=== StaticGuard ===
Contributors: staticguard
Tags: security, static site, elementor, anti-spam, hardening
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Reduce the public WordPress attack surface with a verified static copy. Elementor pages, galleries, lightboxes and classic forms remain available.

== Description ==

StaticGuard generates a local static copy of your public WordPress site and serves it to logged-out visitors from the same domain. WordPress remains installed and available to authenticated administrators, while ordinary public pages no longer need to execute PHP or query the database.

The Free edition is focused on Elementor brochure sites and includes:

* a five-step first-run setup assistant with actionable diagnostics;
* manual full-site static publication;
* local discovery and copying of pages, styles, scripts, fonts, images and videos;
* Elementor-aware asset discovery and validation;
* frontend support for menus, galleries, lightboxes and common interactions;
* classic Elementor Pro form delivery through the site's own AJAX endpoint;
* form origin checks, a honeypot and essential rate limiting;
* validation before activation and anonymous verification after activation;
* automatic recovery to the previous public copy when a new publication fails;
* daily local integrity checks that rebuild or restore the public copy when it is damaged;
* two locally stored, restorable versions, with a configurable retention of 2 to 20 copies;
* hosting diagnostics for Apache, LiteSpeed and common proxy configurations.

No subdomain, second hosting account, DNS change, external static hosting service, StaticGuard account or license key is required for Free.

The administration interface is available in French and English and follows the WordPress dashboard language automatically.

= What StaticGuard changes =

StaticGuard writes generated files under the WordPress uploads directory, in `uploads/staticguard/`. Private releases live in `uploads/staticguard/data` and the active public copy lives in `uploads/staticguard/static/current`. Already-deployed `wp-content/wordpress-shield-data` and `wp-content/wordpress-shield-static` trees can still be read so a live publication is not moved, but new files are never created there. If uploads are offloaded or stored outside the WordPress web root, StaticGuard reports a blocking admin diagnostic instead of writing to `wp-content`. On supported servers it adds a clearly delimited routing block to the WordPress `.htaccess` file. Disabling the plugin removes this managed routing and restores ordinary WordPress delivery.

= Security scope =

Static publication substantially reduces the code exposed on ordinary public pages, but it does not make the complete WordPress installation invulnerable. Keep WordPress, themes and plugins updated; use strong passwords, backups and HTTPS; and protect the hosting account itself.

= Free and Pro =

StaticGuard Free contains no paid-feature code and does not contact a license or update server. StaticGuard Pro is a separate GPL extension.

Pro adds:

* automatic publication
* integrity monitoring and repair
* a private back-office address
* email two-factor authentication
* login protection
* multipage Elementor audits
* extended publication history

Buy Pro at [staticguard.io/tarifs](https://staticguard.io/tarifs): 59 € TTC/year per site, 119 € Pro, 239 € Agency.

== Installation ==

1. Upload the `staticguard` folder to `/wp-content/plugins/` or install the ZIP from Plugins > Add New > Upload Plugin.
2. Activate StaticGuard.
3. Open StaticGuard in the WordPress administration menu.
4. Follow the five setup steps shown by StaticGuard.
5. Select **Check my site** and use the recommended action displayed below any blocking diagnostic.
6. Select **Protect my site** to build and publish the first static version.
7. Open the site in a private browser window and check navigation, images, videos, galleries and lightboxes.
8. Send a real test message through every Elementor form, verify receipt and complete the setup checklist.

StaticGuard Free currently requires readable permalinks, WordPress at the public-domain root, a writable local uploads directory and a server configuration that honors WordPress `.htaccess` rules. Apache and LiteSpeed are the primary supported targets. A pure Nginx or IIS setup requires server rules that this first release does not install automatically.

== Screenshots ==

1. The guided Free setup checks hosting, detects Elementor and leads the administrator through five clear validation steps.
2. Detailed compatibility diagnostics explain every technical check and show the recommended action when manual verification is required.
3. Elementor coverage, Free publishing settings and the separate Pro protections are presented without hiding what each edition includes.

== Frequently Asked Questions ==

= Do I need a subdomain or a second hosting account? =

No. StaticGuard publishes on the current WordPress domain and hosting account.

= Can I continue to use WordPress and Elementor? =

Yes. Logged-in administrators keep the normal WordPress and Elementor experience. Logged-out visitors receive the static copy.

= Does the Elementor contact form work in Free? =

Yes. The classic Elementor Pro form is supported. StaticGuard keeps its own-site AJAX delivery available and adds an origin check, honeypot and essential rate limiting. Always complete a real delivery test after publication. Atomic forms, third-party form widgets and custom endpoints are outside the guaranteed scope of this first release.

= What happens if a publication fails? =

The new build is not activated. If failure happens during public activation, StaticGuard attempts to restore the previous verified copy. The failure remains visible in the deployment history.

= Does StaticGuard work with every hosting provider? =

StaticGuard does not depend on a specific hosting brand or LiteSpeed. It relies on PHP, writable local storage, readable permalinks and Apache-compatible `.htaccess` routing. The built-in diagnostic checks the detectable prerequisites, and the first public publication is the final compatibility test.

= Does StaticGuard send site data to StaticGuard? =

No. The Free plugin does not send site content, form submissions, telemetry or license requests to StaticGuard. Generated files remain on the WordPress hosting account. Links to documentation and Pro pricing open only when an administrator chooses them.

= Is my WordPress administration completely isolated? =

No. The Free edition reduces exposure of ordinary public pages. WordPress administration and selected dynamic endpoints still exist. Strong passwords, updates and backups remain essential. The optional private back-office address and additional login protections are provided by the separate Pro extension.

== Upgrade Notice ==

= 1.0.7 =
Makes Elementor form rate limiting and the shared generation lock atomic under concurrent requests.

= 1.0.6 =
Keeps new generated files under uploads/staticguard and uses staticguard_ prefixes throughout the Free package.

= 1.0.5 =
Clears the remaining Plugin Check warnings on settings sanitization and WordPress.org translation loading.

= 1.0.4 =
Unlocks daily integrity checks and version retention in Free, sanitizes settings on save, and stores new sites under uploads/staticguard while keeping existing staticguard-* folders in place.

= 1.0.3 =
Fixes Elementor build validation after installing Free in the standard `staticguard` plugin folder.

= 1.0.2 =
Repairs publication queues left behind during a plugin replacement and refreshes the administration screen automatically when a build completes.

= 1.0.1 =
Initial WordPress.org-ready Free release with manual verified publication, Elementor assets and interactions, classic form support, hosting diagnostics and two-version recovery.

== Changelog ==

= 1.0.7 =
* Elementor form rate limits now reserve one slot per request with add_option instead of a get-and-increment transient.
* The shared generation lock now uses add_option plus a compare-and-set replace so an expired lock cannot delete a lock another request just acquired.

= 1.0.6 =
* New releases, probe files and generated data are written only under `uploads/staticguard`.
* Offloaded or non-local uploads now fail in the administration screen instead of writing to `wp-content`.
* Existing `staticguard-*` trees remain readable so a live publication is not moved.
* Replaced leftover historical option, hook and define prefixes with `staticguard_`, including form rate-limit transients.

= 1.0.5 =
* Sanitized Free settings in the same assignment before save.
* Stopped calling load_plugin_textdomain; WordPress.org loads translations by slug.

= 1.0.4 =
* Wired daily integrity monitoring and repair in Free, including a manual check from the administration screen.
* Allowed administrators to keep between 2 and 20 local versions in Free.
* Sanitized settings form input before it is stored or passed to extension filters.
* Stopped shipping an en_US translation catalog; translate.wordpress.org remains the source for locale packs.
* Stored new generated files under `uploads/staticguard`, with a fallback for already-deployed `staticguard-*` folders.

= 1.0.3 =
* Recognized StaticGuard frontend assets independently of the plugin installation folder name.
* Stopped requiring the Pro-only multipage functional audit asset in Free builds.
* Added a regression test covering the packaged Free folder and Elementor validation profile.

= 1.0.2 =
* Cleared interrupted generation locks safely when upgrading from the former monolithic plugin.
* Repaired pending publications when their WP-Cron event is missing or late.
* Added live publication status polling and automatic page refresh after completion.
* Improved WP-Cron diagnostics for manual Free publications.

= 1.0.1 =
* Created a standalone Free distribution with no license client, private updater or paid-feature code.
* Added manual verified static publication on the existing WordPress domain.
* Added Elementor-aware page, media, style and script discovery.
* Preserved menus, galleries, lightboxes and common Elementor interactions.
* Included the classic Elementor Pro form with origin checks, honeypot and essential rate limiting.
* Kept two restorable local versions and automatic recovery when activation verification fails.
* Added Apache, LiteSpeed and proxy-aware hosting diagnostics.
* Added a guided first-run assistant, actionable fixes and automatic French/English administration localization.
