v1.0

security-pack/readme.txt

@@ -0,0 +1,128 @@
+=== Security Pack ===
+Contributors: arkhost
+Tags: security, firewall, login, 2fa, malware
+Requires at least: 5.0
+Tested up to: 6.9
+Requires PHP: 7.4
+Stable tag: 1.0
+License: GPLv2 or later
+License URI: https://www.gnu.org/licenses/gpl-2.0.html
+
+WordPress security without the nonsense. No upsells, no premium tier, no fake threat counters.
+
+== Description ==
+
+A complete security plugin that's actually free. No "pro" version, no nag screens, no made-up threat statistics.
+
+= Login Protection =
+* Blocks IPs after failed login attempts
+* Custom login URL (hides wp-login.php)
+* Hides wp-admin from logged-out users
+* Honeypot field for bots
+* Hides login errors (stops username enumeration)
+* Email alerts for admin logins from new IPs
+* Country/IP restrictions on login page
+
+= IP Control =
+* Whitelist and blacklist
+* Auto-blacklist after repeated lockouts
+* IPv4, IPv6, CIDR supported
+
+= Geo Blocking =
+* Block countries
+* Uses free IP2Location LITE database
+* One-click download
+
+= Hardening =
+* Disable XML-RPC
+* Disable dashboard file editing
+* Disable application passwords
+* Restrict REST API to logged-in users
+* Remove WordPress version
+* Block user enumeration (?author=1 and REST API)
+* Disable pingbacks/trackbacks
+
+= Security Headers =
+X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS
+
+= Two-Factor Authentication =
+* TOTP (Google Authenticator, Authy, etc.)
+* Backup codes
+* Enforce for admins
+
+= File Integrity Monitoring =
+* Checks WordPress core files against official checksums
+* Daily scans
+* Email alerts on changes
+
+= Malware Scanner =
+* Scans plugins, themes, uploads
+* Pattern-based detection
+* Quarantine suspicious files
+* Weekly scans
+
+= Activity Log =
+* Login attempts, lockouts, blocks
+* IP, country, username, timestamp
+* Configurable retention
+* CSV export
+
+= Tools =
+* Export/import settings
+* Force logout all users
+* Test email
+* Delete readme.html/license.txt
+
+= Privacy =
+
+No tracking. No analytics. No telemetry.
+
+External connections:
+* WordPress.org API (core file checksums)
+* IP2Location (database download, only when you click it)
+
+== Installation ==
+
+1. Upload the plugin files to `/wp-content/plugins/security-pack/`
+2. Activate the plugin through the 'Plugins' screen
+3. Configure under the Security menu
+
+== Frequently Asked Questions ==
+
+= Is there a premium version? =
+
+No. This is the complete plugin.
+
+= Will it slow my site? =
+
+No. Checks run on login and admin access, not frontend page loads.
+
+= I locked myself out =
+
+Connect via FTP/SSH and rename the plugin folder. Log in normally. Fix your settings.
+
+= Does geo-blocking work without the database? =
+
+No. Download the free IP2Location LITE database from the plugin settings.
+
+= Can I use this with other security plugins? =
+
+Possible but likely to cause conflicts. We recommend using one security plugin at a time.
+
+== Screenshots ==
+
+1. Security status overview
+2. Login protection settings
+3. Activity log
+4. Two-factor authentication setup
+5. Malware scanner with quarantine
+
+== Changelog ==
+
+= 1.0 =
+* Initial release
+
+== Upgrade Notice ==
+
+= 1.0 =
+Initial release.