=== Neksio Login & File Security ===
Contributors: neksiotool
Tags: two-factor authentication, 2fa, login security, file integrity, brute force protection
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protect WordPress logins with two-factor authentication, monitor critical file changes, and manage security threats from a unified dashboard.

**Designed for:**
* Bloggers & Content Creators
* Business Websites
* WooCommerce Stores
* Marketing Agencies
* WordPress Developers


== Description ==

Neksio Login & File Security provides comprehensive login protection and file integrity monitoring for WordPress websites. The plugin combines two-factor authentication (2FA) with file system monitoring to help site administrators protect user accounts and detect unauthorized changes to critical WordPress files.


= Key Features =

* Two-Factor Authentication (TOTP)
* Recovery Codes
* Trusted Devices
* Custom Login URL
* Login Rate Limiting
* IP Blocking
* File Integrity Monitoring
* Security Dashboard
* Security Event Logs
* Email Notifications
* Role-Based 2FA Enforcement
* Emergency Access
* Data Management

= Login Protection =

The plugin implements multiple layers of login security:

* **Two-Factor Authentication (TOTP)** - Time-based one-time passwords compatible with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and Bitwarden
* **Recovery Codes** - Backup access codes generated when 2FA is enabled, stored as secure hashes
* **Trusted Devices** - Remember authenticated browsers for 30 days with secure, HttpOnly cookies
* **Custom Login URL** - Replace the default wp-login.php path with a custom slug
* **Rate Limiting** - Configurable limits on login attempts with automatic lockout
* **IP Blocking** - Manual and automatic blocking of suspicious IP addresses

= File Integrity Monitoring =

The Integrity Monitor tracks changes to critical WordPress files:

* **Critical File Protection** - Monitor wp-config.php and .htaccess for unauthorized modifications
* **Unknown File Detection** - Identify suspicious PHP files in the WordPress root directory
* **Backup File Detection** - Find exposed .htaccess backup files (.htaccess.bak, .htaccess.old)
* **Permission Monitoring** - Track file permission changes that may indicate compromise
* **Real-Time Activity Log** - View security events with timestamps and details

= Security Dashboard =

A centralized dashboard provides visibility into site security:

* Security score calculation based on configured protections
* Login activity tracking (successful and failed attempts)
* Blocked IP addresses and attack classification
* Security event history with filtering
* Trusted devices inventory
* Top threats overview

= Email Notifications =

The plugin sends automated email notifications for critical security events:

**Recovery Codes Email:**
* Sent when you request to email your recovery codes
* Contains all recovery codes in HTML format
* Automatically deletes temporary storage after sending

**Security Alert Emails:**
Sent when critical file changes are detected:
* wp-config.php modifications
* .htaccess modifications
* Unknown PHP files in root directory
* Dangerous file permission changes

**IP Block Notifications:**
Sent when an IP address is blocked:
* Brute force attacks
* Username enumeration attempts
* XML-RPC attacks
* URL scanning attempts
* Includes GeoIP data (country, city, device info)

**2FA Setup Notifications:**
Confirmation emails when:
* 2FA is enabled for an account
* 2FA is disabled for an account
* Recovery codes are regenerated
* Recovery Code Used (when a user successfully authenticates using a backup code)

**Administrative Alerts:**
Sent when critical security configurations change:
* Login URL Changed (when the custom login path is updated)
* Emergency Bypass (when the administrator uses the emergency fallback URL)

**Failed Login Alerts:**
* Optional notifications for failed login attempts
* Configurable threshold settings

**Email Features:**
* Email template customization
* Test email functionality
* Configurable notification recipients
* Rate limiting to prevent email flooding (1 email per IP/hour)
* Daily limit of 5 security alert emails
* HTML formatted emails with dashboard links
* All emails sent from your WordPress installation (no external services)

= Settings Documentation =

The plugin provides a unified settings interface for managing security configurations:

* **Enable GeoIP Lookup** - Controls optional IP intelligence and geolocation data for security reports.
* **Enable Tor Exit Node Detection** - Controls optional detection of known Tor exit nodes during login attempts.
* **Email Notifications** - Customize recipients, enable/disable specific alerts, and manage notification thresholds.
* **Trusted Devices** - Configure expiration durations for remembered browsers and manage trusted device tokens.
* **Custom Login URL** - Configure a custom path to hide the default WordPress login page, including emergency bypass options.
* **File Integrity Monitoring** - Configure settings for monitoring critical files and directory changes.

= Security Philosophy =

Neksio Login & File Security follows WordPress coding standards and uses WordPress APIs whenever possible.

The plugin is designed to reduce attack surface while remaining compatible with standard WordPress installations.

It does not modify WordPress core files.

= Data Storage =

Plugin data remains inside your own WordPress installation.

Sensitive authentication data is encrypted before storage whenever applicable.

= Local QR Generation =

**QR Codes are generated entirely on your own server.**

No QR data is transmitted to external QR code services.

= Developer Friendly =

* Uses WordPress APIs
* Uses hooks and filters
* Translation ready
* WordPress coding standards
* PHP 7.4+
* GPL compatible

= Accessibility =

The plugin follows WordPress admin interface conventions wherever possible.

= Logging =

Security events are stored locally inside the WordPress database.

Retention periods are configurable.

= Clean Uninstall =

The plugin provides options to remove stored data during uninstall.

= Compatibility =

* WordPress 6.0+
* PHP 7.4+
* PHP 8.x Ready (tested with PHP 7.4 through 8.3+)
* Works with most caching plugins
* Compatible with modern TOTP authenticator applications

= Additional Features =

* **Role-Based 2FA Enforcement** - Require 2FA for specific user roles with configurable grace periods
* **Email Notifications** - Receive alerts for security events, failed logins, and IP blocks
* **IP Intelligence** - View attack patterns, geolocation data, and request counts for blocked IPs
* **Data Management** - Configurable retention periods for logs and automatic cleanup
* **Emergency Access** - Secret fallback URL and emergency access key for administrator recovery

= Built for Real-World Use =

This plugin was developed based on lessons learned from investigating and recovering a production WordPress website affected by unauthorized file modifications. The features address specific challenges encountered during incident response, including detecting modified configuration files, identifying injected files, and restoring trusted states.

= Technical Details =

* Uses only WordPress APIs and hooks - no core file modifications
* All QR codes generated locally (no external API calls)
* TOTP secrets encrypted at rest
* Recovery codes stored as hashes only
* PHP 7.4+ required, optimized for PHP 8.1+

== Installation ==

1. Upload the `neksio-login-file-security` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Navigate to Neksio Login & File Security in the admin menu
4. Configure initial settings (custom login URL, rate limits, email notifications)
5. Go to Users → Your Profile to enable two-factor authentication for your account
6. Scan the QR code with your authenticator app and save recovery codes

== Frequently Asked Questions ==

= Which authenticator apps are supported? =

The plugin supports any TOTP-compatible authenticator app, including:

* Google Authenticator
* Microsoft Authenticator
* Authy
* LastPass Authenticator
* 1Password
* Bitwarden

= How are QR codes generated? =

QR codes are generated 100% locally on your server. The plugin uses a hybrid approach:

* **PHP 8.1+**: Native PHP library (chillerlan/php-qrcode)
* **PHP 7.4-8.0**: JavaScript library (qrcodejs)

No data is sent to external services for QR code generation.

= What happens if I lose my authenticator device? =

You can use one of your recovery codes to regain access. Recovery codes are generated when you enable 2FA and should be stored securely. If you have used all recovery codes, a site administrator can disable 2FA for your account from the Users screen.

= Can I hide the WordPress login page? =

Yes. The plugin provides a custom login URL option that replaces the default wp-login.php path. A secret fallback URL and emergency access key are also available for administrator recovery.

= How does IP blocking work? =

IP blocking occurs in two ways:

1. **Automatic blocking** - After a configurable number of failed login attempts
2. **Manual blocking** - Administrators can block IPs from the IP Management page

Each blocked IP record includes the attack type, user agent, request count, and block duration.

= What files does the Integrity Monitor track? =

The monitor tracks:

* wp-config.php
* .htaccess
* Unknown PHP files in the WordPress root
* .htaccess backup files (.htaccess.bak, .htaccess.old, etc.)
* File permission changes

= Is my IP address stored? =

IP address storage is optional and can be disabled in the plugin settings. When enabled, IP addresses are stored according to your configured data retention policy.

= Can I require 2FA for specific user roles? =

Yes. The plugin supports role-based 2FA enforcement. You can select which user roles must enable 2FA and configure a grace period for new users.

= Does this plugin modify WordPress core files? =

No. Neksio Login & File Security uses only WordPress APIs and hooks. It does not modify any WordPress core files.

= What happens when I uninstall the plugin? =

By default, all plugin data is removed when you uninstall. You can choose to keep data during uninstallation in the plugin settings.


= Does the plugin send login credentials externally? =

**No.**

Authentication is performed locally by your WordPress installation. No login credentials are transmitted to external servers.

= What email notifications will I receive? =

The plugin sends notifications for:

* Recovery codes (when requested)
* Critical file changes (wp-config.php, .htaccess modifications)
* IP blocks (brute force, attacks)
* 2FA setup changes
* Failed login attempts (optional)

All emails include rate limiting to prevent flooding. You can customize which notifications you receive in the Email Settings page.

== Screenshots ==

1. Security Dashboard with login statistics and security score
2. Two-Factor Authentication setup with locally-generated QR code
3. Recovery Codes management interface
4. IP Management page with blocked IP list
5. Integrity Monitor dashboard showing file changes
6. Security Activity log with event filtering
7. Trusted Devices management
8. Custom Login URL settings
9. Role-based 2FA enforcement settings
10. Email notification configuration
11. Login Logs with detailed information
12. Security Events history
13. Data Management settings
14. Email Settings configuration
15. IP Intelligence reports
16. Users Screen with 2FA status columns

== External services ==

This plugin uses or connects to the following external services:

= NeksioTool Assets & IP Intelligence (neksiotool.com) =

* **What it is and what it is used for**: This plugin may connect to NeksioTool (neksiotool.com) to load custom site logos and brand images used on 2FA verification pages and plugin settings previews. It may also provide optional links to NeksioTool IP lookup tools from the IP Management dashboard.
* **What data is sent and when**: When an external NeksioTool logo or brand image is loaded, the user's browser may send a standard HTTP request to NeksioTool. This request may include the browser's IP address and HTTP user-agent as part of normal web communication. When an administrator chooses to open an external NeksioTool IP lookup link, the browser also sends a standard HTTP request to that service. The plugin does not send passwords, authentication secrets, recovery codes, or other WordPress login credentials to NeksioTool.
* **Service Terms & Privacy Policy**:
  * Terms of Service: https://neksiotool.com/terms-of-service/
  * Privacy Policy: https://neksiotool.com/privacy-policy/

= GeoIP Geolocation Service (ip-api.com) =

* **What it is and what it is used for**: The plugin can fetch country and city geolocation data for blocked IP addresses to display in security activity logs and IP management reports.
* **What data is sent and when**: Only the specific IP address being queried is sent via an HTTP GET request to ip-api.com. This feature is OPTIONAL and DISABLED by default; it only executes if the site administrator explicitly enables "Enable GeoIP Lookup" in security settings.
* **Service Terms & Privacy Policy**:
  * Terms of Service: https://ip-api.com/docs/legal
  * Privacy Policy: https://ip-api.com/privacy

= Tor Exit Node Detection (Tor Project) =

* **What it is and what it is used for**: The plugin can check whether incoming login requests originate from known Tor exit nodes to prevent brute-force attacks.
* **What data is sent and when**: An HTTP GET request is sent to check.torproject.org to fetch the public exit node list. No user data, site data, or IP addresses are sent to the Tor Project. This feature is OPTIONAL and DISABLED by default; list downloads are cached locally.
* **Service Terms & Privacy Policy**:
  * Terms of Service: https://support.torproject.org/
  * Privacy Policy: https://torproject.org/about/privacy_policy/

= QR Code Generation =

QR codes for 2FA setup are generated **100% locally** using bundled libraries (chillerlan/php-qrcode or qrcodejs). **No data is sent to any external server for QR code generation.**

== Privacy Policy ==

Neksio Login & File Security stores data locally in your WordPress database.

= Data Stored =

* **User Meta**: 2FA status, encrypted TOTP secrets, last verification timestamp, recovery status
* **Custom Tables**: Recovery code hashes, trusted device information, login logs, security events, IP blacklist, file backups
* **Options**: Plugin settings, custom login URLs, security codes

= Cookies =

The plugin uses one cookie for trusted device management:

* **Name**: nlfs_trusted_device
* **Duration**: 30 days
* **Attributes**: Secure, HttpOnly, SameSite=Lax

= Data Retention =

Configurable retention periods for:

* Login logs
* Security events
* Trusted devices (automatic cleanup after inactivity)
* IP blacklist records
* File backups

= Data Removal =

All plugin data can be deleted through the Uninstall settings page or by uninstalling the plugin with data removal enabled. Individual users can delete their 2FA data from their profile page.

= Third-Party Services =

This plugin does **not** automatically transmit data to external servers except under the following conditions:

* **IP Intelligence Reports**: Links open in a new tab **only when explicitly clicked by the user**. The plugin does not automatically send any data to these services.
* **GeoIP Lookup**: This feature is **DISABLED by default**. It requires explicit user opt-in via the plugin settings ("Enable GeoIP Lookup"). The plugin will NOT send any IP addresses to external servers unless the administrator actively enables this option. When enabled, it uses ip-api.com to obtain geolocation data (country/city) for blocked IPs.

QR code generation is performed 100% locally with no external API calls.

Email notifications are sent from your WordPress installation using wp_mail(). No external email services are used.

= Access to Data =

Only users with appropriate capabilities can access administrative data. Users can access only their own 2FA settings and recovery codes.

= Data Encryption =

TOTP secrets are encrypted at rest. Recovery codes are stored as hashes only.

== Changelog ==

= 2.4.0 =
* Improved Emergency Login URL workflow with corrected execution order.
* Fixed wp_loaded hook handling to ensure reliable emergency bypass access.
* Improved Custom Login URL routing reliability across different server configurations.
* Enhanced emergency email notification delivery and formatting.
* Improved security event logging accuracy and data retention.
* Enhanced uninstall cleanup process for complete data removal including transients.
* Improved WordPress.org compliance and documentation clarity.
* Various stability improvements and minor bug fixes.

= 2.3.2 =
* Improved WordPress.org compliance and external services documentation.
* Added explicit Settings API registration for Tor Exit Node Detection.
* Added explicit opt-in controls for Tor and GeoIP features.
* Removed inline CSS and JS for Settings Custom Login page.
* Prevented arbitrary removal of admin_notices to preserve Site Health visibility.
* Hardened settings security and validation.
* Minor bug fixes.

= 2.3.1 =
* Improved WordPress.org compliance.
* Improved security validation and sanitization.
* Improved login and authentication workflows.
* Removed obsolete QR implementation and legacy components.
* Improved package structure and code quality.
* Improved compatibility with WordPress 7.0.
* Fixed issues identified during the WordPress.org review process.
* General stability, performance, and maintenance improvements.

= 2.3.0 =
* Added hybrid QR code generation (PHP 8.1+ uses native library, PHP 7.4-8.0 uses JavaScript)
* Improved PHP version compatibility across all hosting environments (PHP 7.4 through 8.3+)
* Removed all external API dependencies for QR generation
* Enhanced file integrity monitoring with real-time activity log
* Added attack type classification for blocked IPs
* Added comprehensive email notification system with rate limiting
* Improved security dashboard with comprehensive statistics
* Fixed timezone display issues
* Tested with WordPress 6.7

= 2.2.0 =
* Renamed plugin to "Neksio Login & File Security" for clarity
* Continued migration to the new plugin naming convention and namespace
* Updated primary namespace to Neksio_Login_File_Security
* Maintained backward compatibility with existing database keys and nonces
* Added comprehensive security score calculation
* Improved performance and reduced database queries
* Tested with WordPress 6.7

= 2.1.0 =
* Added Integrity Monitor for critical file protection
* Added real-time monitoring for wp-config.php and .htaccess
* Added unknown PHP file detection in WordPress root
* Added .htaccess backup file detection
* Added file permission monitoring
* Added security events history with filtering
* Added database tables for backups and security events
* Tested with WordPress 6.7

= 2.0.0 =
* Added Custom Login URL feature with secret fallback URL
* Added emergency access key for administrator recovery
* Added IP Management page with manual and automatic blocking
* Added attack type classification for blocked IPs
* Added IP intelligence report links
* Added Security Intelligence section to dashboard
* Added login log duplicate prevention
* Added WordPress timezone support for date display
* Added user agent parsing for browser and OS detection
* Tested with WordPress 6.7

= 1.0.0 =
* Initial release
* TOTP authentication with QR code setup
* Recovery codes system
* Trusted devices management
* Login logs and security events
* Security dashboard with metrics
* Security score calculation
* Role-based 2FA enforcement with grace periods
* User profile integration
* Users screen columns for 2FA status
* Settings with multiple tabs
* Privacy controls for IP storage and data retention
* Multisite support

== Upgrade Notice ==

= 2.4.0 =
This update improves the reliability of the Emergency Login URL and Custom Login URL features. It includes fixes for emergency bypass execution order, improved email notifications, enhanced security logging, and a more thorough uninstall cleanup process. Recommended update for all users relying on custom login paths or emergency access features.

= 2.3.2 =
Final compliance update for WordPress.org submission. Includes strict opt-in handling for external services, improved Settings API usage, removal of inline assets, and updated documentation.

= 2.3.1 =
Recommended update. Improves WordPress.org compliance, security validation, sanitization, and compatibility with WordPress 7.0. Removes obsolete legacy components and addresses issues raised during the WordPress.org review process.

= 2.3.0 =
This update improves QR code generation compatibility across PHP versions 7.4 through 8.3+. QR codes are generated locally using either native PHP libraries (PHP 8.1+) or JavaScript fallback (PHP 7.4-8.0). Enhanced file integrity monitoring and email notification system with rate limiting are included.

= 2.2.0 =
Plugin renamed to "Neksio Login & File Security" for clarity. Continued migration to new naming convention while maintaining backward compatibility.

= 2.1.0 =
Major update introducing the Integrity Monitor for critical file protection.

= 2.0.0 =
Major update with Custom Login URL, IP Management, and enhanced dashboard.

== Support ==

* Documentation: https://www.neksiotool.com/neksio-login-file-security/
* WordPress.org forums: https://wordpress.org/support/plugin/neksio-login-file-security/
* Email: support@neksiotool.com
* Website: https://www.neksiotool.com

== Credits ==

* QR Code Generation (PHP 8.1+): chillerlan/php-qrcode - https://github.com/chillerlan/php-qrcode
* QR Code Generation (PHP < 8.1): qrcodejs by davidshimjs - https://github.com/davidshimjs/qrcodejs
* Icons: WordPress Dashicons
* GeoIP Service: ip-api.com - https://ip-api.com
* Tor Exit Node List: The Tor Project - https://www.torproject.org/

== License ==

Neksio Login & File Security is licensed under the GNU General Public License v2 or later.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.