=== Artiman Guard ===
Contributors: hsmasoumi
Tags: anti-spam, security, seo, forms, woocommerce
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.8.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Self-hosted form abuse protection, registration firewall, 404 bot shield and SEO crawl protection.

== Description ==

Artiman Guard protects WordPress and WooCommerce forms without sending CAPTCHA data or security reports to an external service.

Protection layers include:

* Local browser proof-of-work with a mathematical fallback.
* One-time signed challenges, dynamic honeypots and form timing checks.
* Local rate limiting and a managed IP blocklist.
* Secure Cloudflare visitor-IP extraction that trusts headers only from official Cloudflare networks.
* Reverse-and-forward DNS verification for Google and Bing crawlers.
* Aggregated attack events, daily trends, unique attack groups and configurable database caps.
* Verified Cloudflare visitor IP handling without trusting spoofed forwarding headers.
* Reverse and forward DNS verification for Googlebot and Bingbot.
* Route-family rate limiting and pagination/filter crawl-trap detection.
* Aggregated attack events, database row caps and 30-day comparisons.
* Daily and 30-day email security summaries.
* Registration firewall, one-time registration permits and account quarantine.
* Spam-username detection and registration-source monitoring.
* Internal/external link classification for comments, product reviews and form submissions.
* Writing-system checks with automatic site-language defaults and administrator overrides.
* Content-risk scoring for repetition, advertising language, gibberish, disposable email, suspicious domains, invalid phone numbers and duplicate submissions.
* Block, quarantine, suspicious and allow-with-flag decisions.
* Review queues for comments, Elementor Pro Forms and Gravity Forms.
* 404 scanner detection, sensitive-path protection and repeated-request blocking.
* Route-family rate limiting for abusive pagination and filter crawl traps.
* Internal broken-link reports, redirect suggestions and crawl-budget reports.
* Administrator feedback accuracy, URL action recommendations and optional email summaries.
* Soft-404 and suspicious-200 reporting.
* Internal-search and WooCommerce-filter noindex protection.
* WordPress login, registration, lost-password and comment protection.
* WooCommerce login, registration and product-review protection.
* Dedicated Elementor Pro Forms and Gravity Forms fields.
* A local Security Center for suspicious events and managed IP blocks.
* Persian translation and support for WordPress language packs.

Artiman Guard is designed to cooperate with WordPress Core, WooCommerce, Yoast SEO, Rank Math, AIOSEO and SEOPress. SEO directives owned by an active SEO plugin are not replaced.

AI discovery access is controlled separately from model-training access. The optional llms.txt endpoint is only a fallback for sites without a supported SEO plugin or physical llms.txt file; it lists only published public content and does not replace normal sitemaps, structured data or high-quality page content.

Developer website: https://artimanweb.com/

== Installation ==

1. Upload the plugin ZIP from Plugins > Add New > Upload Plugin, or install it from the WordPress Plugin Directory.
2. Activate Artiman Guard.
3. Open Artiman Guard > Settings.
4. Select the forms to protect and choose Smart or Mathematical mode.
5. Test protected forms in a private browser window before enabling stricter rules.
6. Review suspicious activity under Artiman Guard > Security Center.

== Screenshots ==

1. Main protection settings with invisible proof-of-work, account-form coverage and emergency safe mode.
2. Smart Forms & Leads rules for external links, writing-system consistency, risk thresholds and the local review queue.
3. 404 Bot Shield & SEO Protection settings with scanner controls, crawl-budget safeguards and URL reports.

== Frequently Asked Questions ==

= Does the plugin contact an external CAPTCHA service? =

No. Challenge generation, proof-of-work verification, reports and rate limiting are processed locally on the WordPress site.

= Is the mathematical answer visible in the page source? =

No. The answer is stored server-side in a short-lived, one-time challenge record. The signed browser token does not contain the answer.

= How long are security reports stored? =

The administrator can choose from 7 to 90 days. Expired records are removed automatically.

= How can protection be disabled after an accidental lockout? =

Add this line to `wp-config.php`:

`define( 'ARTIMAN_GUARD_SAFE_MODE', true );`

Remove the line or change it to false after correcting the settings.

= Does it support WooCommerce? =

Yes. It protects WooCommerce customer login, registration and product-review forms.

= Does it support Elementor forms? =

Yes. With Elementor Pro active, add the Artiman Guard field to the form. Validation runs in Elementor's Ajax submission flow.

= Does it support Gravity Forms? =

Yes. Add the Artiman Guard field from Advanced Fields to each form that should be protected.

= Does comment protection work with wpDiscuz and other comment plugins? =

Yes, when the plugin submits comments through the standard WordPress comment API. WordPress comments and WooCommerce product reviews are inspected before they are stored. Custom systems that bypass the WordPress comment API must integrate with the `artiman_guard_analyze_submission` filter.

= How are links and languages handled in comments? =

Links to the current website and its subdomains are treated as internal. External links are blocked by default, while trusted external domains and the comment-author website check are configurable. Automatic language mode accepts Persian/Arabic script on Persian or Arabic sites and Latin script on English sites, while tolerating short mixed fragments such as product names. Administrators can select other writing systems or disable the check.

= Does it conflict with SEO plugins? =

Artiman Guard uses provider-aware integration. It works with WordPress Core, Yoast SEO and Rank Math robots output, and defers robots control to AIOSEO or SEOPress when either plugin is active. Redirect cleanup is conservative and disabled by default after upgrading.

== Privacy ==

Artiman Guard does not send visitor data outside the website. When local reports are enabled, it stores the form context, result, reason, risk score, time, salted technical identifiers, and the IP address for suspicious or blocked activity. Routine successful checks are not stored. Security reports and temporary blocks expire automatically. A permanent IP block remains until a manager releases it.

The plugin registers WordPress personal-data exporter and eraser callbacks for locally stored security data.

== Changelog ==

= 0.8.4 =

* Added separate AI search-discovery and model-training controls, explicit robots.txt groups and a conflict-safe fallback llms.txt public-content guide.
* Limited structured-form language checks to narrative fields so legitimate multilingual profile and assessment data is not blocked.
* Minified public and admin assets and load public challenge files only where a protected form is rendered.

* Added verified Cloudflare proxy detection using official network ranges and safe visitor-IP extraction.
* Added reverse and forward DNS verification for Googlebot and Bingbot before crawler exemptions are applied.
* Added route-family rate limiting for pagination and filter crawl traps.
* Aggregated repeated security events into 15-minute attack groups with hit counters.
* Added configurable row caps and batched cleanup for security, form and URL reports.
* Added a 14-day attack chart, 30-day comparison metrics, unique attack groups and unique suspicious-IP counts.
* Added false-positive accuracy reporting from administrator feedback.
* Added daily and 30-day email security summaries and actionable URL recommendations.
* Prevented automatic IP blocks or expired browser challenges from locking out a user with valid WordPress credentials.
* Preserved the clipped hidden-field layout that prevents horizontal overflow.

= 0.8.3 =

* Made automatic language protection strict by default: Persian and Arabic script on Persian or Arabic sites, and Latin script on English sites.
* Raised clear writing-system mismatches to a blocking risk score while tolerating short mixed fragments such as product names.
* Changed new-installation defaults so unexpected-language comments and comments with external links are blocked immediately.
* Kept global Elementor Pro content analysis before email actions, without requiring the dedicated Artiman Guard field.
* Preserved the clipped hidden-field layout introduced in 0.8.2 and added regression checks against off-screen horizontal overflow.

= 0.8.2 =

* Rendered WordPress login, registration and password-reset challenges directly so critical account access no longer depends on an AJAX request.
* Changed the dynamic challenge endpoint to a same-origin relative URL to avoid HTTP, HTTPS and www host mismatches.
* Restored form controls and logged a browser-console diagnostic when a dynamic challenge cannot be loaded.
* Replaced off-screen positioning with clipped accessible hiding to prevent large horizontal scrolling on RTL and mobile pages.
* Kept the mathematical fallback available while proof-of-work is running and avoided a zero-value proof-of-work edge case.

= 0.8.1 =

* Fixed the release package so the required content inspector is included and loaded correctly.

= 0.8.0 =

* Added internal and external link classification for WordPress comments, WooCommerce reviews, Elementor Pro Forms, Gravity Forms and compatible integrations.
* Added configurable handling for external links: moderation, spam or immediate blocking.
* Added trusted external-domain rules while keeping links to the current site and its subdomains safe.
* Added writing-system detection with automatic defaults based on the WordPress site language.
* Added custom Latin, Persian/Arabic, Cyrillic, Chinese, Japanese and Korean controls.
* Added configurable moderation, spam or blocking actions for clearly unexpected-language comments.
* Kept the optional comment-author website check disabled by default to reduce false positives.
* Applied existing repeated-abuse limits and managed IP blocking to the new content signals.

= 0.7.2 =

* Added provider-aware robots integration for WordPress, Yoast SEO and Rank Math.
* Deferred robots control to AIOSEO and SEOPress when either plugin is active.
* Added an allowlist for intentionally indexable WooCommerce filter URLs.
* Removed search and add-to-cart requests from generic crawl-trap classification.
* Limited automatic query cleanup to the WordPress `replytocom` parameter and made cleanup opt-in after upgrade.
* Prevented high-confidence search crawler agents from being blocked for ordinary repeated 404 requests.
* Excluded sitemap, robots and standard icon paths from ordinary 404 blocking.
* Avoided blocking legitimate singular content and archive-like routes with generic sensitive words.
* Limited no-cache handling to sensitive or blocked scanner traffic.
* Paused automatic IP blocking when forwarding headers arrive from an untrusted proxy.
* Fixed Elementor editor previews and trusted-administrator submissions when the field is marked as required.

= 0.7.1 =

* Added a shared abuse counter and automatic blocking for repeated form failures, suspicious submissions and 404 requests.
* Added a managed IP blocklist with release and permanent-block actions.
* Stopped storing routine successful checks.

= 0.7.0 =

* Added a shared decision engine and administrator feedback to reduce false positives.
* Added one-time registration permits and quarantine for unverified public user creation.
* Suppressed notifications and feeds for locally quarantined submissions.

For the complete release history, see `changelog.txt`.

== Upgrade Notice ==

= 0.8.4 =

Adds verified proxy and crawler handling, crawl-trap controls, compact reports and measurable security outcomes while preserving safe account access.

= 0.8.3 =

Strengthens default language and external-link blocking for comments, WooCommerce reviews and supported form builders without reintroducing horizontal overflow.

= 0.8.2 =

Prevents login lockouts caused by challenge-loading failures and removes horizontal overflow from hidden protection fields. Updating is strongly recommended.

= 0.8.1 =

Fixes the incomplete 0.8.0 release package. Updating is strongly recommended.

= 0.8.0 =

Adds configurable external-link and language protection for comments, WooCommerce reviews and supported form integrations. Review the new Smart Forms settings after updating.

= 0.7.2 =

Compatibility and false-positive improvements for SEO plugins, WooCommerce filters, trusted proxies and legitimate crawler traffic.
