=== Moatline Malware Scanner ===
Contributors: nextnova, ibrahimshah2144
Tags: security, malware scanner, two-factor, login security, hardening
Requires at least: 5.0
Tested up to: 7.1
Requires PHP: 7.0
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Malware scanner, two-factor login, XML-RPC protection and hardening, with WordPress.org integrity checks and an activity log.

== Description ==

Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake "verify you're human" pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.

= Malware scanner =

* Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.
* Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.
* Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.
* Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.
* Results name the malware family that matched, so you know what you're dealing with.

= Content scan =

Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.

* Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.
* Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.
* Ordinary scripts such as analytics or form embeds are not flagged.
* Each finding links straight to the post or widget so you can remove the injected code.

= Integrity check against WordPress.org =

Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.

* Files identical to the official release are verified clean and skipped, which keeps false positives low.
* Files that differ are flagged as modified. That is exactly where injected malware hides.

= Two-factor login =

* Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.
* Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.
* 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.
* Password logins over XML-RPC are refused for two-factor users, so the code screen can't be bypassed. Apps use application passwords.

= XML-RPC protection =

* Three modes: allow, Jetpack-safe (only Jetpack's signed requests are accepted) or block completely.
* Refuse password logins over XML-RPC and disable `system.multicall`, which attackers use to try hundreds of passwords in one request.
* Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.
* Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.

= Login protection and access =

* Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.
* Hide usernames from the REST API and block `?author=` username scans.
* See every active login session with IP address and browser, including sessions left by deleted users.
* One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.
* Audit and revoke application passwords, or turn them off.

Every option that blocks something is off until you turn it on, and each one explains what it might affect.

= Live monitoring =

* Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).
* Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.

= Lockdown =

* One-click file modification lock (`DISALLOW_FILE_EDIT` / `DISALLOW_FILE_MODS`) so attackers can't install or edit plugins and themes through the dashboard.
* Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).

= Login security =

* Move the login page to a custom URL and hide wp-login.php.
* Send bots probing the default login page to a 404.

= Database cron cleaner =

* Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click "Clean DB Now".

= Activity log =

* Records security-relevant events such as suspicious cron registrations, with export to JSON.

= Security score =

* A dashboard score and checklist that shows what to fix next.

= Pro add-on =

The free plugin finds and reports threats. The [Pro add-on](https://moatline.io/pro) is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above.

= Links =

* [Website](https://moatline.io)
* [Documentation](https://moatline.io/docs)
* [Support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/)

== Installation ==

1. In your dashboard go to Plugins → Add New and search for "Moatline Malware Scanner", or upload the `moatline-malware-scanner` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Open Malware Scanner → Scanner and run your first scan.
4. Work through the checklist on the Malware Scanner → Dashboard page (Lockdown, Login Security, Settings).

== Frequently Asked Questions ==

= Will the scanner delete anything automatically? =

No. The free plugin never deletes or changes files on its own. Scans only report findings. The database cleaner runs only when you click "Clean DB Now".

= What happens when a file is flagged? =

You can review it, dismiss it, or exclude the path in Settings. Files that belong to WordPress.org plugins can be fixed by reinstalling that plugin. The Pro add-on adds one-click removal and restore.

= I lost my phone and can't log in. What do I do? =

Use one of your backup codes. If you don't have them, another administrator can reset your two-factor login from your user profile. As a last resort, add `define( 'NNMS_DISABLE_2FA', true );` to wp-config.php, log in, and remove the line again.

= Will blocking XML-RPC break Jetpack or the mobile app? =

All XML-RPC options are off by default. If you use Jetpack, choose Jetpack-safe mode: Jetpack keeps working while password logins and multicall stay blocked. The WordPress mobile app can sign in with an application password.

= Can I use it alongside another security plugin? =

Yes. Moatline Malware Scanner does not run a firewall that conflicts with other security plugins. Run one malware scanner at a time if your hosting has limited resources.

= I set a custom login URL and I'm locked out. What do I do? =

Rename the `wp-content/plugins/moatline-malware-scanner` folder over FTP or your host's file manager. This disables the plugin and restores the normal login page.

= Does it work on Nginx? =

Yes. Everything works on Nginx. For blocking PHP in uploads, the plugin shows the Nginx rule to add to your server configuration, because Nginx doesn't read .htaccess files.

= Does the plugin send any data off my site? =

Only to check plugin files against WordPress.org, as described under "External services" below. No personal data is sent and there is no tracking.

== External services ==

This plugin connects to WordPress.org to verify plugin files.

**WordPress.org plugin checksums** (`https://downloads.wordpress.org/plugin-checksums/`)

* What it's used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.
* What is sent: the slug and version number of each installed plugin (for example `contact-form-7` and `5.9`), when you run a scan. No personal data, site content or file contents are sent.
* Provided by WordPress.org: [Terms of Service](https://wordpress.org/about/terms-of-service/) and [Privacy Policy](https://wordpress.org/about/privacy/).

If your server cannot reach WordPress.org, the scan continues without the integrity check.

== Screenshots ==

1. Dashboard with security score, status tiles and checklist.
2. Malware scanner results, naming the malware family for each finding.
3. Lockdown: file modification lock and PHP blocking in uploads.
4. Login security: a custom login URL that hides wp-login.php and wp-admin.
5. Activity log.
6. Hardening & Access: XML-RPC protection, username hiding, login limits and application passwords.

== Credits ==

QR codes for two-factor login are drawn with [qrcode-generator](https://www.npmjs.com/package/qrcode-generator) by Kazuhiko Arase (MIT licence), bundled in `assets/js/vendor/qrcode.js`.

== Changelog ==

= 1.0.2 =
* New: detects the fake "WordPress Defender", "WordPress Security" and "White Label" plugins found on hacked sites in 2026, plus plugins whose author is just "WordPress".
* New: flags empty plugin files left behind by host malware cleaners, which can crash a site.
* New: detects malware plugins that hide themselves from the Plugins list.
* New: signatures for the mlroweb, latoem and renotad script injections.
* New: Settings, Docs and Support links on the Plugins screen.
* Changed: links now point to the new home of the plugin, moatline.io.

= 1.0.1 =
* Fixed: "Clean DB Now" stayed on "Cleaning..." and never finished.
* Fixed: signing in from a custom login URL sent you back to the login page.
* Changed: with a custom login URL, logged-out visitors to /wp-login.php and /wp-admin now see "page not found" instead of being sent to the new address.
* Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately.
* New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours.
* Changed: deleting the plugin keeps settings and two-step login setups unless you choose "Delete all plugin data" in Settings.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.2 =
Detects new fake security plugins and malware injections seen on hacked sites this month.

= 1.0.1 =
Fixes the database cleaner and custom login URL, and adds Pause, Resume and Stop for scans.

= 1.0.0 =
Initial release.
