=== YuraCode Security ===
Contributors: yuracode
Tags: security, firewall, hardening, login, htaccess
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Zero-config hardening, login protection, and an Apache .htaccess firewall (8G ruleset). Active the moment you install, with no external calls.

== Description ==

YuraCode Security protects your site the moment you activate it: no setup, no dashboard clutter, no external calls. Three focused modules cover the essentials: hardening, brute-force login protection, and an Apache-level firewall, all controlled from a single settings screen. Settings are managed on the **Settings → YuraCode Security** screen.

= Hardening =

* **Disable XML-RPC** - turns off the XML-RPC API and removes the pingback header, RSD link, and wlwmanifest link.
* **Restrict REST API to logged-in users** - returns a 401 for anonymous REST requests.
* **Hide WordPress version** - removes the generator meta tag, the `?ver=` query string from enqueued scripts and styles, and the shortlink and REST output links.
* **Generic login error messages** - stops username/email enumeration on the login form.
* **Disable emojis** - removes the emoji detection script and styles from the front end and admin.
* **Disable self-pingbacks** - prevents the site from pinging itself when linking to its own posts.
* **Disable application passwords** - turns off Application Passwords for authenticated REST/API access.
* **Disable AI prompts** - prevents WordPress or plugins from executing prompts through the AI Client API (WordPress 7.0).
* **Disable comments** - removes comments everywhere: blocks new comments and trackbacks, hides existing comments and their counts, blanks the comment template, blocks comment feeds and the REST/XML-RPC comment APIs (block notes are preserved), and removes the Comments admin UI. Existing comments stay in the database.

= Login Protection =

* **Limit failed login attempts** - tracks failures per IP address and locks the offender out for a configurable duration.
* **Maximum attempts** - the number of failures allowed before lockout (default 5).
* **Lockout duration** - the lockout length in minutes (default 15).

= Firewall (.htaccess / 8G) =

Writes a rules block to the `.htaccess` file in the WordPress root (and, optionally, `wp-content/uploads/.htaccess`). Rules run at the Apache level, before WordPress loads. The block is kept between its own markers so it never conflicts with WordPress's own rewrite rules, and a backup of your original file is kept in `wp-content/uploads/yuracode-security/` before every change (removed on uninstall).

* **8G Firewall** - the built-in ruleset by Perishable Press, with independently toggleable categories:
  * Block malicious query strings
  * Block malicious request URIs
  * Block bad user agents
  * Block bad referrers
  * Block suspicious cookies
  * Block dangerous request methods
* **Protect wp-config.php and sensitive files** - denies access to `wp-config.php`, `php.ini`, `error_log`, and `.sql` / `.log` backup files.
* **Block direct access to wp-includes** - 403s direct requests to PHP files under `wp-includes`, `wp-admin/includes`, and `wp-includes/theme-compat`.
* **Block PHP execution in uploads** - writes a `wp-content/uploads/.htaccess` that denies `*.php`, `*.phtml`, and `*.phar` files.

All firewall rules use Apache 2.4 syntax (`Require all denied`). On activation the `.htaccess` block is written immediately; on deactivation it is removed. Servers that don't honor `.htaccess` (nginx, IIS) are detected automatically and the firewall is skipped with an admin notice. If the `.htaccess` file is not writable, an admin notice is shown and the firewall is skipped gracefully.

== Installation ==

1. Upload the `yuracode-security` folder to `/wp-content/plugins/`, or install the plugin from the WordPress plugin directory.
2. Activate the plugin through the **Plugins** screen.
3. Go to **Settings → YuraCode Security** and review the toggles. The firewall is enabled by default and writes its rules to your root `.htaccess` on activation; a backup of your original `.htaccess` is kept in `wp-content/uploads/yuracode-security/` before every change.

== FAQ ==

= Does YuraCode Security work on nginx? =

The hardening and login-protection features work everywhere. The firewall writes rules to `.htaccess`, which only Apache (and LiteSpeed) honor. On nginx, IIS, or other servers it is detected automatically and skipped, with an admin notice explaining why.

= Does YuraCode Security make external requests? =

No. The plugin runs entirely on your server, makes no external calls, and does not collect or send any data.

= What happens to my `.htaccess` on deactivation? =

The managed rules block is removed and your original content is restored. A backup of your original `.htaccess` is kept in `wp-content/uploads/yuracode-security/` before every change and removed on uninstall.

== Privacy ==

YuraCode Security makes no external requests and collects no user data. It runs entirely on your server; the only files it writes are its own settings and the managed `.htaccess` rules (with a backup of your original kept in the uploads folder). Nothing is sent anywhere.

== Credits ==

The built-in firewall ruleset is the [8G Firewall](https://perishablepress.com/8g-firewall/) by Jeff Starr (Perishable Press), bundled under the GPL.

== Screenshots ==

1. The settings overview: hardening options for XML-RPC, the REST API, comments, and more.
2. Brute-force login protection: per-IP lockout with configurable attempts and duration.
3. The Apache-level firewall: 8G rule categories plus config, includes, and uploads protection.

== Changelog ==

= 1.0.0 =
* Initial release.
