=== Ironfang Security ===
Contributors: ironfang
Tags: security, updates, configuration
Requires at least: 6.8
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Security configuration checks for WordPress, with clear evidence and guidance. Checks run on your site and do not send information to Ironfang.

== Description ==

Ironfang Security reviews a WordPress site's configuration, update information and privileged accounts for common security risks. It explains each finding, shows the evidence it observed and suggests a practical next step.

It checks:

* whether WordPress, plugin and theme updates are available, using the update information WordPress has already stored, and how old that information is;
* whether the server's PHP version still receives security fixes, and how the site is set to update;
* whether WordPress is set up for HTTPS;
* whether PHP errors are shown to visitors, and whether a debug log is kept inside the site's files;
* whether the dashboard file editors are on, and who on the server can read or change wp-config.php;
* what public registration grants, and which accounts have administrator-level access.

It also lists the installed software. An available update is maintenance information; this plugin does not report known vulnerabilities.

Findings are listed by priority, each with its evidence and practical guidance. You can recheck a finding after fixing it, or ignore one you have reviewed; an ignored finding is still reported by its check and is never counted as passed.

You can download a report of the results as readable text or JSON. It leaves out server paths and account details.

One hardening change is available, and only if you ask for it: turning off the dashboard's theme and plugin file editors. It has the same effect as DISALLOW_FILE_EDIT, without editing wp-config.php. The check confirms the change, you can undo it, and each change is logged. It works only while the plugin is active.

What the plugin does not do:

* It does not change your site's settings, unless you turn off the file editors with it.
* It does not contact Ironfang or any other service.
* It is not a firewall or malware scanner, and it does not block attacks.
* It does not give your site a security score or certify that it is safe.

The plugin supports single-site WordPress installations. It does not load on multisite networks.

== Privacy ==

This plugin does not send data to Ironfang or any third party, does not collect analytics and does not set cookies.

Check results store counts and settings, not account details. The list of administrator accounts is read when an administrator opens it and is not stored. If you turn the file editors off or back on with the plugin, it logs when, and the ID of the account that did it.

Reports are made only when an administrator asks for one and are sent straight to the browser; no copy is kept on the server. Reports leave out server paths and account details. The site address is included unless you untick it, and the reasons given for ignoring findings only if you choose them.

**Ironfang Security › Settings** lists everything the plugin stores.

== Installation ==

1. Upload the plugin ZIP from Plugins › Add New Plugin › Upload Plugin, or extract it into `wp-content/plugins/ironfang-security`.
2. Activate the plugin. Activation does not change any site setting.
3. Open **Ironfang Security** in the admin menu. Only users who can manage site options can see it.

== Frequently Asked Questions ==

= Does this plugin protect my site from attacks? =

No. It is not a firewall and does not block traffic. It is intended to identify configuration risks so you can act on them.

= Why do some results say "Could not be determined"? =

A check reports that when it cannot observe enough to give an answer: for example when WordPress has not stored recent update information, or when a scan started from WP-CLI cannot see the web server's PHP settings. Such a result is never counted as passed. Each one explains what is missing and what to do.

= What has it been tested with? =

WordPress 6.8, 7.0 and 7.1, with PHP 8.1 to 8.5 (not every combination); Apache and nginx; a site behind an HTTPS reverse proxy; a site in a subdirectory; read-only site files; a Redis object cache; and alongside WooCommerce, WP Super Cache and Wordfence. Other set-ups have not been tested.

= Where can I get help or send feedback? =

Email hello@ironfang.com. If a check fails to run, include the reason it shows.

= How do I report a security vulnerability in this plugin? =

Email security@ironfang.com, privately, not in the support forum. Include the plugin, WordPress and PHP versions, steps to reproduce and the access an attacker needs. We acknowledge reports within 3 business days and give an assessment within 7 days. We aim to fix critical and high severity issues within 14 days of confirming them, and others within 90 days. We coordinate disclosure with you, publish an advisory once the fix is released, and credit you unless you prefer not to be. There is no paid bug bounty.

= Can it turn off the file editors? =

Yes, if you ask it to. On the "Dashboard file editor" check's page, choose "Turn off the file editors". Nobody, administrators included, can then edit theme or plugin code from the dashboard, as with DISALLOW_FILE_EDIT. Installing and updating plugins and themes keeps working. The check runs again to confirm it, and you can turn the editors back on there.

It works only while the plugin is active: deactivating or deleting the plugin turns the editors back on. For a permanent change, add DISALLOW_FILE_EDIT to wp-config.php. If something already turns the editors off, the plugin says so and does not offer the change.

From WP-CLI, run `wp ironfang-security hardening apply file_editor --user=<administrator>`, or `undo` to turn them back on. `wp ironfang-security hardening list` shows the current state, and `log` shows who changed it and when.

= What happens when I uninstall it? =

Deactivating stops any running scan and keeps the plugin's stored data. If you turned the file editors off with the plugin, they turn back on while it is deactivated, and off again if you reactivate it. Deleting the plugin removes the data it created and nothing else. To keep the results, download a report from **Ironfang Security › Settings** before deleting it; a deactivated plugin cannot make a report, so reactivate it first if needed.

== Screenshots ==

1. The overview after the checks have run: open findings by severity and the next actions, most urgent first.
2. Every open finding, ranked by severity and confidence.
3. A finding with the evidence the check observed and what to do about it.
4. Settings: download a report, and see everything the plugin stores and what deleting it removes.

== Screenshots ==

1. The overview after the checks have run: open findings by severity and the next actions, most urgent first.
2. Every open finding, ranked by severity and confidence.
3. A finding with the evidence the check observed and what to do about it.
4. Settings: download a report, and see everything the plugin stores and what deleting it removes.

== Changelog ==

= 1.1.0 =
* New: turn off the dashboard's theme and plugin file editors from the "Dashboard file editor" check's page, or with `wp ironfang-security hardening apply file_editor`. It has the same effect as DISALLOW_FILE_EDIT without editing wp-config.php. The check confirms it, you can undo it, and each change is logged. It works only while the plugin is active, and is not offered when something already turns the editors off.
* Changed: the file editor check reports when Ironfang Security turns the editors off, and reports a finding if other code turns them back on.

= 1.0.1 =
* Fixed: reports called the directory above WordPress the site root. It is now labelled "[directory above WordPress]".

= 1.0.0 =
* First release: twelve local checks covering updates, PHP support, update policy, HTTPS, PHP error display, the debug log, the dashboard file editors, wp-config.php permissions, registration and administrator accounts; a software inventory; findings with evidence and guidance, recheck and ignore; scan recovery; and a redacted report download.

== Upgrade Notice ==

= 1.1.0 =
Adds an optional, reversible way to turn off the dashboard file editors. Nothing changes on your site unless you choose it.
