=== Defenora Secure Shield ===
Contributors: solankisoftware
Tags: security, login, brute-force, hardening, activity-log
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Login protection, brute-force lockouts, hardening, integrity scans, activity logs, and a transparent security score. Not a malware guarantee.

== Description ==

Defenora Secure Shield is a free WordPress security plugin for site administrators. It is designed for the WordPress.org Plugin Directory: no trialware lockouts of core features, no hidden tracking, and no automatic file or database deletion.

Scanning and scoring report only the checks this plugin can run. They do **not** mean a website is fully secure or free of malware.

= Dashboard =

* Overall security score with clear bands (excellent through critical improvements recommended)
* Counts of critical issues, warnings, and passed checks
* Module status: login protection, hardening, file integrity, security headers, XML-RPC, REST API
* Last scan time, last security event, blocked login count, stored event count
* Quick Scan and Full Scan with live percentage progress
* After each scan: full report, failed issues found, and fatal scan-step errors (if a step crashed)
* The plugin never displays “your website is 100% secure”

= Security score =

* Transparent weighted checks (HTTPS, file editor, XML-RPC, debug mode, login protection, administrators, REST API, headers, sensitive files, debug.log)
* Each check explains what was tested, why it matters, the current result, and a recommended action
* Hardening is never applied silently; administrators apply or revert it

= Login security and brute-force protection =

* Tracks successful logins, failed logins, logouts, and password reset requests
* Temporary lockouts by IP and by username (never permanent automatic blocks)
* Configurable failed-attempt threshold and lockout duration
* Login cooldown and rate limits for login and password-reset requests
* Optional generic login errors (does not hide lockout or rate-limit messages)
* Optional idle session timeout (off by default)
* Force logout of another user’s sessions from the Users screen
* Trusted IPs (never lock) and trusted proxies (X-Forwarded-For only if REMOTE_ADDR matches)
* Usernames that should never be locked
* Emergency bypass: `define( 'SWSS_DISABLE_LOGIN_PROTECTION', true );` in `wp-config.php`

= Rate limiting =

* Login and lost-password request limits (transients / object cache)
* Unauthenticated REST **write** requests (GET/HEAD/OPTIONS are not limited, so public content and WooCommerce reads keep working)
* XML-RPC is not hard-killed; login protection still applies to XML-RPC authentication

= WordPress hardening (optional, reversible) =

* Disable the plugin and theme file editors
* Hide the WordPress generator tag and core asset `ver` query args (plugin/theme cache-busting is left intact)
* Disable XML-RPC, or leave it on and block `system.multicall` (default: multicall blocked, XML-RPC still enabled)
* REST API: unchanged (default), require login for sensitive routes, or restrict most guest REST access (with public/WooCommerce allowlists)
* Compatibility impact is explained on the Hardening screen before you enable a control
* Plugin-managed values can be restored; `.htaccess` is not edited automatically

= Security scanner =

* **Quick Scan:** high-impact configuration checks, with a progress percentage per step
* **Full Scan:** configuration checks plus core/plugin/theme integrity, suspicious file patterns, user audit, database checks, and security headers
* Report includes score, failed issues, fatal step errors, full check list, and suspicious-file findings
* Scans are read-only: no automatic file deletion, plugin/theme deactivation, or database cleanup
* Scheduled scans: off (manual only), daily, or weekly via WP-Cron (default weekly); overlapping scans are prevented
* Official WordPress.org checksums are used when available; if the checksum service is down, that is **not** treated as a compromise

= File integrity and suspicious code =

* Compares WordPress core (and WordPress.org plugins/themes when checksums exist) using official APIs over HTTPS
* Flags PHP in uploads and conservative local patterns (for example dangerous PHP constructs). Terminology is “potentially suspicious,” not a confirmed malware verdict
* Scanned PHP is never executed (`eval` is not used to test files)
* Recommended action is review/quarantine, not automatic delete

= User security =

* Lists usernames, roles, registration dates, and last login when this plugin has observed a login
* Highlights administrator accounts, the default `admin` username, recently created administrators, and unusual capabilities
* Never displays passwords, hashes, cookies, or other secrets

= Database checks =

* Administrator capability rows, autoloaded options size, mixed site URL protocols, incomplete user rows
* Does not display password hashes, API keys, salts, or tokens
* Does not delete options or users automatically

= Security headers and HTTPS =

* Checks Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, and X-Frame-Options (front-end request during full scan)
* Optional sending of **safe** headers from WordPress (`send_headers`); skipped in wp-admin and skipped if a header is already present
* Aggressive CSP is off unless you enable it; test thoroughly
* HTTPS recommendations only; the plugin does not install certificates

= Activity logs =

* Events such as login success/failure/block, logout, password reset/change, user create/delete, role changes, plugin/theme/core events, hardening and setting changes, scans
* Fields: ID, time (UTC), type, severity (INFO–CRITICAL), user ID, optional IP and user agent, description
* Search, event type, severity, date range, pagination
* Passwords and secrets are never logged

= Privacy =

* Optional IP and user-agent logging
* Retention period and automatic log cleanup (WP-Cron)
* WordPress personal data export and erase integration
* Optional “delete all plugin data on uninstall” (off by default)
* No telemetry and no phone-home. Full scans may contact WordPress.org checksum endpoints over HTTPS

= Notifications =

* Optional emails: administrator login, repeated failed logins, scan completed, critical findings, setting changes
* Cooldown to avoid email floods
* Uses `wp_mail()` and the site admin email unless you set another address

= Tools and diagnostics =

* Run scans, export logs (CSV), clear logs, reset plugin settings (confirmation required)
* Diagnostics: WordPress/PHP/database versions, theme, plugin count, memory limit, WP-Cron, HTTPS, REST mode, XML-RPC, file permissions, object cache — no secrets
* Copy or download a safe diagnostics text file

= Requirements =

* WordPress 6.2 or later
* PHP 8.0 or later
* Capability `manage_options` (or network options in network admin on multisite)

The free plugin is meant to be useful on its own. It does not disable essential protection to force an upgrade.

== Installation ==

1. Upload the `defenora-secure-shield` folder to your WordPress plugins directory (or install the ZIP from **Plugins → Add Plugin**).
2. Activate **Defenora Secure Shield** on the Plugins screen.
3. Open **Secure Shield** in the WordPress admin menu.
4. Run a **Quick Scan**, then review **Login Security** and **Hardening**.
5. Apply hardening one control at a time and test the block editor, WooCommerce, Jetpack, and any XML-RPC or REST integrations you use.

= Recommended first configuration =

1. Keep login protection and brute-force protection enabled (they are on by default).
2. Set failed-attempt and lockout values you can recover from.
3. Optionally add a trusted office IP and/or usernames that must never be locked.
4. Leave REST API mode on **unchanged** unless you understand the impact.
5. Do not enable a strict Content-Security-Policy until you have tested the front end and wp-admin.
6. Leave **Delete all plugin data on uninstall** off unless you want a clean removal later.

== Frequently Asked Questions ==

= Does a high score mean the site is secure? =

No. The score only reflects checks Defenora Secure Shield can run. It does not prove the absence of malware, vulnerabilities, or misconfiguration outside those checks.

= I am locked out of wp-admin. What should I do? =

Lockouts are temporary. You can:

* Wait until the lockout duration expires
* Connect from a trusted IP if you configured one
* Rename or remove the `defenora-secure-shield` folder over SFTP/FTP
* Add this line to `wp-config.php` above “That’s all, stop editing!”:

`define( 'SWSS_DISABLE_LOGIN_PROTECTION', true );`

Then sign in, unblock the IP or username under **Login Security**, and remove the constant when finished.

= Will this plugin break Gutenberg, WooCommerce, or the WordPress mobile apps? =

Not with the default settings. REST API stays unchanged. Guest REST **reads** are not rate-limited. XML-RPC remains enabled with `system.multicall` blocked. Disabling XML-RPC entirely, restricting REST, or sending a strict CSP can break integrations — those options explain the risk on screen.

= Does the plugin send data to the plugin author? =

No. There is no telemetry. During integrity scans the site may request official checksum JSON from WordPress.org over HTTPS. If that request fails, the plugin reports “not checked,” not a compromise.

= Does it delete malware or clean the database automatically? =

No. Scans are read-only. You must review findings yourself. The plugin will not delete files, drop tables other than its own (and only on uninstall if you opted in), or remove WordPress users or options as a “cleanup.”

= Can it permanently block an IP? =

No. Automatic lockouts always expire. Administrators can unblock an IP or clear all lockouts from **Login Security**.

= What database tables does it create? =

Only plugin tables: `{prefix}swss_events` (activity log) and `{prefix}swss_lockouts` (temporary lockouts). It does not alter core WordPress tables except reading them for checks and writing its own options, user meta for last login/activity, and transients for rate limits.

= What happens on uninstall? =

By default, settings and tables are kept. If you enable **Delete all plugin data on uninstall**, the plugin removes its options, transients, cron events, and those two tables only.

= Who can access the settings? =

Users with `manage_options` (typically administrators). Subscribers, contributors, authors, and editors cannot manage the plugin. On multisite, network admin uses `manage_network_options` in the network admin.

= Why did a scan show a fatal error? =

A single scan step encountered a PHP error (for example an unreadable directory). That step is skipped; the rest of the scan continues. The site is not modified. The report lists the step name. With `WP_DEBUG` enabled, a short error detail may appear; stack traces are not shown to visitors.

== Screenshots ==

1. Dashboard — security score, module status, Quick Scan / Full Scan, and recommendations
2. Scanner — live progress percentage and full report (failed issues, fatal errors, complete check list)
3. Login Security — thresholds, trusted IPs/proxies, lockout list, unblock, emergency recovery notes
4. Hardening — reversible controls with compatibility impact for XML-RPC, REST API, and the file editor
5. File Integrity — core, plugin, and theme checksum results
6. Activity Logs — search, type, severity, and date filters
7. Users — role audit and force logout (no password hashes)
8. Tools — diagnostics export without secrets

== Changelog ==

= 1.0.1 =
* Stepped Quick Scan and Full Scan with live percentage and current step label
* Full scan report: failed issues found, fatal scan-step errors, and complete check list
* Progress UI on Dashboard, Scanner, File Integrity, and Tools

= 1.0.0 =
* Initial release: dashboard, score, login/brute-force protection, rate limits, hardening, XML-RPC and REST options, integrity and suspicious-file scans, user and database checks, headers, HTTPS recommendations, activity logs, privacy tools, notifications, scheduled scans, diagnostics, and uninstall cleanup option

== Upgrade Notice ==

= 1.0.1 =
Improves scans with progress percentage and a full report of failed issues and fatal step errors.

= 1.0.0 =
Initial release.
