=== Moatline Malware Scanner ===
Contributors: nextnova, ibrahimshah2144
Tags: security, malware scanner, two-factor, login security, hardening
Requires at least: 5.0
Tested up to: 7.1
Requires PHP: 7.0
Stable tag: 1.0.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Malware scanner, two-factor login, XML-RPC protection and hardening, with WordPress.org integrity checks and an activity log.

== Description ==

Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake "verify you're human" pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.

= Malware scanner =

* Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.
* Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.
* Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.
* Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.
* Results name the malware family that matched, so you know what you're dealing with.

= Content scan =

Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.

* Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.
* Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.
* Ordinary scripts such as analytics or form embeds are not flagged.
* Each finding links straight to the post or widget so you can remove the injected code.

= Integrity check against WordPress.org =

Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.

* Files identical to the official release are verified clean and skipped, which keeps false positives low.
* Files that differ are flagged as modified. That is exactly where injected malware hides.

= Two-factor login =

* Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.
* Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.
* 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.
* Password logins over XML-RPC are refused for two-factor users, so the code screen can't be bypassed. Apps use application passwords.

= XML-RPC protection =

* Three modes: allow, Jetpack-safe (only Jetpack's signed requests are accepted) or block completely.
* Refuse password logins over XML-RPC and disable `system.multicall`, which attackers use to try hundreds of passwords in one request.
* Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.
* Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.

= Login protection and access =

* Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.
* Hide usernames from the REST API and block `?author=` username scans.
* See every active login session with IP address and browser, including sessions left by deleted users.
* One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.
* Audit and revoke application passwords, or turn them off.

Every option that blocks something is off until you turn it on, and each one explains what it might affect.

= Live monitoring =

* Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).
* Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.

= Lockdown =

* One-click file modification lock (`DISALLOW_FILE_EDIT` / `DISALLOW_FILE_MODS`) so attackers can't install or edit plugins and themes through the dashboard.
* Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).

= Login security =

* Move the login page to a custom URL and hide wp-login.php.
* Send bots probing the default login page to a 404.

= Database cron cleaner =

* Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click "Clean database", and backs up everything it removes so you can restore it.

= Activity log =

* Records security-relevant events such as suspicious cron registrations, with export to JSON.

= Security score =

* A dashboard score and checklist that shows what to fix next.

= Pro add-on =

The free plugin finds and reports threats. The [Pro add-on](https://moatline.io/pro) is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above.

= Links =

* [Website](https://moatline.io)
* [Documentation](https://moatline.io/docs)
* [Changelog](https://moatline.io/changelog)
* [Report a security issue](https://moatline.io/security)
* [Support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/)
* Email: support@moatline.io

== Installation ==

1. In your dashboard go to Plugins → Add New and search for "Moatline Malware Scanner", or upload the `moatline-malware-scanner` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Open Malware Scanner → Scanner and run your first scan.
4. Work through the checklist on the Malware Scanner → Dashboard page (Lockdown, Login Security, Settings).

== Frequently Asked Questions ==

= Will the scanner delete anything automatically? =

No. The free plugin never deletes or changes files on its own. Scans only report findings. The database cleaner runs only when you click "Clean database".

= What happens when a file is flagged? =

You can review it, dismiss it, or exclude the path in Settings. Files that belong to WordPress.org plugins can be fixed by reinstalling that plugin. The Pro add-on adds one-click removal and restore.

= I lost my phone and can't log in. What do I do? =

Use one of your backup codes. If you don't have them, another administrator can reset your two-factor login from your user profile. As a last resort, add `define( 'NNMS_DISABLE_2FA', true );` to wp-config.php, log in, and remove the line again.

= Will blocking XML-RPC break Jetpack or the mobile app? =

All XML-RPC options are off by default. If you use Jetpack, choose Jetpack-safe mode: Jetpack keeps working while password logins and multicall stay blocked. The WordPress mobile app can sign in with an application password.

= Can I use it alongside another security plugin? =

Yes. Moatline Malware Scanner is a scanner and hardening tool, not a firewall, so it runs alongside Wordfence, Sucuri, Solid Security, All-In-One Security and Jetpack. Your firewall blocks attacks; Moatline finds what got through and how it keeps coming back. Run one malware scan at a time if your hosting has limited resources.

= I set a custom login URL and I'm locked out. What do I do? =

Rename the `wp-content/plugins/moatline-malware-scanner` folder over FTP or your host's file manager. This disables the plugin and restores the normal login page.

= Does it work on Nginx? =

Yes. Everything works on Nginx. For blocking PHP in uploads, the plugin shows the Nginx rule to add to your server configuration, because Nginx doesn't read .htaccess files.

= Does the plugin send any data off my site? =

Only to check plugin files against WordPress.org, as described under "External services" below. No personal data is sent and there is no tracking.

== External services ==

This plugin connects to WordPress.org to verify plugin files.

**WordPress.org plugin checksums** (`https://downloads.wordpress.org/plugin-checksums/`)

* What it's used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.
* What is sent: the slug and version number of each installed plugin (for example `contact-form-7` and `5.9`), when you run a scan. No personal data, site content or file contents are sent.
* Provided by WordPress.org: [Terms of Service](https://wordpress.org/about/terms-of-service/) and [Privacy Policy](https://wordpress.org/about/privacy/).

If your server cannot reach WordPress.org, the scan continues without the integrity check.

== Screenshots ==

1. Dashboard: security score, what was found and what to fix next.
2. A scan in progress: 13 short steps covering files, the database and the live home page.
3. Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database.
4. The dashboard after cleanup: no threats and a strong security score.
5. Lockdown: stop plugin and theme changes and block PHP in the uploads folder.
6. Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks.
7. Two-step login with any authenticator app, set up from your profile.

== Credits ==

QR codes for two-factor login are drawn with [qrcode-generator](https://www.npmjs.com/package/qrcode-generator) by Kazuhiko Arase (MIT licence), bundled in `assets/js/vendor/qrcode.js`.

== Changelog ==

= 1.0.6 =
* Fixed: the uploads scan now finds PHP files renamed to .phtml, .php5, .php7, .php8, .pht, .phtm, .phar or .phps, and upper-case names such as .PHP. Attackers exploiting the Bricksforge file upload flaw (CVE-2026-85097) use these names.
* Fixed: the "Block PHP in uploads" rule now covers the same extensions and ignores letter case. Sites that already had the block turned on are upgraded automatically.
* Changed: the Nginx rule shown for manual setup covers the same extensions.

= 1.0.5 =
* Fixed: on sites without a mu-plugins folder (most sites), the checks for fake plugins and hidden binary payload files were skipped. They now always run.
* New: database entries used by the fake CAPTCHA (ClickFix) loader that reads its address from the Polygon blockchain are named as such in scan results.
* Changed: cleaner admin screens: no emoji on buttons, a two-column scan progress list, and a red "Threats found" headline on the dashboard while threats remain.
* Changed: each database entry is reported once, even when several checks match it.
* Fixed: Lockdown now shows "Locked" when DISALLOW_FILE_MODS was added to wp-config.php by hand or by your host.
* Fixed: when the plugin folder is a symlink, the scanner now checks every plugin and still skips its own files.
* Fixed: finished scan steps no longer keep saying "Scanning...".
* Fixed: XML-RPC Jetpack-safe mode now also recognises WooPayments and the standalone Jetpack plugins, which use the same WordPress.com connection.

= 1.0.4 =
* Fixed: the Moatline logo in the admin header did not show on some installs.

= 1.0.3 =
* New: redesigned admin screens, with a header and tabs on every page and a new dashboard showing your security score, what to fix next, recent activity and the database cleaner.
* New: checks your live home page the way visitors see it, to catch fake CAPTCHA (ClickFix) scripts injected at page load.
* New: detects the "X Global Data Flow" / "Traffic Monitor" fake plugins and new White Label CMS loader variants, including malware that empties other security plugins' files.
* New: the database cleaner backs up everything it removes, and a "Restore last backup" button puts it back.
* New: warns you if Moatline's own files have been emptied by malware, instead of failing silently.
* Changed: the Documentation and Support links were removed from the Plugins screen row (they are on the plugin's own pages).

= 1.0.2 =
* New: detects the fake "WordPress Defender", "WordPress Security" and "White Label" plugins found on hacked sites in 2026, plus plugins whose author is just "WordPress".
* New: flags empty plugin files left behind by host malware cleaners, which can crash a site.
* New: detects malware plugins that hide themselves from the Plugins list.
* New: signatures for the mlroweb, latoem and renotad script injections.
* New: Settings, Docs and Support links on the Plugins screen.
* Changed: links now point to the new home of the plugin, moatline.io.

= 1.0.1 =
* Fixed: "Clean DB Now" stayed on "Cleaning..." and never finished.
* Fixed: signing in from a custom login URL sent you back to the login page.
* Changed: with a custom login URL, logged-out visitors to /wp-login.php and /wp-admin now see "page not found" instead of being sent to the new address.
* Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately.
* New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours.
* Changed: deleting the plugin keeps settings and two-step login setups unless you choose "Delete all plugin data" in Settings.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.6 =
Finds and blocks PHP webshells disguised as .phtml, .php5, .php8 and similar in uploads, as used in the Bricksforge attacks.

= 1.0.5 =
Names fake CAPTCHA loaders hidden in the database, cleaner admin screens and several fixes.

= 1.0.4 =
Fixes the logo not showing in the admin header.

= 1.0.3 =
New dashboard, a live home-page check for fake CAPTCHA malware, new fake-plugin detections and a database cleaner backup.

= 1.0.2 =
Detects new fake security plugins and malware injections seen on hacked sites this month.

= 1.0.1 =
Fixes the database cleaner and custom login URL, and adds Pause, Resume and Stop for scans.

= 1.0.0 =
Initial release.
