=== Atikur Security and Risk Monitor ===
Contributors: atikur20
Tags: security, plugin monitoring, plugin health, maintenance, risk
Requires at least: 5.0
Tested up to: 6.9.4
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Quickly review plugin update freshness, compatibility signals, and simple risk scoring in one dashboard.

== Description ==

**Atikur Security and Risk Monitor** gives you a clear overview of the health and risk profile of installed plugins.

It focuses on **update freshness, WordPress compatibility, maintenance signals, and simple risk scoring**, so you can quickly see which plugins may need attention.

No external accounts or paid services are required.

=== Key features ===

* **Security Debt Indicator (summary)**
  - Shows how many plugins are high-risk, likely abandoned on WordPress.org, or not marked as tested with your current WordPress version.
  - Gives an overall plugin risk level: Low / Moderate / High.

* **Per-plugin health overview**
  - Last updated date when official WordPress.org metadata is available.
  - Relative age of updates such as "3 months ago".
  - "Tested up to" and compatibility notes with your current WordPress version.
  - Basic risk score (0-100) based mainly on update recency.

* **Maintenance signals**
  - Quick indicator for compatibility and WordPress.org maintenance status.
  - Clear labeling when a plugin does not have official WordPress.org metadata.

This plugin uses:

* WordPress core plugin data (`get_plugins()`), and
* the official WordPress.org plugin information API (`plugins_api()`) when a matching WordPress.org plugin slug can be determined.

It does **not** perform malware scanning or vulnerability database lookups.

== Installation ==

1. Upload the `atikur-security-and-risk-monitor` folder to the `/wp-content/plugins/` directory, or install via the WordPress plugin installer by uploading the ZIP file.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **Plugins > Security and Risk Monitor** to review your installed plugins.

== Frequently Asked Questions ==

= Does this plugin change how plugins are updated? =

No. It only displays plugin metadata and does not modify update behavior.

= Does this plugin connect to any external APIs? =

Yes. When possible, it requests plugin metadata from the official WordPress.org plugin information API.

= Does it scan for malware or vulnerabilities? =

No. It does not perform code scanning or vulnerability scanning.

Instead, it focuses on **update recency, compatibility, and maintenance signals**.

= How are non-WordPress.org plugins handled? =

If a plugin cannot be matched to official WordPress.org metadata, the dashboard labels it clearly and avoids treating missing metadata as proof that the plugin is abandoned.


== Changelog ==

= 1.0.1 =
* Initial release.

