=== Papy3D Security Guard Changelog ===

= 2.0.10 =
* Replace the administration header PNG with the supplied AVIF banner.
* Preserve the existing 1454×500 display dimensions and admin layout.

= 2.0.9 =
* Update the WordPress.org `Tested up to` metadata from 7.0 to 7.1.
* No functional or security code changes.

= 2.0.8 =
* Correct the WordPress plugin author display name from `Papy3D` to the canonical WordPress.org account name `papy3d`.
* Keep product, package and Papy 3D Factory branding unchanged.

= 2.0.7 =
* Remove the deprecated `imagedestroy()` call from the pre-WordPress CAPTCHA image response path; GD image objects are released automatically by PHP 8+.
* Preserve the existing PNG/SVG CAPTCHA behavior without changing challenge generation, validation or connector logic.

= 2.0.6 =
* Accept the current protected uploads-based Papy3D WAF stable loader in connector handoff validation.
* Retain the historical wp-content WAF loader only as an exact backward-compatible migration target and continue rejecting arbitrary paths.

= 2.0.5 =
* Restore local CAPTCHA rendering on login, password reset, registration and comment forms after transient challenge tokens moved to the `t2s:` / `t2o:` formats.
* Accept current transient token prefixes in the CAPTCHA parser and route both `t1*` and `t2*` transient formats through `P3DSG_Crypto::decrypt_transient()` while retaining legacy compatibility.

= 2.0.4 =
* Remove the final generated `$_SERVER['SCRIPT_FILENAME']` references from the Early Guard loader.
* Detect direct loader execution from PHP's `get_included_files()` execution context, avoiding request superglobals and preserving `auto_prepend_file` behavior.

= 2.0.3 =
* Apply WordPress Coding Standards formatting and PHPDoc corrections across the PHP source after the final PHPCS review.
* Preserve Security Guard 2.0.2 behavior while incorporating the PHPCBF-safe formatting changes verified against the previous package.

= 2.0.2 =
* Remove the remaining pre-WordPress direct `$_SERVER` fallback reported by Plugin Check.
* Keep Early Guard compatible before WordPress bootstrap by using sanitized `filter_input()` first and sanitized `getenv()` only as a SAPI fallback.

= 2.0.1 =
* Complete a plugin-wide follow-up review of every nonce, capability, input, JSON, server-header and prefixing path raised by the WordPress.org manual review.
* Recursively sanitize nested WAF GET, POST, JSON and upload metadata while preserving reversible decoding only inside the detection engine.
* Sanitize and validate trusted-proxy and Wordfence vulnerability-feed JSON structures before persistence.
* Harden settings import upload metadata, forced-password-reset authorization, status/settings nonce checks and Cloudflare scheme validation.
* Keep the optional `p3dwaf_integration_v1_status` filter as an explicitly documented external API owned by the companion Papy3D WAF plugin.

= 2.0.0 =
* Remove the bundled shared administration hub and its shared CSS/bridge from Security Guard.
* Replace the shared parent menu with the autonomous `p3dsg-security-guard` top-level administration page.
* Remove all Security Guard runtime, activation and uninstall dependencies on shared hub classes and registry.
* Keep the optional Papy3D WAF public integration hook as an external companion-plugin API only.
* Normalize remaining compact control structures and route the Early Guard reset through the canonical standalone administration URL.

= 1.5.13 =
* Hardened input validation and nonce flow following the WordPress.org manual review.
* Reworked WAF request inspection to sanitize reversible copies before analysis while preserving encoded attack detection.
* Reworked the pre-bootstrap challenge to use sanitizing PHP filters and an explicitly signed HMAC nonce before processing the answer.
* Centralized Papy3D WAF integration status access and documented shared-suite identifiers.

= 1.5.12 =
* Remove redundant PHPDoc parameters reported by PHPCS/WPCS across the shared hub, early runtime, vulnerability, integrity, sensitive-file and administration modules.
* Correct the remaining Yoda conditions, loop-test function calls, short ternaries and documentation warnings without weakening validation or security behavior.
* Treat ZipArchive::numFiles as the native PHP API property it is: copy it into a snake_case local variable and use a narrowly justified PHPCS suppression only on the native property read.
* Rename the malware-scanner parent helper parameter, remove an obsolete empty renderer condition and update the canonical shared administration hub to 1.4.7.

= 1.5.11 =
* Replace historical `@since Unknown` placeholders with traced introduction versions from the retained release history and archived diffs.
* Keep symbol-level versions where a direct change record exists and use the first verifiable owning subsystem version for private internals whose individual line history is unavailable.
* Update the canonical shared administration hub to 1.4.6 with the stable broker documented since 1.4.0 and the versioned implementation documented as 1.4.6.

= 1.5.10 =
* Unslash explicitly selected honeypot request fields at the WordPress superglobal boundary before validation and sanitization.
* Avoid double-unslashing HTML form values and avoid applying WordPress request unslashing to REST request parameters that are already normalized.
* Keep the canonical shared administration hub 1.4.5 unchanged.

= 1.5.9 =
* Normalize WordPress PHP documentation across classes, methods, members, dependencies, return tags and custom hooks.
* Update the canonical shared administration hub to 1.4.5 with complete class/member documentation.
* Stop copying complete request superglobals in the honeypot module; only explicitly named fields are selected before validation and sanitization.
* Reformat the public stylesheet for maintainable WordPress CSS coding style.
* Keep the full historical changelog in changelog.txt while limiting readme.txt to the current release.

= 1.5.8 =
* Restore genuine PHP 8.0 compatibility by removing PHP 8.1/8.2-only return types while keeping the declared minimum unchanged.
* Defer plugin-service bootstrap to `plugins_loaded` so the main plugin file only defines constants, loads classes and registers lifecycle/bootstrap hooks.
* Replace the shared hub NOWDOC stylesheet with a local conditionally enqueued asset and update the canonical shared administration hub to 1.4.4.
* Replace direct Base64 decoding with validated Sodium-compatible legacy migration and move new encrypted/key/integrity transports to versioned hexadecimal formats.
* Move the stable Early Guard loader from the historical `wp-content` location into protected plugin-owned uploads storage, republish enabled runtimes idempotently after updates, and retain the previous loader only for the PHP cache transition window.
* Build the TOTP QR SVG through DOM APIs instead of `innerHTML`, remove hard-coded JavaScript fallbacks and harden sensitive-file probes with `wp_safe_remote_get()`.
* Remove low-value generated `Return value.` PHPDoc text and keep only narrowly justified static-analysis suppressions.

= 1.5.7 =
* Replace production `set_error_handler()` wrappers with local SPL filesystem objects and exception handling in the early guard, malware scanner, quarantine storage and permission audit.
* Remove the standalone pre-WordPress stylesheet route/link so Plugin Check no longer reports a non-enqueued stylesheet; the challenge remains a local semantic HTML/CAPTCHA form.
* Keep the canonical shared administration hub 1.4.3 byte-identical.

= 1.5.6 =
* Fix a fatal error on the Papy 3D hub home page when the first active compatible plugin exposes a partial or legacy label set.
* Normalize runtime hub labels before rendering and normalize again defensively before formatting the plugin count.
* Update the canonical shared administration hub to 1.4.3.

= 1.5.5 =
* Move mutable private state to the WordPress uploads directory resolved at runtime and store the authenticated-encryption master key in the WordPress database at the correct single-site or multisite scope, with migration of historical storage.
* Replace plaintext quarantine copies with chunked authenticated-encryption containers and migrate historical quarantine payloads before use.
* Keep only the stable early `auto_prepend_file` safety loader directly below `wp-content`; move changeable early-guard configuration and runtime state to protected uploads storage, with authenticated encryption for the configuration.
* Remove dynamic nooped-plural translation from the shared administration hub and update the canonical shared administration hub to 1.4.2.
* Remove PHP-rendered inline admin styles, serve the pre-WordPress challenge stylesheet locally, and remove filesystem error suppression.
* Expand external-service and private-storage documentation for WordPress.org review.

= 1.5.4 =
* Update the shared administration hub from version 1.4.0 to the canonical version 1.4.1.
* Centralize safe cleanup of orphaned hub cards while preserving active plugins and inactive plugins that remain physically installed.
* Keep the Security Guard adapter and all security features unchanged.

= 1.5.3 =
* Correct all issues listed in the supplied Plugin Check report: translator comments, explicit AJAX nonce validation, sanitized proxy headers, fixed prepared SQL and documented dedicated custom-table queries.
* Document unavoidable bounded local stream operations used before WordPress bootstrap or for exclusive quarantine copies.
* Reuse an existing compatible Papy 3D top-level menu at late `admin_menu` priority to prevent duplicate menus.
* Shorten the WordPress.org Description section below the parser limit.

= 1.5.2 =
* Reuse the historical shared Papy 3D administration hub when another compatible Papy3D plugin provides it, preventing a duplicate top-level menu.
* Defer hub registration until all active plugins are loaded so compatibility does not depend on plugin load order.
* Keep the plugin-specific prefixed hub as a standalone fallback for clean WordPress.org installations where no shared legacy hub exists.

= 1.5.1 =
* Resolve WordPress, content, plugin, theme and uploads locations through WordPress APIs instead of internal directory constants in scanners and update reporting.
* Add nonce-protected redirect statuses for administrative and login notices while preserving capability checks on every state-changing action.
* Remove the unused public CAPTCHA image endpoint; CAPTCHA images remain generated locally as signed inline data.
* Keep the public WAF request inspection explicitly nonce-free because it analyses arbitrary inbound traffic and does not authorize privileged actions.
* Rename the embedded administration hub class, option, menu slug, asset handle and CSS selectors to the plugin-specific `p3dsg` prefix.
* Preserve the guarded shared-library loading pattern for compatible Papy3D plugins that adopt the same prefixed hub implementation.

= 1.5.0 =
* Add an incremental heuristic malware/backdoor scanner for PHP-like files and sensitive server configuration across WordPress, plugins, themes, MU-plugins and uploads.
* Keep entropy telemetry at a fixed zero score weight until real-corpus calibration is completed.
* Use one shared batch engine for browser requests, explicitly chained one-shot WP-Cron events and the `wp papy3d-security scan` WP-CLI command.
* Add atomic scanner-start and per-scan batch locks, heartbeat recovery, resumable cursors, bounded retention, seen states, hash exceptions that expire on modification and explicit permanent path exceptions.
* Add protected quarantine with random non-executable payload names, capacity limits, hash-verified restore and no automatic deletion.
* Add dashboard malware alerts and contextual file-date diagnostics that can reinforce an existing finding without creating or scoring one on their own.
* Add on-demand per-file comparison after verified plugin/theme header and WordPress.org identity checks, with mandatory temporary archive cleanup.
* Add static file-permission checks, trusted-proxy-aware HTTPS redirects and targeted mixed-content diagnostics.
* Reuse the existing protected storage root for encryption keys and quarantine payloads and clean all new state on uninstall.

= 1.4.2 =
* Shorten the WordPress.org Description section with a wider parser safety margin while preserving the plugin’s main capabilities and external-service disclosure.

= 1.4.1 =
* Clear all stored « Pris en compte » acknowledgement states whenever the local vulnerability report is deleted, so a later scan starts with every finding active again.
* Gray and lock the Wordfence API-key field and disable the test/synchronize/save-key button while a decryptable key is already stored.
* Require explicit deletion of the stored key before another key can be tested or saved, with matching server-side protections against crafted administrative requests.
* Keep the separate « Synchroniser maintenant » action available for refreshing the local feed with the currently stored key.

= 1.4.0 =
* Classify every active plugin or theme vulnerability without a published fix by its age since Wordfence disclosure: 0–3, 4–14, 15–30, 31–60, or more than 60 days.
* Display cautious maintenance-confidence badges, exact elapsed days, tailored recommendations, and a report summary without claiming that an author has formally abandoned a component.
* Sort unpatched findings by the most urgent maintenance-age status, then by age and component name.
* Replace the generic vulnerability dashboard warning with distinct update, recent, degraded-confidence, potentially-unreliable, and strongly-recommended-removal alerts.
* Keep acknowledged findings collapsed at the end of the report and excluded from age summaries, dashboard notices, and notifications until an administrator restores them or their material vulnerability state changes.
* Add optional aggregated vulnerability notifications with dedicated recipients, using the existing immediate, daily, or weekly alert-delivery system.
* Notify only when an unpatched finding is new, materially changed, or crosses into a more concerning age bracket; store only a bounded hash-based transition state and no request or visitor data.

= 1.3.1 =
* Defer the privacy migration bootstrap until WordPress pluggable functions are available.
* Prevent a fatal `Call to undefined function wp_salt()` during plugin loading and legacy log-key migration.

= 1.3.0 =
* Add one shared GDPR policy for Security Guard logs and alert IP addresses, with exact or obfuscated storage, IPv4 /24 and IPv6 /64 masking, common retention, and irreversible bounded migration of historical data.
* Keep temporary blocks and rate limits bound to local HMAC identifiers derived from exact addresses instead of widening blocks to masked /24 or /64 networks.
* Replace newly written honeypot and username-blacklist grouping keys with local HMAC identifiers while retaining active historical keys.
* Add centralized immediate, daily, or weekly delivery for login, sensitive-action, and update alerts.
* Deduplicate repeated events, isolate summaries by recipient set, optionally send critical events immediately, and provide manual send and queue-clear actions.
* Mask exact addresses already waiting in the alert queue before any digest can be delivered in obfuscated mode.

= 1.2.0 =
* Add automatic trusted-proxy detection without trusting arbitrary forwarded headers.
* Detect Cloudflare only from bundled official IPv4/IPv6 ranges, Sucuri from bundled ranges, and same-host/private reverse proxies from exact private peers whose right-most X-Forwarded-For hop is public.
* Reject spoofed provider headers outside validated source networks.
* Restore the original IPv6 from CF-Connecting-IPv6 when Cloudflare Pseudo IPv4 overwrites client headers.
* Synchronize newly detected proxy trust with the Security Guard early runtime and Papy3D WAF while keeping remote list downloads limited to manually selected providers.
* Expire automatic detections after 30 days and limit local reverse-proxy peers to eight exact addresses.

= 1.1.3 =
* Corrected WAF handoff commit verification during per-worker `.user.ini` cache transitions on PHP-FPM/CGI/LiteSpeed.
* The connector accepts the verified WAF loader and on-disk target directive while the current worker still reports the previous Security Guard loader; unrelated owners remain rejected.

= 1.1.2 =
* Shorten the Description section with a wider safety margin for the WordPress.org readme parser.

= 1.1.1 =
* Correct validation findings for translator guidance, nonce-visible request handling, and the readme description limit.
* Store trusted-proxy refresh notices in a short-lived per-user transient instead of reading an unsigned query parameter.
* Document the public Papy3D WAF integration hook and the WordPress core `DISALLOW_FILE_EDIT` constant as intentional cross-plugin/core APIs.

= 1.1.0 =
* Delegate numeric author and anonymous REST user enumeration to a compatible active Papy3D WAF runtime.
* Stop the corresponding Security Guard handlers before they inspect a request already owned by Papy3D WAF.
* Delegate pingback method filtering to Papy3D WAF while preserving Security Guard's `pingback.extensions.getPingbacks` removal, optional complete XML-RPC shutdown, and X-Pingback response-header removal.
* Gray and lock the author-enumeration card, and present XML-RPC as a clear complementary policy instead of a duplicate protection.
* Exclude delegated author and pingback-only modules from active-module counters while preserving their stored fallback settings.
* Require explicit active-slot capabilities from Papy3D WAF 1.4.0 or newer before delegating each WordPress-specific policy.

= 1.0.72 =
* Fix proxy-provider setting saves while Papy3D WAF is the effective `auto_prepend_file` owner.
* Skip obsolete Security Guard private-config writes during active delegation.
* Retain the disabled-config write only when Security Guard still owns the directive during a transfer.
* Preserve shared-context publication to Papy3D WAF and all manual proxy ranges.

= 1.0.71 =
* Add optional automatic trusted-proxy provider lists while preserving manual entries.
* Retrieve bounded validated ranges from selected official sources daily or on demand and retain recent last-known-good data after transient failures.
* Scope provider-specific client-IP headers to the corresponding validated proxy network.
* Synchronize effective ranges with the early guard and Papy3D WAF connector context.
* Present discontinued StackPath/MaxCDN as manual-only.
* Reject unsafe IPv4/IPv6 /0 trusted-proxy ranges and remove expired automatic trust from the early runtime even when network refresh is disabled.

= 1.0.70 =
* Make repeated Papy3D WAF ownership transfers idempotent when the Security Guard early guard is disabled or has no private storage directory.
* Avoid an unnecessary private-config write when there is no Security Guard runtime to suspend.
* Recreate storage protections before a required suspension and publish configuration through a collision-resistant temporary file.

= 1.0.69 =
* Treat the live Papy3D WAF integration status as the authoritative source for duplicate-protection delegation.
* Continue delegation when the runtime is active, awaiting its initial probe, or validating a newly published A/B slot, provided it owns `auto_prepend_file` and exposes a valid policy mode.
* Keep the Security Guard early guard and local WAF suspended even when an older transfer left no durable connector state.
* Correct the hardened-mode label shown in the delegation overlay.

= 1.0.68 =
* Visually lock and gray the early-login guard and local WordPress WAF sections while a healthy Papy3D WAF delegation is active.
* Display an accessible overlay explaining that Papy3D WAF owns the duplicated protections, with the active runtime mode and a direct administration link.
* Keep all delegated Security Guard settings submitted and stored unchanged so automatic restoration remains possible.
* Exclude delegated modules from the active-module counters while retaining them in the available-module totals.

= 1.0.67 =
* Add the versioned Papy3D WAF connector protocol 1.0 with prepare, release, commit, rollback and recovery states.
* Persist prepare and restore boundaries and avoid overwriting a WAF directive waiting for the PHP per-directory INI cache.
* Report failed marker removal instead of committing an unverifiable transfer.
* Delegate the WordPress-level WAF only after Papy3D WAF proves effective ownership through its signed health probe.
* Share custom login paths, trusted proxies and WAF allow ranges through the public connector without exposing private options or secrets.
* Preserve Security Guard WAF and early-guard settings for automatic restoration when Papy3D WAF is disabled or removed.
* Keep CAPTCHA, honeypots, TOTP, sessions, login controls, hardening, audits and alerts active during WAF delegation.

= 1.0.66 =
* Let administrators acknowledge individual vulnerability findings, keep them collapsed at the end of the report, exclude them from dashboard alerts, and reactivate them automatically when their material state changes.
* Replace native username and password failures through the structured `wp_login_errors` hook so custom login URLs reliably display the configured generic message.
* Enforce anonymous REST user-enumeration blocking when WordPress returns a successful cookie-authentication result without an authenticated user.
* Embed each local CAPTCHA SVG directly in the form so a custom login URL, hosting rule, or expired image request cannot replace it with a 404 response.
* Renew cached login and comment challenges through a rate-limited no-cache front-end request before submission.
* Keep the legacy signed image routes solely for forms already cached by an earlier release.

= 1.0.65 =
* Serve local CAPTCHA SVG images through a signed, no-cache front-end request so hosting rules or security layers that block anonymous wp-admin resources cannot replace the image with a 404 response.
* Retain the legacy admin-post image handlers for cached pages while all newly rendered forms use the public endpoint.
* Add a native `comment_form_submit_field` fallback for both CAPTCHA and honeypot output when a theme omits the usual comment field actions.
* Keep the rendering guards so themes that expose both standard hooks still receive only one copy of each protection.

= 1.0.64 =
* Require anonymous classic and REST comments to carry a valid signed, post-bound form proof plus the randomized empty honeypot field, rejecting direct submissions that omit or reshape the trap.
* Add a conservative minimum completion time and seven-day cache-compatible lifetime to the signed comment-form proof.
* Prevent duplicate honeypot and CAPTCHA markup when a theme invokes both supported comment-form hooks for one form.
* Generate short-lived CAPTCHA challenges with a dedicated transient encryption key so a missing persistent secrets key cannot silently remove the comment CAPTCHA.
* Accept current `s2:`/`o2:` CAPTCHA tokens during the compatibility window and display a visible fail-closed message if a comment challenge cannot be created.

= 1.0.63 =
* Replace the public-404 query URL with a collision-resistant missing front-end path and keep every legacy non-empty marker value in a 404 state.

= 1.0.62 =
* Add an optional site-rendered 404 mode for blocked `wp-admin` and `wp-login.php` requests, using a safe body-dropping redirect and the normal front-end 404 template flow.

= 1.0.61 =
* Block anonymous REST user enumeration through `/wp-json/wp/v2/users` and `?rest_route=/wp/v2/users` under the existing author-protection module.
* Add one-click `DISALLOW_FILE_EDIT` hardening without disabling plugin, theme, or core updates.
* Enrich changed-file integrity reports with bounded suspicious-code signature checks and no stored code excerpts.
* Add administrator-only, nonce-protected JSON settings export/import with secret filtering and full existing-settings validation.

= 1.0.60 =
* Make repeated-login and TOTP attempt counters atomic under concurrent authentication requests.
* Add a versioned persistent encryption key, bounded migration of legacy salt-derived ciphertext, key-loss detection, and salt-rotation resilience.
* Cache merged plugin settings for each request and invalidate the cache immediately after settings mutations.
* Clarify trusted-proxy header precedence, make the Cloudflare fallback reachable for unusable XFF input, and keep the pre-WordPress resolver aligned.
* Make WAF occurrence and risk aggregation atomic and express the standalone runtime direct-access guard in a Plugin Check compatible form.

= 1.0.59 =
* Add an optional pre-WordPress login guard installed safely through `auto_prepend_file`.
* Count login submissions globally across all sources and detect short bursts, distributed one-attempt-per-IP attacks, sustained low-rate attacks, and repeated attempts from one address.
* Challenge login traffic before WordPress loads during attacks with a signed, expiring, entirely local CAPTCHA and a source-bound pass cookie.
* Add one-switch administration, live installation and attack status, protected counter reset, safe conflict refusal, emergency bypass support, and complete privacy and hosting documentation.

= 1.0.58 =
* Add the official plugin URI for the Papy 3D Factory forge.
* Separate neutral hub metadata from translated runtime labels while retaining the canonical shared hub version 1.2.3.
* Split administration rendering and Wordfence feed synchronization into dedicated reusable traits so each implementation file remains focused and bounded.
* Complete WPCS documentation, direct-access guards, and defensive control-flow cleanup without changing the security features.
* Add the generated translation template for the plugin text domain.

= 1.0.57 =
* Update the shared Papy 3D administration hub to version 1.2.3.
* Harden shared hub registry hydration against incomplete or legacy stored entries.
* Replace the numbered legacy-hub compatibility comment with a capability-based description.

= 1.0.56 =
* Update the shared Papy 3D administration hub to version 1.2.2.
* Keep the shared hub independent from the Security Guard text domain and persist only locale-neutral routing metadata.
* Supply translated pluralization and permission-denied labels from the plugin integration.

= 1.0.55 =
* Move the encrypted Wordfence API key to a dedicated non-autoloaded option, with automatic migration from the legacy general-settings value.
* Preserve a separately stored validation state for keys that have already completed a successful feed import.
* Stop presenting a later 401 or 403 as proof that an already validated encrypted key is locally invalid.
* Add bounded, redacted response diagnostics and explicit stored-key/validated-key fingerprint consistency checks.
* Use HTTP/1.1 with a closed connection for repeat Wordfence feed requests and preserve the last valid local feed on remote authentication failures.

= 1.0.54 =
* Escape the complete translated dashboard-widget summary before output.
* Resolve the Plugin Check output-escaping error reported for the hidden issue count.

= 1.0.53 =
* Added an administrator-only security summary widget to the WordPress dashboard.
* Limited the summary to unresolved issues requiring review, with normal WAF activity shown only as informational statistics.
* Kept all detailed alerts on the plugin screen and preserved native dashboard widget visibility controls.

= 1.0.52 =
* Add the missing translator comment for the correlated WAF-rule count.
* Make nonce and capability verification explicit in the manual WAF unblock handler.
* Document intentional raw request inspection for the WAF while sanitizing ordinary HTTP headers.
* Replace the dynamic event-pruning query with a fully prepared bounded DELETE statement.


= 1.0.51 =
* Remove WordPress and plugin version details from the Wordfence Intelligence request user agent so the documented external-service disclosure matches the request.
* Supply translated labels to the shared Papy 3D administration hub.
* Translate WAF, honeypot, and suspicious-username CSV export headings and remove untranslated JavaScript fallback messages.
* Add suggested privacy-policy content through the WordPress privacy-policy helper on admin_init.


= 1.0.50 =
* Limit administrative security notices to the plugin screen to comply with WordPress.org guideline 11.
* Add a defensive capability check to settings processing.
* Confirm that privileged administrative actions remain protected by capability and nonce verification.


= 1.0.49 =
* Add a self-hosted application firewall with observation, balanced, and strict operating modes.
* Detect high-confidence SQL injection, XSS, path traversal, local or remote file inclusion, command injection, sensitive-file probes, web-shell probes, CRLF, JNDI, XXE, SSRF, serialized-object payloads, and dangerous uploads.
* Add bounded request inspection, risk scoring, route, parameter, and IP exclusions, configurable blocking thresholds, and temporary IP blocking.
* Add a dedicated event table, 30-day dashboard statistics, event aggregation, retention cleanup, manual unblocking, complete log clearing, and CSV export.
* Keep the WAF disabled and in observation mode by default, exclude internal plugin actions and cron, keep logged-in administrators observation-only, and document the limits of a plugin-level firewall.


= 1.0.48 =
* Replace direct deletion of the internal `rewrite_rules` option with the public `flush_rewrite_rules()` API during deactivation.
* Move the complete historical changelog to `changelog.txt` and retain only recent releases in the WordPress.org readme.
* Correct the duplicated 1.0.44 changelog heading for the previous release.


= 1.0.47 =
* Add the required translator context for the Wordfence cooldown countdown placeholders.
* Render the cooldown button attributes through WordPress attribute helpers and escaped translated values.
* Document the two intentional direct option-table writes with targeted PHPCS exceptions.

= 1.0.46 =
* Fix saving a newly validated Wordfence Intelligence key by bypassing the global settings sanitizer that restored the previous empty secret.
* Disable both remote-download buttons during the enforced 31-minute cooldown and re-enable them automatically when the countdown ends.
* Clarify that the 30-minute download limitation comes from the Wordfence Intelligence service terms, while local scans remain unlimited.

= 1.0.45 =
* Fix Wordfence API-key deletion by bypassing the settings sanitizer that restored the previous encrypted key during admin-post deletion.
* Preserve all unrelated settings, disable the module, invalidate option caches, and verify the raw stored value after deletion.

= 1.0.44 =
* Fix API-key deletion so the encrypted Wordfence key is explicitly emptied, verified after cache purge, and its stored fingerprint metadata is removed.

= 1.0.43 =
* Fix handling of temporary Wordfence Intelligence refusals after a previously successful synchronization.
* Add a one-minute safety margin to the documented 30-minute API interval.
* Verify that the exact API key survives encryption and option storage before reporting success.

= 1.0.42 =
* Ensure uninstall removes the Security Guard card from the shared Papy 3D registry, including legacy-key entries.
* Preserve every other registered Papy3D plugin and delete the shared option only when the registry becomes empty.
* Apply the selective registry cleanup to every site during a multisite network uninstall.

= 1.0.41 =
* Restore a neutral shared “Accueil” page beneath the stable “Papy 3D” administration menu.
* Add a persistent registry where every compatible Papy3D plugin publishes and removes only its own card.
* Keep the shared registry when one plugin is uninstalled and delete it only after the final registered plugin is removed.
* Let any remaining compatible Papy3D plugin recreate the shared menu and homepage, avoiding ownership by Security Guard.

= 1.0.40 =
* Remove the shared “Accueil” submenu and its dedicated landing page.
* Make the top-level “Papy 3D” menu open Security Guard directly when this plugin creates the shared menu.
* Keep only plugin entries beneath the shared menu so other Papy3D extensions can add their own submenus.

= 1.0.39 =
* Move the plugin entry out of Settings and into a shared top-level “Papy 3D” administration menu.
* Reuse an existing Papy 3D menu, including compatible menus registered with a different slug, and create it only when needed.
* Update settings links, audit notices, action redirects, screen detection, and asset loading for the new administration location.

= 1.0.38 =
* Update the optional PayPal support form to use the standard `_xclick` workflow.
* Set the donation description to “Offrir un café” and the suggested amount to 5 EUR.
* Replace the text submit control with a local graphical support button.

= 1.0.37 =
* Add dedicated “Support the project” and “About” administration tabs.
* Add an optional PayPal donation form based on the Papy3D Fact Viewer workflow, without loading or contacting PayPal before an explicit form submission.
* Add the new Papy3D Security Guard banner and 256-pixel icon to the administration interface.
* Keep settings submission separate from the external donation form and hide the settings action bar on informational tabs.

= 1.0.36 =
* Fix the five remaining Plugin Check findings in the Wordfence vulnerability scanner.

= 1.0.35 =
* Fix Plugin Check SQL identifier preparation, nonce validation, streaming file access, and uninstall cleanup warnings.

= 1.0.34 =
* Added a per-administrator dismissal for global warnings that contain only unpatched WordPress core vulnerabilities.
* Actionable plugin, theme, and patched-core vulnerability warnings remain visible.
* A dismissed core-only warning automatically returns when the affected core findings change.

= 1.0.33 =
* Makes Wordfence API action messages one-time only instead of persisting in the URL.
* Removes and verifies encrypted API-key deletion and clears obsolete key-related errors.
* Orders vulnerability findings by remediation priority with red or orange vertical indicators.

= 1.0.32 =
* Refactors Wordfence Intelligence into a quota-safe synchronization architecture.
* Downloads the complete Scanner Feed at most once every 30 minutes and imports it into dedicated local database tables.
* Uses staging tables and an atomic swap so a failed synchronization preserves the last valid local feed.
* Makes installed-component scans fully local and repeatable without additional Wordfence API requests.
* Adds daily feed synchronization, Retry-After handling, local feed status, and separate synchronization diagnostics.
* Streams the large JSON feed record by record instead of decoding the complete document in PHP memory.

= 1.0.31 =
* Return every Wordfence Intelligence action to the dedicated Vulnerabilities tab.
* Fix the persistent Audit-tab anchor after manual scans, API-key tests, key removal, and report deletion.
* Update the vulnerability warning link and message to reference the Vulnerabilities tab.

= 1.0.30 =
* Move the Wordfence Intelligence vulnerability audit into its own dedicated Vulnerabilities tab.
* Keep the Audit tab focused on sensitive-file exposure and local file-integrity monitoring.
* Display the vulnerability module as a full-width card without changing its settings, API key, reports, or scheduled scans.

= 1.0.29 =
* Clears a stale failed vulnerability-scan report after a Wordfence Intelligence API key is successfully validated.
* Prevents the settings screen from showing a successful key test and an obsolete authentication failure at the same time.

= 1.0.28 =
* Test and save the exact newly entered Wordfence Intelligence API key in one protected action.
* Remove invisible Unicode characters and whitespace from copied API keys.
* Add a non-secret SHA-256 fingerprint so administrators can confirm which key is stored and tested.
* Add a protected action to remove the stored API key and disable the audit module.
* Add a non-secret HTTP diagnostic for rejected API requests.

= 1.0.27 =
* Normalize Wordfence Intelligence API keys copied with a Bearer or Authorization prefix.
* Add an authenticated API-key test action and clearer diagnostics for 401 and 403 responses.
* Clarify that the Vulnerability Data Feed key is different from the Wordfence plugin license key.

= 1.0.26 =
* Added an authenticated Wordfence Intelligence v3 Scanner Feed integration.
* Added a local inventory of WordPress core, installed plugins, and installed themes, including active state and update versions already known by WordPress.
* Added strict affected-version matching, patched-version guidance, vulnerability references, required feed attributions, daily WP-Cron scans, encrypted API-key storage, report clearing, rate limiting, and bounded report storage.
* Added an external-service disclosure and privacy details for the optional Wordfence Intelligence connection.

= 1.0.25 =
* Fixed output escaping findings in audit summaries and password-reset notices.
* Refactored CSV export output so Plugin Check recognizes the controlled escaping.
* Added explicit nonce verification adjacent to integrity ignore-path input processing.

= 1.0.24 =
* Repackaged the plugin under its canonical `papy3d-security-guard` directory so the plugin slug and text domain match.
* Added installation guidance warning against keeping renamed backup copies inside `wp-content/plugins` when running Plugin Check.
* No security-module behavior or stored setting was changed.

= 1.0.23 =
* Moved the Trusted proxies field out of the administration IP-filter module into a global Network and IP detection section.
* Clarified that trusted proxies are shared by IP filtering, lockouts, TOTP limits, alerts, username-blacklist detection, and honeypot logging.
* Added explicit guidance separating trusted proxy networks from administration allowlists.

= 1.0.22 =
* Added a renewable global honeypot field for login, registration, password-reset, multisite signup, comments, REST comments, and other public HTML forms.
* Added immediate rejection, temporary IP blocking, bounded detection logs, manual unblocking, field-name renewal, and CSV/plain-IP exports.
* Added privacy guards so passwords, comment bodies, CAPTCHA answers, TOTP values, and recovery codes are never logged by the honeypot module.

= 1.0.21 =
* Added a configurable blacklist for commonly attacked usernames.
* Added log-only and automatic temporary IP-blocking modes with final authentication enforcement.
* Added optional domain and site-name variants, existing-account conflict protection, manual unblocking, bounded retention, and CSV/plain-IP exports for external firewalls.

= 1.0.20 =
* Added an explicit choice to include or exclude the administrator who starts a forced-password-reset campaign.
* Excluding the initiator preserves that administrator's current sessions and exempts the account from the active campaign.
* Campaign summaries now show whether the initiating administrator is included or excluded.

= 1.0.19 =
* Added a forced password-reset campaign for all existing site users.
* Added immediate session revocation, a dedicated password-change screen, REST blocking, and native WordPress password-flow completion.
* Added configurable minimum password length and campaign cancellation.

= 1.0.18 =
* Added protected actions to delete the stored sensitive-file scan report.
* Added a protected action to delete local-integrity and official-core reports while preserving the trusted baseline and ignored-path list.

= 1.0.17 =
* Added local file-integrity baselines and daily comparison scans.
* Added detection of added, modified and deleted files with reversible ignores.
* Added manual acceptance of a new trusted baseline.
* Added official WordPress core MD5 checksum verification.

= 1.0.16 =
* Added a bounded local scanner for exposed sensitive files, including environment files, WordPress configuration backups, database exports, public archives, debug.log, and executable PHP files in uploads.
* Added optional limited HTTP verification for static files by comparing only the first 128 bytes, without storing file contents.
* Deliberately avoids requesting PHP files found in uploads so potentially malicious code is never executed by the scanner.
* Added per-finding remediation guidance and exact blocking snippets for Apache/LiteSpeed, Nginx/OpenResty, Nginx Proxy Manager, Microsoft IIS, and Caddy.
* Added scan locking, per-user rate limiting, symlink avoidance, multisite capability restrictions, bounded traversal, and a persistent administrative report.

= 1.0.15 =
* Added an independent sensitive-action alert module with configurable administrative recipients.
* Added individual alerts for new administrators, administrator role elevation, administrator email and password changes, TOTP activation, deactivation and emergency reset, recovery-code regeneration, custom login-path changes, IP-filter and XML-RPC protection deactivation, and application-password creation or revocation.
* Added request-level deduplication so creating a new administrator does not also generate a duplicate role-elevation or password-change alert.
* Added plain-text notification context with the site, date, initiator, IP address, and user agent while explicitly excluding credentials and authentication secrets.
* Added custom internal actions for completed TOTP lifecycle events.

= 1.0.14 =
* Added an independent HTTP security-header module for public WordPress document responses.
* Added individual controls and strict value allowlists for COEP, COOP, CORP, Referrer-Policy, X-Content-Type-Options, X-Download-Options, X-Frame-Options, X-Permitted-Cross-Domain-Policies, and X-XSS-Protection.
* Preset conservative headers while leaving the potentially disruptive COEP, COOP, and CORP controls disabled by default.
* Excluded wp-admin, wp-login.php, REST, AJAX, feeds, trackbacks, and cron from the module scope.
* Added settings warnings for cross-origin compatibility and cached or server-generated responses.

= 1.0.13 =
* Added an independent browser content-protection module with ten individually configurable controls.
* Added local JavaScript controls for context menus, text selection, copy, cut, paste, print shortcuts, common developer-tool shortcuts, source-view shortcuts, Print Screen, and drag-and-drop.
* Added print-only CSS that produces a blank document when browser printing is disabled.
* Added a clear settings warning that screenshot, developer-tool, and source-view restrictions are deterrents and cannot be guaranteed by a web page.
* Kept the WordPress login screen and administration area outside the module scope.

= 1.0.12 =
* Added an independent module to remove native feed discovery links from the public document head.
* Removes the WordPress `feed_links` and `feed_links_extra` callbacks when enabled.
* Keeps direct feed endpoints available to preserve compatibility with feed readers and integrations.
* Added defensive filters for direct calls to the native site and comment feed-link generator.

= 1.0.11 =
* Added an independent module to hide the front-end WordPress admin bar for selected user roles.
* Added a role selector based on the roles registered on the current site.
* Preserved wp-admin access, capabilities, and the administration toolbar.
* Added validation that prevents enabling the module without selecting at least one role.

= 1.0.10 =
* Fixes a possible HTTP 500 error caused by enforcing session limits inside the early current-user resolution filter.
* Moves session checks to the normal WordPress initialization phase.
* Adds defensive compatibility checks for custom session-token backends.

= 1.0.9 =
* Added an independent advanced session-management module.
* Added configurable logout after 5 to 1,440 minutes of inactivity.
* Added a configurable absolute session limit from 1 to 720 hours.
* Excluded WordPress Heartbeat, post-lock refreshes, cron, and WP-CLI from activity renewal.
* Added a protected action to revoke every WordPress user session, including the current administrator.
* Restricted network-wide revocation to network administrators on multisite installations.
* Added clear login notices after inactivity, absolute expiration, or global session revocation.
* Redirected an expired authenticated session to the custom login path instead of returning the protected wp-admin 404 response.

= 1.0.8 =
* Added an independently configurable generic login credential error message.
* Preserved CAPTCHA, TOTP, and IP lockout errors so legitimate users still receive actionable feedback.
* Added optional removal of WordPress generator output from HTML and feeds.
* Added conservative removal of asset version parameters only when they exactly match the installed WordPress core version.
* Preserved plugin and theme asset versions to avoid interfering with cache invalidation.

= 1.0.7 =
* Reorganized the settings screen into Access, Authentication, Hardening, and Notifications tabs.
* Added active-module counters, clearer module states, responsive cards, and a persistent save bar.
* Kept all settings in one form so saving one tab cannot reset options from another tab.
* Added accessible keyboard navigation and restoration of the last active tab.

= 1.0.6 =
* Fixed CAPTCHA verification so answers are case-insensitive.
* Mixed uppercase and lowercase input now matches the displayed challenge.

= 1.0.5 =
* Fixed login CAPTCHA enforcement after WordPress validates the username and password.
* Prevented the native authentication provider from replacing an invalid CAPTCHA error with a valid user.
* Added a final login guard that clears the authentication cookie if another extension bypasses the CAPTCHA error.
* CAPTCHA is checked before password verification, cached once per request, and enforced again after all providers run.

= 1.0.4 =
* Rewrote the WordPress.org readme in standard English.
* Added the required translator explanation for the recovery-code plural placeholder.
* Reworked request sanitization so WordPress Coding Standards and Plugin Check can verify it directly.

= 1.0.3 =
* Moved TOTP profile actions to independent forms submitted through `admin-post.php`.
* Removed the incorrect unsaved-changes warning during TOTP management actions.
* Added the remaining recovery-code count.
* Added secure regeneration of eight recovery codes after confirmation with a current TOTP or recovery code.
* Added local copying and downloading of recovery codes.
* Regenerating recovery codes immediately invalidates the previous set.
* Added an action to cancel an unconfirmed TOTP enrollment.

= 1.0.2 =
* Added TOTP validation to `wp_authenticate_user` and at the end of the `authenticate` filter chain.
* Added a final `wp_login` guard that removes the cookie and invalidates the session if TOTP was not validated.
* An enrollment that was started but not confirmed now blocks login instead of ignoring the code.
* A TOTP value entered for an account that is not configured is explicitly rejected.
* Added enforcement policies for configured accounts, administrators, or all users.
* Prevented duplicate processing of the same code during a single request.

= 1.0.1 =
* Fixed a critical TOTP login validation issue.
* Moved TOTP validation to the end of the WordPress authentication chain.
* Denied accounts with an incomplete TOTP configuration.
* An encrypted TOTP secret remains authoritative if its activation flag is altered.

= 1.0.0 =
* Initial modular release.
