=== WEDOS | Protection & Cache Performance ===
Contributors: wedos
Donate link:
Tags: security, cdn, cache, firewall, waf
Requires at least: 6.7
Tested up to: 7.1
Stable tag: 2.5.1
Requires PHP: 8.2
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Protect your WordPress website with WEDOS Global: cloud WAF, DDoS protection, CDN and page cache, set up from WordPress.

== Description ==

The plugin connects your website to WEDOS Global Protection and keeps an eye on its health. Setup is guided step by step and suits non-technical site owners: the plugin prefills your domain, shows exactly the DNS records WEDOS Protection asks for and nothing is registered until you confirm it.

= Protection =

* **Cloud WAF and DDoS protection**: harmful traffic is filtered on the WEDOS network before it reaches your server.
* **Free setup or your existing service**: a domain without protection gets a free WEDOS Protection service after your consent. A domain that is already protected (also in your own WEDOS account) is only displayed, never registered again.
* **Dashboard**: protection status, the DNS records to set and traffic analytics.

= Speed =

* **WP-CDN**: WordPress core, WooCommerce, plugin and theme files served from the WEDOS CDN. A file is rewritten only when its SHA-256 hash matches the CDN copy. Off until you enable it.
* **Page Local Cache**: rendered pages stored as static HTML on your server.

= Security checks =

* **Vulnerabilities**: installed plugins, themes and WordPress core compared daily with a database of publicly known vulnerabilities. The comparison runs on your server.
* **Recommendations**: concrete fixes based on your own traffic, applied only after you confirm them.
* **UpdraftCentral key compromise**: detection of the October 2026 backdoor, with the steps to take. Read-only: the plugin never changes other plugins or accounts.

= Links =

* [WEDOS Global](https://www.wedos.com/protection/)
* [Knowledge Base](https://kb.wedos.com/en/kategorie/wedos-global-en/)
* [Community Help](https://help.wedos.com)

The service is provided by WEDOS Group SA, 7 Rue Robert Stumper, L-2557 Luxembourg, EU: [Terms of Service](https://www.wedos.com/en/terms-of-service/), [Privacy Policy](https://www.wedos.com/en/privacy-policy/).

== External services ==

No personal data of your visitors is ever transmitted.

**WEDOS Global Protection (plugin.wedos.global)**

* Used to verify domain ownership (a verification file the plugin writes to /.well-known/), to register the protection service and to read its status and traffic statistics.
* Data sent: domain name, server IP address, admin email address, a request ID and this installation's private API key (it proves the request comes from this site; only its SHA-256 hash is published in the verification file).
* A protection service is registered only after you click "Activate protection + CDN" and confirm the consent dialog.

**WEDOS CDN (wp-cdn.wedos.com)**

* Only when WP-CDN is enabled: serves static files of WordPress core, WooCommerce, plugins and themes, and the manifest with their SHA-256 hashes.
* No data about visitors is transmitted.

**Anonymous telemetry (plugin.wedos.global)**

* Only when you opt in: plugin version, WordPress version and number of rewritten files, once a day. No domain, IP address or personal data.

**Subscriptions (plugin.wedos.global) and billing (FastSpring)**

* Used only when you start a trial or buy a paid plan. Data sent: domain name, admin email address, plan.
* Orders are processed by FastSpring (fastspring.com) as the merchant of record; see FastSpring's privacy policy.
* The free plan works without any subscription. When a trial ends, the plugin keeps working on the free plan.

**Vulnerability database (utils.wedos.tools)**

* Downloaded once a day (compiled from the Wordfence Intelligence feed, CC BY-ND 4.0). Nothing about your site is sent.

**Website performance check (utils.wedos.tools)**

* Once a day measures the public loading speed of your website for the Site Snapshot card. Data sent: domain name.

**Recommendations (plugin.wedos.global)**

* The signed list of recommendations is downloaded hourly; nothing about your site is sent.
* When you confirm, ignore or undo a recommendation on a site protected by WEDOS, the plugin reports the domain, the recommendation ID, your decision and the number and average duration of matching requests in the last 24 hours.

== Bundled libraries ==

All code ships inside the plugin package:

* **Chart.js 4.4.0** (MIT): dashboard charts. File `assets/vendor/wedos-chart.umd.min.js`, an unmodified copy of `chart.umd.min.js`. Source: https://github.com/chartjs/Chart.js/releases/tag/v4.4.0
* **jsVectorMap 1.7.0** (MIT, license in `assets/vendor/jsvectormap/`): the visitor map (paid feature). Source: https://github.com/themustafaomar/jsvectormap
* **WEDOS vulnerability matcher** (`includes/Vuln/`): our own unminified GPL code.

Optionally, the dashboard can load Chart.js and jsVectorMap from wp-cdn.wedos.com instead (switch "Dashboard libraries"). It is off by default; every CDN file carries a Subresource Integrity hash and falls back to the bundled copy.

== Installation ==

1. Upload the plugin files to the /wp-content/plugins/wgpwpp directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress
3. Let the plugin guide you through the service setup process

== Changelog ==

= v2.5.1 =
* Fix: the dashboard libraries (Chart.js, jsVectorMap) are loaded from the bundled copies by default again; loading them from the WEDOS CDN is the opt-in switch "Dashboard libraries"
* Plugin description and external services rewritten

= v2.5.0 =
* Fix: opening the setup page, checking the status or re-syncing the verification token never creates a protection service any more. A service is created only after the consent in the setup, and only when the domain has none: an existing service (also one in another WEDOS account) is only reflected
* Fix: the DNS records shown are the ones WEDOS Protection asks for (nameservers, CNAME targets, _acme-challenge) instead of generic names; services created in the WEDOS client zone use their own target names. Without ANAME support the A records now point to the protection addresses (previously a CDN address was suggested)
* Fix: "Active" is shown only when WEDOS Protection reports the service active; while it is still being set up the plugin shows which step it waits for and re-reads the state (with growing intervals, at most once a day once nothing changes)
* New services are created in record mode, matching the DNS records the plugin shows
* Re-syncing the verification token no longer queries the WEDOS API
* Fix: data left in the database by plugin version 1.x is removed on update. Version 2 never used it, but the old option "wgpwpp" could hold a debug log of many megabytes that WordPress loaded on every request (Site Health: autoloaded options)
* Fix: the daily vulnerability check needed about 170 MB of memory and could fail on hosting with a 128 MB PHP limit. The feed is now downloaded straight to disk and only the entries for installed plugins and themes are read (about 12 MB, 4x faster); the check is skipped when neither the feed nor the installed versions changed

= v2.4.0 =
* New: detection of the UpdraftCentral key compromise (October 2026): UpdraftCentral keys stored on the website, the hidden backdoor plugin and its secret accounts are shown on the dashboard and in an admin notice, with the steps to take. Read-only: the plugin never changes other plugins, keys or accounts

= v2.3.2 =
* Fixed: PHP notice "_load_textdomain_just_in_time was called incorrectly" (WordPress 6.7+ with debugging on), caused by translated cron interval labels while the plugin schedules its tasks during load

= v2.3.1 =
* Fixed: version 2.3.0 on WordPress.org was briefly published without the Recommendations files, which stopped websites that updated during that time
* New: safety net: if any plugin file is missing (for example after an interrupted update), the plugin pauses itself and shows a notice instead of stopping the website

= v2.3.0 =
* New: Recommendations — WEDOS publishes signed recommendations, the plugin measures on your site whether they apply and you decide: Confirm or Ignore. Nothing changes without your confirmation and every change can be undone
* New: first recommendation — requests for missing media files in wp-content/uploads (typically bots) get a fast 404 instead of starting the whole WordPress; applied at web server level (.htaccess) when the server supports it and a check proves it works, otherwise in PHP before the theme loads
* New: server-level rules are removed again automatically when the plugin is deactivated or WEDOS withdraws the recommendation
* Security: every request to the WEDOS backend now carries a per-install private key; the verification file publishes only its SHA-256 hash, so nobody else can request this site's data by naming the domain. The key is created automatically on update and rotates with the verification token
* Fixed: a failed verification token rotation no longer retries on every dashboard visit; the plugin re-syncs the backend once and retries after 24 hours

= v2.2.3 =
* Fixed: flushing the whole page cache from the admin bar no longer ends in a fatal error when another request removes a cache folder at the same time; the flush skips the missing folder and clears the rest
* Fixed: cache maintenance and cache size calculation tolerate files and folders removed concurrently

= v2.2.2 =
* New: Protection Summary — the dashboard explains in plain words what the protection handled (passed, blocked, verified, logged) and why requests were stopped
* New: visitor geography with per-country protection actions, connection overview (TLS, HTTP versions) and targeted-paths insight
* New: security vulnerability scanning of installed plugins, themes and WordPress core against the WEDOS vulnerability feed, with protection-aware guidance
* New: Site Snapshot daily health card (load time, TTFB, SSL, database, updates, admin accounts) with automatic anomaly notices
* Improved: onboarding reliably detects an already protected website and opens the dashboard automatically
* Improved: origin server IP detection never reports the protection edge address as the origin
* Fixed: page cache no longer stores error responses (database errors, fatal errors); deployed cache runners update themselves
* Fixed: the verification file is served by WordPress itself when file permissions prevent writing it
* Security: hardened output escaping and input sanitization across the admin interface

= v2.2.1 =
* Improved: smart onboarding — the DNS setup step is skipped automatically when the domain already routes to WEDOS Protection (via A records or CNAME/ANAME), including domains protected under another account
* Improved: DNS records are only required when the protection service reports a known actionable state; active domains are never asked for additional records
* Improved: WordPress 7.0 compatibility and WordPress.org Plugin Check compliance
* Fixed: minor onboarding and dashboard polish

= v2.2.0 =
* New: Visitor Geography section — interactive world map, top countries, top cities, top targeted URI paths with attack-pattern detection, threat distribution and connection quality breakdown (TLS version, encryption ratio, HTTP methods split)
* New: Subscription plans — Free, Standard and Premium with 30-day free trial that can be started directly from the dashboard
* New: Security email reports with selectable frequency (weekly or bi-weekly), delivered to the admin email on the configured day
* New: Daily rotation of the .well-known verification token for hardened ownership proof
* New: WGP CDN cache purge button — manually flush the Anycast CDN edge cache for sites with a provisioned WGP service
* Improved: dashboard performance — backend responses are cached locally with smart invalidation on plan changes
* Improved: refined entitlement system aligned with the subscription plans
* Improved: clearer empty states and actionable first-check prompts across the dashboard
* Fixed: numerous stability and UX improvements across onboarding, dashboard and trial activation

= v2.1.1 =
* Improved: dedicated CDN-only dashboard for sites that do not need full WEDOS Protection

= v2.1.0 =
* New: WEDOS CDN — speeds up your site by serving WordPress core assets from WEDOS CDN edge nodes; no configuration needed, toggle On in the dashboard
* New: WooCommerce CDN (Experimental) — extends CDN to WooCommerce static assets; more plugins coming soon
* New: Weekly security reports — receive a weekly email summary of blocked attacks, traffic and protection status
* New: Report a problem — submit feedback, bug reports or questions directly from the dashboard
* Compatibility: minimum required WordPress version lowered from 6.9 to 6.7

= v2.0.21 =
* Fixed: www. prefix stripped from domain before dashboard-data API call
* Traffic Analytics: empty state message when no data available

= v2.0.20 =
* Dashboard stat tiles: Total requests, Yesterday traffic and HTTP Status Codes
* Traffic Analytics: Top Countries section with live data
* Visitor Geography card hidden when analytics data unavailable
* Security: improved API communication layer

= v2.0.19 =
* Code quality and compatibility improvements

= v2.0.18 =
* Security: improved communication layer

= v2.0.17 =
* Plugin renamed to WEDOS | Protection & Cache Performance
* Fixed: domain with code 2278 now shows DNS setup step instead of fatal error when DNS not yet pointing to WEDOS

= v2.0.16 =
* Smarter page cache: per-page caching, deduplication, automatic maintenance and admin bar flush buttons

= v2.0.15 =
* Verification file: auto-fix permissions on .well-known/ and wedos-verify.txt before write attempt

= v2.0.14 =
* Compliance: reduced tags to 5 per WordPress.org guidelines
* Compliance: added External Services section to README documenting data sent to plugin.wedos.global
* Compliance: WordPress core update notices are no longer suppressed on plugin page

= v2.0.13 =
* Dashboard now shows 'Active — FREE Plugin' or 'Active — WEDOS' badge based on activation source

= v2.0.12 =
* Extended suppression of third-party notices — covers all admin_notices variants, core update nags and footer overlays

= v2.0.11 =
* Suppress third-party admin notices on the plugin dashboard page

= v2.0.10 =
* Fixed fatal error on activation when OPcache serves stale Settings.php from older version

= v2.0.9 =
* Renamed mu-plugin file to wgpwpp-cache.php (wp-content/mu-plugins/wgpwpp-cache.php)

= v2.0.8 =
* Page cache now uses mu-plugin as primary strategy — works independently of other caching plugins
* Falls back to advanced-cache.php drop-in if mu-plugins/ is not writable
* Dashboard shows which strategy is active (mu-plugin or advanced-cache.php)

= v2.0.7 =
* Fixed: www. prefix is now stripped from domain before API calls (API does not accept explicit www.)
* DNS records are still generated for the original host including www.

= v2.0.6 =
* Page cache now checks and attempts to auto-fix file permissions before enabling
* Permission issues shown with confirmation dialog and detailed error info

= v2.0.5 =
* Removed wgp-domain-create-retry flow — domain activation is now handled in a single step

= v2.0.4 =
* Improved domain activation detection for code 2278 — checks A records against known WGP IPs (185.8.237.5, 185.8.237.6), ANAME and www. variant
* CDN Cache purge button disabled until release (01.05.2026)

= v2.0.3 =
* Fixed plugin reset — now fully cleans up all options, cache files, advanced-cache.php and .well-known/ verification files

= v2.0.2 =
* Added WEDOS CDN Cache card in dashboard with Purge CDN Cache button

= v2.0.1 =
* Fixed verification file not being created before ingest call (verify_file_missing)
* Fixed verification file not served correctly behind WordPress rewrite rules
* Fixed unnecessary retry being triggered for all domains (not only disabled)
* Fixed error code 1001 (request pending) incorrectly treated as fatal error
* Added file permission diagnostics when verification file write fails
* Added clear error message in UI when verification file cannot be created
* Added .htaccess and do_parse_request hook to ensure /.well-known/ is served directly

= v2.0.0 =
* Redesigned onboarding and dashboard UI
* Simplified DNS setup flow
* Improved protection status detection
* Performance improvements

= v1.2.2 =
* Buttons for deletion of file cache and CDN cache
* Dashboard improvements
* Service activation improvements

= v1.2.1 =
* Updated FAQ
* Updated plugin description and assets

= v1.2.0 =
* Dashboard page added
* UX optimization

= v1.1.6 =
* UX optimization

= v1.1.5 =
* Expansion of supported translations (SK, HU)

= v1.1.4 =
* WP 6.5 compatibility
* Language texts corrections

= v1.1.3 =
* Page caching improvements
* REST API improvements

= v1.1.2 =
* Page caching improvements
* Security reports improvements

= v1.1.1 =
* bugfix: missing icons

= v1.1.0 =
* Security reports
* Page caching
* CDN Cache

= v1.0.0 =
* Initial release

== Upgrade Notice ==

= v2.0.0 =
Major update with redesigned interface. All your existing settings are preserved automatically.
