=== Iron Security – WordPress Security Plugin ===
Contributors: wpiron
Donate link: https://wpiron.com
Tags: security, firewall, malware, login, 2fa
Requires at least: 4.7
Tested up to: 6.8
Stable tag: 2.5.3
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Hardening tool that blocks hackers and protect against: Brute Force Attacks, Exploits, Injections, Clickjacking and other important functionalities.

== Description ==

**Iron Security** is your WordPress security bodyguard.

It shields your site from brute force attacks, unauthorized admin access, file injections, and common exploits like XML-RPC and REST API abuse. Whether you're a solo creator or managing client sites, Iron Security delivers essential protection without the performance hit.

🔒 **Don’t wait until your site is compromised. Secure it now — effortlessly.**

Iron Security includes real-time brute-force protection, custom login URLs, HTTP headers, session control, malware upload prevention, and much more. All from a single, easy-to-use plugin dashboard.

**Protects Against:**
- 🔐 Brute Force Attacks (Limit login attempts, 2FA)
- 👮 Unauthorized Admin Access (Custom login URL, admin limit)
- 👤 User Enumeration
- 🎯 Admin Account Targeting (Admin ID & username protection)
- 💣 XML-RPC & REST API Exploits
- 🛡️ Code Injection & PHP Malware Uploads
- 📂 Direct Access to Sensitive Files
- 📛 MIME Sniffing & Content-Type Exploits
- 🖼️ Clickjacking
- 🧬 Cross-Site Scripting (XSS)
- 🌐 Referrer Leakage

== 🔐 Key Features ==

### 🛠 General Hardening
- Disable XML-RPC & REST API
- Hide WordPress & WooCommerce versions
- Block AI & scraping bots
- Disable file editor
- Enable plugin & core auto-updates

### 🔍 Security Logs
- View detailed logs of login attempts and alerts
- Filter logs by IP, message, or date
- Audit suspicious activity easily

### 🔑 Login & Authentication
- Custom login/admin URL
- Limit login attempts with lockouts
- Session timeout for idle users
- Limit number of administrators
- Block user enumeration
- Change default Admin ID and Username
- Enable 2FA (Google Authenticator)

### 🗂 Files & Directory Protection
- Block PHP file uploads
- Prevent direct access to core/system files

### 📦 HTTP Security Headers
- X-Content-Type-Options
- X-Frame-Options
- X-XSS-Protection
- Strict-Transport-Security
- Referrer-Policy
- Content-Security-Policy
- Permissions-Policy


---

> Iron Security is built for creators who care about speed, simplicity, and security. If you're not securing your site, you're risking everything.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/iron-security` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to the **Iron Security** menu in the admin dashboard to configure your settings.

== Frequently Asked Questions ==

= What makes Iron Security different from other WordPress security plugins? =
Iron Security is lightweight, fast, and focused on the most effective hardening techniques. Instead of bloated features, it delivers practical tools that directly protect your WordPress site from real threats.

= Is Iron Security suitable for beginners? =
Absolutely. Iron Security features an intuitive dashboard with clear explanations for each setting. Whether you’re new to WordPress or a seasoned developer, you’ll find it easy to set up and use.

= How does changing the login URL protect my site? =
By replacing the default /wp-admin or /wp-login.php URLs, you reduce the risk of automated brute force attacks. Bots and attackers can’t easily locate your login page, adding an extra layer of protection.

= What happens if someone exceeds the allowed login attempts? =
Their IP will be temporarily blocked based on your configured settings. You can set how many failed attempts are allowed, how long the lockout lasts, and monitor the attempt logs directly from the plugin dashboard.

= How does Admin ID protection work? =
WordPress assigns the first admin user an ID of 1 — a known target for attacks. Iron Security helps you avoid this by allowing you to assign a different user ID to your admin account, reducing exposure to targeted exploits.

= Can Iron Security block XML-RPC and REST API access? =
Yes. These features can be optionally disabled. XML-RPC and REST API are common targets for attacks like brute force or user data enumeration. If you don’t use them, disabling them can significantly reduce your attack surface.

= What are HTTP security headers, and why should I enable them? =
HTTP security headers such as X-Frame-Options, Content-Security-Policy, and Strict-Transport-Security enhance browser-level security. They help protect your site against XSS, clickjacking, and other injection-based attacks. Iron Security lets you enable these headers with just a few clicks.

= Will Iron Security slow down my website? =
No. Iron Security is performance-focused and doesn't include heavy scans or background processes. It’s designed to secure your site without impacting loading speed or user experience.

= Is Iron Security compatible with WooCommerce? =
Yes, Iron Security works seamlessly with WooCommerce. It protects your admin area, login forms, and critical files without interfering with your store's functionality or customer experience.

= How can I get support or report a bug? =
You can reach out via the WordPress.org support forum: https://wordpress.org/support/plugin/iron-security/ or contact our team directly at https://wpiron.com.

= How often is Iron Security updated? =
We actively maintain Iron Security to ensure compatibility with the latest WordPress releases. Expect regular updates with new features, security improvements, and bug fixes.

= What is the benefit of disabling file editing in WordPress? =
Disabling the file editor in the admin panel prevents attackers from injecting malicious code directly into theme or plugin files if they gain admin access.

= What kind of logs does Iron Security provide? =
Iron Security includes a dedicated Security Logs panel where you can view all failed login attempts, successful authentications, and warning-level events. You can filter logs by IP, date, or message content. This helps identify brute force attempts, unauthorized access, and unusual behavior. You can also delete specific logs or clear them entirely.

= What does hiding the WordPress version do? =
Iron Security removes the WordPress version from your website’s source code to reduce the risk of automated attacks targeting specific versions with known vulnerabilities.

= How does Iron Security block AI crawlers? =
The plugin adds specific rules to your robots.txt file to block AI and data scraping bots, helping protect your content from unauthorized use and training.

= What does "Limit number of administrators" mean? =
Limiting admin users helps reduce the number of high-privilege accounts on your site. The plugin notifies you if more than one admin account exists, encouraging better access control and role management.

= How does session timeout protect my site? =
If a logged-in user is inactive for a certain period, they are automatically logged out. This prevents unauthorized access from unattended sessions on shared or public devices.

= Can I block user enumeration? =
Yes. Iron Security prevents bots from discovering usernames through the `?author=` query parameter, a common tactic used in brute force and targeted attacks.

= What does “Change default admin username” do? =
If your admin account uses "admin" as the username, it becomes an easy target. Iron Security helps you safely change this default to something unique and secure.

= What does "Prevent direct file access" mean? =
The plugin restricts access to sensitive files like PHP templates and system files that should not be accessed directly, protecting your site from unauthorized requests.

= Can I block PHP file uploads? =
Yes. Iron Security allows you to block PHP file uploads in forms and media to prevent malicious scripts from being uploaded to your site.

= What are plugin and core auto-updates, and why enable them? =
Keeping your WordPress core and plugins updated is critical to staying secure. Iron Security allows you to enable automatic updates, so your site is always protected with the latest patches.

== Screenshots ==

1. screenshot-1.png
2. screenshot-2.png
3. screenshot-3.png
4. screenshot-4.png
5. screenshot-5.png
6. screenshot-6.png
7. screenshot-7.png

== Changelog ==

= 2.5.3 - 2025-07-23 =
* Fixed Auto-updates functionality

= 2.5.2 =
* Fixed Auto-update plugins issues

= 2.5.1 =
* Fixed disabling Files editing functionality

= 2.5.0 =
* Fixed errors + renewed the scripts

= 2.4.6 =
* Remove freemius scripts

= 2.4.5 =
* FIxed COntact form 7 issue with rest API
* Added endpoints for restriction for Rest API (temporary)
* Added whitelisted endpoints for Rest API
* Planning to do UI for advanced Rest Api changes

= 2.4.4 =
* Added notification for the ones who have bellow v2.4

= 2.4.3 =
* Added notification for the ones who have bellow v2.4

= 2.4.2 =
* Fix uploading files issue

= 2.4.1 =
* Fix missing parts for the versioning

= 2.4.0 =
* Improved UI part with faster moving between tabs
* Lighter code and better UX navigating between tabs
* Added 2FA and improved performance in the admin UI — highly recommended update.

= 2.3.11 =
* Improve readme

= 2.3.10 =
* Improve readme

= 2.3.9 =
* Added translations

= 2.3.8 =
* Added translations

= 2.3.7 =
* Added Freemius opt-in integration

= 2.3.6 =
* Improved login brute-force protection
* Improved security logs – now deletable

= 2.3.5 =
* Fixed saving issue with security headers

= 2.3.4 =
* Plugin update for latest WordPress compatibility

= 2.3.3 =
* Added functionality to change default admin username

= 2.3.2 =
* Fixed Gutenberg block disabling issue

= 2.3.1 =
* Removed broken AI crawler notification

= 2.3.0 =
* Updated package dependencies
* Fixed React library error
* Fixed settings syncing issue in dashboard tabs

= 2.2.9 =
* Fixed warnings and small errors

= 2.2.8 =
* Minor improvements

= 2.2.7 =
* Fixed IP spoofing vulnerability
* Added user lockout feature for login limits

= 2.2.6 =
* Fixed session timeout message
* Added AI crawler blocking feature

= 2.2.5 =
* Fixed .htaccess issues with file/directory protection

= 2.2.4 =
* Fixed fatal error when editing pages
* Resolved styling issues in admin

= 2.2.3 =
* Fixed readme formatting

= 2.2.2 =
* Added support window
* General fixes and UI improvements

= 2.2.0 =
* Added HTTP Security Headers
* Enhanced admin panel design

= 2.1.0 =
* File and directory protection features
* Improved session timeout logic

= 2.0.0 =
* Login security section added
* Custom admin URL and brute-force protection

= 1.1.3 to 1.1.0 =
* Plugin review fixes and initial release

== Upgrade Notice ==

= 2.2.5 =
We fixed bugs related to PHP file upload blocking and direct access protection. Highly recommended update.

= 2.2.0 =
New HTTP Security Headers feature added — please update for improved protection.

== Credits ==

Developed and maintained by [WPIron](https://wpiron.com)

== License ==

This plugin is licensed under the GPLv2 or later.
