=== SecurWP – Advanced Security, Firewall & Malware Scanner ===
Contributors: securwpteam
Tags: security, firewall, malware scanner, login protection, 2FA
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Cloud-powered malware scanning, firewall rules, login security with 2FA, vulnerability alerts, and essential security hardening.

== Description ==

SecurWP helps protect WordPress sites with cloud-assisted malware scanning, firewall controls, login security, hardening, vulnerability monitoring, audit logging, and centralized monitoring.

It is built for site owners, agencies, and teams that need strong protection without turning every site into a security project. The plugin protects WordPress locally, the SecurWP Console gives portfolio-level visibility, and optional expert services help when human cleanup or managed response is needed.

The scanner performs lightweight verification locally and moves heavy malware analysis to SecurWP Cloud. Files are hashed first and checked against cloud signatures. Only files that cannot be verified by hash may be uploaded for deeper analysis. Verified results are cached locally so unchanged files are not checked again unnecessarily.

= Cloud Malware Scanner =

Run checks for file integrity, malware indicators, server reputation, exposed sensitive files, user account security, database security, and known vulnerabilities. Scans run in the background and can throttle when your server is under load.

= Firewall and Bot Protection =

Block malicious requests before WordPress processes them. SecurWP includes IP and country blocking, rate limits, user-agent filtering, custom rules, community blocklist support, server-level rules where supported, and optional Cloudflare sync.

= Login Security and 2FA =

Reduce account takeover risk with two-factor authentication, brute-force lockouts, CAPTCHA support, custom login URLs, breached-password detection, email codes, authenticator app codes, and recovery codes.

= WordPress Hardening =

Close common WordPress exposure points with one-click controls for XML-RPC, user enumeration, WordPress version output, REST API access, PHP execution in uploads, sensitive file access, file editing, and security headers where supported.

= Vulnerability Monitoring =

SecurWP checks installed plugins, themes, and WordPress core against cloud vulnerability data. Findings include severity, affected versions, CVE references where available, and suggested fixes. Abandoned plugins can be flagged separately.

= Audit Log and Alerts =

Track logins, failed logins, lockouts, plugin and theme changes, user account changes, firewall blocks, scan results, and sensitive setting changes. Events can be searched, filtered, and exported to CSV.

Email alerts are available in the plugin. SecurWP Console plans can also route alerts to Slack and Discord.

= SecurWP Console =

Connect your site to the SecurWP Console to manage one site or many from a single dashboard. The Console adds portfolio security status, scan history, vulnerability tracking, uptime monitoring, SSL expiry checks, remote website scanning, Slack and Discord alerts, downloadable reports, team roles, and optional expert or managed security services.

== Installation ==

1. Upload the `SecurWP` folder to `/wp-content/plugins/`, or install SecurWP from the WordPress plugin directory.
2. Activate the plugin from the **Plugins** screen in WordPress.
3. Open **SecurWP** from the WordPress admin sidebar.
4. Complete the setup wizard using an email code, license key, or SecurWP Console authorization.
5. Review the recommended protection settings and run your first scan.

SecurWP requires outbound HTTPS for cloud scanning, vulnerability lookups, firewall intelligence, and console sync.

== Frequently Asked Questions ==

= What are the server requirements? =

SecurWP requires WordPress 6.0 or higher, PHP 7.4 or higher, and outbound HTTPS access so the plugin can communicate with SecurWP Cloud.

= Do I need a SecurWP account? =

No. You can start using SecurWP by entering your email address to activate a free license. A SecurWP Console account is optional and is only needed if you want to connect your site to the Console for centralized monitoring, multi-site management, reports, team access, or support.

Cloud features such as malware analysis, vulnerability intelligence, firewall intelligence, and license validation use SecurWP Cloud under your license, but the plugin does not require a Console account to run. No credit card is needed for the free license.

= Will SecurWP slow down my site? =

SecurWP is designed to keep heavy scanning work off your server. Scans run in the background, use local hash verification where possible, and can slow themselves down when your server is under load.

= How does the cloud scanner work? =

SecurWP hashes files locally and checks those hashes against SecurWP Cloud. Known files are resolved quickly. Only files that cannot be verified by hash may be uploaded for deeper analysis. Results are cached locally so unchanged files do not need to be checked again.

= Is my site's content sent to SecurWP? =

No. SecurWP does not send your database content, posts, pages, comments, customer data, or other WordPress content to the cloud.

The scanner hashes files locally and checks those hashes against SecurWP Cloud. File hashes cannot be used to reconstruct file contents. Only files that cannot be verified by hash alone may be uploaded for malware analysis.

If `wp-config.php` ever needs cloud analysis, SecurWP strips database credentials, authentication keys, salts, and other sensitive configuration values before the file is sent. Uploaded analysis files are deleted after processing.

See the SecurWP Privacy Policy for details.

= Does SecurWP work with other security plugins? =

SecurWP can coexist with other plugins, but running two firewalls, two CAPTCHA systems, or two brute-force lockout systems at the same time can cause conflicts. Disable duplicate features in other security plugins.

= What is the Remote Website Scanner? =

The Remote Website Scanner checks your site from outside WordPress. It can detect exposed sensitive files, suspicious redirects, missing security headers, outdated software, and known vulnerabilities that may not be visible from inside WordPress.

= Does SecurWP support WordPress Multisite? =

Yes. SecurWP supports WordPress Multisite with per-site or network-wide configuration.

= Where can I get support? =

Users can open a support request from the SecurWP Console. Pro and Managed plan users receive priority support from the SecurWP team.

== Screenshots ==

1. Dashboard overview with security posture, recent threats, and scan summary
2. Scanner with live scan progress and results grouped by module
3. Firewall management with traffic log, IP blocking, and rule builder
4. Hardening controls organized by security category
5. Vulnerability monitor with severity, affected versions, and fix guidance
6. Audit log with searchable event history and CSV export
7. Settings page with notifications, license, and integration controls

== External Services ==

SecurWP connects to external services only for features you enable or when you connect the plugin to your SecurWP account.

= SecurWP Cloud =

Service: SecurWP Cloud
Endpoints: intel.securewp.net and console.securewp.net

SecurWP communicates with its own cloud infrastructure for license activation and validation, cloud malware analysis, vulnerability lookups, firewall intelligence, community blocklist synchronization, and optional SecurWP Console sync.

Data sent for license activation and validation may include your email address, license key or license token, site URL, WordPress version, plugin version, and basic site metadata needed to activate and validate your license.

Data sent for malware scanning includes file hashes generated locally by the plugin. File hashes cannot be used to reconstruct file contents. Only files that cannot be verified by hash alone may be uploaded for deeper malware analysis. Uploaded analysis files are deleted after processing.

SecurWP does not send your database, posts, pages, comments, customer data, WooCommerce orders, or other WordPress content to SecurWP Cloud.

If wp-config.php ever requires cloud analysis, SecurWP removes database credentials, authentication keys, salts, and other sensitive configuration values before the file is sent.

Data sent for vulnerability monitoring may include installed plugin and theme names, plugin and theme versions, WordPress core version, and related security metadata needed to identify known vulnerabilities.

Data sent for firewall intelligence, community blocklist synchronization, and optional Console sync may include firewall event metadata, blocked IP addresses, scan results, vulnerability findings, site status, and security configuration metadata.

Connecting to the SecurWP Console is optional. Console sync only runs after you enable console for the website from your SecurWP Console account.

Privacy policy: https://securewp.net/privacy-policy/
Terms of service: https://securewp.net/terms-and-conditions/

= MaxMind GeoLite2 =

Service: https://www.maxmind.com/en/geolite2/geolite2-country
Purpose: GeoIP country blocking when enabled with your MaxMind license key.
When/data: downloads or updates the local GeoLite2 database. Visitor IPs are resolved locally and are not sent to MaxMind at request time. Sends MaxMind license key and download request data.
Privacy policy: https://www.maxmind.com/en/privacy-policy
Terms/EULA: https://www.maxmind.com/en/geolite2/eula

= Have I Been Pwned =

Service: https://haveibeenpwned.com/Passwords
Purpose: breached-password detection when enabled.
When/data: checks passwords during login or password validation. Sends only the first 5 characters of the SHA-1 password hash. The full password and full hash are never sent.
Privacy policy: https://haveibeenpwned.com/Privacy
Terms: https://haveibeenpwned.com/TermsOfUse

= Google reCAPTCHA =

Service: https://www.google.com/recaptcha/about/
Purpose: CAPTCHA protection when Google reCAPTCHA is selected and configured.
When/data: protected login form load or challenge verification. Sends CAPTCHA response token, site key, and visitor/browser data required by Google.
Privacy policy: https://policies.google.com/privacy
Terms: https://policies.google.com/terms

= Cloudflare Turnstile =

Service: https://developers.cloudflare.com/turnstile/
Purpose: CAPTCHA protection when Cloudflare Turnstile is selected and configured.
When/data: protected login form load or challenge verification. Sends challenge token, site key, and visitor/browser data required by Cloudflare.
Privacy policy: https://www.cloudflare.com/turnstile-privacy-policy/
Terms: https://www.cloudflare.com/website-terms/

= Cloudflare API =

Service: https://api.cloudflare.com/
Purpose: syncing blocked IPs or firewall rules when the Cloudflare integration is enabled.
When/data: when Cloudflare settings are saved or firewall blocks are synced. Sends API credentials or token, configured zone details, blocked IPs, and firewall rule data required for the integration.
Privacy policy: https://www.cloudflare.com/privacypolicy/
Terms: https://www.cloudflare.com/website-terms/

== Changelog ==

= 1.0.0 =
* Initial release
