added the dedicated public plugin-details URL; translations are delivered through WordPress.org language packs instead of compiled catalogs in the ZIP.

= 3.1.0 =

* Split the control centre into dedicated Dashboard, Rules, Settings and Log submenu screens.
* Added clear dashboard shortcuts and updated widget and Plugins-screen links to open the correct section.
* Kept each action, notice, filter and pagination flow inside its relevant section.
* Reduced unnecessary database work by loading log queries only on the Log screen.

= 3.0.2 =

* Translated legacy `allowed` security-log statuses and added their filter and visual style.

= 3.0.1 =

* Added the bundled Italian translation for the plugin description shown on the Plugins screen.

= 3.0.0 =

* Renamed the plugin to DamaSoft Email Security with the DS Email Security menu label.
* Rebuilt the administration dashboard and WordPress dashboard widget.
* Added a dedicated DamaSoft email-shield logo while keeping a standard Dashicon in the WordPress menu.
* Added safe migration from the original 2.x single-file plugin without deleting settings or logs.
* Added conservative DNS mode for new installations while preserving strict mode on upgrades.
* Added To, Cc and Bcc filtering and stopped storing successful-recipient logs.
* Added server-side WooCommerce Checkout Block support.
* Hardened CartFlows capture interception with nonce validation and exact integration targeting.
* Fixed full cleanup pagination and removed the unsafe fallback that could touch unrelated cart tables.
* Added anonymized IP logging, configurable retention, privacy-policy text, exporter and eraser.
* Replaced dynamic SQL identifiers with WordPress placeholders and protected admin actions with redirects and nonces.
* Added clean uninstall handling, translation support and WordPress.org metadata.

== Upgrade Notice ==

= 3.2.0 =

Clarifies repeated automatic checks and fixes outgoing-mail suppression. Existing settings and log rows are preserved; dashboard totals now represent distinct security cases.

= 3.1.0 =

Introduces a clearer submenu-based administration layout. Protection behaviour, settings and stored data are unchanged.

= 3.0.2 =

Displays preserved legacy allowed events in the site language. Existing log rows are not changed or deleted.

= 3.0.1 =

Adds the Italian translation for the plugin description. No settings or data are changed.

= 3.0.0 =

Major interface and security upgrade. Existing settings and logs are preserved. Back up production before installing, then activate the new plugin; the active 2.x predecessor is deactivated automatically to avoid duplicate filtering.
