=== CyberPulse — Advanced Security & Bot Protection ===
Contributors: gataurus
Tags: security, firewall, bot-protection, ip-blocking, brute-force
Requires at least: 5.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 5.9.1.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Changelog URI: https://wordpress.org/plugins/cyberpulse/#developers

🛡️ Real-time security firewall with IP blocking. Blocks bots, brute force attacks, XSS, and AI scrapers. 10 languages, lightweight, no ads.

== Description ==

🛡️ CyberPulse (Cyber Pulse) is a powerful security firewall with IP blocking and whitelist that protects your website 24/7.

Every request is analyzed in real time. Bots, scanners, and attackers are blocked instantly — before they reach your site. The plugin detects suspicious behavior, blocks AI data collectors like GPTBot and ClaudeBot, and stops brute force attacks with automatic IP bans.

**Why Choose Cyber Pulse:**

* ⚡ **Real-Time Protection** — monitors every request and blocks threats instantly
* 🍃 **Lightweight & Fast** — no database load, logs stored in files with automatic cleanup
* 🌍 **10 Languages** — Russian, English, German, French, Italian, Spanish, Portuguese, Chinese, Japanese, Korean
* 🚀 **Easy to Use** — install and protect your site in under a minute
* 🚫 **No Ads** — clean interface, no upsells in your admin panel
* 🔗 **Works with Caching** — compatible with WP Rocket, W3 Total Cache, LiteSpeed Cache, and CDN services

**Protection Features:**

* 🤖 AI Scraping Protection — blocks GPTBot, ClaudeBot, PerplexityBot, CCBot, and other AI data collectors
* 🛡️ Server-level `.htaccess` protection — optional (opt-in) blocking of sensitive files and AI bots directly at the Apache/LiteSpeed level
* 🔍 Multi-layer bot detection (20+ independent checks: User-Agent, HTTP headers, Referer, Accept-Language, behavioral analysis, and more)
* 🔐 Brute force protection — automatic permanent /24 subnet ban after exceeding attempt limit
* 🌍 IP Management — block IPs, subnets (/24), whitelist trusted addresses, detect visitor country by IP
* 📁 WordPress system files hiding — blocks access to wp-config.php, .env, .git, and other sensitive files
* ⏱️ Rate Limiting — configurable request limits to prevent DDoS and aggressive scraping
* ✅ IP Whitelist — manual and automatic (server IP, search engines, administrator IPs)
* 🔒 Force HTTPS redirect — automatic 301 redirect from HTTP to HTTPS with proxy-loop protection
* 🛡️ XSS attack protection — blocks cross-site scripting in requests
* 🔎 404 scanner detection — blocks vulnerability scanners by excessive 404 errors
* 🔒 URL Firewall — manual path blocking for specific endpoints
* 👤 User-Agent blacklist with statistics — block specific bots by User-Agent
* 🔗 Referer verification — blocks suspicious requests without proper Referer header
* 📊 Security score dashboard — hourly attack histogram, fix recommendations
* 📧 Email alerts on attack spikes
* 📝 Event audit log — track logins, settings changes, and plugin activity
* 🎨 Dark & Light theme for admin panel

== Installation ==

1. Go to **Plugins → Add New** in your WordPress admin
2. Search for "CyberPulse"
3. Click **Install Now** and then **Activate**
4. Navigate to **CyberPulse** in the admin menu
5. ✅ Your site is protected — default settings provide optimal security

== Frequently Asked Questions ==

= 🔍 What is CyberPulse? =

CyberPulse (also written as Cyber Pulse) is a powerful security firewall for WordPress that protects your site from bots, scanners, and brute force attacks in real time.

= 🌍 How does IP blocking work? =

CyberPulse automatically detects visitor IP addresses, checks them against known malicious IP databases, and blocks suspicious IPs or entire /24 subnets permanently. You can also manually block IPs, subnets (CIDR), and whitelist trusted IP addresses.

= 🔍 How does bot detection work? =

CyberPulse analyzes 20+ parameters of every request: User-Agent, HTTP headers, Accept-Language, Referer, browser headers (Sec-Fetch-*), behavioral patterns, and more. Suspicious requests are blocked automatically with temporary or permanent IP bans.

= ⚡ Does it slow down my site? =

No. CyberPulse is designed to be lightweight. All checks use efficient caching, and logs are stored in files — not in the database. It works smoothly with high-traffic sites.

= 🔗 Is it compatible with caching and CDN services? =

Yes. Cyber Pulse works with WP Rocket, W3 Total Cache, LiteSpeed Cache, Cloudflare, and other CDN and caching solutions. Real visitor IPs are correctly detected via proxy headers.

= 🔎 Will it block search engines? =

No. Google, Bing, Yandex, Baidu, DuckDuckGo, and other legitimate search bots are automatically detected and whitelisted by IP subnet and User-Agent signature.

= ✅ Can I whitelist my IP or specific services? =

Yes. You can whitelist IPs, subnets (CIDR), hostnames, User-Agent patterns, and specific URL paths. Administrators are automatically whitelisted on login.

= 🔐 How does brute force protection work? =

When failed login attempts exceed the limit (default: 5 attempts in 15 minutes), the entire /24 subnet is permanently blocked. No temporary bans — attackers go straight to permanent block.

= 🤖 Does it protect against AI scraping? =

Yes. Cyber Pulse blocks known AI training bots: GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot, CCBot (Common Crawl), and others. AI scrapers are detected by User-Agent and IP signatures. For maximum performance, you can optionally enable `.htaccess` protection to block them before PHP even loads.

= ⭐ How is this different from other security plugins? =

CyberPulse offers AI scraping protection, 10 languages out of the box, a real-time dashboard with hourly attack histogram, and a clean interface with no ads or upsells. It's lightweight and stores logs in files — not in your database.

= 🛡️ Is there a PRO version? =

Yes. PRO adds 2FA authentication, geo-blocking (195 countries), DDoS protection, malware scanner, content copy protection, file integrity monitoring, and more. [Learn more](https://cyberpulse-security.com/)

== Screenshots ==

1. 📊 Main dashboard with real-time statistics and hourly histogram
2. 🛡️ Security score assessment with fix recommendations
3. 🚫 Blocked bots log with detailed analysis
4. 📁 Page tracking and traffic analytics
5. ✅ Whitelist management panel
6. ⚙️ Security settings with multiple bot detection options

== Changelog ==

= 5.9.1.3 =
* ⚡ Performance: Lowered the default Rate Limiting threshold from 60 to 40 requests per minute. Added a smart collapsible guide in the UI to help users choose the right value (with CGNAT and mobile carrier warnings).
* 🛡️ Custom Static 403 Page: When .htaccess protection blocks a bot, it now displays a beautifully styled cyberpulse-403.html page instead of the hosting provider's default error page.
* 🔧 Better UX: Replaced the "Back to Home" button with a "Refresh Page" button on the static block page, which is more useful for temporary blocks.
* 🔒 New Free Feature: Force HTTPS 301 redirect with proxy-loop protection, full-width UI, and translations for all 10 supported languages.

= 5.9.1.2 =
* 🤖 AI bot protection is now configurable. Added two independent toggles so you control exactly what gets blocked.
* 🧠 AI Training Bots (default ON) — blocks GPTBot, CCBot, Google-Extended, ClaudeBot, Bytespider, Amazonbot, etc. They only download your content and never show your site to users.
* 🔍 AI Search Bots (default OFF) — blocks OAI-SearchBot, ChatGPT-User, PerplexityBot, Claude-User, Amzn-SearchBot, etc. They index your site for AI search engines. Enable this if you want the old strict behavior.
* 🆕 Expanded signature database — added new AI bots: DuckAssistBot (DuckDuckGo), Amzn-User (Amazon), Grok-DeepSearch (xAI), QwenBot (Alibaba), DeepSeekBot, xAI-Crawler, and cohere-training-data-crawler.
* 🛡️ New server-aware .htaccess panel: shows "Recommended: ON" on Apache/LiteSpeed with a writable file, warns clearly on nginx or read-only setups, and disables the checkbox when the feature cannot work.

= 5.9.1.1 =
* 🔒 Security: User-Agent validation rewritten — hardcoded Chrome version threshold replaced with behavioural verification (Sec-Fetch-*, Client Hints, Accept-Language). 
* 🤖 Bot Detection: Added WebView whitelist (Instagram, Facebook, TikTok, Telegram, Snapchat, Pinterest, LinkedIn, WeChat, LINE, KakaoTalk, Viber, Twitter) to prevent false positives on mobile in-app browsers.
* ⚡ Reliability: Temporary blocks now survive `alloptions` cache invalidation — fixes rare cases where a blocked IP was allowed again within seconds.

= 5.9.1.0 =
* 🔒 Security: AI scraper check now runs first, before the human-test window. Bots that pass the captcha once are still checked against AI signatures on every subsequent request. Admin IPs remain exempt.
* 🔒 Security: Request flood protection now issues temporary blocks for heuristic evidence (traffic spike, datacenter IP) and reserves permanent subnet bans for repeat offenders only — reduces false positives without weakening the protection.
* 🔒 Reliability: Server IP is now re-validated every 24 hours instead of being cached indefinitely. A hosting migration or proxy change is picked up automatically, and private/reserved addresses from reverse-proxy setups are rejected at every step.
* ⚡ Performance: Radically optimized admin panel loading by eliminating blocking GeoIP requests, implementing smart log reading (200KB) with a 1000-row display limit to prevent UI freezing (full files are still processed during download/copy).
* ⚡ Performance: Log writes are now **~50× faster** on busy sites, with ~5× lower memory use during rotation. Leftover `.log.1` files from older versions are cleaned up automatically.

= 5.9.0.9 =
* 🔒 Security & Feature: `.htaccess` protection is now **opt-in** (disabled by default) and managed via a new "AI Scraping Protection" settings block. The ruleset was also extended to block `.git`, `.env`, `.sql` dumps, and other sensitive files before PHP loads.
* 🤖 Bot Detection: Unified and expanded detection logic — added 12 new AI bot signatures (Claude-User, xAI-Grok, etc.) and implemented Mac+Chrome antidetect checks to catch residential proxy bot farms. Also blocked fake GPTBot/ClaudeBot impersonation and scrapers masquerading as mobile apps (TikTokSpider, InstagramScraper).
* 🎨 UI: Brute Force panel now displays the full history of login attempts (active and inactive) with clear limit indicators.

= 5.9.0.8 =
* 🚀 Major Performance Boost: Complete dashboard overhaul — log files are now read only once, and CSS rendering optimizations allow you to smoothly view thousands of log rows without any lag.
* ⚡ Backend Optimization: Restored object caching for threat levels, top offenders, and UA statistics. Rate limiting is now working properly, and background tasks are safely throttled.
* 🎨 Interactive Dashboard: All cards (KPI and Pulse) are now clickable with smooth-scroll navigation to relevant sections. Added informative tooltips and replaced confusing percentages with clear numerical differences.

= 5.9.0.7 =
* 🔒 Search engine protection: Google, Yandex, Bing, Baidu, Apple, Meta, Telegram, Twitter, and Cloudflare subnets bypass permaban
* 🔒 Automated cleanup of search engine subnets from permanent block list
* 🔒 Instant-pass whitelist for verified search bots
* 🔒 Fake-UA guard: search bots with "Chrome/<digits>" in User-Agent fall back to regular checks
* 🔒 Subnet size guard: permaban skips subnets wider than /16 (IPv4) or /32 (IPv6)
* ⚡ Rate limiting and 404 detection skip verified search engine bots
* ⚡ Performance: merged whitelist checks into a single compact sanity check
* ✅ New helpers: cybersec_is_search_engine_subnet(), cybersec_purge_search_engine_subnets_from_permaban()
* 🎨 Complete UI redesign — cleaner, more professional interface across all admin tabs
* 🎨 New light theme "CyberPulse Daylight" — warm green palette, brand grid pattern, saturated accent, chunky shadows

= 5.9.0.6 =
* 🔒 Security: Fixed brute force protection bypass via `_wpnonce` parameter
* 🔒 Security: Fixed privilege escalation via whitelist `note` field — admin IPs now use explicit `auto_type` marker
* 🐛 Fixed: XSS check on AJAX human verification now reads raw request data
* 🐛 Fixed: Chrome parsers with fixed old builds now blocked
* ✅ Added: Extended bot UA blacklist (CVE-validators, unknown crawlers, NetAPI)
* ⚡ Performance: Cached `cybersec_check_ai_scraper()` result within single request
* 🧹 Cleanup: Activated `cybersec_sync_page_logs_stats()` — page counters now auto-refresh every 5 min

= 5.9.0.5 =
* ✅ Added: Extended whitelist for search engines and monitoring services
* ✅ Added: Extended Yandex subnet list
* ✅ Added: Extended SQL injection patterns and audit logging
* 🔒 Security: Improved bot detection integration

= 5.9.0.4 =
* 🐛 Fixed: 403 block page styles not loading
* ⚡ Added: pulsing glow animation on 403 page icon

= 5.9.0.3 =
* 🔒 Added: permaban check to hide_wordpress, hide_plugins_themes, rate_limiting, 404_detection, url_firewall
* 🔒 Added: permaban check to cybersec_check_all before all blocking checks
* ⚡ Added: static file exclusion in hide_wordpress (CSS, JS, images no longer trigger hide_wp checks)
* 🔧 Fixed: Server IP retrieval (cybersec_get_server_ip) — proper wp_unslash + sanitize
* 🐛 Fixed: Duplicate logging — added dedup window in cybersec_log_blocked_bot
* 🐛 Fixed: Scanner logging spam — added deduplication for repeated identical log entries

= 5.9.0.2 =
* ⚡ Performance: Optimized cybersec_is_real_browser() — reduced from 120+ stripos() calls to 3-4 preg_match() operations (95% faster)
* ⚡ Performance: Optimized cybersec_is_legitimate_bot() — reduced from 60+ operations to 5-10 (85% faster)
* 🚀 Added PTR (reverse DNS) verification for legitimate bots (Googlebot, Bingbot, Yandex, etc.)
* 🔒 Security: Added permanent block for system file access attempts (wp-config.php, .env, .git, etc.)

= 5.9.0.1 =
* 🔧 Fixed: Counter mismatch between statistics and log files (hotfix)
* 🔧 Fixed: Statistics cache causing stale data (removed cache)
* 🔧 Fixed: Duplicate entries in blocked/allowed logs (60-second dedup)
* 🔧 Fixed: Tracked pages showing nested subpages (exact match only)
* 🔧 Fixed: Internal/private IPs shown in logs

= 5.9.0.0 =
* 🔧 Fixed: Counter mismatch between statistics and log files
* 🔧 Fixed: Statistics cache causing stale data (removed cache, count directly from files)
* 🔧 Fixed: Duplicate entries in blocked/allowed logs
* 🔧 Fixed: Internal/private IPs shown in logs (10.x.x.x, 172.16.x.x, 192.168.x.x, 100.64.x.x)
* ⚡ Improved: Dashboard order (Security Score → Allowed → Blocked → Page Tracking → Event Log)
* ⚡ Improved: Direct file counting for accurate statistics

= 5.8.9.9 =
* 🔒 Security: Fixed XSS vulnerabilities in 403 block page (replaced esc_url with esc_js for JavaScript context)
* 🔒 Security: Added strip_tags() before htmlspecialchars() in XSS detection to prevent stored XSS attacks
* 🔒 Security: Fixed SQL injection vulnerability in stale transients cleanup query
* 🔒 Security: Added current_user_can('manage_options') check to cybersec_handle_simple_check()
* 🔒 Security: Added IP validation in cybersec_ajax_human_verify() AJAX handler
* 🔒 Security: Added sanitize_text_field() for User-Agent in track_user_agent() function
* 🔒 Security: Fixed cookie removal logic in cybersec_remove_all_blocks()
* ⚡ Performance: Added throttling to cybersec_cleanup_expired_temp_blocks() (5 min cooldown)
* 🔧 Fixed: Proper variable naming in cybersec_cleanup_stale_transients() foreach loop
* 🐛 Fixed: Potential memory issue in cybersec_fs_put_contents() with large log files

= 5.8.9.8 =
* 🔒 Security fix: Added XSS protection with input sanitization and esc_url_raw
* 🛡️ Fixed 403 page bugs: increased token lifetime, IP validation
* 🚀 Performance optimization: added wp_cache for settings and whitelist
* 🔧 Fixed cron schedule error: registered cyberpulse_every_5_minutes
* 🧹 Added directory traversal protection in log functions
* ✅ Added nonce verification in AJAX human-verify handler
* 🔄 Full data cleanup on IP unblock (cookies, cache, transients)

= 5.8.9.7 =
* 🚀 Performance optimization: Added Object Cache support for 15+ functions (whitelist, offenders, threat level, UA stats, and more)
* 🛡️ Security enhancement: Removed browser header bypass in request checks, improved XSS validation for all users
* ⚡ Improved bot detection: Expanded real browser detection with 50+ UA patterns (VK, Telegram, WhatsApp, Instagram, and more)
* 🔧 Optimized log rotation with safe truncation to prevent file corruption
* 🧹 Enhanced transient cleanup with lower DB load
* 🌐 Added caching for geo-location lookups (ip-api.com)
* 📈 Security test now validates 20+ protection features

= 5.8.9 =
* 🌍 Added translation files for 10 languages
* 🔗 Updated PRO website link
* 🛠️ Fixed SQL compatibility with MariaDB

= 5.8.6 =
* 🚀 Initial release with AI scraping protection, bot detection, brute force defense, and more

== External Services ==

This plugin connects to external services to provide specific functionality.

**🌍 IP Geolocation**
* Service: ip-api.com
* Purpose: Determines visitor country for statistics
* Data sent: Visitor IP address
* When: On each page visit from non-whitelisted IP
* Terms of Service: https://ip-api.com/docs/legal
* Privacy Policy: https://ip-api.com/docs/legal

**🖥️ Server IP Detection**
* Service: https://www.ipify.org/
* Purpose: Detects the server's public IP address
* Data sent: None (only receives IP)
* When: Once on plugin activation, then cached for 24 hours

**🔒 Threat Intelligence**
* Service: blocklist.de, abuse.ch (FeodoTracker), Tor Project
* Purpose: Checks visitor IPs against known malicious IP databases
* Data sent: None (downloads threat lists locally)
* When: Periodically (cached for 24 hours)
* blocklist.de: https://www.blocklist.de/en/impressum.html
* abuse.ch: https://abuse.ch/
* Tor Project: https://www.torproject.org/about/trademark/

**🔄 WordPress.org API**
* Service: api.wordpress.org
* Purpose: Checks for WordPress core updates (security score feature)
* Data sent: None (standard WordPress update check)
* When: On security score calculation
* Privacy Policy: https://wordpress.org/about/privacy/

== Source Code ==

The original unminified developer source code is available inside the plugin package (in the .zip archive) or via the WordPress.org SVN repository.