=== WP Malware Guard ===
Contributors: swadhinkhan
Tags: security, malware, firewall, audit, hardening
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 7.4
Stable tag: 0.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress malware protection, audit logging, firewall controls, file scanning, hardening, reports, and commercial licensing.

== Description ==

WP Malware Guard helps site owners monitor and respond to WordPress security threats.

Features include:

* SOC-grade security audit event log with IP, method, URI, user agent, severity, category, risk score, MITRE, and OWASP context.
* SQL injection, XSS, RCE, file inclusion, scanner, enumeration, and web-shell request detection.
* Monitor or block firewall modes with active-defense IP blocking.
* Manual IP/CIDR blocks with bulk management and Cloudflare edge push.
* Rate limiting.
* Login brute-force protection.
* Malware/file scanner with paginated findings, bulk export, and bulk quarantine.
* WordPress core checksum checks.
* File quarantine, restore, and delete response controls.
* XML-RPC, REST API, version-signal, custom login URL, directory indexing, security header, author-enumeration, and permission hardening.
* Email alerts and SIEM webhook routing.
* SOC dashboard, live view, charts, and session timeline correlation.
* Threat simulator for brute force, SQL injection, XSS, and malicious upload drills.
* Cloudflare edge blocking.
* HTML and A4 PDF security reports.
* Evidence backup exports plus full-site backup and restore controls.
* CSV/JSON compliance exports, retention cleanup, pagination, and bulk actions.
* Commercial license activation and validation.

== Installation ==

1. Upload the plugin ZIP from the `dist` folder.
2. Activate WP Malware Guard.
3. Open Malware Guard in wp-admin.
4. Run a file scan and review firewall settings.

== Changelog ==

= 0.4.0 =
* Added explicit Basic, Active, and Under Attack security modes with effective firewall/rate-limit profiles.
* Added SOC status pills, Tools page, and centralized Settings page to match the requested admin workflow.
* Improved compatibility with Dodo Payments license activation responses that return an activated instance without a literal status field.

= 0.3.1 =
* Improved compatibility with Dodo Payments license activation responses that return an activated instance without a literal status field.

= 0.3.0 =
* Added Pro SOC dashboard with lightweight charts, live view, and session correlator.
* Added Alert Center with email severity controls and SIEM webhook routing.
* Added A4 PDF report generation with site identity, footer, timestamp, hardening status, scan details, and framework mappings.
* Added pagination, per-page controls, CSV/JSON exports, and bulk actions for row-heavy admin pages.
* Added threat simulator for brute force, SQL injection, XSS, and malicious upload training drills.
* Added complete backup and restore controls with database SQL, files, evidence, and controlled restore scopes.
* Added hardening controls for custom login URL, directory indexing, security headers, author enumeration, and file permissions.
* Added quarantine restore/delete controls and active-defense IP blocks for high-risk web attacks.
* Fixed admin notice color inheritance inside the plugin UI.

= 0.2.1 =
* Added explicit Cloudflare token clearing.
* Reduced browser password-manager autofill risk on Cloudflare credential fields.

= 0.2.0 =
* Added session timeline correlation.
* Added Cloudflare edge blocking settings and push workflow.
* Added HTML report generation.
* Added evidence backup exports.
* Updated public copy and versioning.

= 0.1.0 =
* Initial product build.
