=== Aardwolf Security Scanner ===
Contributors: aardwolfsec
Tags: security, hardening, penetration testing, scanner, vulnerability
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 1.2.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scan your WordPress site for the common attack vectors a penetration tester would probe, and get plain-English configuration fixes.

== Description ==

**Aardwolf Security Scanner** runs a battery of passive, read-only checks against
your own WordPress site — the same low-hanging fruit a penetration tester looks
for first — and gives you a prioritised, plain-English list of what to fix and
how.

It does **not** attack your server, exploit anything, or send any data off-site.
Every check runs locally on your own install.

= What it checks =

* **Software updates** — outdated WordPress core, plugins and themes, plus dormant/inactive extensions that widen your attack surface.
* **Accounts & authentication** — the default `admin` username, username enumeration via author archives and the REST API, insecure registration defaults, and missing login brute-force protection.
* **Configuration hardening** — the dashboard file editor, exposed debug output, missing/placeholder security keys and salts, the default `wp_` table prefix, and forcing HTTPS on the admin area.
* **Information exposure** — a reachable XML-RPC endpoint, the version-leaking `readme.html`, the generator meta tag, directory browsing, and sensitive files (debug logs, `.git`, `.env`, config backups) left in the web root.
* **HTTP security headers** — missing `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Content-Security-Policy` and HSTS.
* **Transport & environment** — sites still on plain HTTP and end-of-life PHP versions.
* **File permissions** — world-readable/writable `wp-config.php` and root directory.
* **Known vulnerabilities** — installed plugins that have been removed from the WordPress.org directory (often a sign a plugin was pulled for an unresolved security issue).

Each finding comes with a severity rating and a specific, actionable remediation.

= Scheduled scans & email alerts =

Run scans automatically in the background (daily or weekly via WP-Cron) and get
an email when your security posture regresses — the score drops, problems
increase, or a high-risk issue appears. You can also choose to be emailed after
every scheduled scan.

= Export reports =

Export the latest scan as a **CSV** file, or open a clean, print-styled **PDF
report** that you can save or share (uses your browser's "Save as PDF").

= About Aardwolf Security =

This plugin is provided by [Aardwolf Security](https://aardwolfsecurity.com/).
Automated checks are a great first line of defence, but they are not a
substitute for a manual penetration test by a qualified assessor.

== External services ==

This plugin connects to one external service, the official **WordPress.org Plugin API** (`https://api.wordpress.org/plugins/info/1.0/`).

* **What it is used for:** the "Known Vulnerabilities" check queries this API to find out whether any of your installed plugins have been removed/closed on the WordPress.org directory (which often indicates a plugin was pulled for an unresolved security issue).
* **What data is sent, and when:** the directory *slug* of each installed plugin (e.g. `akismet`) is sent when a scan runs. No personal data, site content, or credentials are transmitted. Responses are cached for 24 hours to minimise requests.
* **Terms & privacy:** this is a WordPress.org service, governed by the [WordPress.org Terms](https://wordpress.org/about/) and [Privacy Policy](https://wordpress.org/about/privacy/).

The plugin also makes loopback HTTP requests to *your own site* (its own URL) to inspect response headers and check for publicly exposed files. These stay on your own server and are not sent to any third party.

== Installation ==

1. Upload the `aardwolf-security-scanner` folder to `/wp-content/plugins/`, or install the ZIP via Plugins → Add New → Upload Plugin.
2. Activate the plugin through the Plugins screen.
3. Go to **Security Scanner** in the admin menu and click **Run Security Scan**.

== Frequently Asked Questions ==

= Is it safe to run on a production site? =

Yes. All checks are passive and read-only. The plugin makes a few loopback HTTP
requests to your own site to inspect headers and exposed files, which is
harmless. Always keep a current backup before changing configuration, as a
matter of good practice.

= Does it fix things automatically? =

No. The scanner reports findings and gives you clear, specific remediation
steps for each one, but the changes themselves (editing `wp-config.php`,
permissions, web-server rules, settings) are yours to make.

= Why does a check say "could not complete"? =

Some checks make a loopback request to your own site. If your host blocks
loopback connections, those checks are skipped rather than failed. The result
will explain what to verify manually.

== Changelog ==

= 1.2.5 =
* Printable report stylesheet is now registered and enqueued via wp_enqueue_style()/wp_print_styles() instead of a hard-coded <link> tag.

= 1.2.4 =
* Moved the printable report's CSS to a bundled stylesheet (no inline <style>) and removed the inline print-button script.
* Removed an unnecessary wp-admin/includes/plugin.php include in the login-protection check.
* Corrected the Contributors username.

= 1.2.3 =
* Removed the duplicate Plugin URI header (it matched the Author URI); kept the Author URI.

= 1.2.2 =
* Output all logos via escaped <img> tags (removed raw inline-SVG output) for cleaner, escape-late-compliant markup.
* Documented the WordPress.org Plugin API usage under a new "External services" readme section.

= 1.2.1 =
* Resolved WordPress.org Plugin Check findings: removed the unused Domain Path header and the discouraged load_plugin_textdomain() call, rewrote the CSV export without direct filesystem functions, scoped template variables, tidied the uninstall routine, and updated "Tested up to".

= 1.2.0 =
* Removed the optional WPScan API integration and the one-click hardening feature; these are planned for a future Pro add-on. The free directory-removal check (which needs no API key) remains.

= 1.1.1 =
* Scheduled scans now let you choose the time of day (and the day of the week for weekly scans), interpreted in your site's timezone.
* Fixed the oversized admin menu icon.
* Failed checks now show a problem-phrased title (e.g. "Usernames are publicly enumerable") instead of the healthy-state wording.
* The user-enumeration check now tests the live vectors (REST users endpoint and the ?author= redirect) rather than stored user data.

= 1.1.0 =
* Added scheduled scans (daily/weekly) with email alerts on regression.
* Added CSV and printable PDF report export.
* Added a Known Vulnerabilities check: flags plugins removed from the WordPress.org directory (free) and cross-checks CVEs via an optional WPScan API token.
* Bumped "Tested up to" and refreshed the settings screen.

= 1.0.0 =
* Initial release: 22 security checks across six categories, security score, and optional one-click hardening.

== Upgrade Notice ==

= 1.1.0 =
Adds scheduled scans with email alerts, CSV/PDF export, and a known-vulnerability check.

= 1.0.0 =
Initial release.