=== east115 Account Guard ===
Contributors: east115
Tags: login, security, membership, concurrent-login, device-binding
Requires at least: 5.2
Tested up to: 7.1
Requires PHP: 7.2
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Limit one account to real owners. Stop account sharing on membership sites.

== Description ==

Membership sites lose revenue every day to shared accounts — one login passed around an office, posted in a group chat, or resold. This plugin limits account sharing using WordPress native session management (WP_Session_Tokens). No polling, no extra server load.

Three configurable strategies:

* **Kick oldest (kick, default)** — a new login instantly terminates all other sessions of that account. The old device is logged out on its next request. Smoothest experience, similar to single-device streaming policies.
* **Exclusive online (deny)** — while any device is active, new-device logins are rejected outright. Strictest mode.
* **Device binding limit** — each account can bind up to N devices (default 2), slots auto-release after X days (default 30). An anonymous device identifier cookie is set on first login.

More features:

* Heartbeat detection: every visit refreshes activity time (60-second write throttle, no slowdown)
* Admin exemption: administrators can bypass all restrictions
* Unbind tool: one click in the admin to clear a user's device bindings and force all devices offline — perfect for device-change appeals
* Zero external dependencies: no third-party requests, all data stays in your database

The plugin interface is written in Chinese and fully internationalized (text domain: `east115-account-guard`). Translations for other languages are welcome via translate.wordpress.org.

== Installation ==

1. Upload and activate the plugin in the admin.
2. Go to Settings - Prevent Account Sharing, pick a strategy and device limit.
3. To handle device-change appeals, use the unbind tool at the bottom of the settings page.

== Frequently Asked Questions ==

= A member changed phones and is now locked out. What now? =

Go to Settings - Prevent Account Sharing, enter the user's ID or login name in the unbind tool, and clear their bindings. They log in again on the new device.

= Does clearing browser cookies count as a new device? =

Yes. The device identifier lives in a browser cookie; clearing cookies, switching browsers, or incognito mode all register as new devices. This is the intended anti-sharing behavior. Legitimate users can be unbound by an admin.

= Does this plugin set cookies? =

Yes. One anonymous cookie named `eastacgu_device` (random 32-character hex string, HttpOnly, one-year lifetime). It only distinguishes devices, contains no personal information, and is never sent to third parties.

= Will it slow down my site? =

No. Heartbeat writes are throttled to once per 60 seconds per session; every check uses native WordPress sessions and user meta. No polling, no external requests.

== Privacy ==

This plugin collects and transmits no personal data. The only data stored is an anonymous device-identifier cookie (`eastacgu_device`) in the browser and device binding timestamps in user meta. Uninstalling removes all settings and binding data.

== Changelog ==

= 1.2.1 =
* Removed the Author URI header (connection to the site is restricted for some regions, which triggered a review error)
* Renamed all function/class/option/menu prefixes from `pas_` to the unique `eastacgu_` prefix (previous prefix was too short and risked conflicts)
* Added automatic migration of settings, device bindings, and device cookies from versions 1.2.0 and earlier

= 1.2.0 =
* Renamed to a distinctive name and slug: east115 Account Guard / east115-account-guard
* Removed load_plugin_textdomain() — translations auto-load for WordPress.org-hosted plugins since WP 4.6

= 1.1.0 =
* Added internationalization (i18n) — all strings translatable
* Added uninstall cleanup (uninstall.php)
* Added plugin header metadata

= 1.0.0 =
* Initial release: kick-oldest, device binding limit, concurrent denial, heartbeat detection, admin exemption, admin unbind tool
