=== SiteCare – File Permissions Manager ===
Contributors: fstab
Donate link: https://buymeacoffee.com/mchncd
Tags: permissions, chmod, security, file permissions, htaccess
Requires at least: 6.1
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 2.3.13
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Wrong permissions expose your site or quietly break it. Fix them across your whole WordPress install in one safe click - no FTP or SSH.

== Description ==

File and directory permissions are one of the easiest things to get wrong on a WordPress site - and one of the most consequential. Set them too loose and you hand attackers an easy way in; set them too tight and updates, uploads, and plugins quietly stop working. The correct values are well known (755 for folders, 644 for files, locked-down config files), but applying them the usual way means FTP or SSH access, recursive `chmod` commands, and a real risk of breaking your site with a single typo.

SiteCare File Permissions Manager removes all of that. From one screen under **Tools → Permissions**, it recursively applies the safe, recommended permissions across your entire WordPress install - no FTP, no shell, no command line. The recommended values are pre-filled, so for most people it really is a single button.

**Features**

* One-click recursive chmod for the whole WordPress site.
* **Instant diagnosis** - the screen opens with a clear "X items are writable by everyone" warning whenever risky permissions are found, so you know right away whether you have a problem.
* Separate, recommended values for directories (755) and files (644).
* **Beginner-friendly checkboxes** for owner / group / world (read, write, execute) - no need to understand octal numbers. The matching number is filled in for you and stays in sync.
* **Plain-language explanation** of exactly what each setting means ("You: open & view & change. Everyone: open & view"), updated live as you change the boxes.
* **Dangerous values are blocked** - world-writable permissions like 777 or 666, unreadable files (000) and non-traversable folders can never be applied, both in the browser and on the server, so you cannot lock yourself out or open your site up by mistake.
* Advanced overrides for sensitive files (.htaccess, wp-config.php, .user.ini, php.ini) with three modes: recommended read-only (444), the same value as your files, or a custom value per file.
* Live, expandable file tree that shows the current permission of every file and folder, with colour hints for safe vs. risky values.
* Real progress bar with batched processing, so it works on large sites without hitting PHP timeouts.
* Ships fully translated into five world languages - German, Spanish, French, Portuguese and Russian - plus Czech.
* No external scripts, fonts or trackers are loaded.

A rule for a sensitive file (for example php.ini) is only applied when that file actually exists on the server. Missing files are simply skipped.

== Installation ==

= From your WordPress dashboard (recommended) =
1. Go to **Plugins → Add New** and search for "SiteCare File Permissions Manager".
2. Click **Install Now**, then **Activate**.

= Manual upload =
1. Download the plugin .zip file.
2. Go to **Plugins → Add New → Upload Plugin** and choose the .zip.
3. Click **Install Now**, then **Activate**.

= Getting started =
Go to **Tools → Permissions** and click **Start changing permissions**. The recommended, safe values are already filled in, so you can review the live file tree and apply them in one click.

== Frequently Asked Questions ==

= What permissions should I use? =

The defaults are the widely recommended values: 755 for folders and 644 for files, and read-only 444 for sensitive configuration files. If you are not comfortable with the numbers, just use the checkboxes - the plugin explains in plain language what each choice does and fills in the number for you.

= Can I set 777? Is it safe? =

No, and that is on purpose. World-writable permissions such as 777 or 666 let anyone on the server write to your files and are a common way sites get hacked - there is no legitimate reason to set them site-wide. The plugin blocks them (along with other unsafe values like 000 or non-traversable folders) both in the browser and on the server, so you cannot apply them even by accident.

= What if php.ini or .user.ini do not exist on my server? =

Nothing happens for them. The plugin only changes files that actually exist, and missing files are skipped safely.

= Is it safe to run on a large site? =

Yes. Processing is done in small batches with a live progress bar, so it does not hit PHP execution time limits.

= Who can use it? =

Only administrators (users with the manage_options capability) can open the screen or run any action.

= Does it load anything from third-party servers? =

No. All styles and scripts are bundled with the plugin. Nothing is loaded from external servers.

== Screenshots ==

1. The main screen: instant risk diagnosis, beginner-friendly permission checkboxes and the live permission tree.
2. Advanced options for sensitive files with recommended, global or custom modes.

== Changelog ==

= 2.3.13 =
* Corrected the "Tested up to" header to the major WordPress version for wp.org compliance.

= 2.3.12 =
* The permissions screen is now ad-free: notices and promos injected by other plugins no longer appear inside it.

= 2.3.11 =
* Czech translation is back on board alongside the five world languages.

= 2.3.10 =
* Unified translations across the SiteCare family: five world languages (German, Spanish, French, Portuguese, Russian).
* Refreshed screenshots.

= 2.3.9 =
* New scpc_risk_cache_ttl filter to tune how long the risk diagnosis is cached.
* Shortened the directory description to fit WordPress.org limits.

= 2.3.8 =
* New: instant diagnosis - the screen now opens with a clear "X items are writable by everyone" warning when risky permissions exist on your site.
* Dismissing the support box now sticks across browsers and devices (stored per user on the server).
* Housekeeping: refreshed screenshots and link attribution.

= 2.3.7 =
* Preset chips (755, 644 ...) now show a plain-language tooltip explaining what each value does.
* More breathing room between the support box and the permissions section.

= 2.3.6 =
* Tidied up the permissions screen: each matrix is now a self-contained card with its own header, the value + presets sit on one row, and both columns line up cleanly.

= 2.3.5 =
* Balanced the two-column layout: the file tree now matches the height of the settings column, removing the empty space.

= 2.3.4 =
* Moved the support box directly under the intro notice; the info icon is now blue and better aligned.

= 2.3.3 =
* Footer links no longer underline on hover; tidied up the "safe defaults" notice.

= 2.3.2 =
* Unified the footer across the SiteCare plugin family; the SiteCare link now points to app.sitecare.cz.

= 2.3.1 =
* Added a subtle link to SiteCare for people who manage several sites and want them all handled from one dashboard.

= 2.3.0 =
* New: **beginner-friendly checkbox editor** for owner / group / world (read / write / execute). No octal knowledge needed - the number is filled in and kept in sync automatically.
* New: **live plain-language explanation** of what each permission choice actually means, so you always know what you are about to apply.
* New: **safety guardrails**. Dangerous values (world-writable like 777/666, unreadable 000, non-traversable folders, setuid/setgid) are now hard-blocked in the browser and re-checked on the server - they can never be applied.
* Improved: clearer, decluttered interface with contextual "i" info tooltips, a primary "Apply safe permissions" action and a cleaner responsive layout.
* Changed: removed the one-click Undo. With dangerous values now impossible to apply and permissions safely re-runnable, it was no longer needed.

= 2.2.0 =
* Renamed to SiteCare – File Permissions Manager, part of the SiteCare plugin family

= 2.1.0 =
* New: confirmation step before changing permissions, showing exactly how many files and folders will be affected.
* New: interface now follows your chosen WordPress admin colour scheme.
* New: file tree is fully keyboard accessible.
* Improved: errors are shown inline instead of browser pop-ups.
* Improved: refreshed icons and a friendly way to support the plugin (review, translate, donate).

= 2.0.0 =
* New two-column interface with a live file tree and real progress bar.
* Advanced overrides for .htaccess, wp-config.php, .user.ini and php.ini (recommended / global / custom).
* Batched, timeout-safe processing.
* Full internationalization with translations for major languages; no external resources loaded.
* Security hardening: nonces, capability checks, path-traversal protection, symlink skipping.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 2.3.0 =
Now beginner-proof: set permissions with plain checkboxes, see in plain language what they do, and dangerous values like 777 are blocked automatically. Recommended for all users.

= 2.2.0 =
New name (SiteCare – File Permissions Manager). How the plugin works is unchanged.

= 2.1.0 =
Adds a confirmation step before changes, native admin colours and keyboard accessibility. Recommended for all users.

= 2.0.0 =
Redesigned, safer and translation-ready. Recommended for all users.
