=== Vyntic Guard – Security & Malware Scanner ===
Tags: security, malware scanner, brute force, login security, activity log
Requires at least: 6.4
Requires PHP: 8.0
Tested up to: 7.1
Stable tag: 1.7.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Security plugin with malware scanning, brute-force protection, login security, IP blocking, activity logs, hardening, and custom login URLs.

== Description ==

Vyntic Guard helps secure WordPress against brute-force login attacks, suspicious file changes, weak security configuration, and unwanted access attempts.

The free plugin combines a malware scanner, brute-force protection, login security controls, IP blocking, activity logging, WordPress hardening, security checks, and a custom login URL in one dashboard. It runs locally without requiring a Vyntic account or license key.

= Malware Scanner =

Review potential file-security issues before taking action.

* Malware scanner with administrator review
* WordPress core integrity checks using official WordPress checksums when available
* Encrypted quarantine for selected files
* Recovery-copy downloads before destructive actions
* Permanent delete controls for administrator-reviewed findings
* No automatic deletion of scan findings

= Brute Force & Login Protection =

Reduce repeated login attacks and control access to your WordPress login route.

* Brute-force protection with progressive lockouts
* Blocked IP manager with manual unblock controls
* Custom public login URL
* WordPress-generated login links updated for the custom route
* No renaming of WordPress core login files

= Activity Log, IP Blocking & Hardening =

Monitor important activity and strengthen common WordPress security settings.

* Activity logging with configurable retention
* Security dashboard with configuration score
* Security configuration check
* WordPress hardening controls
* Fingerprint-reduction controls
* Central blocked-IP management

= Local-First Privacy =

Vyntic Guard Free does not require a Vyntic account. Activity logs and blocked-IP data are stored in the site's WordPress database and are not sent to Vyntic servers.

= Vyntic Guard Pro =

Vyntic Guard Pro is an optional add-on distributed separately. It adds:

* Two-factor authentication (2FA)
* Authenticator App (TOTP) with local QR enrollment
* Email, SMS, and WhatsApp OTP
* Passkey verification
* CAPTCHA and Google reCAPTCHA integration
* SMTP and Twilio provider configuration
* Stealth Engine for public WordPress path virtualization
* Drag-and-drop Login and 2FA Verification Page Builder

Learn more about Vyntic Guard Pro at https://vynatics.corsysltd.com/vyntic-guard

== Installation ==

1. Install Vyntic Guard from Plugins > Add New, or upload the `vyntic-guard` ZIP through Plugins > Add New > Upload Plugin.
2. Activate Vyntic Guard.
3. Open Vyntic Guard in wp-admin.
4. Run the Security Check to review your current configuration.
5. Review Login Protection before enabling or changing a custom login URL on a production site.
6. Run the Malware Scanner and review findings before quarantining or deleting any file.

== Frequently Asked Questions ==

= What security features are included in Vyntic Guard Free? =

Vyntic Guard Free includes brute-force protection, login security controls, IP blocking, activity logging, WordPress hardening, security configuration checks, a custom login URL, and malware scanning.

= Does Vyntic Guard protect against brute-force login attacks? =

Yes. Vyntic Guard uses progressive lockouts for repeated failed login activity. Administrators can review blocked IPs and manually unblock them when needed.

= Does Vyntic Guard include a malware scanner? =

Yes. The free plugin includes a malware scanner that presents findings for administrator review. Selected files can be quarantined in encrypted storage, downloaded as recovery copies, or permanently deleted by an administrator.

= Does the malware scanner automatically delete files? =

No. Findings are presented for administrator review. Destructive actions require explicit administrator action.

= Can I change the WordPress login URL? =

Yes. Vyntic Guard can expose a custom public login route and update WordPress-generated login links while leaving WordPress core files in place.

= Does Vyntic Guard Free require a license key or account? =

No. Vyntic Guard Free does not require a license key or Vyntic account.

= Does Vyntic Guard send security logs to Vyntic servers? =

No. Activity logs and blocked-IP data are stored in the site's WordPress database and are not sent to Vyntic servers by the free plugin.

= Are Pro features included but disabled in the free ZIP? =

No. Premium implementation code is distributed separately in the Vyntic Guard Pro add-on.

== External Services ==

= WordPress Core Checksum API =

The malware scanner can request official WordPress core checksums from `api.wordpress.org` when performing core-file integrity checks. The request contains the installed WordPress version and locale required by the WordPress checksum API. No Vyntic account is required for this request.

= Site Self-Check =

The Security Check can request the site's own public home page to inspect visible WordPress fingerprints. This request targets the site itself.

== Privacy ==

Vyntic Guard Free does not require a Vyntic account and does not send site security logs to Vyntic servers. Activity logs and blocked-IP data are stored in the site's WordPress database.

The malware scanner can contact the official WordPress checksum API for core-file integrity checks as described in the External Services section.

== Changelog ==

= 1.7.2 =
* Fixed responsive hamburger colors, dark-mode Protection Module and table surfaces, icon backgrounds, active sidebar contrast, and topbar interaction cursors.
* Set command-search shortcut padding to 7px.
* Refined sidebar scrolling, profile menu, switches, upgrade hover states, and SVG toast icons.

= 1.7.1 =
* Rebuilt the Vyntic Guard admin experience around the Security Command Center UI references.
* Refined the header, navigation, overview, login protection, security check, malware scan, cards, tables, responsive layout, and Pro upgrade surfaces.
* Added copy-login-URL interaction and printable security report export.
* Reset WordPress wp-toolbar padding on Vyntic Guard screens.
* Sidebar upgrade card scrolls with the navigation instead of remaining pinned.
* Fixed the Login Protection Summary layout with isolated icon, label, value, and meta selectors; full-width responsive alignment is preserved.
* Moved quarantine storage into a plugin-specific WordPress uploads directory and encrypted quarantined payloads at rest.
* Removed server-side arbitrary-path restore and added nonce-protected recovery-copy downloads.
* Reworked brute-force tracking to bounded storage and removed attacker-controlled per-IP/per-username transients.
* Sanitized settings before extension hooks receive them and moved admin menu CSS into the enqueued stylesheet.
* Expanded unique prefixes for PHP classes and admin/AJAX actions.

= 1.7.0 =
* Renamed the plugin to Vyntic Guard and changed the WordPress.org slug/text domain to `vyntic-guard`.
* Split premium features into the separately distributed Vyntic Guard Pro add-on.
* Added a Free vs Pro comparison table and Upgrade to Pro button.
* Kept brute-force protection, hardening, activity logging, custom login URLs, security checks, and malware scanning in Free.
* Added extension hooks used by the Pro add-on without bundling premium implementation code in the Free package.
* Kept the custom login URL disabled by default on new installs; administrators can enable it explicitly from Login Protection.
