=== Sitemap Guardian ===
Contributors: sitemapqa
Tags: security, login, audit, hardening, integrity
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.5
License: GPLv2 or later

Practical WordPress security, monitoring, and hardening in one place.

== Description ==

Sitemap Guardian by Sitemap Co. helps you manage key WordPress security controls from one clear dashboard.

It brings together firewall protection, login security, site hardening, security activity, alerts, and integrity scanning so administrators can review their site’s security posture and respond quickly when attention is needed.

Key features include:

* Firewall and abusive-request protection
* Login protection and administrator security alerts
* Security hardening and optional country access controls
* File integrity scanning, audit activity, and weekly summaries
* Emergency controls and WordPress.org update checks

No WordPress plugin can guarantee protection from every threat. Use maintained hosting, prompt updates, strong access controls, and tested backups alongside Sitemap Guardian.

== Installation ==

1. Upload the plugin directory to `/wp-content/plugins/`.
2. Activate Sitemap Guardian.
3. Review Sitemap Guardian in the WordPress admin menu.
4. Run the first integrity scan to establish a local baseline.

== Privacy ==

This version sends no product telemetry. WordPress core checksum scans contact WordPress.org. Security audit events store a validated IP address where available, plus a keyed IP hash, in the site's own database; older events recorded before version 0.11.0 contain only the irreversible hash. Records follow the configured retention period. Audit context is bounded and sanitized. Administrators choose whether deletion of the plugin also removes its database tables, settings, scan results, and user metadata.

== External services ==

WordPress core checksum verification contacts the official WordPress.org checksum service when a scan is finalized.

The dashboard requests the official WordPress.org security-news RSS feed. The response is cached locally and a failure does not affect protection.

Administrator-login emails can contain an Opentracker IP lookup link. Sitemap Guardian does not contact Opentracker automatically; the IP address is sent to Opentracker only if an email recipient opens that link.

== Changelog ==

= 1.0.5 =
* Simplified the public WordPress.org plugin description.

= 1.0.4 =
* Added an overview release panel that reads WordPress.org update data, supports a manual refresh, and provides WordPress's secure one-click update action when a newer version is available.
* Fixed Smart 404 throttling to use only a validated individual visitor IP and never fall back to a shared site-wide counter.

= 1.0.3 =
* Confirmed compatibility with WordPress 7.1.

= 1.0.2 =
* Confirmed compatibility with WordPress 7.0.4.

= 1.0.1 =
* Enqueued login-page styling through the WordPress styles API.
* Replaced late global hardening constants with targeted WordPress capability handling.
* Removed the ineffective late administration-SSL constant and audited privileged request handlers.

= 1.0.0 =
* First WordPress.org-ready stable release.
* Removed executable-file editing for WordPress.org directory compatibility.
* Added explicit external-service and uninstall-data disclosures.
