=== Techbox Firewall ===
Contributors: techboxdesign
Tags: firewall, waf, web application firewall, malware, bot protection
Requires at least: 6.2
Tested up to: 7.0
Stable tag: 1.0.3
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Web Application Firewall for WordPress. Blocks SQL injection, XSS, malicious bots, and bad requests.

== Description ==

Techbox Firewall is a fast, lightweight Web Application Firewall (WAF) for WordPress. It inspects every
request and blocks common attacks — SQL injection, cross-site scripting (XSS), remote code execution,
directory traversal, malicious bots, and bad requests.

Techbox Firewall is part of the **Techbox Shield** family and is designed to pair with
[Techbox Login Security](https://wordpress.org/plugins/techbox-login-security/) for complete front-door
protection: the firewall stops malicious requests, while Login Security guards the login itself.

= What you get =

* **WordPress-layer WAF** — loads early and screens every request, on any host, no `.htaccess` or server
  changes required.
* **Core attack rules** — SQL injection, XSS, RCE, LFI/RFI, path traversal, malicious user-agents and
  bad bots, and anomalous requests.
* **Signed rule updates** — optional (off by default); enable weekly or daily when you want fresher rules, verified before apply.
* **Learning mode** — on by default so you can watch and log before you enforce.
* **IP allow / block lists** — block known-bad addresses and allow-list your own office or VPN.
* **Activity log** — see exactly what was blocked and why, with a clean, plain-English record.
* **Safe-mode recovery** — a built-in way back if a rule or setting ever gets in your way.

= Built for real people, not just developers =

Security software is often written for experts. Techbox Firewall is different: smart defaults,
plain-English settings, and a clear view of what it is blocking — so first-time site owners and seasoned
agencies both feel at home.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/` or install it from the Plugins screen in WordPress.
2. Activate **Techbox Firewall** through the *Plugins* menu.
3. Open **Techbox Firewall** in the admin sidebar. Screening starts in **Monitor** mode on the **Basic**
   protection level — requests are logged, not blocked, until you switch to Enforce.
4. Allow-list your IP under IP Access, review the Logs, then turn on **Enforce** when ready.

== Frequently Asked Questions ==

= Will this break my site or block real visitors? =

Techbox Firewall ships with conservative defaults and a **learning mode** so you can review what it would
block before it enforces anything. If a rule ever gets in your way, a **safe-mode recovery** option and
per-rule controls let you fix it quickly.

= Does it work on any host? =

Yes. Techbox Firewall runs inside WordPress (no `.htaccess` or server configuration needed), so it works
on shared, managed, and VPS hosting alike.

= Do I still need a login security plugin? =

A firewall and login protection solve different problems. Techbox Firewall blocks malicious requests;
[Techbox Login Security](https://wordpress.org/plugins/techbox-login-security/) protects the login itself
(limit login attempts, lockouts, activity logging). They are designed to work together.

== Privacy ==

Firewall logs, IP lists, and settings stay on your WordPress site. Logs may include IP addresses,
request paths, and matched rule IDs so you can audit blocks — remove or restrict access if your
policies require it.

Our website Privacy Policy: https://techboxdesign.com/privacy-policy/

== External services ==

This plugin can optionally download fresher attack-detection signatures from a feed service
operated by Techbox Design. It is off on a fresh install and stays off until you switch it on.

* **Service:** `https://feeds.techboxdesign.com/firewall/v1/` — a JSON signature document plus a
  detached signature file.
* **When:** Only after an administrator turns on **Allow this site to contact the Techbox
  signature feed** under Firewall → Rule updates. With that off, the plugin makes no request to
  the service at all, from any trigger. With it on, you choose between manual checks only, weekly,
  or daily.
* **Data sent:** An ordinary HTTPS GET via the WordPress HTTP API. No account, no licence key, and
  no visitor personal data.
* **What comes back:** Detection signature *data* — a match expression per entry, plus a category,
  a score, and which parts of a request to inspect. Every field is validated against an allow-list
  and the document’s signature is verified before anything is stored. Nothing downloaded is
  executed, evaluated, included, or unserialised, and no plugin, theme, or add-on is installed or
  updated by this service. Plugin updates come from WordPress.org only.
* **If it is unavailable:** The signatures bundled with the plugin are always active, so protection
  does not depend on this service being reachable or enabled.
* **Terms of Use:** https://techboxdesign.com/terms-and-conditions/ (see “Optional signed rule
  feed”)
* **Privacy Policy:** https://techboxdesign.com/privacy-policy/

You can withdraw permission at any time; doing so also cancels any schedule.

== Third-party notices ==

This plugin may receive **translated derivatives** of the [OWASP Core Rule Set](https://coreruleset.org/)
(Apache License 2.0) through its signed rule feed. Upstream project:
https://github.com/coreruleset/coreruleset — copyright CRS project contributors; see the upstream
`LICENSE` for the full Apache License 2.0 text. We do not embed ModSecurity; only portable
signatures are translated into Techbox’s JSON rule format and delivered via the signed feed.

== Changelog ==

= 1.0.3 =
* Log retention now keeps events for the full 1–365 days offered in settings.
* Choose which header carries the visitor IP behind a proxy or CDN, or leave it on automatic detection.
* The optional rule feed now asks before its first check and names the service it contacts.
* The IP block list explains what it does in the firewall mode you are actually running.
* Security and reliability hardening.
* Compatibility fixes for recent WordPress releases.

= 1.0.2 =
* Harden admin output escaping.

= 1.0.1 =
* Document Privacy Policy and Terms links for the optional signed rule feed.
* Point Plugin URI at the WordPress.org listing and trim outbound marketing links.

= 1.0.0 =
* First public release: WordPress-layer WAF with Basic / Balanced / Strict levels.
* Ships in Monitor mode on Basic by default; switch to Enforce when ready.
* Optional signed rule feed (off by default; weekly or daily when enabled), seed fallback, IP lists, logs, and safe-mode recovery.

== Upgrade Notice ==

= 1.0.3 =
Adds control over proxy headers and the optional rule feed, keeps logs for the full retention range, and hardens security and reliability.

= 1.0.2 =
Hardens admin output escaping.

= 1.0.1 =
Clarifies external-service Privacy/Terms links for WordPress.org review.

= 1.0.0 =
First public release of Techbox Firewall.
