=== MyNew Registration Lockdown ===
Contributors: mynewtechnologies
Tags: registration, security, users, lockdown, audit
Requires at least: 6.5
Tested up to: 7.0
Stable tag: 1.0.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Blocks unauthorized WordPress user creation at the shared insertion layer while preserving approved administrator and WP-CLI workflows.

== Description ==

MyNew Registration Lockdown enforces one centralized user-creation policy across WordPress. Instead of relying only on the public registration setting or a visible form, it evaluates user creation at the shared `wp_insert_user()` insertion layer.

The default policy blocks unauthorized account creation while allowing:

* Logged-in administrators with the `create_users` capability inside wp-admin.
* WP-CLI user creation by a server operator.
* Explicitly authorized integrations through the documented `mnrl_is_user_creation_authorized` filter.

The plugin also disables the default registration action, can disable multisite signups, records privacy-aware audit events, retains those events for a configurable period, and can send threshold-based email alerts.

No telemetry is collected. The plugin does not contact MyNew Technologies or any third-party service.

Documentation and support: https://mynewtechnologies.com/products/registration-firewall/

== Installation ==

1. Upload the `mynew-registration-lockdown` directory to `/wp-content/plugins/` or install the ZIP through Plugins > Add New > Upload Plugin.
2. Activate the plugin.
3. Open Settings > Registration Lockdown.
4. Review the default authorization policy before deploying to a site that intentionally creates users through custom integrations.

== Frequently Asked Questions ==

= Does this merely hide the registration form? =

No. It enforces policy at the user insertion layer used by WordPress core and most integrations.

= Can administrators still create users? =

Yes, by default, logged-in users with the `create_users` capability can create users from wp-admin.

= Can an integration be allowed? =

Yes. Authenticate and authorize the integration, then return `true` from the `mnrl_is_user_creation_authorized` filter for that specific request.

= Does the plugin disable XML-RPC or remove REST routes? =

No. Those interfaces may provide unrelated functionality. The plugin blocks unauthorized user creation without unnecessarily disabling entire subsystems.

= What data is logged? =

The plugin stores the request time, request channel, method, path, and user agent. IP, login, and email values are stored only as keyed SHA-256 hashes.

== Changelog ==

= 1.0.2 =
* Replaced interpolated table identifiers with WordPress identifier placeholders.
* Documented intentional cache bypasses for retention cleanup and uninstall operations.
* Eliminated the remaining Plugin Check database warnings.

= 1.0.1 =
* Resolved Plugin Check findings for translation loading, global prefixes, translator comments, and request classification.
* Added short-lived object caching for dashboard aggregates and recent events.
* Improved database-query documentation and cache invalidation.
* Moved cleanup scheduling to activation and expanded uninstall cleanup.
* Added stronger PHPDoc and defensive result handling.

= 1.0.0 =
* Initial production release.
* Central user-creation policy gate.
* Administrator and WP-CLI authorization controls.
* Privacy-aware database audit log.
* Retention cleanup and threshold alerts.
* Settings and recent-events dashboard.
