=== SMEPlan Security Shield ===
Contributors: solotop
Tags: security, malware scan, firewall, hardening, backdoor
Requires at least: 6.1
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.7.34
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scheduled security scanning (files/DB/config), baseline/integrity checks, safe quarantine & rollback, and hardening for WordPress.

== Description ==

SMEPlan Security Shield is a free, open-source security plugin built around a practical WordPress operations checklist: it watches the 3 most common attack surfaces (OWASP-class attacks plus WordPress-specific ones, persistence mechanisms, and entry vectors), detects issues with baseline/checksum + signature + thresholded heuristics, and remediates safely (quarantine instead of outright deletion; 1-click rollback).

= Key features =

* **Batched, checkpointed file scanning**: prioritizes `mu-plugins`, drop-ins, the active theme/plugins, and `uploads`; never loads the whole file tree into RAM at once.
* **Safe database scanning**: keyset pagination (no `OFFSET`) over `options`/`posts`/`postmeta`; only flags a row when it decodes into an actually executable PHP/JS token, skipping image data URIs.
* **Configuration checks**: `.htaccess`/`.user.ini` rules that map media extensions to PHP, `auto_prepend_file`, file/directory permissions, weak salts/keys, unusual cron entries.
* **Baseline/integrity**: compares core files against WordPress.org's official checksums; automatically builds a SHA-256 baseline for every plugin/theme on install/update; 1-click restore of any mismatched core file from a signature-verified WordPress.org package, with the current file quarantined first.
* **Quarantine & rollback**: moves suspicious files aside (never deletes), with a full transaction log and 1-click rollback.
* **Per-component backups**: a "last confirmed good" snapshot of each plugin/theme, refreshed on every trusted update, checksum-verified before every restore, with a best-effort local tamper-resistance layer.
* **Maintenance mode with a TTL** that turns on automatically when remediation touches a hot path or a large batch, and turns itself off once a health-check passes.
* **Hardening**: login rate-limit/lockout by IP + IP/username (real IP behind a CDN via trusted proxies), disables XML-RPC pingback + caps `system.multicall`, security headers (HSTS/X-Frame-Options/CSP Report-Only), controlled auto-updates (low-traffic time window, skips VCS-managed sites, health-check after updating).
* **Multi-layer scan scheduling**: WP-Cron + an internal watchdog + an HMAC-signed REST endpoint (for system cron/remote pings) + a WP-CLI command — the schedule keeps running even when WP-Cron is unreliable.
* **Multisite**: enumerates every site by `blog_id`, scanning each site's own `uploads` folder and tables.

Two hardening behaviours worth knowing about before you enable them, because they change how the site answers requests that are not this plugin's own:

* **User-enumeration blocking is on by default.** For visitors who are not signed in, the core `wp/v2/users` REST routes stop being served and `?author=<id>` links redirect to the home page. This is a deliberate part of the login-hardening layer, but it is a change to an API this plugin does not own — a headless front end, a mobile app or a third-party integration that reads the public user list will see it disappear. Turn it off under Hardening if something depends on it. (rc-47)
* **`wp smeplan-ss scan run` exits 75 when a scan is already running.** 75 is `EX_TEMPFAIL` — "temporary failure, try again" — rather than 0, so a wrapper running under `set -e` will treat a busy lock as a failed command. Handle 75 explicitly if you schedule the command that way. (rc-49)

= Not yet in this release (planned for later versions) =

* 2FA (TOTP) and CAPTCHA for the login page.
* Anonymous telemetry (opt-in).
* Translations (every string is already wrapped in `__()`, ready for translators via translate.wordpress.org — no translation is bundled with the plugin itself).
* Action Scheduler integration for enterprise-grade durable queuing.

== Installation ==

1. Upload the plugin to `wp-content/plugins/` or install it through the Plugins screen.
2. Activate the plugin.
3. Go to **Security Shield → Wizard** to check WP-Cron/loopback and configure trusted proxies if the site sits behind a CDN.
4. See **Security Shield → Policies** to turn hardening features on/off as needed.

== Frequently Asked Questions ==

= Does the plugin delete suspicious files automatically? =

No. Files at the "malicious" level are **moved into quarantine** (`wp-content/uploads/smeplan-security-shield/quarantine/`) rather than deleted, and can be rolled back with 1 click. Files at the "suspicious" level are only recorded, waiting for manual review on the Findings page.

Quarantined files are kept for a limited time: once a session is older than the retention period set under Policies (14 days by default), it is removed automatically to stop the quarantine folder growing without bound. Roll back anything you want to keep before that window closes, or raise the retention setting.

= What is removed when I delete the plugin? =

Deleting the plugin removes every option it created, its scheduled events, and the three custom capabilities it grants. It **deliberately does not remove its storage folder** at `wp-content/uploads/smeplan-security-shield/`, which holds the quarantine, the file baseline, the event log and any component backups.

This is a deliberate choice, not an oversight. Quarantined files are *moved*, not copied — the folder holds the only remaining copy of anything the plugin took out of the site. Deleting a plugin is easy to do in the middle of handling an incident, or by someone who is not the person investigating, and having that click silently destroy both the only rollback path and the only forensic evidence would be the wrong default for a security plugin. Reinstalling brings the previous quarantine and logs straight back.

To remove it, delete that folder yourself over SFTP or your host's file manager once you are sure nothing in it is still needed. **Read the caution first:** the `quarantine/` subfolder can contain live malicious files that were pulled off the site. Delete them, do not move them back into place.

= Does the plugin automatically edit database content or the .htaccess file? =

No. Every finding in the database or in configuration files (.htaccess/.user.ini) is only reported, never auto-fixed, to avoid breaking a site's legitimate functionality.

= Does this plugin change how WordPress updates itself? =

No. It never supplies its own update source: there is no bundled update checker, no third-party update server, no filtering of the plugin-information API, and nothing written to the transients core caches available updates in. Everything WordPress installs still comes from WordPress.org, fetched and verified by WordPress itself.

What it does offer — off by default, and only if you switch it on in **Policies** — is control over *when* an update WordPress has already found and verified gets applied. Using core's own public `auto_update_core` / `auto_update_plugin` / `auto_update_theme` filters, it can hold an update back until the low-traffic window you configure, skip it while the site is under load, and skip any plugin or theme directory that is under version control (updating those breaks a deploy). It only ever delays WordPress's own updates; it never substitutes them.

Since 0.7.32 it can also refuse one: a plugin or theme package is scanned while still in its temporary folder, and if a file in it matches malware detection the install is stopped before anything is written. A manual update can be allowed through once from the dashboard notice; an automatic one is refused and reported. This uses core's own `upgrader_source_selection` filter, changes nothing about where updates come from, and can be switched off in Policies.

Automated scanners flag any use of those filters for a human to look at, which is why this is spelled out here.

= What environment does it need? =

WordPress 6.1+, PHP 7.4+. Works best when WP-Cron runs normally; if the site has `DISABLE_WP_CRON` set or blocks loopback requests, use system cron/WP-CLI following the instructions on the Wizard page.

== Screenshots ==

1. SMEPlan Security Shield Dashboard and Security Scanner Overview.

== Privacy Policy ==

By default, this plugin does not send any data outside of the site it is installed on. Everything it collects (scan findings, logs, baseline data) stays in the local WordPress database and in a protected local storage folder inside the uploads directory (`wp-content/uploads/smeplan-security-shield/`, blocked from direct web access).

Two features send data off-site, and both are entirely opt-in — off unless the site admin explicitly sets them up:

* **Alert email**: if enabled, a summary of new findings is emailed to the site's configured admin email address (`admin_email`) using WordPress's own `wp_mail()`.
* **Alert webhook**: if the admin enters a Webhook URL in Policies, a summary (site URL, alert subject, malicious/suspicious counts, timestamp — no personal or visitor data) is sent as JSON to that admin-provided URL whenever new findings are detected. Nothing is sent anywhere unless the admin fills in this field themselves.

That storage folder outlives the plugin on purpose: deleting the plugin removes its options, cron events and capabilities, but leaves the folder in place so a quarantined file is never destroyed by an uninstall performed mid-incident. See the FAQ entry "What is removed when I delete the plugin?" for the reasoning and for how to remove it yourself.

The plugin does not phone home to any SMEPlan-operated server, does not track usage/analytics, and does not include any third-party tracking or advertising code.

== Changelog ==

Newest release only — WordPress.org truncates this section at 5,000
characters. The full history is in `changelog.txt`, shipped with the plugin.

= 0.7.34 =
Fixes from a fourth full review of 0.7.32. The first item is the reason this release exists.
* **A version upgrade no longer looks like an attack.** Scan checkpoints written by an earlier version carry no signature, so the new integrity check refused them all — correctly — but reported each at critical, filling the Dashboard with red "State unauthenticated" lines for a format change. A missing signature on a file older than this site's key reads as a migration now; a wrong signature, or a missing one on a newer file, stays critical. (rc-78)
* **The detector read its own documentation as malware.** It treated the inside of a string literal as code, so advice text explaining a signal in the words of that signal — "The file calls eval() …" — scored exactly like a real call. String bodies are blanked now, the same way comments already were: PHP executes neither. Real detection is unchanged, and a test scans every shipped file on each run. The same flaw hit any plugin that documents an attack technique or holds a code sample in a string. The message shown when a package IS blocked also names the right screen now. (rc-76, rc-77)
* **A backup could be forged (critical).** Restoring a component checked only that the archive matched the checksum written beside it — and both files sit in the same folder, so anything able to write there could supply a matching pair and have it extracted over a plugin directory on the next Restore. Backup metadata is signed now, with a key held in the database. Existing backups carry over once. (rc-01)
* **The window for adopting older quarantine metadata reopened on every update.** Meant to run once, for sessions written before signatures existed, it was keyed to the plugin version — so a forged session only had to wait for the next release to be signed. It closes once now. (rc-02)
* **Baselines and scan checkpoints are signed too.** Both sat in the uploads folder under predictable names with no integrity marker, so one write could switch off change detection for a component. (rc-64)
* **Maintenance mode could delete WordPress's own.** Core writes the same `.maintenance` file during every update; the watchdog has checked ownership since 0.7.25, but the disable path and the WP-CLI command did not. A failed write is also no longer reported as success, which used to let a backup restore move a live directory while the site served traffic. (rc-65, rc-66)
* **The scanner could report a clean cycle without reading a file,** if clearing the previous checkpoint failed. It checks now, and an oversized file can no longer kill the same request forever. (SS3, CF-01)
* **The per-tick I/O limit means what it says.** It counted at most 256 KB per file while the code underneath read up to 5 MB, hashed whole files and streamed up to 64 MB. Every read reports what it read now, and memory is checked before a file is opened. (rc-04, rc-32)
* **Quarantine retention works again.** A session's age came from meta.json's modification time, which the migration rewrote — so every update pushed old sessions another retention period out. (rc-23)
* **Restoring a false positive accepts the right checksum.** The hash came from a hidden form field rather than the signed metadata, so the file could be re-quarantined on the next tick. (rc-56)
* **Multisite:** the guard against duplicate network-activation batches never matched, so batches could run concurrently and the progress marker move backwards. A key that could not be stored also no longer produces signatures nobody can verify. (rc-54, rc-22, rc-03)
* **Performance:** the Trusted components screen no longer re-reads every baseline line to count them; the Dashboard no longer opens every quarantine record to render one number; database checkpoints are paced by time, not row count; settings are merged once per request; bulk backups are spread over separate cron runs. (rc-29, rc-28, rc-27, rc-33, rc-31)
* **Accessibility:** row buttons on Trusted components and Accepted files say which row they belong to and name the target in their confirmation; the Dashboard summary reflows at 400% zoom; settings tables mark row headers; the Logs view switch says which view you are on. (rc-15, rc-45, rc-59, rc-60, rc-61)
* **Also:** storage filenames stopped being guessable when the cron secret is blank; orphaned quarantine folders were logged once a minute forever, pushing real findings out of the log window (once a day now); a full core restore is rate-limited; the file displaced by a rollback is recorded rather than left unmentioned; `/findings` says whether its list was truncated; the watchdog no longer treats a fire-and-forget request as proof the site was scanned. (rc-19, rc-30, rc-20, rc-25, rc-62, rc-24)

Older releases: see `changelog.txt`.

== Upgrade Notice ==

= 0.7.34 =
Closes a critical hole: anything able to write into the uploads folder could forge a component backup and have it extracted over a plugin directory on the next Restore. Backups, baselines and scan checkpoints are now signed. Recommended for all sites.

= 0.7.32 =
Fixes four ways this plugin could itself lose data or take a site down (a core-file restore leaving the file missing, a rollback overwriting the destination, a backup restore running with the site live, and a stranded .maintenance file after uninstall), stops one large file stalling the scanner, and restores quarantine recovery on sites upgraded from 0.7.26-0.7.30. Adds a Trusted components screen. Recommended for all sites.

= 0.7.31 =
Follow-up fixes to 0.7.30: restores legacy-quarantine recovery after a reinstall, stops the scanner from restarting without ever finishing, and hardens the 0.7.30 alert and cron-example fixes. Recommended for all sites.

= 0.7.30 =
Fourteen security and correctness fixes from a full review of 0.7.29, several affecting multisite recovery, quarantine rollback, and automatic backups. Recommended for all sites.

= 0.7.29 =
Stops WordPress 6.7+ logging a "translation loaded too early" notice on every admin page load. Recommended if your debug log is filling up.

= 0.7.28 =
Removes a debug warning added in 0.7.25 that flooded the log on sites with WP_DEBUG enabled. No behaviour change otherwise.

= 0.7.27 =
Stops WordPress 6.7+ filling the debug log with a "translation loaded too early" notice on every request. No behaviour change otherwise; 0.7.26's security fix is included.

= 0.7.26 =
Security release. Fixes an arbitrary file write inside the WordPress root: a forged quarantine session could make Rollback overwrite wp-config.php. Affects 0.7.24 and 0.7.25. Update, then review the Remediation screen before clicking Rollback if the site may have been compromised.
