WP-Security-Pack/README.txt

=== WP Security Pack ===
Contributors: arkhost
Tags: security, login, firewall, 2fa, malware
Requires at least: 5.0
Tested up to: 6.4
Requires PHP: 7.4
Stable tag: 1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A security plugin. No upsells, no premium version, no "threat counters". Just security settings that work.

== Description ==

WP Security Pack adds security features to WordPress. It's free, open source, and doesn't nag you to upgrade.

**What it does:**

= Login Protection =
* Limit login attempts (block IPs after failed logins)
* Custom login URL (hide wp-login.php)
* Hide wp-admin from non-logged-in users
* Honeypot field to catch bots
* Hide login error messages to prevent username enumeration
* Email alerts when admins log in from new IPs
* Restrict login page access by country or IP

= IP Control =
* Whitelist IPs (always allowed)
* Blacklist IPs (always blocked)
* Auto-blacklist IPs after repeated lockouts
* Supports IPv4, IPv6, and CIDR notation

= Geo Blocking =
* Block access from specific countries
* Uses free IP2Location LITE database
* One-click database download

= Hardening =
* Disable XML-RPC
* Disable file editing in dashboard
* Disable application passwords
* Restrict REST API to logged-in users
* Remove WordPress version from source
* Disable user enumeration (?author=1 and REST API)
* Disable pingbacks and trackbacks

= Security Headers =
* X-Content-Type-Options
* X-Frame-Options
* X-XSS-Protection
* Referrer-Policy
* Permissions-Policy
* Content-Security-Policy
* Strict-Transport-Security (HSTS)

= Two-Factor Authentication =
* TOTP-based (works with Google Authenticator, Authy, etc.)
* Backup codes
* Option to enforce 2FA for administrators

= File Integrity Monitoring =
* Monitors WordPress core files
* Compares against official WordPress.org checksums
* Daily automatic scans
* Email alerts when files change

= Malware Scanner =
* Scans plugins, themes, and uploads
* Pattern-based detection for common threats
* Does not scan WordPress core (use File Integrity for that)
* Weekly automatic scans

= Activity Log =
* Records login attempts (success and failed)
* Records lockouts and blocks
* Shows IP, country, username, timestamp
* Configurable retention period
* Export to CSV

= Tools =
* Export/import settings
* Force logout all users
* Test email delivery

**What it doesn't do:**

* Firewall at the server level (use your host's firewall)
* Real-time threat intelligence (we don't phone home)
* Backup your site (use a backup plugin)
* CDN or performance optimization

**Privacy:**

The plugin doesn't send data anywhere except:

* WordPress.org API to verify core file checksums
* IP2Location to download the geo database (if you click the download button)

No tracking, no analytics, no telemetry.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/wp-security-pack/`
2. Activate the plugin through the 'Plugins' screen
3. Go to Security in the admin menu to configure

== Frequently Asked Questions ==

= Is there a premium version? =

No. This is the complete plugin.

= Will this slow down my site? =

The plugin runs security checks on specific actions (login, admin access). It doesn't add overhead to frontend page loads for regular visitors.

= I locked myself out =

Connect to your server via FTP or SSH and rename the plugin folder. This disables the plugin and you can log in normally.

= Does geo-blocking work without the database? =

No. You need to download the IP2Location LITE database from the plugin settings. It's free.

= Can I use this with other security plugins? =

Probably, but there may be conflicts. We recommend using one security plugin at a time.

== Screenshots ==

1. Status overview
2. Login protection settings
3. Activity log
4. Two-factor authentication setup

== Changelog ==

= 1.0 =
* Initial release

== Upgrade Notice ==

= 1.0 =
Initial release.