=== ClarityGuard ===
Contributors: RFDizon, freemius
Tags: security, scanner, vulnerability, ai, hardening
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.6.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scans your WordPress site for security issues and explains them in plain English — with one-click fixes on Pro.

== Description ==

Most security plugins tell you *that* something is wrong. ClarityGuard tells you what it means and what to do about it.

**Free features:**

* Outdated WordPress core / plugin detection
* Known-vulnerability lookup (optional, bring your own WPScan API token)
* File permission checks on key WordPress files/folders
* Publicly exposed file detection (debug logs, backup files, .env, etc.)
* Default "admin" username detection
* Weekly automated scan with an email summary
* Plain-English explanation and fix steps for every finding
* "Explain with AI" per finding and an AI-generated incident report, once you add your own API key (Anthropic, OpenAI, or Google Gemini's free tier) under AI Settings (fully optional -- everything else works with zero API keys)

**Pro:**

* One-click, reversible auto-remediation for safe fixes
* File-integrity checks: WordPress core and WordPress.org-hosted plugins are verified against official checksums, and other code is compared with your site's own recorded baseline
* "Triage with AI" for file-integrity findings, plus "Accept as new baseline" for legitimate edits to custom code

**Planned for Pro:** multi-site agency dashboard and scheduled AI risk-posture summaries.

== Installation ==

1. Upload the `clarityguard` folder to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress.
3. Go to "ClarityGuard" in the admin menu and click "Run Scan Now".

== Frequently Asked Questions ==

= Does this replace Wordfence/Sucuri? =

No — this is not a firewall or malware scanner replacement. It's a plain-English triage and remediation layer, and works well alongside a firewall plugin.

= Does the free version require any API keys? =

No. Every free-tier check runs entirely locally. The known-vulnerability lookup is optional and only runs if you add your own WPScan API token in settings.

== External services ==

This plugin can optionally connect to the following third-party services. The AI providers and WPScan are never contacted unless you explicitly enable the feature and provide your own API key/token. Every check in the free version runs locally on your site. The one exception is the WordPress.org checksum lookup used by the Pro file-integrity check, described last.

**Anthropic (Claude)** — used to generate the plain-English "Explain with AI" text and AI incident reports, if you choose Anthropic as your AI provider under AI Settings and supply your own API key. When you click "Explain with AI" or "Generate AI Incident Report," the relevant finding text (issue title, description, and site name) is sent to Anthropic's API to generate the explanation; no data is sent otherwise.
[Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) | [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy)

**OpenAI** — used the same way as Anthropic above, if you choose OpenAI as your AI provider under AI Settings and supply your own API key. The same finding text is sent to OpenAI's API only when you click "Explain with AI" or "Generate AI Incident Report."
[OpenAI Terms of Use](https://openai.com/policies/row-terms-of-use/) | [OpenAI Privacy Policy](https://openai.com/policies/row-privacy-policy/)

**Google Gemini** — used the same way as Anthropic and OpenAI above, if you choose Gemini as your AI provider under AI Settings and supply your own API key. The same finding text is sent to Google's Gemini API only when you click "Explain with AI" or "Generate AI Incident Report." Unless the site owner is located in the EU, UK, or EEA, Google may use free-tier API prompts to improve its models — see Google's terms for current details.
[Google APIs Terms of Service](https://developers.google.com/terms) | [Gemini API Additional Terms of Service](https://ai.google.dev/gemini-api/terms) | [Google Privacy Policy](https://policies.google.com/privacy)

**WPScan** — used for the optional known-vulnerability lookup, if you add your own WPScan API token under Settings. When enabled, this plugin sends the slugs of your active plugins to the WPScan API to check them against the WPScan vulnerability database; no other site data is sent.
[WPScan Terms of Service](https://wpscan.com/terms/) | [WPScan Privacy Policy](https://automattic.com/privacy/) (WPScan is an Automattic property)

**Pro only: AI triage of file-integrity findings** — when you click "Triage with AI" on a file-integrity finding, the finding text and the first part of that file's contents (up to about 4,000 characters) are sent to the AI provider you chose above, after a confirmation prompt. Nothing is sent unless you click it.

**WordPress.org (api.wordpress.org and downloads.wordpress.org)** — Pro only. During each scan, the file-integrity check requests the official checksum lists for your WordPress version and for your installed WordPress.org-hosted plugins, so it can tell whether any file differs from the official release. The request includes your WordPress version and locale, and each plugin's slug and version. No file contents are sent.
[WordPress.org Privacy Policy](https://wordpress.org/about/privacy/)

== Screenshots ==

1. The security report: findings grouped by severity, each with a one-click AI explanation and, on Pro, a one-click Auto-Fix button.
2. AI Settings: choose Anthropic, OpenAI, or Google Gemini (free tier available), paste your own API key, and use the built-in guide if you have never created one before.

== Changelog ==

= 0.6.0 =
* Pro: file-integrity checks. WordPress core and WordPress.org-hosted plugins are verified against official checksums on every scan; custom plugins, mu-plugins and theme edits are compared with a baseline recorded by your own site. Modified, missing and unexpected files are reported as findings.
* Pro: "Triage with AI" gives a SUSPICIOUS / LIKELY BENIGN / UNCERTAIN verdict with reasoning for a flagged file, and "Accept as new baseline" marks a legitimate edit to custom code as safe.
* New database table for file baselines, created automatically on update.
* Fixed: the outdated-plugins check could offer an update that needs a newer PHP or WordPress than the site runs, and Auto-Fix would install it, leaving the plugin unable to activate. Such updates are now reported with a clear explanation and no Auto-Fix button, and Auto-Fix refuses them as well.
* Rewrote the remaining custom-table queries so every $wpdb->prepare() call sits directly inside its query call, and prefixed the report page's template variables.
* Readme: moved misplaced changelog entries into the Changelog section and corrected the Pro feature list.

= 0.5.6 =
* Added Google Gemini as a third AI provider option alongside Anthropic and OpenAI. Gemini has a genuinely free tier via Google AI Studio (no payment method required), giving free-tier users a no-cost path to "Explain with AI" and AI incident reports.

= 0.5.5 =
* Fixed: the outdated-plugins check could keep reporting "no findings" even when updates were genuinely available, because it relied on WordPress core's own throttled update check (wp_update_plugins()), which silently reuses whatever it found on its last run for up to 12 hours -- including a stale empty result. "Run Scan Now" now forces a fresh check every time via delete_site_transient('update_plugins') before checking, so results are always live.

= 0.5.4 =
* All custom-table SQL now uses $wpdb->prepare()'s %i identifier placeholder for table names instead of interpolating them directly into the query string, closing several PreparedSQL findings from an automated Plugin Check scan. Raised "Requires at least" to WP 6.2, since %i requires it.
* No user-facing change.

= 0.5.3 =
* Renamed all internal identifiers (classes, functions, options, database tables, AJAX actions) from the CG_/cg_ prefix to CGARD_/cgard_, to meet the WordPress.org four-character-minimum prefix guideline. No user-facing change.
* Auto-remediation ("Auto-Fix"/"Undo") is now packaged as Pro-only code that is not included in the free version at all, rather than being included but disabled by a license check, per WordPress.org's guidelines on locked functionality. Free-tier scanning, AI explanations, and reports are unaffected.
* Documented all third-party services (Anthropic, OpenAI, WPScan) this plugin can optionally connect to, including what data is sent and links to each provider's terms and privacy policy.
* Removed a few unnecessary WordPress core file includes and a hardcoded wp-content path assumption; removed the now-unnecessary load_plugin_textdomain() call (translations are loaded automatically for WordPress.org-hosted plugins since WP 4.6).

= 0.5.2 =
* Moved uninstall cleanup (dropping plugin tables, deleting options) from a standalone uninstall.php into Freemius's after_uninstall hook, per their deployment requirements. No user-facing change.

= 0.5.1 =
* Fixed leftover "Security Copilot" text from the pre-rename plugin name still showing in the admin menu and two AI-provider error messages.
* Live-verified real Freemius licensing end to end: opt-in, license activation, and Auto-Fix correctly unlocking on Pro.

= 0.5.0 =
* Added Freemius licensing integration scaffold: CG_License::is_pro() now checks a live Freemius license first (once the SDK is installed and configured — see FREEMIUS-SETUP.md), falling back to the existing developer constant / filter seam so nothing changes for sites that don't have it configured yet.
* No visible changes for existing installs until Freemius credentials are added; this lays the groundwork for real Pro purchases/renewals instead of the CG_FORCE_PRO developer-only override.

= 0.4.0 =
* Added one-click Auto-Fix for safe, narrowly-scoped findings: file permission fixes (fully reversible via an Undo button), deleting known-safe exposed files (stock readme.html, debug.log), and plugin auto-updates.
* Every applied fix is written to an audit log (new cg_fix_log table) with before/after state, whether or not it's revertible.
* Deliberately left unfixable from here: the default-admin-username finding, core version updates, and CVE findings, plus .env / wp-config.php.bak (too risky to auto-delete something that might be the only copy of a needed secret/backup).

= 0.3.0 =
* AI layer is now provider-agnostic: choose Anthropic (Claude) or OpenAI on the AI Settings page. Existing v0.2.0 Anthropic keys keep working automatically.

= 0.2.0 =
* Added optional AI layer: per-finding "Explain with AI" and a one-click AI-generated incident report, backed by the Anthropic Messages API.
* New AI Settings page for the API key/model (or define CG_AI_API_KEY in wp-config.php to keep it out of the database).
* AI responses are cached (30 days) per finding/report so repeat views don't re-spend API calls.

= 0.1.0 =
* Initial MVP: core scanner, five checks, admin report page, weekly email summary.
