= 1.16.1 =
- Reworked filesystem location resolution to use WordPress path APIs and plugin-file-derived paths instead of operational ABSPATH and WordPress filesystem plugin-directory helpers.
- Improved support for non-standard WordPress core, content, plugins, themes, uploads, and home-directory layouts, including safer .htaccess location handling.
- Reworked direct database queries to use prepared wpdb statements, including %i placeholders for table and column identifiers and placeholders for all dynamic values.
- Added safe failure handling when required WordPress paths or .htaccess marker helpers cannot be resolved.

= 1.16.0 =
- Added optional read-only Database Malware Scanner to manual Quick and Full scans.
- Quick database scans inspect wp_options; Full database scans also inspect wp_posts.post_content and wp_postmeta.meta_value in bounded batches.
- Added context-aware behavioural detection for request-controlled PHP execution, decoder/eval chains, obfuscated external redirects, hidden external iframes, hidden-link SEO injection, and confirmed encoded payloads without requiring a remote malware-signature database.
- Added conservative context handling so ordinary post/page PHP code examples and common custom-code/analytics storage do not become malware findings solely because they contain code-like text.
- Added a separate Database findings results table, severity summary, scan-history count, JSON export section, read-only escaped excerpts, and credential/token redaction.
- Database scanning is opt-in per manual scan and does not run automatically; scanned WordPress database records are never modified by Database Malware Scanner 1.0.

= 1.15.1 =
- Added current automatic .htaccess findings directly to System Tweaks → Server Rules Protection.
- The findings table shows severity, file, line, detected rule, and a redacted matched directive.
- Automatic scans now persist their current finding snapshot separately from Audit Log history.
- Older 1.15.0 count-only scan results show an upgrade notice until the next automatic scan populates detailed findings.

= 1.15.0 =
- Added Server Rules Integrity + Auto-Heal for Hard Guard-managed .htaccess blocks with a 24-hour WP-Cron check and strict loopback verification before automatic repair is kept.
- Added Upload Directory Shield, which preserves foreign uploads/.htaccess content and adds a dedicated PHP-like execution deny block with an HTTP canary verification and rollback on server errors.
- Added a daily Suspicious .htaccess Scanner for dangerous PHP/CGI handlers, auto_prepend/auto_append directives, and execution-enabling rules in upload/cache/temp locations without automatic deletion of foreign files.
- Integrated suspicious .htaccess analysis into manual Quick and Full malware scans when the feature is enabled.
- Added Audit Log events for server-rule tampering, successful/failed Auto-Heal, and newly detected suspicious .htaccess files without repeating identical daily alerts.

= 1.14.4 =
- Removed the plugin-only administration language selector; the interface now follows the locale selected by WordPress for each user.
- Removed the separate Email language setting; global plugin emails use the WordPress site language and user-specific 2FA messages use the recipient's WordPress language.
- Removed custom gettext overrides and rely on WordPress native just-in-time loading of WordPress.org language packs.
- Retained compatibility translation of language-dependent text stored by older plugin versions without bundling translation catalogs.

= 1.14.3 =
- Removed bundled compiled translation catalogs and switched runtime translation fallback to installed WordPress.org language packs.
- Replaced direct internal plugin/content directory constant usage with WordPress directory APIs.
- Updated external-service documentation for the Hard Guard vulnerability intelligence feed.
- Disabled automatic vulnerability-feed downloads by default for new installations so external contact requires administrator opt-in.
- Corrected WordPress.org checksum-service documentation.

= 1.14.2 =
* Fixed the per-user interface language selector regression introduced in 1.14.0.
* Restored the bundled `.l10n.php` runtime catalogs required by the plugin-only language mechanism for Polish, German, Spanish, French and Italian.
* Installed WordPress.org language-pack messages now override bundled messages when available, with the bundled catalog retained as a fallback.

= 1.14.1 =
* Reduced vulnerability-database update peak memory by avoiding a second full JSON decode while the newly downloaded feed is already in memory.
* Reused stored signed-feed metadata for rollback protection and released HTTP/JSON buffers earlier during manual and scheduled database updates.

= 1.14.0 =
* Prepared the WordPress.org review package by removing bundled compiled translations and the obsolete plugin textdomain loader.
* Updated country.is external-service documentation and source repository URL.
* Removed the global PHP error-display ini override and retained read-only diagnostics.
* Replaced the plugin-managed mixed-content output buffer with the WordPress template enhancement output-buffer filter.
* Switched hardcoded wp-includes references to WPINC where applicable.
* Switched the emergency login redirect to WordPress site_url() handling for subdirectory installations.
* Expanded the Hard Guard vulnerability-feed disclosure.

= 1.13.5 =
* Fixed MySQL 8.0 compatibility for vulnerability-result storage by replacing the reserved `references` database column with `reference_urls`.
* Added upgrade migration support for existing installations that already have the legacy `references` column.
* Failed scans now display their stored database/consistency error directly in the Scanner results panel.

= 1.13.4 =
- Show the threat-intelligence feed generation time separately from the site's last successful database check.
- Display both timestamps in the WordPress-configured site timezone.
- Distinguish a newly downloaded feed from a successful manual check where the site already has the latest signed database.
- Return an explicit unchanged-feed result from the database updater so the Scanner UI can report that no newer feed was available.

= 1.13.3 =
- Check every vulnerability/outdated finding INSERT before incrementing counters.
- Fail scans on vulnerability-result persistence errors and expose table/database diagnostics.
- Reconcile summary vulnerability/outdated counts against actual stored rows before completing the scan.
- Preserve new-vulnerability state only after result persistence and consistency checks succeed.

= 1.13.2 =
* Hardened signed-feed transport verification against shared hosts/CDNs that gzip an already gzipped feed.
* GitHub Actions now requests `Accept-Encoding: identity` for public feed verification.
* Added an explicit signing-key/public-key pair check before building the feed.
* Public verification compares canonical JSON payloads rather than raw gzip transport bytes.

1.13.1 — 2026-08-11
--------------------------------
- Added a privacy-preserving current-version index to the signed Hard Guard feed for WordPress.org Core, plugins, and themes; customer sites still send no installed software inventory to Hard Guard.
- Outdated detection now prefers the downloaded signed version index and falls back to WordPress' existing local update cache only when a component is not covered.
- Vulnerable components can also be marked Outdated, so security exposure and available updates are no longer mutually exclusive findings.
- Added version-index status in Scanner settings and a warning until the production feed has been rebuilt with version records.
- Kept feed schema 1 additive/backward-compatible so existing 1.13.0 clients continue accepting the signed feed while ignoring the new optional version index.

1.13.0 — 2026-08-10
--------------------------------
- Added Vulnerability Monitoring for WordPress Core, plugins, and themes as a separate Full/Automatic Scan stage after file analysis.
- Added distinct Vulnerable and Outdated result categories; available updates are not treated as known vulnerabilities unless the installed version matches an advisory range.
- Added a signed Hard Guard vulnerability database with Ed25519 verification, 12-hour update scheduling, HTTPS-only downloads, size limits, schema validation, and fail-safe retention of the previous verified database.
- The public detached signature is fetched as `vulnerabilities-v1.sig.txt` so shared hosting cannot misclassify the signature as gzip content; legacy `.json.gz.sig` remains a compatibility fallback.
- Vulnerability-database requests use a neutral Hard-Guard-Security User-Agent and do not transmit the site URL, plugin/theme inventory, installed versions, file names, or scan results.
- Added local inventory matching for WordPress Core, installed plugins, and installed themes, including active/inactive status.
- Added HGSA/CVE identifiers, CVSS, Critical/High/Medium/Low severity, fixed version, known-exploited flag, source attribution, and advisory references.
- Added Outdated detection from the existing WordPress update cache without triggering a new plugin/theme inventory request.
- Added state tracking so unchanged vulnerability findings do not generate duplicate email alerts on every automatic scan.
- Added separate vulnerability counts to scan status, history, JSON exports, and completion notifications.
- Added a manual Update vulnerability database now action and database status in Scanner settings.
- Added the companion Hard Guard Vulnerability Feed Builder for public CVE/GitHub/CISA data, reviewed component mappings, signing, and unmapped-CVE review.

1.12.0 — 2026-08-10
--------------------------------
- Added MANUAL and AUTOMATIC Scanner modes.
- Automatic mode runs a Full Scan every configurable 1–365 days, with a 7-day default interval.
- Automatic scans execute in bounded WP-Cron batches and schedule continuation steps so large sites do not need one long PHP request.
- Added a database advisory lock around the automatic runner to prevent overlapping cron workers from processing the same scan concurrently.
- Added a next automatic scan indicator and a warning when WordPress cron spawning is disabled.
- Manual Quick Scan and Full Scan remain available even while automatic scheduling is enabled.
- Added Manual/Automatic run labels to scan details, history, audit events, and scanner notification emails.
- Switching Scanner mode to MANUAL clears pending automatic cron jobs and safely stops an in-progress automatic scan.
- Deactivation and uninstall now clear the automatic scanner start and continuation hooks.

Hard Guard Security changelog

1.11.0 — 2026-08-10
--------------------------------
- Added hardened client-IP resolution with an explicit source setting for REMOTE_ADDR, X-Forwarded-For, X-Real-IP, CF-Connecting-IP, and RFC 7239 Forwarded.
- Changed X-Forwarded-For and Forwarded processing to walk proxy chains from the server side toward the visitor and stop at the first untrusted hop.
- Added strict forwarded-header validation with 4 KB header and 32-hop limits; malformed or incomplete chains now fail safely to REMOTE_ADDR.
- Added support for quoted RFC 7239 IPv4/IPv6 for= values with optional ports.
- Added a Proxy diagnostics table showing the direct peer, trust state, selected source, received proxy headers, resolved visitor IP, and fallback reason.
- New installations now use REMOTE_ADDR only by default. Existing installations that previously configured trusted proxies are migrated to a clearly marked Legacy automatic compatibility mode until the administrator selects an explicit source.
- Updated GeoIP safety validation to evaluate the proposed client-IP source and trusted-proxy settings before saving a changed country policy.
- Added Polish translations for the new proxy hardening and diagnostics interface.

1.10.36 — 2026-08-09
--------------------------------
- Added a dedicated Audit Log → Logins & IP blocks section with 24-hour, 7-day, and 30-day statistics.
- Added failed-login and lockout trend visualization, suspicious IP ranking, and current active IP lockout details.
- Replaced the Dashboard successful-login KPI with unique blocked IPs and active IP lockouts; all security KPIs now link to detailed views.
- Changed the Audit Log Overview top-IP list to include only suspicious authentication and blocking events.
- Added Polish runtime translations for the new login-security interface.

1.10.35
- Renamed the public plugin identity from WP HARD GUARD to Hard Guard Security for WordPress.org trademark compliance.
- Changed the repository slug, plugin directory, main file, and text domain to hard-guard-security.
- Added compatibility detection for older WP HARD GUARD copies and legacy managed .htaccess marker blocks.
- Prepared the free WordPress.org edition.
- Added a voluntary PayPal donation panel limited to Hard Guard Security screens and a Donate link in the plugin row; no PayPal assets or tracking pixels load before the administrator clicks.
- Added WordPress personal-data exporter and eraser integration.
- Updated plugin headers, external-service disclosures, privacy information, and repository packaging.
- Removed the network-only header so the plugin can be activated per site or network-wide.

Earlier release history follows.

Hard Guard Security Changelog
=======================

Version 1.10.34 — 2026-07-31
--------------------------------
- Fixed Dashboard → Latest 10 Audit Log events and Audit Log event details retaining the language active when an event was recorded.
- New plugin-generated Audit Log messages are stored in a language-neutral English form and translated when displayed.
- Existing Polish, German, Spanish, French and Italian Audit Log messages, including sprintf-style messages, now follow the current Hard Guard Security interface language.
- Fixed persisted SSL redirect status messages retaining the interface language active when the SSL settings were saved; existing stored messages now follow the current user language.
- Fixed Scanner finding reasons remaining in the language used when the scan was originally saved.
- Known malware-rule labels are now stored in a language-neutral form and translated when displayed.
- Existing English Scanner results and exported JSON reports now follow the currently selected Hard Guard Security interface language.
- Expanded the built-in Help page and bundled HTML documentation with detailed 2FA, Scanner, Antispam, Audit Log, SMTP sender, security-header, File Permissions, Data hiding, Turnstile, and settings import/export guidance.
- Corrected the File Integrity Help and HTML documentation to match root-file checks, symbolic-link handling, report labels, exclusions, scan limits, retained detection metadata, and read-only behavior.

Version 1.10.33 — 2026-07-31
--------------------------------
- Fixed the per-user interface language selector not translating the plugin after a clean installation.
- Restored the bundled `.l10n.php` runtime catalogs required by the plugin-only language mechanism for Polish, German, Spanish, French and Italian.
- Added package validation that fails when any required runtime translation catalog is missing.
- Missing custom catalogs now fall back to the native WordPress translation instead of forcing the English source string.

Version 1.10.32 — 2026-07-31
--------------------------------
- Moved the permanent uninstall cleanup option out of the Data hiding panel into a separate Plugin uninstallation section.
- Clarified that uninstall cleanup is unrelated to data hiding, runs only when the plugin is uninstalled, and permanently removes stored data.
- Split the corresponding Help documentation and navigation into separate Data hiding and Plugin uninstallation sections.

Version 1.10.31 — 2026-07-31
--------------------------------
- Fixed complete-data uninstall so the enabled cleanup option now removes all eight plugin database tables, including the Scanner quarantine table.
- Added safe deletion of Scanner quarantine files, plugin-created quarantine control files, and empty standard quarantine directories.
- Removed every Hard Guard Security option, transient, network metadata record, and user metadata record by the plugin prefix, including all current and future 2FA metadata.
- Applied the main-site uninstall preference to every site in Multisite and cleaned per-site tables and options across the network.
- Ensured uninstall always clears the plugin cron hook, managed server rules where writable, and plugin capabilities even when stored data is retained.
- Expanded the Settings description to state that logs and Scanner quarantine files are permanently deleted.

Version 1.10.30 — 2026-07-31
--------------------------------
- Made Antispam country allowlists and blocklists strict policy decisions that cannot be cancelled by trusted-email score reductions or custom score thresholds.
- Added configurable handling when country.is cannot determine a country: allow, moderate comments while blocking registrations, or block every protected submission.
- Made disallowed-language and unknown-language actions direct moderation, spam, or rejection decisions rather than score additions.
- Added separate actions for detected languages outside the allowlist and for unknown language.
- The Antispam page now performs and displays a real country.is status check whenever country rules are active and warns when the lookup fails.
- Corrected Antispam privacy/source descriptions and clarified that external form plugins are outside this module.

Version 1.10.29 — 2026-07-31
--------------------------------
- Simplified country detection to use only the country.is IP-to-country API.
- Removed Cloudflare CF-IPCountry and server-side GEOIP_COUNTRY_CODE, MM_COUNTRY_CODE, and COUNTRY_CODE detection.
- Removed the Automatic/local-only GeoIP source strategy and its obsolete saved setting.
- Removed WPGUARD_DISABLE_EXTERNAL_GEOIP and WPGUARD_GEOIP_ENDPOINT support; the endpoint is fixed to https://api.country.is/.
- Updated GeoIP, Antispam, Help, and privacy text to describe the single country.is source.
- Kept 24-hour successful-result caching, 10-minute failed-result caching, site-wide fail-open behavior, the IP/CIDR recovery whitelist, and the WPGUARD_DISABLE_GEOIP emergency bypass.

Version 1.10.28 — 2026-07-31
--------------------------------
- Fixed GeoIP allowlist and blocklist policies not taking effect when Cloudflare CF-IPCountry and server GeoIP variables were unavailable.
- Added a country.is IP-to-country fallback with successful results cached for 24 hours and failed lookups cached for 10 minutes.
- Trusted Cloudflare and server GeoIP data remain preferred; external lookup failures continue to fail open to prevent accidental site-wide lockouts.
- Added WPGUARD_DISABLE_EXTERNAL_GEOIP and WPGUARD_GEOIP_ENDPOINT constants for disabling the fallback or using a compatible self-hosted endpoint.
- Updated the GeoIP settings descriptions, privacy information and bundled translations.
- Expanded privacy disclosures for author telemetry, Turnstile, SMTP credential encryption, GeoIP cache durations, Antispam separation and external GeoIP controls.
- Prevented the Settings page and unrelated settings saves from initiating external GeoIP lookups.
- The administrator-country safety check now runs only when an enabled GeoIP policy, source strategy, country list or recovery whitelist changes.
- Added an explicit Test country detection action that follows the configured source strategy and warns before country.is can be contacted.
- Added Automatic and trusted Cloudflare/server-only GeoIP strategies; local-only mode avoids external requests and per-IP GeoIP transient records on high-traffic websites.
- Cached parsed plugin settings per site for each PHP request, with Multisite-safe separation and immediate invalidation after updates.
- Cached active Audit Log alert rules per site for each PHP request and invalidate the cache after rule changes.

Version 1.10.27 — 2026-07-31
--------------------------------
- Fixed File Integrity findings remaining in the language used when an older scan result was saved.
- Previously stored Polish, German, Spanish, French and Italian File Integrity and File Permissions labels and explanations are now normalized and displayed in the currently selected Hard Guard Security interface language without requiring a new scan.

Version 1.10.26 — 2026-07-31
--------------------------------
- Fixed File Permissions Scan results displaying English status, type, and explanation text when another Hard Guard Security interface language was selected.
- Scan findings are now stored in a language-neutral form and translated when displayed, including previously saved English results from version 1.10.25.
- Localized status badges and File, Directory, and Symlink result types in all bundled languages.

Version 1.10.25 — 2026-07-31
--------------------------------
- Reworked File Integrity to compare only security-relevant WordPress root, wp-admin, and wp-includes files, excluding bundled themes, plugins, language packs, and common configuration files that caused false alarms.
- Added detection of unexpected files directly in the WordPress root as well as wp-admin and wp-includes.
- Added ADDED, MODIFIED, REMOVED, UPLOADS SCRIPT, and SYMLINK change labels with file size, filesystem modification time, and first-detected time.
- Added persistent unresolved-finding history so repeated scans keep the original first-detected timestamp.
- Added complete translations of the new File Integrity interface and findings for all bundled languages.

Version 1.10.24 — 2026-07-30
--------------------------------
- Added a dedicated Dashboard item for public PHP error-display suppression.
- The Dashboard now verifies the effective PHP runtime state and shows a warning when the server still reports error display as enabled.
- Renamed the aggregate item to Other selected System Tweaks and removed error-display suppression from its condition to avoid duplicate status reporting.

Version 1.10.23 — 2026-07-30
--------------------------------
- Made all descriptive code examples on the built-in Help screen translatable instead of leaving labels and instructions hard-coded in English.
- Added complete Polish, German, Spanish, French and Italian translations for login, GeoIP, email, 2FA, Application Passwords, Tweaks, SSL, Antispam, Scanner, Audit Log and File Integrity examples.
- Kept technical identifiers, IP examples, capability names, URLs and emergency PHP constants unchanged.

Version 1.10.22 — 2026-07-30
--------------------------------
- Fixed mixed-language emails by translating previously hard-coded subjects and field labels in security notifications, Scanner reports, Antispam digests and outbreak alerts.
- Added a global Email language setting for security notifications, Scanner reports, Antispam reports, Audit Log alerts and test emails.
- Added an upgrade migration that uses the current Hard Guard Security interface language or the WordPress site language for existing installations.
- Made user-specific 2FA emails follow the recipient language.
- Added localized Antispam source, status and common reason labels in digest emails.

Version 1.10.21 — 2026-07-30
--------------------------------
- Added explicit PHPCS exclusions for the two intentional runtime ini_set() calls used by the optional public error-display suppression setting.
- Removed Squiz.PHP.DiscouragedFunctions.Discouraged scan warnings without changing the feature behavior.

Version 1.10.20 — 2026-07-30
--------------------------------
- Added configurable Permissions-Policy controls for camera, microphone, geolocation and payment access.
- Added safe presets that leave payment behavior unchanged for store compatibility while allowing camera, microphone and geolocation to be blocked after the feature is enabled.
- Added Permissions-Policy to PHP output and generated Apache/LiteSpeed and Nginx examples.
- Added OPTIONAL and LIMITED scanner statuses for missing optional policies and deliberately limited CSP configurations.
- Improved Permissions-Policy validation for malformed rules, duplicates and sensitive-feature wildcards.

Version 1.10.19 — 2026-07-30
--------------------------------
- Improved the live security-header scanner to validate HSTS, nosniff, Referrer-Policy, frame protection, CSP, Permissions-Policy, and legacy XSS-filter values instead of checking only whether a header exists.
- Distinguished the limited upgrade-insecure-requests directive, report-only policies, and enforcing CSP policies with content-source restrictions.
- Corrected HSTS max-age=0 messages so they reflect whether the HSTS header is actually enabled.
- Added explicit Nginx and PHP-header coverage notices for .htaccess, static files, CDN responses, and full-page caches.
- Added stronger reverse-proxy loop warnings and automatic refusal to install an origin .htaccess redirect when forwarded HTTPS signals are detected over an HTTP origin request.

Version 1.10.18 — 2026-07-30
--------------------------------
- Improved the Polish name and description of the legacy browser XSS-filter setting.

Version 1.10.17 — 2026-07-30
--------------------------------
- Added a safe System Tweaks option that suppresses public PHP and startup error display after WordPress loads without disabling error logging.
- Added current WP_DEBUG, WP_DEBUG_DISPLAY, display_errors and display_startup_errors diagnostics to System Tweaks.
- Replaced two loose JavaScript comparisons in the bundled QR code library with strict equality checks for CodeCanyon coding-standard compliance.

Version 1.10.16 — 2026-07-30
--------------------------------
- Fixed the per-user interface language switcher for German, Spanish, French and Italian on current WordPress versions.
- Added native .l10n.php catalogs and domain-specific translation handling so the selected plugin language is independent of the WordPress dashboard locale.
- Added tested regional-locale mapping and plural-form handling for all bundled languages.

Version 1.10.15 — 2026-07-30
--------------------------------
- Added complete French and Italian translations for the interface, Help content, security messages, Scanner findings, and email reports.
- Extended the per-user language selector and automatic locale handling to Français and Italiano, including regional French and Italian WordPress locales.

Version 1.10.14 — 2026-07-30
--------------------------------
- Added complete German and Spanish translations for the interface, Help content, security messages, Scanner findings, and email reports.
- Extended the per-user language selector and automatic locale handling to Deutsch and Español, including regional German and Spanish WordPress locales.

Version 1.10.13 — 2026-07-30
--------------------------------
- Removed the redundant “website:” label from the administration footer while keeping the website URL clickable.

Version 1.10.12 — 2026-07-30
--------------------------------
- Added a clickable product website link next to the support email in Hard Guard Security administration footers.

Version 1.10.11 — 2026-07-30
--------------------------------
- Corrected the final Plugin Check translator-comment placement errors in the email 2FA and test-mail templates.

Version 1.10.10 — 2026-07-30
--------------------------------
- Improved Antispam digest diagnostics with explicit recipients, selected transport and detailed wp_mail/SMTP errors.
- Manual Antispam digests now always summarize the latest seven days and include checked submissions, decisions, top reasons, countries and quarantine incidents.
- Clarified when Antispam reason and country statistics are populated.
- Improved SMTP password compatibility and added a bounded SMTP connection timeout.

Version 1.10.9 — 2026-07-30
- Corrected the remaining Plugin Check internationalization errors.
- Hardened scanner and checkbox request handling.
- Added precise code-quality exceptions for one-time public tokens and intentional usermeta queries.
- Preserved Audit Log monitoring while removing a false update-modification detection.

Version 1.10.8 — 2026-07-30
---------------------------
- Reworked quarantine and managed .htaccess operations to use the WordPress Filesystem API.
- Corrected prepared SQL, request sanitization, output escaping, URL parsing and readme metadata reported by Plugin Check.
- Added translator comments and ordered placeholders for translatable strings.
- Added precise code-standard exceptions for intentional live queries to plugin-owned security tables and the optional Cloudflare Turnstile integration.

Version 1.10.7 — 2026-07-30
---------------------------
- Limited loading of Scanner, Antispam, Audit Log and general administration classes to WordPress administration requests.
- Reduced unnecessary PHP file loading during ordinary frontend requests without changing admin or admin-ajax functionality.

Version 1.10.6 — 2026-07-30
---------------------------
- Removed the Endpoint protections Help item from Data hiding settings.
- Removed the WordPress XML-RPC documentation link from that Help section.

Version 1.10.5 — 2026-07-30
---------------------------
- Renamed the Polish Settings section “Zabezpieczenia i dane” to “Ukrywanie danych”.
- Removed the duplicated Log retention (days) field from Settings; retention remains configured in Audit Log.
- Removed the misplaced Log retention item from the data-hiding Help section.

Version 1.10.4 — 2026-07-30
---------------------------
- Added the complete GNU General Public License version 2 text to the distribution package.
- Added Help guidance for removing a duplicated 2FA entry from Google Authenticator.
- Added the author contact email to the Hard Guard Security administration footer.
- Added a general security limitation, backup and staging notice to the dashboard, Help and buyer documentation.

Version 1.10.3 — 2026-07-29
- Changed the Scanner and Help submenu labels to sentence case for consistency with the remaining administration menu items.

Version 1.10.2 — 2026-07-29
---------------------------
- Corrected the default Polish GeoIP blocked-visitor message to: “Dostęp do tej witryny jest niedostępny z Twojej lokalizacji.”
- Added configurable GeoIP HTTP 403 page title and message.
- Added an optional validated https://, http:// or mailto: contact/help link with a custom label.
- Added a saved-message preview, plain-text sanitization, length validation and updated Help/documentation.

Version 1.10.1 — 2026-07-29
---------------------------
- Added a dashboard table with the 10 most recent Audit Log events below the 24-hour login statistics.
- Added time, severity, event, actor, IP and result columns with direct links to individual Audit Log records.
- Added responsive dashboard styling and updated built-in Help and external HTML documentation.

Version 1.10.0 — 2026-07-29
---------------------------
- Added site-wide GeoIP country access control to the main Settings screen.
- Added Disabled, country blocklist, and country allowlist policies.
- Added strict ISO 3166-1 alpha-2 validation and current-country lockout protection.
- Existing IP/CIDR whitelist entries, logged-in administrators, WP-Cron and WP-CLI bypass GeoIP blocking.
- Unknown countries fail open when geolocation data is unavailable.
- Added HTTP 403 responses, Audit Log events, a wp-config.php emergency bypass, built-in Help and CodeCanyon documentation.
- Documented that PHP-level GeoIP rules do not block static files or full-page responses served before WordPress starts.

Version 1.9.1 — 2026-07-29
--------------------------
- Clarified in Antispam settings and built-in Help that country filtering applies only to protected comments and native registration and never blocks ordinary visits or browsing.

Version 1.9.0 — 2026-07-29
--------------------------
- Rebranded the product and all buyer-facing text as Hard Guard Security.
- Renamed the distribution folder, main plugin file, text domain and language catalogs.
- Preserved existing wpguard_ settings, metadata, capabilities, hooks and database table identifiers for data compatibility.
- Removed production inline CSS and inline JavaScript event handlers.
- Added external administration and public styles/scripts for confirmations, Turnstile and antispam fields.
- Rebuilt and formatted admin.css with a table of contents, documented sections and grouped responsive rules.
- Removed all !important declarations from the administration stylesheet.
- Replaced every SELECT * query with an explicit column list.
- Added strict IP, IPv6 and CIDR validation and canonicalization for whitelist, blacklist and trusted proxy fields.
- Added validation for lockout stages, custom login paths, notification recipients, SMTP hosts/senders and Turnstile keys.
- Added validation for Audit Log alert recipients and structured Antispam email, domain, country, language and pattern fields.
- Invalid structured settings are rejected without overwriting the previous working configuration.
- Added complete English HTML documentation and a CodeCanyon-ready distribution structure.

Version 1.8.2
-------------
- Expanded the built-in Help screen with detailed Audit Log settings explanations.

Version 1.8.1
-------------
- Added complete Audit Log documentation to the built-in Help screen.

Version 1.8.0
-------------
- Added the normalized Audit Log workspace, alert rules, retention, export, capabilities and Multisite aggregation.
