=== 007AJ Security Scanner & Firewall ===
Contributors: ebiz212
Tags: security, firewall, login, malware, hardening
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Login lockout, a lightweight firewall, a core file integrity scan, hardening switches and an activity log, running on your own server.

== Description ==

007AJ Security Scanner & Firewall is a lightweight security plugin by 007AJ. It runs on your own server, and every feature is off until you turn it on.

**Login lockout**

* Counts failed logins per IP address. After a set number of failures (default 5 in 15 minutes) the address is locked out for a set time (default 30 minutes).
* Applies to every login that goes through WordPress: the login form, XML-RPC and application passwords. A locked-out address cannot log in even with the right password.
* The login form shows how long the lockout lasts. A successful login resets the counter.
* Locked-out addresses are listed on the Dashboard with an Unlock button.
* Optional email to the site admin when a lockout happens (at most one email every 15 minutes).

**Firewall (lite)**

* Checks the page address, the query string (names and values) and the names of submitted form fields for obvious attack probes: SQL injection (for example `UNION SELECT`, `' OR '1'='1`, `SLEEP(`), script injection (`<script>`, event handlers, `javascript:` links) and path traversal (`../`, `/etc/passwd`, `php://`). Matching requests get a 403 page.
* Logged-in administrators and editors are not checked, so writing posts that contain HTML or code keeps working. Submitted form values (comments, contact forms) are not checked either, to avoid false alarms.
* Optional switch to turn off XML-RPC completely (also removes the pingback header and turns off pingbacks).
* Optional limit on form submissions to wp-login.php per IP address (default 20 in 5 minutes); extra requests get a 429 answer.
* The rules were written for this plugin. They catch common, obvious probes; they are not a complete defence and do not replace keeping WordPress, themes and plugins up to date.

**Integrity scan**

* A "Run scan now" button compares every WordPress core file on the server with the official checksums published by WordPress.org.
* Lists modified and missing core files, plus files in wp-admin, wp-includes and the site root that are not part of WordPress.
* Reports only. The plugin never changes or deletes files. Plugins, themes and uploads are not scanned.

**Hardening switches**

* Turn off the theme and plugin file editors (sets `DISALLOW_FILE_EDIT` unless wp-config.php already sets it).
* Limit username discovery for visitors who are not logged in: `?author=N` requests go to the home page, the REST users endpoint answers 401, and the users sitemap is removed.
* Hide the WordPress version generator tag (cosmetic).
* Turn off application passwords.

**Activity log**

* Records logins, failed logins, lockouts, firewall blocks, rate-limit hits, blocked user discovery, scans and setting changes, with time, IP address and username.
* Keeps only the newest 500 entries. Filter by event; clear with one click.

**Dashboard**

Today's lockouts, failed logins, blocked requests, the last scan result, hardening switches and log size, all on one screen.

**How IP addresses are read**

Only `REMOTE_ADDR` is used. Forwarded headers such as `X-Forwarded-For` can be forged by the visitor and are never trusted. If your site is behind a proxy or CDN that does not pass the real visitor address to PHP, every visitor may appear to have the same address. The Settings screen shows the address the server sees for you, so you can check this before turning on lockouts.

== Installation ==

1. Upload the `007aj-security-scanner-firewall` folder to `/wp-content/plugins/`, or install it from Plugins > Add New.
2. Activate the plugin from the Plugins screen.
3. Open **007AJ Security > Settings**, turn on the features you want and save.
4. Open **007AJ Security > Integrity scan** and click **Run scan now** for a first check of your core files.

== Frequently Asked Questions ==

= I locked myself out. What now? =

Wait until the lockout ends, or log in from a different network. If you have file access, you can also rename the plugin folder in `wp-content/plugins/` to turn it off. Deactivating the plugin removes all current lockouts.

= Will the firewall break my site? =

It skips logged-in administrators and editors, does not look at submitted form values, and only matches obvious attack patterns. If a visitor is blocked by mistake, the activity log shows which rule matched; you can turn the firewall off in Settings.

= Does this plugin remove malware? =

No. The integrity scan tells you which WordPress core files were changed, removed or added. To restore core files, use Dashboard > Updates > Re-install. Plugins, themes and uploads are not scanned.

= Does the plugin contact any outside server? =

Only when you click "Run scan now". See "External Services" below.

= What happens to my data when I delete the plugin? =

By default settings and the log are kept. To remove everything, tick "Delete all plugin data when the plugin is deleted" in Settings before deleting the plugin. This drops the log table and removes all of the plugin's options and temporary counters.

= Is there a paid version? =

007AJ Security Scanner & Firewall Suite is a separate, standalone paid plugin. This plugin shows one dismissible notice about it on its own Dashboard and one link on the Plugins screen. Nothing here is disabled, limited or time-limited.

== External Services ==

This plugin connects to one external service, and only when an administrator asks it to.

**WordPress.org core checksums (api.wordpress.org)**

* What it is for: the integrity scan downloads the official list of WordPress core file checksums so it can compare them with the files on your server.
* When: only when an administrator clicks "Run scan now" on the Integrity scan screen. There are no automatic or scheduled requests.
* What is sent: a request to `https://api.wordpress.org/core/checksums/1.0/` with your WordPress version number and site language (for example `version=7.1&locale=en_US`), with the user agent set to `WordPress/<version>`. Your site address, users and files are not sent. Your server's IP address is visible to WordPress.org, as with any web request.
* Service provider: WordPress.org. Terms of use: https://wordpress.org/about/terms-of-service/ - Privacy policy: https://wordpress.org/about/privacy/

No other outbound requests are made. Nothing is sent to 007AJ. The plugin row on the Plugins screen and the dismissible notice on the plugin's Dashboard contain a plain link to https://007aj.com/007aj-security-scanner-firewall-suite; nothing is loaded from that address and nothing is sent unless you click the link yourself.

== Privacy ==

What the plugin stores on your server, depending on the features you turn on:

* **Activity log** (if on): time, event type, IP address, the username entered or used, the user ID of a logged-in user, and a short detail (for example the firewall rule that matched and the page address requested). Newest 500 entries only.
* **Login lockout** (if on): for each locked-out address, the IP address, the last username tried, the number of failed attempts and the lockout end time, removed when the lockout ends. Failed-attempt and login-request counters are stored as temporary values keyed by a one-way hash of the IP address and expire on their own.
* **Lockout emails** (if on) go to the site admin address and contain the IP address and last username tried.
* **Integrity scan**: the last scan result (lists of file names), with no personal data.
* **Daily counters** for the Dashboard (numbers only).

The plugin adds suggested text to Settings > Privacy and registers a personal data exporter and eraser with WordPress (Tools > Export Personal Data / Erase Personal Data). They find activity log entries by the person's user ID, username or email address.

== Changelog ==

= 0.1.3 =
* Removed "Tested up to" from the plugin header so it lives only in readme (wordpress.org requirement).

= 0.1.2 =
* Fix: on MySQL/MariaDB, activity log entries with long non-ASCII text (for example a long multibyte username or request path) were silently dropped because the text was cut by bytes in the middle of a character. Text is now cut by characters and invalid UTF-8 is removed first.

= 0.1.1 =
* Login lockout: failed-login counting per IP, configurable limit, window and lockout length, lockout notice on the login form, Dashboard list with Unlock, optional admin email.
* Firewall (lite): rules for common SQL injection, script injection and path traversal probes; optional XML-RPC switch; optional wp-login.php rate limit.
* Integrity scan: manual comparison of WordPress core files with the official WordPress.org checksums; lists modified, missing and unknown files.
* Hardening switches: file editor, username discovery, generator tag, application passwords.
* Activity log: capped table (500 entries) with filter and clear; personal data exporter and eraser now return and remove real entries.
* Dashboard with today's counts and the last scan result; new Settings, Integrity scan and Activity log screens.
* Suite notice reworded.

= 0.1.0 =
* Initial scaffold: admin Dashboard, settings, privacy policy text, personal data exporter and eraser hooks, opt-in uninstall cleanup, translation template.