=== Ethwebs Role Auditor ===
Contributors: sanmathiraj
Donate link: https://wayanad.co.in/wordpress-plugins/
Tags: security, audit, user roles, admin alert, privilege escalation
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight, zero-bloat security auditor that monitors user roles, catches direct database SQL injection admin additions, and displays on-screen and emailed security reports.

== Description ==

**Ethwebs Role Auditor** is an ultra-lightweight, zero-bloat security tool specifically built to catch privilege escalation and unauthorized administrator account creations—even when performed via direct database SQL injection attacks that bypass standard security plugins.

Most security logging plugins create heavy custom database tables and rely strictly on standard WordPress hooks (`wp_login`, `user_register`). When attackers exploit database vulnerabilities, they insert rows directly into `wp_users` and `wp_usermeta`, bypassing WordPress hooks entirely.

Ethwebs Role Auditor addresses this by running direct, prefix-aware SQL database queries during scheduled background audits to count and identify every single user account holding administrator capabilities.

### Key Features:
* **Direct Database SQL Audit:** Queries the database directly to detect unauthorized administrator accounts added via SQL injection.
* **On-Screen Security Reports:** Displays clean, structured audit tables directly inside the WordPress dashboard upon manual check.
* **Multiple Recipient Notifications:** Enter single or comma-separated email addresses to notify your security team.
* **Attacker Exclusion Protection:** Intelligently strips newly promoted/attacker email addresses from receiving security alerts.
* **Manual "Run Check Now" Audit:** Trigger an instant on-demand database scan directly from your settings panel.
* **Instant Role Elevation Alerts:** Receive email notifications whenever a user is created or promoted to Administrator or Editor.
* **New Admin Login IP Detection:** Lightweight transient-based IP tracking notifies you when an administrator accesses the dashboard from a new IP address.
* **Zero Database Bloat:** Creates zero custom database tables and runs cleanly in the background.

== Installation ==

1. Upload the `ethwebs-role-auditor` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Navigate to **Settings > Ethwebs Role Auditor** to configure recipient emails and alert preferences.
4. Click **Run Check Now & Send Email** to view a live security audit report directly on screen.

== Frequently Asked Questions ==

= Do I need an SMTP plugin configured for this plugin to work? =
No. While email reports are sent out in the background, manual audit checks display a full, structured audit table (including user role counts and active admin user IDs) directly on your settings page inside the WordPress dashboard.

= How does this plugin detect attacks that bypass standard security plugins? =
Most security plugins rely strictly on standard WordPress action hooks (like `wp_login`). When attackers use SQL injection vulnerabilities, they write administrative users directly into database tables (`wp_users` and `wp_usermeta`), completely bypassing the WordPress hook layer. Ethwebs Role Auditor executes a direct SQL database query against your actual database table prefix to count and identify every single user account holding `administrator` capabilities, catching silent database modifications instantly.

= What happens if an attacker creates an admin account with their own email address? =
Ethwebs Role Auditor features an Attacker Exclusion Safeguard. When an instant role elevation alert fires, the plugin checks the promoted user's email address against your notification list and strips out the attacker's email, ensuring they never receive security warnings about their own activity.

= Can I send alerts to multiple team members? =
Yes. You can enter multiple comma-separated email addresses (e.g. `admin@site.com, security@site.com`) in the Notification Email field under **Settings > Ethwebs Role Auditor**.

= Will this plugin slow down my site or bloat my database? =
No. Unlike standard activity log plugins that write thousands of rows to your database every time a page is loaded, Ethwebs Role Auditor is zero-bloat. It creates zero custom database tables. Cron checks run lightly in the background once per day, and temporary session IP tracking uses standard auto-expiring WordPress transients.

== Changelog ==

= 1.0.0 =
* Initial release. Features direct database auditing, on-screen dashboard report displays, comma-separated multiple email recipients, attacker exclusion safeguard, manual audit check trigger, and IP tracking.