WP-Security-Pack/wp-security-pack

=== WP Security Pack ===
Contributors: arkhost
Tags: security, firewall, login, 2fa, malware
Requires at least: 5.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress security without the nonsense. No upsells, no premium tier, no fake threat counters.

== Description ==

A complete security plugin that's actually free. No "pro" version, no nag screens, no made-up threat statistics.

= Login Protection =
* Blocks IPs after failed login attempts
* Custom login URL (hides wp-login.php)
* Hides wp-admin from logged-out users
* Honeypot field for bots
* Hides login errors (stops username enumeration)
* Email alerts for admin logins from new IPs
* Country/IP restrictions on login page

= IP Control =
* Whitelist and blacklist
* Auto-blacklist after repeated lockouts
* IPv4, IPv6, CIDR supported

= Geo Blocking =
* Block countries
* Uses free IP2Location LITE database
* One-click download

= Hardening =
* Disable XML-RPC
* Disable dashboard file editing
* Disable application passwords
* Restrict REST API to logged-in users
* Remove WordPress version
* Block user enumeration (?author=1 and REST API)
* Disable pingbacks/trackbacks

= Security Headers =
X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS

= Two-Factor Authentication =
* TOTP (Google Authenticator, Authy, etc.)
* Backup codes
* Enforce for admins

= File Integrity Monitoring =
* Checks WordPress core files against official checksums
* Daily scans
* Email alerts on changes

= Malware Scanner =
* Scans plugins, themes, uploads
* Pattern-based detection
* Quarantine suspicious files
* Weekly scans

= Activity Log =
* Login attempts, lockouts, blocks
* IP, country, username, timestamp
* Configurable retention
* CSV export

= Tools =
* Export/import settings
* Force logout all users
* Test email
* Delete readme.html/license.txt

= Privacy =

No tracking. No analytics. No telemetry.

External connections:
* WordPress.org API (core file checksums)
* IP2Location (database download, only when you click it)

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/wp-security-pack/`
2. Activate the plugin through the 'Plugins' screen
3. Configure under the Security menu

== Frequently Asked Questions ==

= Is there a premium version? =

No. This is the complete plugin.

= Will it slow my site? =

No. Checks run on login and admin access, not frontend page loads.

= I locked myself out =

Connect via FTP/SSH and rename the plugin folder. Log in normally. Fix your settings.

= Does geo-blocking work without the database? =

No. Download the free IP2Location LITE database from the plugin settings.

= Can I use this with other security plugins? =

Possible but likely to cause conflicts. We recommend using one security plugin at a time.

== Screenshots ==

1. Security status overview
2. Login protection settings
3. Activity log
4. Two-factor authentication setup
5. Malware scanner with quarantine

== Changelog ==

= 1.0 =
* Initial release

== Upgrade Notice ==

= 1.0 =
Initial release.