=== Trufend ===
Contributors: shewa
Tags: security, login, firewall, malware, backup
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Harden WordPress with brute-force protection, login security, security headers, malware scanning, backups, and more.

== Description ==

Trufend helps you protect a WordPress site with practical security controls that stay out of your way until you need them. Enable only the modules you want, review activity from a single dashboard, and keep common attack paths closed.

= Free features =

* **IP Lock** — Limit failed login attempts, block abusive IP addresses, and unblock them from the settings page.
* **Login Security** — Hide login hints, optional custom login URL, and email-based two-factor authentication.
* **Admin User Protection** — Enforce stronger administrator passwords and surface important account changes.
* **Security Headers** — Send common HTTP security headers such as `X-Frame-Options` and `Referrer-Policy`.
* **XML-RPC Protection** — Disable XML-RPC when it is not needed.
* **User Enumeration Protection** — Block common author-scanning techniques.
* **REST API Protection** — Restrict anonymous REST API access when configured.
* **Comment Protection** — Add a lightweight honeypot to comment forms.
* **User Activity Log** — Review recent security-related activity in the dashboard.
* **Malware Scanner** — Scan individual files for suspicious PHP patterns.
* **Backups** — Create manual database or site file backups in the background.
* **File Permissions** — Browse file and folder permissions from the WordPress admin.


= External libraries =

Trufend bundles the following library with its distribution:

* [shewa/wp-job-queue](https://packagist.org/packages/shewa/wp-job-queue) — GPL-2.0-or-later — Background job processing for scans and backups.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/trufend`, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Open **Trufend** in the admin menu to review the dashboard and enable the modules you need.

If you install from source, run `composer install --no-dev` in the plugin directory before activation so bundled dependencies are available.

== Frequently Asked Questions ==

= Does this plugin phone home or collect analytics? =

No. Trufend does not send site data to external services by default. Optional Pro upgrade links can be changed with the `trufend_pro_upgrade_url` filter.

= Will uninstalling remove my data? =

Yes. When you delete the plugin, Trufend removes its database tables, settings, scheduled events, and stored backup archives by default. Use the `trufend_uninstall_delete_backups` filter if you want to keep backup files.

= Does the plugin modify wp-config.php? =

Only when Pro is active and you enable the file editor protection toggle. Trufend adds a managed `DISALLOW_FILE_EDIT` constant and removes it on uninstall when possible.

= Can I use this on multisite? =

Yes. When network-activated, settings can be managed network-wide and per-site tables are cleaned up on uninstall.

== Screenshots ==

1. Security dashboard with module overview
2. Module settings with enable toggle and options
3. File permissions browser
4. Malware scanner results
5. Backup manager

== Changelog ==

= 1.0.0 =
* Initial release with core security modules.

== Upgrade Notice ==
