# WP Security Pack

WordPress security without the bullshit. No upsells, no premium tier, no fake threat counters.

## Requirements

- WordPress 5.0+
- PHP 7.4+

## What It Does

### Login Protection
- Blocks IPs after failed login attempts
- Custom login URL (hides wp-login.php)
- Hides wp-admin from logged-out users
- Honeypot field for bots
- Hides login errors (stops username enumeration)
- Email alerts for admin logins from new IPs
- Country/IP restrictions on login page

### IP Control
- Whitelist and blacklist
- Auto-blacklist after repeated lockouts
- IPv4, IPv6, CIDR supported

### Geo Blocking
- Block countries
- Uses free IP2Location LITE database
- One-click download

### Hardening
- Disable XML-RPC
- Disable dashboard file editing
- Disable application passwords
- Restrict REST API to logged-in users
- Remove WordPress version
- Block user enumeration (?author=1 and REST API)
- Disable pingbacks/trackbacks

### Security Headers
X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS

### Two-Factor Authentication
- TOTP (Google Authenticator, Authy, etc.)
- Backup codes
- Enforce for admins

### File Integrity Monitoring
- Checks WordPress core files against official checksums
- Daily scans
- Email alerts on changes

### Malware Scanner
- Scans plugins, themes, uploads
- Pattern-based detection
- Weekly scans
- Does not scan core files (that's what File Integrity is for)

### Activity Log
- Login attempts, lockouts, blocks
- IP, country, username, timestamp
- Configurable retention
- CSV export

### Tools
- Export/import settings
- Force logout all users
- Test email

## Installation

1. Upload to `/wp-content/plugins/wp-security-pack/`
2. Activate
3. Configure under Security menu

## FAQ

**Premium version?**
No. This is it.

**Will it slow my site?**
No. Checks run on login and admin access, not frontend loads.

**Locked myself out?**
Rename the plugin folder via FTP/SSH. Log in. Fix settings.

**Geo-blocking without database?**
Won't work. Download IP2Location LITE from settings. It's free.

**Use with other security plugins?**
Possible but likely conflicts. Pick one.

## Privacy

No tracking. No analytics. No telemetry.

External connections:
- WordPress.org API (core file checksums)
- IP2Location (database download, only when you click it)

## License

GPLv2 or later