=== Wonder Secure ===
Contributors: wonderfolks
Tags: security, firewall, malware scanner, two-factor authentication, brute force
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Firewall, malware scanner, file integrity checks, login protection, two-factor authentication and image protection in one plugin.

== Description ==

Wonder Secure by Wonderfolks Interactive protects a WordPress site at every layer and explains what it finds in plain language.

= Security dashboard =
* Security score with a clear status (Secure, Needs attention, At risk).
* Interactive threat graph of blocked attacks, failed logins and scan findings over 24 hours, 7 days or 30 days.
* Developer recommendations, with one-click fixes where a setting can solve the problem.
* Top attacking IPs and a live feed of recent events.

= Malware scanner and file integrity =
* Scans WordPress core, plugins and themes in small batches, so it works on shared hosting.
* Compares core and WordPress.org plugin and theme files against the official checksums.
* Detects modified, missing and unknown files, PHP files in uploads and known malware signatures.
* Restores modified core, plugin and theme files from WordPress.org with one click, or quarantines malicious files (quarantine is reversible).
* Vulnerability checks for core, plugins and themes through the WPScan database (API token required) plus outdated-version detection.
* Scheduled scans (daily or weekly) and on-demand scans.

= Web application firewall =
* Rule sets for SQL injection, cross-site scripting, directory traversal and file inclusion, remote code execution, bad bots and scanners. Each category can be switched on or off.
* Country blocking (block list or allow list).
* Manual IP / CIDR allow and block lists, plus automatic temporary blocking of repeat attackers.
* Rate limiting (requests per time window per IP, with a temporary block when exceeded).
* Runs at plugin load, before themes and other plugins; the rule cache keeps the overhead well under 50 ms.

= Login security =
* Brute force protection with lockouts after a configurable number of failed attempts.
* TOTP two-factor authentication (Google Authenticator, Authy, 1Password and others) with backup codes, enforceable per user role.
* Google reCAPTCHA v2 or hCaptcha on the login, registration and lost password forms.
* Hide the login page behind a custom URL; wp-login.php and wp-admin return 404 to logged-out visitors.

= Asset protection =
* Protection scope: whole site, selected folders, or images only.
* Hotlink protection, directory listing protection and PHP execution blocking for uploads, written as .htaccess rules (Apache / LiteSpeed) or a ready-made Nginx snippet.
* Right-click and drag protection for images (a deterrent; it cannot stop a determined visitor).

= Alerts and reports =
* Real-time email alerts for administrator logins, new administrators, file changes and malware, attacks, lockouts and vulnerabilities.
* Custom sender name and address, multiple recipients and editable email templates.
* Daily, weekly or monthly security summary reports.

= Hardening =
* Hide the WordPress version, disable XML-RPC and the file editor, block user enumeration, and send security headers (including optional HSTS) from one screen.

== Installation ==

1. Upload the `wonder-secure` folder to `/wp-content/plugins/`, or upload the zip from Plugins > Add New > Upload Plugin.
2. Activate the plugin through the Plugins screen.
3. Open Wonder Secure in the admin menu and run the first scan from the Scanner screen.
4. If your site is behind Cloudflare or a load balancer, set the correct IP source under Wonder Secure > Settings before enabling automatic blocking.

= Locked out? =
Add one of these lines to wp-config.php, then remove it once you can log in again:

`define( 'WONDERSECURE_DISABLE_FIREWALL', true );` turns off the firewall, IP blocking and rate limiting.
`define( 'WONDERSECURE_DISABLE_HIDE_LOGIN', true );` restores the standard wp-login.php address.

You can also rename the `wp-content/plugins/wonder-secure` folder to disable the plugin completely.

== Frequently Asked Questions ==

= Does it work on Nginx? =
Yes. Everything works on Nginx except rules that live in .htaccess. For those, Wonder Secure shows a ready-made Nginx configuration snippet under Asset Protection to add to your server block.

= Where do country lookups come from? =
From headers set by your CDN or server (Cloudflare, Sucuri, CloudFront, mod_geoip) or, if you choose, from ipinfo.io. No GeoIP database is bundled.

= Do I need a WPScan account? =
Only for the vulnerability database. Without a token Wonder Secure still flags outdated core, plugins and themes.

= How are firewall rules and malware signatures updated? =
They ship with the plugin and can also be pulled daily from a signature feed URL (Settings > Updates), without updating the plugin.

== External services ==

Wonder Secure connects to the services below. Except for WordPress.org, each one is off until you turn it on and enter its details in the plugin settings. No data is sent to Wonderfolks Interactive.

= WordPress.org =
Used to check that WordPress core, plugin and theme files match the official releases, and to download clean copies when you click Repair.
When: during each scan (scheduled or manual) and when you repair a file.
Data sent: your WordPress version and locale, and the slugs and version numbers of installed plugins and themes. Repairs request the specific file being restored.
Endpoints: api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org.
Privacy policy: https://wordpress.org/about/privacy/

= WPScan vulnerability database (Automattic) =
Used to find known vulnerabilities in WordPress core, plugins and themes.
When: only if you choose WPScan as the vulnerability source and enter your own API token, during scans.
Data sent: your API token and the slugs and version numbers of WordPress core, plugins and themes.
Terms of service: https://wpscan.com/terms
Privacy policy: https://automattic.com/privacy/

= IPinfo =
Used to find the country of a visitor's IP address for country blocking and the activity log.
When: only if you select IPinfo as the country source and the visitor's country is not provided by your CDN or server.
Data sent: the visitor's IP address, and your IPinfo token if you entered one. Results are cached.
Terms of service: https://ipinfo.io/terms-of-service
Privacy policy: https://ipinfo.io/privacy-policy

= Google reCAPTCHA =
Used to block bots on the login, registration and lost password forms.
When: only if you choose reCAPTCHA and enter your site and secret keys. The visitor's browser loads the reCAPTCHA script on those forms, and the response is verified with Google when the form is submitted.
Data sent: the CAPTCHA response token, your secret key and the visitor's IP address, plus whatever Google collects in the browser.
Terms of service: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy

= hCaptcha =
Used for the same purpose as reCAPTCHA, as an alternative provider.
When: only if you choose hCaptcha and enter your site and secret keys.
Data sent: the CAPTCHA response token, your secret key and the visitor's IP address, plus whatever hCaptcha collects in the browser.
Terms of service: https://www.hcaptcha.com/terms
Privacy policy: https://www.hcaptcha.com/privacy

= Rule and signature feed (optional) =
Used to download new firewall rules and malware signatures without updating the plugin.
When: only if you enter a feed URL under Settings or define WONDERSECURE_SIGNATURES_URL; it is checked once a day. No feed is configured by default.
Data sent: a standard HTTPS request to the address you entered, with the plugin version in the user agent.

== Privacy ==

Wonder Secure stores security events (IP address, country, user ID, request details) in your own database so you can review attacks and logins. Events are deleted automatically after the retention period you choose (90 days by default). Two-factor secrets are encrypted and backup codes are hashed. Nothing is sent to Wonderfolks Interactive.

== Changelog ==

= 1.0.0 =
* Initial release.

== Credits ==

QR codes on the two-factor setup screen are drawn with qrcode-generator by Kazuhiko Arase (MIT license).
