=== Owl Security ===
Contributors: owlgorithmlabs
Tags: security, firewall, malware, two factor authentication, login security
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.12.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

All-in-one WordPress security: firewall, malware scanner, login protection, 2FA, and backups in one clean, lightweight dashboard.

== Description ==

**Protect your WordPress site around the clock.** Owl Security blocks malicious traffic, scans for malware, hardens common weak points, and secures your login — all from one fast, clearly designed dashboard that doesn't slow your site down.

Owl Security brings practical WordPress protection and recovery tools into one responsive administration screen. The Free build works without a license, does not perform remote entitlement checks, and keeps its security features available locally.

Free capabilities include:

* Live risk score and security status overview.
* Brute-force protection, login rate limiting, login alerts, built-in math CAPTCHA and honeypot protection.
* Optional Google reCAPTCHA v2/v3 or Cloudflare Turnstile when an administrator selects and configures one of those providers.
* RFC 6238 TOTP two-factor authentication and recovery controls.
* Malware signature scanning and administrator-requested WordPress core checksum verification.
* Reversible quarantine with path and symlink safety checks.
* Firewall rules for high-confidence SQL injection, cross-site scripting, command execution, traversal, abusive bots, endpoint abuse, and request rate limiting.
* Comment and registration anti-spam controls.
* Activity logging for security-relevant WordPress events without storing passwords or submitted form bodies.
* File-integrity baselines, file-permission checks, upload MIME validation, and upload-directory execution protection.
* Manual protected backups, downloads, restore checks, and recovery tools available in the Free build.
* Reversible hardening for the file editor, XML-RPC, directory browsing, version output, author enumeration, and anonymous REST access.
* Manual reports, CSV/PDF exports, and a bounded debug-log viewer.
* Multisite-aware activation, deactivation, and uninstall behavior.

Owl Security does not silently enable commercial vulnerability, CAPTCHA, password-breach, GeoIP, reputation, AI, or uptime services. Optional providers remain inactive until the administrator chooses the related feature and supplies any required credentials.

Scheduled scans, deep scan, virtual patching, trusted devices, behavioral anomaly detection, advanced file security, scheduled backups, WPScan vulnerability intelligence, Safe Update Guard, scheduled summaries, and country/IP/geo blocking are available only in the separate Pro build.

== External services and privacy ==


Owl Security can contact the services listed below. Optional services remain disabled until an administrator enables the related feature and, where required, enters credentials.

= WordPress.org Core Checksums API =

What it is: The official WordPress.org service that returns file checksums for a specific WordPress release.

When data is sent: Only when an administrator runs a malware scan with WordPress core verification enabled.

Data sent: The installed WordPress version and locale are sent in the request URL. The request User-Agent also contains the Owl Security version and the site's home URL. No site content, users, passwords, form submissions, or database records are sent.

Service information: https://wordpress.org/about/
Privacy: https://wordpress.org/about/privacy/

= WPScan Vulnerability Database API =

What it is: An optional vulnerability-information service operated by Automattic.

When data is sent: This service is used only by the separate Pro build. The WordPress.org Free build does not contact WPScan. In Pro, data is sent only after an administrator enables vulnerability intelligence, enters a WPScan API token, and runs or loads a vulnerability scan.

Data sent: The WPScan API token is sent in the Authorization header, and the plugin or theme slug is sent in the request URL. The request User-Agent contains the Owl Security version and the site's home URL. Installed component versions are compared locally against the returned records. Site content, users, passwords, and form submissions are not sent.

Terms: https://wpscan.com/terms/
Privacy: https://automattic.com/privacy/

= Have I Been Pwned Pwned Passwords API =

What it is: An optional compromised-password lookup service.

When data is sent: Only when compromised-password checking is enabled and WordPress validates a password during a supported password or login flow.

Data sent: Only the first five characters of an uppercase SHA-1 hash are sent through the k-anonymity range API. The raw password and the complete hash never leave the site. The request User-Agent contains only the Owl Security version.

API information: https://haveibeenpwned.com/API/v3#PwnedPasswords
Terms: https://haveibeenpwned.com/TermsOfUse
Privacy: https://haveibeenpwned.com/Privacy

= Google reCAPTCHA =

What it is: An optional third-party CAPTCHA provider.

When data is sent: Only when an administrator selects reCAPTCHA v2 or v3, saves valid provider credentials, and a protected form is submitted.

Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Google's siteverify endpoint. Google's browser script may also receive browser, device, network, and interaction data under Google's policies. Built-in Math and Honeypot modes do not contact Google.

Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy

= Cloudflare Turnstile =

What it is: An optional third-party CAPTCHA provider.

When data is sent: Only when an administrator selects Turnstile, saves valid provider credentials, and a protected form is submitted.

Data sent: The configured secret key, the provider response token, and the visitor IP address are sent server-side to Cloudflare's siteverify endpoint. Cloudflare's browser script may also receive browser, device, network, and interaction data under Cloudflare's policies. Built-in Math and Honeypot modes do not contact Cloudflare.

Terms: https://www.cloudflare.com/website-terms/
Privacy: https://www.cloudflare.com/privacypolicy/

Email reports and login notices use the WordPress site's configured wp_mail() transport. Owl Security does not operate that mail service. Administrators can disable IP logging or enable IP anonymization. Request query values and submitted form bodies are not stored in the request log.

== Installation ==

1. Upload the `owl-security` folder to `/wp-content/plugins/`, or upload the ZIP through Plugins > Add New > Upload Plugin.
2. Activate Owl Security.
3. Open Owl Security from the WordPress administration menu.
4. Review Login Protection, Firewall, File & Upload, Backup, and Hardening settings before enabling restrictive controls.
5. Create and download a known-good backup before performing restore or filesystem-hardening operations.

No npm, Composer, or other build step is required after upload.

== Frequently Asked Questions ==

= Does the Free build require a license? =

No. The Free build has no license field and does not contact a licensing service.

= Does Owl Security send data automatically? =

It does not silently enable optional third-party services. Official WordPress core checksums are requested only as part of an administrator-requested scan. Pwned Passwords, reCAPTCHA, and Turnstile require an administrator to enable or configure the related Free feature. WPScan vulnerability intelligence is available only in the separate Pro build.

= Can I keep CAPTCHA completely local? =

Yes. Use the built-in math CAPTCHA and honeypot instead of a third-party CAPTCHA provider.

= What does the Pwned Passwords check send? =

Only the first five characters of a SHA-1 password hash. The original password and complete hash stay on the WordPress site.

= Can quarantine permanently delete a file? =

Quarantine is reversible. Eligible files are moved into a protected directory and their original paths are recorded. WordPress core files and Owl Security's own active files are protected from automatic quarantine.

= What backup file is created without ZipArchive? =

Owl Security creates a protected `.sql.gz` database-only backup and deletes the temporary raw SQL export. If neither ZipArchive nor zlib is available, backup creation fails clearly instead of retaining a standalone SQL file.

= Is restore risk-free? =

No restore tool is risk-free. Keep an off-site backup and test major restore operations on staging first.

= Is Owl Security free? =

Yes. The Free build is fully functional on its own — web firewall, malware scanner, login protection, two-factor authentication, manual backup and restore, hardening, activity logging, and reports all work without a license and without remote entitlement checks. A separate Pro build adds automation and scheduled or real-time protection.

= Does Owl Security slow down my site? =

It's built to stay light. Scans run on demand or in the background rather than blocking page loads, and deep request inspection is optional. The dashboard is designed to be fast and unobtrusive.

= Do I need coding knowledge to use it? =

No. Every feature is controlled from a single WordPress admin screen with plain-language explanations. Hardening changes are reversible, so you can safely try them and undo any that don't suit your site.

= Does Owl Security include two-factor authentication (2FA)? =

Yes. Free includes RFC 6238 TOTP two-factor authentication (compatible with apps like Google Authenticator and Authy) plus recovery controls, alongside brute-force protection, login rate limiting, and CAPTCHA options.

= Will it work on multisite? =

Yes. Activation, deactivation, and uninstall behavior are multisite-aware.

= What does the Pro version add? =

Pro adds automation and scale: scheduled and deep scanning, WPScan vulnerability intelligence with automatic patching, virtual patching, trusted devices, behavioral anomaly detection, scheduled backups, Safe Update Guard, scheduled report summaries, and country/IP/geo blocking. The Free build never contains locked Pro code.

== Screenshots ==

1. Security dashboard — live security score, plain-language verdict, and recent activity at a glance.
2. Malware scanner — detected items with one-click quarantine, restore, or dismiss, and reversible actions.
3. Web firewall — blocked-request activity and rule controls.
4. One-click hardening — vulnerability scan and reversible hardening checklist.
5. Login protection — two-factor authentication setup, CAPTCHA options, and brute-force defense.

== Changelog ==

= 1.12.1 =

* Updated compatibility for WordPress 7.1.
* Documentation and readme improvements. No functional changes.

= 1.12.0 =

* Physically excluded trusted-device token and Pro login-risk execution modules from the WordPress.org package; Free two-factor authentication always requires its normal second factor.
* Added a package audit that rejects direct Pro execution gates or upgrade-error paths in Free-shipped PHP.
* Added protected `.sql.gz` database-only backup fallback and automatic deletion of the temporary raw SQL export.
* Made backup archive and restore paths support renamed or relocated WordPress content directories through manifest metadata.
* Reverified external-service disclosures, path handling, identifier prefixing, PHP syntax, JavaScript syntax, and the Free/Pro packaging boundary.

= 1.10.1 =

* Added a strict Free/Pro build boundary while preserving the shared plugin slug, options, tables, and data.
* Made the Free administration interface independent from license activation.
* Added a WordPress.org-focused external-services disclosure and GPL-2.0 license file.
* Isolated Pro-only integrity and uninstall licensing code from the Free package boundary.
* Switched Free third-party server requests to `wp_safe_remote_get()` or `wp_safe_remote_post()` with explicit timeouts.

== Upgrade Notice ==

= 1.12.1 =

Compatibility and documentation update; no functional changes.

= 1.12.0 =

Separates all remaining Pro execution modules, prevents standalone SQL backup artifacts, and supports custom content-directory names.
