=== 2MNY Shield — Security & Firewall ===
Contributors: 2mnysecurity
Tags: security, firewall, malware scanner, login security, waf, bruteforce, 2fa, security headers, file integrity
Requires at least: 6.0
Tested up to: 7.1.2
Requires PHP: 7.4
Stable tag: 1.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Complete WordPress security with WAF (182 rules + virtual patching), malware scanner (237 signatures), file integrity monitoring, live traffic view, email alerts, 2FA with recovery codes and trusted devices, activity log, REST API guard, country blocking, live threat blocklist, and cloud sync with the 2mny.com platform (13,641 live exploit signatures).

== Description ==

2MNY Shield is a complete WordPress security plugin that protects your website from hackers, malware, and vulnerabilities.

= Key Features =

* **Web Application Firewall** — 182 OWASP rules blocking SQL injection, XSS, command injection, LFI, RFI, XXE, SSRF, SSTI, and more
* **Malware Scanner** — 237 malware signatures scanning all PHP files for backdoors, web shells, and obfuscated code
* **File Integrity Monitoring** — Monitors all WordPress files for unauthorized changes. Get alerts when files are modified, added, or deleted.
* **Live Traffic View** — See real-time HTTP requests, blocked attacks, and visitor IPs in your dashboard.
* **Email Alerts** — Get notified instantly when malware is found, files change, or attacks are blocked.
* **Login Security** — 2FA (Google Authenticator) with 10 single-use recovery codes, trusted devices (7-day remembered browsers), per-user login history, brute-force protection, login rate limiting
* **Vulnerability Feed + Virtual Patching** — installed plugins/themes matched against the 2MNY platform's live 13,641-template Nuclei exploit-signature corpus; known exploit URLs blocked at the firewall until you update (Kadence/Patchstack parity)
* **Activity Log** — full audit trail (sign-ins, plugin/theme changes, user/role changes, settings, blocked attacks) with search, filters, and compliance-ready CSV export
* **REST API Guard** — namespace restriction for logged-out visitors, user-enumeration blocking, batch-route abuse caps (WP 7.0.2 attack class)
* **Live Threat Blocklist (NEW v1.4.0)** — hourly-pushed firewall blocklist from the 2MNY platform's live feeds: ThreatFox active-campaign attack-IP IOCs + OpenPhish/URLhaus/ThreatFox malicious hosts. Wordfence-real-time-rules class protection, free tier included.
* **Country Blocking (NEW v1.4.0)** — block countries from the whole site, or restrict wp-login.php/xmlrpc.php to a country allow-list (the "BD-only admin sign-in" rule). Cloudflare CF-IPCountry aware, 12h per-IP geo cache, fail-open on geo outage so admins are never locked out. Wordfence parity, free tier.
* **2MNY Network (opt-in)** — shared blocklist: contribute salted hashes of attacking IPs, pull the aggregate Bangladesh-fleet blocklist. Raw IPs never leave your site.
* **Site-type Presets** — Government/Bangladesh (GOBISM baseline), E-commerce, Blog, Portfolio + settings import/export
* **Weekly Digest + Webhooks** — Monday email summary (score, blocks, vulns, findings); JSON webhook for MSPs/SOCs (Pro)
* **Core Checksums + Quarantine** — verify WordPress core files against official checksums, restore from the canonical release, quarantine malicious files with timestamped backups
* **Staging Awareness** — staging/dev sites detected automatically; alert noise suppressed
* **Security Headers** — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and more
* **Automated Fixing (Pro)** — One-click remediation for common vulnerabilities
* **Cloud Sync (Pro)** — Manage multiple sites from 2mny.com dashboard

= Free vs Pro =

The free version includes full firewall, daily malware scan, file integrity monitoring, live traffic, email alerts, login security, and headers manager. 

Pro version ($89/year) adds: advanced WAF (200+ OWASP rules), real-time monitoring, automated vulnerability fixing, cloud platform sync, multi-site management, and priority support.

== Installation ==

1. Upload `2mny-shield` to `/wp-content/plugins/`
2. Activate through the Plugins menu in WordPress
3. Configure settings under 2MNY Shield menu

== Changelog ==

= 1.4.0 (2026-10-02) =
* NEW: Live Threat Blocklist — hourly-pushed firewall blocklist from the 2MNY platform's live feeds: ThreatFox active-campaign attack-IP IOCs + OpenPhish/URLhaus/ThreatFox malicious hosts (Wordfence-real-time-rules class protection, free tier included)
* NEW: Country Blocking — site-wide country block-list + wp-login.php/xmlrpc.php country allow-list (the "BD-only admin sign-in" rule). Cloudflare CF-IPCountry aware, 12h per-IP geo cache via ipwho.is, fail-open on geo outage so admins are never locked out
* NEW: Real Firewall settings page — WAF status, virtual-patch and threat-blocklist telemetry, country blocking controls, and the recent-blocks table (replaces the placeholder page)
* NEW: Real Security Headers settings page — HSTS (max-age / includeSubDomains / preload), X-Frame-Options, Referrer-Policy controls + live header table (free tier, as documented)
* NEW: License settings page — activate/deactivate your Pro key in-plugin
* FIX: plugin header version now matches the shipped 1.4.0 constant (WordPress showed 1.3.0)

= 1.3.0 (2026-10-02) =
* NEW: Activity/audit log with search, filters, and compliance-ready CSV export (table-stakes parity with Wordfence/Sucuri/Jetpack)
* NEW: Vulnerability feed + virtual patching — plugins/themes matched against the 2MNY platform's live 13,641-template Nuclei corpus; exploit URLs blocked at the WAF until update (free weekly / Pro 12-hourly)
* NEW: REST API Guard — namespace restriction, user-enumeration blocking, batch-route abuse caps (WP 7.0.2 attack class)
* NEW: 2FA recovery codes (10 single-use) and trusted devices (7-day remembered browsers), per-user login history panel
* NEW: 2MNY Network opt-in shared blocklist (salted-hash privacy, BD-fleet intelligence)
* NEW: Site-type presets incl. Government/Bangladesh (GOBISM baseline) + settings import/export
* NEW: Weekly digest email + JSON webhook (Pro)
* NEW: Core checksum verification/restore + file quarantine with backups
* NEW: Staging-site detection with alert suppression
* NEW: First-run onboarding wizard with security-score feedback
* Compatible with WordPress 7.1.2, PHP 8.5+


= 1.2.0 =
* NEW: File Integrity Monitoring — hash-based file change detection for all WordPress files
* NEW: Live Traffic View — real-time dashboard showing all requests and blocked attacks
* NEW: Email Alert System — instant notifications for malware, file changes, brute-force, firewall blocks
* NEW: Real-time firewall hook — blocks attacks at plugins_loaded priority 1 (before WordPress processes)
* NEW: User enumeration protection — blocks ?author=N enumeration
* NEW: Admin POST protection — checks for SQL injection in admin form submissions
* ENHANCED: Firewall now integrates with Live Traffic and Alerts systems
* ENHANCED: Rate limiting for brute-force (5 attempts → 1hr block)
* WordPress coding standards: proper escaping (esc_html, esc_attr), nonces on all forms, capability checks

= 1.1.0 =
* Enhanced firewall: 182 OWASP rules (was 9)
* Enhanced malware scanner: 237 signatures (was 9)
* WordPress 7.0 compatibility tested
* Scanner detection: blocks known security tools
* Bot detection: 15 known scanner user agents blocked

= 1.0.0 =
* Initial release
