=== Mokomaro Login Guard Lite ===
Contributors: mokomaro
Tags: security, login, brute force
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

Local password-login protection with temporary connection limits and a privacy-conscious activity summary. No account or license key required.

== Description ==

Mokomaro Login Guard Lite temporarily restricts password logins after five failed attempts from the same connection address within a fixed 15-minute window. Restrictions last 15 minutes. Successful logins clear that connection's counter.

Administrators can review up to 100 recent connection summaries and clear all counters and restrictions under Settings > Mokomaro Login Guard Lite.

All included functionality is free without a trial period. There are no locked premium features, remote license checks, telemetry, external libraries, external update servers or external API requests. This plugin does not include AI analysis, a firewall, malware scanning or file integrity monitoring.

Use only one login limiter at a time. Disable any previous version or other login-limiting plugin before enabling this plugin.

= Privacy and data retention =

The plugin stores an HMAC-SHA256 connection identifier derived from REMOTE_ADDR and a site secret, failed-attempt counts, window and restriction expiry timestamps, and the most recent failure timestamp in a local database table. This identifier is pseudonymous, not anonymous. Raw IP addresses, usernames, passwords, request bodies and user agents are not stored. Administrators see a shortened identifier. Daily WP-Cron cleanup removes summaries older than seven days when no restriction is active; low-traffic sites may run cleanup later. Uninstall removes this plugin's table and scheduled task. Deactivation stops the task and retains records.

= Important limitations =

Verify REMOTE_ADDR identifies the real visitor at the web server before enabling, especially behind a CDN or reverse proxy. Forwarded headers are deliberately ignored. Shared IP addresses can restrict legitimate users. This initial version supports single-site installations only. Password resets remain available; administrators with no active session can wait for the restriction to expire or disable the plugin using their hosting file manager. This is a login limiter, not comprehensive site protection. Application passwords, external SSO and authentication systems bypassing WordPress's authenticate/wp_login_failed hooks are outside scope. Other authentication plugins may affect behavior; test compatibility first.

== Installation ==

1. Back up your test site and database.
2. Upload the mokomaro-login-guard-lite folder to /wp-content/plugins/.
3. Activate on a single-site test installation.
4. Open Settings > Mokomaro Login Guard Lite.
5. Test login failure limits and recovery before production use.

== Frequently Asked Questions ==

= Is a paid license required? =
No. All functionality included in this plugin is free without a time limit.

= Does it send data to external AI services? =
No. This plugin does not use AI or make external requests.

= Where are translations managed? =
Translations are managed through translate.wordpress.org and delivered by WordPress language packs. This package does not contain bundled translation files. Until a translation is available, the interface uses English.

== Changelog ==

= 1.0.1 =
* Rename the plugin and text domain to Mokomaro Login Guard Lite.
* Use official WordPress language packs without bundled translations.
* Remove previous branding and product links.

= 1.0.0 =
* Initial login limiter and local connection summary.
