Artiman Guard release history
=============================

0.8.7
-----
* Fixed IP-enforcement bypass through untrusted forwarding headers and wp-login.php text in unrelated query strings.
* Stopped trusting earlier X-Forwarded-For entries past the nearest untrusted hop, and protected unresolved shared proxies from automatic bans.
* Required successful deletion of a one-time challenge before verification can succeed; rejected malformed and overridden honeypots.
* Applied the issuance quota to server-rendered login challenges as well as the public AJAX endpoint.
* Added standard REST comment-creation challenge/content checks and prevented success-cache reuse across REST subrequests.
* Bound Elementor validation to the selected widget/field and grouped challenge failure limits by form system.
* Added configurable content-submission budgets independent of challenge correctness, with throttled rate-limit reports.
* Bounded content inspection to 64 KiB/256 nodes/4 nesting levels and stored report text to 16 KiB/64 inspected fields.
* Excluded challenge fields from content inspection and reports; detected unquoted HTML external links.
* Inspected array-valued Gravity Forms input and used the Elementor field-error API when rejecting content.
* Prevented User-Agent rotation from splitting otherwise identical security-report groups.
* Limited Google crawler exemptions to Googlebot/Google hostnames and normalized IPv6 comparison.
* Honored registration-firewall switches, reset expired failure lockouts, and restricted the Store API exception to the resolved checkout route.
* Skipped legacy migration/schema checks on normal requests and excluded password-protected posts from fallback llms.txt.

0.8.6
-----
* Require the displayed mathematical answer on every protected challenge, including when browser proof-of-work succeeds.
* Remove the valid-credentials shortcut that skipped the challenge on the WordPress login form.
* Reject malformed numeric answers instead of stripping unrelated characters before comparison.
* Clarify that browser proof-of-work is an additional risk signal, not a replacement for the visible challenge.
* Keep the mathematical question visible when browser proof-of-work completes; preserve the hidden honeypot overflow fix.

0.8.5
-----
* Added a Persian and English form setup guide inside the WordPress admin for Elementor Pro, Gravity Forms, comments, WooCommerce, Contact Form 7 and custom forms.
* Explained required fields, phone and email types, URL validation, logged-out testing and review-queue diagnosis.
* Hardened public challenge input handling and administrator settings against malformed array values.
* Bound the honeypot field name to the signed challenge to prevent request-side substitution.

0.8.4
-----
* Added secure automatic Cloudflare proxy recognition and verified visitor-IP extraction.
* Verify Googlebot and Bingbot with reverse and forward DNS before bypassing scanner limits.
* Added normalized route-family rate limiting for pagination and filter crawl traps.
* Aggregate repeated security events in 15-minute groups and retain exact hit totals.
* Added configurable row caps, batched cleanup, attack charts, 30-day comparisons and unique attack/IP metrics.
* Added feedback-based false-positive accuracy, daily and monthly summaries, and URL action recommendations.
* Valid WordPress credentials and interactive login requests cannot be trapped behind an automatic IP block.
* Preserved all language-filtering and horizontal-overflow fixes from 0.8.3.
* Added separate controls for AI search discovery and model-training crawlers without weakening sensitive-path protection.
* Added a conflict-safe fallback llms.txt guide for sites without a supported SEO plugin or physical file, plus explicit robots.txt AI access groups.
* Prevented legitimate multilingual names, cities, countries, occupations and choices in structured Elementor and Gravity Forms from triggering the language blocker.
* Stopped loading public challenge assets on pages without a protected form and switched public and admin assets to production-minified files.

0.8.3
-----
* Made automatic language protection strict by default: Persian and Arabic script on Persian or Arabic sites, and Latin script on English sites.
* Raised clear writing-system mismatches to a blocking risk score while tolerating short mixed fragments such as product names.
* Changed new-installation defaults so unexpected-language comments and comments with external links are blocked immediately.
* Kept global Elementor Pro content analysis before email actions, without requiring the dedicated Artiman Guard field.
* Preserved the clipped hidden-field layout introduced in 0.8.2 and added regression checks against off-screen horizontal overflow.

0.8.2
-----
* Rendered WordPress login, registration and password-reset challenges directly so critical account access no longer depends on an AJAX request.
* Changed the dynamic challenge endpoint to a same-origin relative URL to avoid HTTP, HTTPS and www host mismatches.
* Restored form controls and logged a browser-console diagnostic when a dynamic challenge cannot be loaded.
* Replaced off-screen positioning with clipped accessible hiding to prevent large horizontal scrolling on RTL and mobile pages.
* Kept the mathematical fallback available while proof-of-work is running and avoided a zero-value proof-of-work edge case.

0.8.1
-----
* Fixed the release package so the required content inspector is included and loaded correctly.

0.8.0
-----
* Added internal and external link classification for WordPress comments, WooCommerce reviews, Elementor Pro Forms, Gravity Forms and compatible integrations.
* Added configurable moderation, spam or blocking actions for external links and clearly unexpected writing systems.
* Added trusted external domains and site-language-aware script defaults.
* Kept the optional comment-author website check disabled by default to reduce false positives.
* Applied the existing repeated-abuse limits and managed IP blocklist to the new content signals.

0.7.2
-----
* Added provider-aware robots integration for WordPress, Yoast SEO and Rank Math.
* Deferred robots control to AIOSEO and SEOPress when either plugin is active.
* Added an allowlist for intentionally indexable WooCommerce filter URLs.
* Removed search and add-to-cart requests from generic crawl-trap classification.
* Limited automatic query cleanup to the WordPress replytocom parameter and made cleanup opt-in after upgrade.
* Prevented high-confidence search crawler agents from being blocked for ordinary repeated 404 requests.
* Excluded sitemap, robots and standard icon paths from ordinary 404 blocking.
* Avoided blocking legitimate singular content and archive-like routes with generic sensitive words.
* Limited no-cache handling to sensitive or blocked scanner traffic.
* Paused automatic IP blocking when forwarding headers arrive from an untrusted proxy.
* Fixed Elementor editor previews and trusted-administrator submissions when the field is marked as required.

0.7.1
-----
* Added a central IP abuse counter shared by form failures, suspicious submissions and 404 scanning.
* Added automatic temporary IP blocking for repeated ordinary 404 requests.
* Added a managed IP blocklist with release and permanent-block actions.
* Stopped storing routine successful security checks.

0.7.0
-----
* Added a shared decision engine with administrator feedback to reduce false positives.
* Added one-time registration permits for protected WordPress and WooCommerce registration paths.
* Added account quarantine and suppressed notifications for quarantined accounts and comments.
* Added a local feedback signal store with automatic cleanup.

0.6.4
-----
* Added compact settings groups and human-readable Security Center labels.
* Added filtering and pagination to the 404 and crawl-budget report.

0.6.3
-----
* Fixed the Persian translation catalog.
* Hardened visitor IP resolution behind trusted proxies.
* Batched report cleanup and skipped SEO inspection for non-front-end requests.

0.6.2
-----
* Added cache-safe dynamic challenge issuance.
* Enforced missing-challenge rejection on protected form routes.
* Improved SEO-plugin, redirect and trusted-proxy compatibility.

0.6.1
-----
* Restored and completed the bundled Persian translation.

0.6.0
-----
* Added Smart Forms and Leads Protection.
* Added 404 Bot Shield and SEO crawl protection.

0.5.1
-----
* Adopted the unique artigu_ internal prefix and migrated earlier data.
* Updated WordPress.org metadata.

0.5.0
-----
* Added the central Registration Firewall, spam-username rules and source monitoring.

0.4.2
-----
* Improved Elementor Pro and Gravity Forms field validation.

0.4.0
-----
* Added dedicated Elementor Pro Forms and Gravity Forms fields.

0.3.3
-----
* Added the required uninstall query annotation.

0.3.2
-----
* Improved Plugin Check compatibility for local event-table queries.

0.3.1
-----
* Added nonce verification, translator comments and Security Center hardening.

0.3.0
-----
* Added local proof-of-work, one-time challenges, local reports and safe mode.

0.2.0
-----
* Added WooCommerce and comment protection.

0.1.1
-----
* Added Persian translation and improved the administration layout.

0.1.0
-----
* Initial release.
