=== All in One Content Protector & Security ===
Contributors: maheshmthorat
Donate link: https://buymeacoffee.com/maheshmthorat
Tags: security, malware scanner, firewall, login protection, content protection
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.0.1
License: GPLv3
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Find and fix security problems: a site scanner, vulnerability and file change alerts, login and bot protection, and safe fixes you can undo.

== Description ==

All in One Content Protector & Security checks how secure your WordPress site really is. It explains each problem in plain language, shows the evidence it found and how to fix it, and can fix many problems for you once you confirm.

It is built to be safe on a live site:

* Scans only read your site.
* Nothing is changed until you confirm a fix, and every fix can be undone.
* Every protection is off until you switch it on.
* Your files, database and plugin list never leave your server.

= Security overview =

* A security score out of 100, with its history.
* Open issues by severity (critical, high, medium, low) and the number of passed checks.
* The status of WordPress, PHP, the database and HTTPS.
* Recent security events and suspicious traffic.
* Recommended next steps.

Every issue has its own page with:

* what was found, and the evidence
* why it matters
* step-by-step instructions, with links to official documentation
* the issue's history

An issue is marked as solved only when a new scan confirms the problem is gone. You can also accept a risk with a note; it reopens automatically if the evidence changes.

= Security scanner =

77 read-only checks in eight areas:

* **WordPress:**
    * updates and automatic security updates
    * core files compared with the official WordPress.org checksums
    * keys and salts, debug settings and the file editor
    * user registration with privileged roles
    * user name exposure
* **PHP:**
    * supported version (end-of-life detection)
    * error display, dangerous settings and functions
    * whether PHP can run in the uploads folder
* **Database:**
    * server version and connection encryption
    * excessive privileges of the database user
    * administrators hidden from the user list or created outside WordPress
    * malicious code stored in settings
    * Passwords are never displayed.
* **Files:**
    * wp-config.php permissions and exposure
    * writable files and PHP files in uploads
    * suspicious .htaccess and .user.ini rules
    * downloadable backups and database dumps
    * forgotten phpinfo pages and database tools
* **File changes:**
    * Plugins from WordPress.org are compared with their official checksums.
    * Themes, premium plugins, must-use plugins and drop-ins are compared with a baseline.
    * Changes made by updates are accepted automatically.
* **Plugins and themes:**
    * available updates
    * known vulnerabilities, with the version that fixes them
    * plugins closed on WordPress.org, and unmaintained or unused extensions
    * A plugin is never called vulnerable just because it is old or inactive.
* **Web server:**
    * HTTPS and certificate expiry
    * security headers and CORS settings
    * directory listings and version disclosure
* **Traffic:** ongoing login attacks, XML-RPC abuse, and proxies that are not set up.

Scans run in short steps, so they never time out. You can cancel and resume them, and they continue in the background. Run a quick scan, a full scan or a scan of one area, or schedule daily or weekly scans. A check that cannot run is reported as "could not check", never as passed.

= Vulnerability alerts =

Add a free Wordfence Intelligence API key and the plugin downloads the vulnerability database once a day. It compares the database with your plugins, themes and WordPress version **on your server**, so your plugin list is not sent anywhere. Developers can add other data sources.

= Login, bot and traffic protection =

All of these are off until you switch them on:

* **Login protection.** Temporary blocks after repeated failed logins, longer for repeat offenders. Blocks always expire, unless you add one yourself.
* **XML-RPC control.** Disable pingbacks, block `system.multicall`, or turn XML-RPC off completely. This works on every server, including Nginx.
* **Bot blocking.** Block repeated probing for sensitive files, floods of "page not found" requests, known attack tools and fake search engine crawlers. Crawlers are checked by their published addresses or by reverse DNS, never by the user agent alone.
* **Security headers.** Sent by PHP on every server. The Content-Security-Policy starts in report-only mode and comes with a compatibility check against your home page.
* **Hardening.** Disable the file editor, hide PHP errors, and hide user names and the WordPress version from visitors.
* **Allowlist and manual blocks.** Cloudflare and proxy support, and an emergency safe mode.

The plugin takes care not to block real visitors:

* Logged-in administrators and allowlisted addresses are never blocked.
* If another website makes a visitor's browser send requests to your site, those requests never get the visitor blocked.
* A proxy or CDN address shared by many visitors is never blocked automatically.

These protections work inside WordPress and reduce automated attacks. They cannot stop network floods (DDoS); that needs protection from your host or CDN.

= Safe fixes you can undo =

Many issues have an **Apply fix** button. Before anything changes you see:

* the problem and the exact change
* the expected impact
* the backup that will be made, and how to undo the change

You have to confirm before anything is changed.

* Changes to .htaccess are backed up, tested with a request to your site, and reverted automatically if the site returns an error.
* Every fix can be undone from the change history.
* The plugin never changes file permissions, PHP versions, database privileges, or plugin and theme files.

= Alerts and reports =

* E-mail alerts for new issues (each issue only once), new administrator accounts and repeated login attacks.
* Daily or weekly summaries.
* A printable report.
* CSV exports of issues and events, and JSON exports of scans.
* A Site Health test.
* WP-CLI commands (`wp aowpcs`).

= Content protection =

Block text selection, image dragging, right-click and the browser console. You can choose not to apply these to logged-in editors and administrators.

This makes casual copying less convenient. Anything a browser shows can still be saved by a determined visitor, so treat it as a deterrent, not a security measure.

== Installation ==

1. In your dashboard go to **Plugins → Add New**, search for "All in One Content Protector & Security", then install and activate it.
2. Open **Security → Overview**, choose which online lookups are allowed, and start the first scan.
3. Optional: add a Wordfence Intelligence API key in **Security → Settings → Vulnerability data**.
4. Optional: switch on the protections you want in **Security → Firewall & Protection**.

Content protection is in **Security → Content Protection**. On multisite it is in **Settings → Content Protection** on each site.

== Frequently Asked Questions ==

= Will scanning slow down or change my site? =

No. Scans only read files, settings and the database, in short steps of a few seconds. Nothing changes unless you apply a fix and confirm it.

With the default settings, the plugin adds no database queries to your visitors' page views.

= I locked myself out. What now? =

Blocks expire on their own. To turn off all blocking straight away, do one of these:

* Add `define('AOWPCS_SAFE_MODE', true);` to wp-config.php.
* Run `wp aowpcs blocks clear`.
* Rename the plugin folder.

= My site is behind Cloudflare, a load balancer or a proxy. =

Turn on the Cloudflare preset, or enter your proxy addresses, in **Security → Settings → Monitoring & privacy**.

Until you do, the plugin notices when one address forwards requests for many visitors, and never blocks that address automatically. If visitors connect to your server directly, select "This site is not behind a proxy".

= Why does a check say "Could not check"? =

Some checks need to request your site from the server, or need an online lookup you have not allowed. When that is not possible, the check says so instead of reporting a pass.

= Do I need a Wordfence account? =

Only for vulnerability alerts, which need a Wordfence Intelligence API key. Everything else works without it. Without a key, the vulnerability checks report "could not check".

= Does it replace a server firewall or a malware clean-up service? =

No. It finds and explains problems, reduces common automated attacks, and helps you fix configuration problems. A hacked site needs a careful clean-up; the issue pages link to the official WordPress guidance.

= I used version 2. Are my settings kept? =

Yes. Your content protection, XML-RPC and header settings are kept.

The rules version 2 wrote to .htaccess stay in place. The scanner reports them and offers a replacement, with a backup and rollback.

= Is multisite supported? =

Yes. Network administrators find the security suite in the Network Admin; it covers the whole network. Each site's administrators set up content protection for their own site.

= Which data leaves my server? =

Only what the services listed under "External services" need, and only after you allow them. Website files, database contents and configuration are never uploaded.

= How do I remove all data? =

In **Security → Settings**, turn on **Delete all data on uninstall**, then delete the plugin.

Without that setting, data is kept, so you can reinstall without losing your history.

== Screenshots ==

1. Security overview: the score and its history, open issues by severity, site status and recent security events.
2. An issue page: what was found, the evidence and step-by-step instructions.
3. A fix preview: the exact change, the backup and how to undo it are shown before you confirm.
4. Firewall & Protection: login protection and XML-RPC control, each off until you switch it on.
5. Traffic: verified crawlers, bots and suspicious requests.
6. Content protection settings.

== External services ==

The plugin contacts these services only when the related feature is turned on.

**WordPress.org** (api.wordpress.org, downloads.wordpress.org)

* Used for: official checksums of WordPress and of WordPress.org plugins, plugin and theme directory information, and WordPress' own update checks.
* Data sent: your WordPress version and language, and the names and versions of your installed plugins and themes.
* Turned on by: "WordPress.org lookups" in Security → Settings.
* [Privacy policy](https://wordpress.org/about/privacy/)

**Wordfence Intelligence** (www.wordfence.com)

* Used for: the vulnerability database. It is downloaded and compared on your server.
* Data sent: your API key and, as with any download, your server's IP address.
* Turned on by: entering an API key.
* [Terms](https://www.wordfence.com/terms-of-service/) · [Privacy policy](https://www.wordfence.com/privacy-policy/)

**Google and Bing** (developers.google.com, www.bing.com)

* Used for: the published address ranges of their crawlers. Nothing about your site is sent.
* Turned on by: crawler verification.
* [Google privacy policy](https://policies.google.com/privacy) · [Microsoft privacy statement](https://privacy.microsoft.com/)

**Cloudflare** (www.cloudflare.com)

* Used for: Cloudflare's published address ranges. Nothing about your site is sent.
* Turned on by: the Cloudflare preset.
* [Privacy policy](https://www.cloudflare.com/privacypolicy/)

**Your DNS resolver**

* Used for: reverse DNS lookups of addresses that claim to be search engine crawlers.
* Turned on by: crawler verification.

**Your own site**

* Used for: checking what visitors can reach (exposed files, headers, directory listings), by requesting your own pages.

== Privacy ==

Traffic monitoring is off by default. When you turn it on, the plugin stores the following, for suspicious requests only:

* the time
* the IP address, shortened by default
* the request method, and the path without the query string
* the HTTP status
* the user agent
* why the request was flagged

For failed logins it stores only whether the account exists, never the user name or password. Passwords, cookies, authorization headers and request bodies are never stored.

Events are deleted after 30 days; you can change this. Administrator logins are recorded with the user ID; you can turn this off.

== Changelog ==

= 3.0.1 =
* New: the plugin name and version are shown at the top of every screen.
* Changed: Content Protection has the same design as the security screens, comes right after Overview in the Security menu, and its status is shown on the Overview.
* Changed: the About and Say Thanks tabs were redesigned; they no longer load images from other websites.
* Fix: the 3.0.0 package downloaded in its first hour also contained development files (test tools and build output). Updating to 3.0.1 removes them.

= 3.0.0 =
* New: a complete security suite:
    * security overview with score and history
    * a scanner with 77 checks
    * vulnerability alerts and file change detection
    * server and database checks
    * bot and traffic monitoring, and a security event log
    * login, XML-RPC and bot protection
    * safe fixes with rollback
    * e-mail alerts, reports and WP-CLI commands
* New: the plugin is now called "All in One Content Protector & Security".
* Changed: content protection can skip logged-in editors and administrators. This is on by default for new installations.
* Changed: the security header and XML-RPC options moved to Security → Firewall & Protection. Your settings are kept, and "Disable XML-RPC" now also works on servers without .htaccess (Nginx).
* Changed: .htaccess rules from version 2 stay in place. The scanner reports them and offers a replacement, with a backup and rollback.
* Fix: deactivating the plugin removes its .htaccess rules, and activating it restores them.
* Requires PHP 7.4 and WordPress 6.0 or newer.

Earlier versions are listed in the [development log](https://plugins.trac.wordpress.org/log/all-in-one-wp-content-security/).

== Upgrade Notice ==

= 3.0.1 =
New look for Content Protection and the plugin name on every screen. Removes development files from sites that installed 3.0.0 in its first hour.

= 3.0.0 =
Adds a complete security suite. Requires PHP 7.4 and WordPress 6.0 or newer. Your settings are kept. After updating, open Security → Overview to run your first scan.
