v1.0

README.md

@@ -0,0 +1,103 @@
+# WP Security Pack
+
+WordPress security without the bullshit. No upsells, no premium tier, no fake threat counters.
+
+## Requirements
+
+- WordPress 5.0+
+- PHP 7.4+
+
+## What It Does
+
+### Login Protection
+- Blocks IPs after failed login attempts
+- Custom login URL (hides wp-login.php)
+- Hides wp-admin from logged-out users
+- Honeypot field for bots
+- Hides login errors (stops username enumeration)
+- Email alerts for admin logins from new IPs
+- Country/IP restrictions on login page
+
+### IP Control
+- Whitelist and blacklist
+- Auto-blacklist after repeated lockouts
+- IPv4, IPv6, CIDR supported
+
+### Geo Blocking
+- Block countries
+- Uses free IP2Location LITE database
+- One-click download
+
+### Hardening
+- Disable XML-RPC
+- Disable dashboard file editing
+- Disable application passwords
+- Restrict REST API to logged-in users
+- Remove WordPress version
+- Block user enumeration (?author=1 and REST API)
+- Disable pingbacks/trackbacks
+
+### Security Headers
+X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS
+
+### Two-Factor Authentication
+- TOTP (Google Authenticator, Authy, etc.)
+- Backup codes
+- Enforce for admins
+
+### File Integrity Monitoring
+- Checks WordPress core files against official checksums
+- Daily scans
+- Email alerts on changes
+
+### Malware Scanner
+- Scans plugins, themes, uploads
+- Pattern-based detection
+- Weekly scans
+- Does not scan core files (that's what File Integrity is for)
+
+### Activity Log
+- Login attempts, lockouts, blocks
+- IP, country, username, timestamp
+- Configurable retention
+- CSV export
+
+### Tools
+- Export/import settings
+- Force logout all users
+- Test email
+
+## Installation
+
+1. Upload to `/wp-content/plugins/wp-security-pack/`
+2. Activate
+3. Configure under Security menu
+
+## FAQ
+
+**Premium version?**
+No. This is it.
+
+**Will it slow my site?**
+No. Checks run on login and admin access, not frontend loads.
+
+**Locked myself out?**
+Rename the plugin folder via FTP/SSH. Log in. Fix settings.
+
+**Geo-blocking without database?**
+Won't work. Download IP2Location LITE from settings. It's free.
+
+**Use with other security plugins?**
+Possible but likely conflicts. Pick one.
+
+## Privacy
+
+No tracking. No analytics. No telemetry.
+
+External connections:
+- WordPress.org API (core file checksums)
+- IP2Location (database download, only when you click it)
+
+## License
+
+GPLv2 or later