=== WPSEC Security ===
Contributors: wpsecch
Tags: security, firewall, malware, brute-force, hardening
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Comprehensive WordPress security: WAF firewall, brute-force protection, malware scanner, 2FA, hardening profiles, and real-time threat intelligence — all free.

== Description ==

WPSEC is a **free-first security plugin** built for WordPress developers and site operators who demand enterprise-grade protection without paywalls.

= Core Protection (Free) =

* **Web Application Firewall (WAF)** — Pattern-based blocking for SQLi, XSS, LFI, CVE probes, and exploit scans
* **Brute-Force Guard** — Automatic IP lockout after configurable failed login attempts
* **Rate Limiting** — Per-IP request throttling with configurable scope (sensitive paths or all)
* **Country Blocking** — Geo-policy enforcement via blocklist or allowlist mode
* **IP Control Manager** — Unified allow/block rules with network intelligence sync

= Detection Engine =

* **Session-Based Risk Scoring** — 17 calibrated signal types with decay profiles and benign signal reduction
* **Traffic Classification** — Automatic labeling: human, known bot, unknown bot, attacker, WP-internal
* **Confidence Engine** — History-based confidence from signal diversity, velocity, and volume
* **False-Positive Workbench** — Per-rule suppress/reduce overrides, IP and path whitelists

= Scanning =

* **Vulnerability Scanner** — Core, plugin, and theme update checks, file integrity monitoring, known CVE matching
* **Deep Malware Scanner** — 17 regex signatures for backdoors, webshells, obfuscation, crypto miners
* **Scheduled Scans** — Daily cron with email notifications on findings
* **Knowledge Base** — Remote API rules with local fallback

= Identity & Login Security =

* **Two-Factor Authentication** — TOTP (RFC 6238) for admins, editors, or all users
* **Google reCAPTCHA v2** — Optional login form protection
* **Password Policy** — Minimum length, complexity requirements, breached password check via Have I Been Pwned (k-Anonymity)

= Hardening =

* **One-Click Profiles** — Balanced, Strict, and Enterprise presets
* **REST API User Enumeration Blocking** — Removes /wp/v2/users for unauthenticated requests
* **Author Enumeration Blocking** — Redirects ?author=N queries
* **WordPress Version Meta Removal** — Strips generator tag from HTML
* **XML-RPC Control** — Disable XML-RPC with one toggle

= Operational Dashboard =

* **Security Metrics (SLO/SLI)** — Block efficacy, detection confidence, attack distribution, sync health
* **Actor Detail View** — Per-IP score, confidence, signal timeline, and event history
* **Intrusion Alerts** — Grouped email notifications with cooldown for critical events
* **Threat Intelligence Sync** — Event telemetry with enriched scoring context

= Architecture =

* Single Source of Truth (SSOT) for IP rules and enforcement
* Modular class design with dependency injection
* PRO-ready gating structures (all features currently free)
* Fail-safe: local protection continues when backend is unavailable
* Privacy-first: IP hashing for network intelligence, no unnecessary PII

== Installation ==

1. Upload the `wpsec-security` folder to `/wp-content/plugins/`
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Navigate to **WPSEC → Monitor** to configure policies
4. Optionally apply a hardening profile (Balanced/Strict/Enterprise) for instant security baseline

== Privacy Policy ==

WPSEC Security connects to the WPSEC backend service (api.wpsec.ch) for the following purposes:

* **Event Telemetry** — Blocked attack events (attack type, hashed IP, request path) are synced to the backend for aggregated threat intelligence. No plaintext IPs or personal data are transmitted.
* **Vulnerability Knowledge Base** — The plugin fetches known vulnerability signatures from the backend to keep detection rules current.
* **License Verification** — License tier and portal link status are checked periodically.
* **Enrollment** — On first activation, the plugin registers with the backend using a generated site UUID and Ed25519 key pair.

All communication uses HTTPS. IP addresses are SHA-256 hashed before transmission. No user accounts, emails, passwords, or site content are ever sent to the backend.

You can review the WPSEC privacy policy at [https://wpsec.ch/privacy/](https://wpsec.ch/privacy/).

== Frequently Asked Questions ==

= Is WPSEC really free? =

Yes. All security features are free. PRO structures exist in the code for future premium features, but core protection has no paywall.

= Does WPSEC work without an internet connection? =

Yes. All enforcement, scanning, and detection works locally. Network intelligence sync and KB updates are optional enhancements.

= Does WPSEC slow down my site? =

The firewall runs early in the WordPress init cycle with minimal overhead. Scans run via WP-Cron in the background.

= How does the breach check work? =

Password breach checking uses the Have I Been Pwned k-Anonymity API. Only the first 5 characters of the password SHA-1 hash are sent — the full password never leaves your server.

== Screenshots ==

1. Dashboard with security score and live KPIs
2. Monitor page with policy configuration
3. Security Metrics (SLO/SLI) dashboard
4. False-Positive Workbench
5. Malware scan results

== Changelog ==

= 1.0.2 =
* Fix: Live KPI computation for global stats endpoint
* Fix: Timezone consistency (NOW vs UTC_TIMESTAMP) in all event queries
* Fix: Count all security events consistently across endpoints
* New: Cumulative installations chart (30-day daily series)
* New: Client-side KPI rendering via JavaScript fetch API
* New: Empty-state UI for attack vectors and top targets
* Fix: Customer Portal links now point to portal.wpsec.ch
* Updated: Plugin version to 1.0.2

= 1.0.0 =
* Initial release
* WAF firewall with 5 pattern categories
* Brute-force guard with automatic lockout
* Country blocking (blocklist/allowlist)
* Rate limiting (configurable scope and thresholds)
* IP Control Manager with network intelligence
* Session-based risk scoring with 17 signal types
* Traffic classification (human/bot/attacker)
* History-based confidence engine
* Vulnerability scanner with 14 checks
* Deep malware scanner with 17 signatures
* Scheduled malware scans with email alerts
* Knowledge Base with remote API + local fallback
* Two-factor authentication (TOTP)
* Google reCAPTCHA v2 on login
* Password policy with HIBP breach check
* One-click hardening profiles (Balanced/Strict/Enterprise)
* REST and author enumeration blocking
* WP version meta removal
* False-positive workbench with rule overrides
* Security metrics (SLO/SLI) dashboard
* Actor detail view with signal timeline
* Intrusion alerts with cooldown
* Event telemetry sync with enriched schema v2
* Clean uninstall with full data removal

== Upgrade Notice ==

= 1.0.2 =
Live KPI data, cumulative installations chart, timezone fixes, portal link corrections.

= 1.0.0 =
First stable release. Install and activate to immediately protect your WordPress site.
