=== Sitemap Guardian ===
Contributors: sitemapqa
Tags: security, firewall, login, hardening, scanner
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.21
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free, practical security monitoring and hardening for WordPress.

== Description ==

Sitemap Guardian is a free all-in-one security toolkit for WordPress. It helps administrators monitor site security, strengthen common settings, review activity, and identify files or stored content that need attention.

Key features include:

* Local request and login protection.
* Configurable hardening and security headers.
* File-integrity, database health, and database-content scans.
* Security activity logging, alerts, and update awareness.
* Protected database backup and scheduled local file scans.
* WordPress core, plugin, and theme update inventory.

All features are free. Sitemap Guardian does not collect product telemetry.

== Installation ==

1. Install and activate Sitemap Guardian.
2. Open Sitemap Guardian from the WordPress admin menu.
3. Review the settings for your environment.
4. Run an initial file scan to establish a local baseline.

== Privacy ==

Sitemap Guardian stores its security settings, scan results, and audit information in the site’s own WordPress database. Audit events can include a validated IP address and user agent where available; records follow the configured retention period. The plugin sends no product telemetry.

== External services ==

WordPress core checksum verification contacts the official WordPress.org checksum service when a file scan is finalized. The dashboard can request the official WordPress.org security-news RSS feed, which is cached locally. Administrator-login emails can include an Opentracker IP lookup link; no request is made to Opentracker unless an email recipient opens that link.

== Changelog ==

= 1.0.21 =
* Corrects internal version metadata and asset cache versions after the 1.0.20 release.

= 1.0.20 =
* Prevents a broken third-party WordPress mail callback from interrupting successful logins or notification delivery.

= 1.0.19 =
* Fixes Login CAPTCHA validation so incorrect or missing arithmetic answers cannot complete a successful sign-in.

= 1.0.18 =
* Adds an administrator-only System Information panel with safe website, server, database, and permission diagnostics.

= 1.0.17 =
* Adds an optional, safe first-time setup wizard for new installations.

= 1.0.16 =
* Adds daily or weekly scheduled local file scans with clear enable/disable controls.
* Adds protected database backup, database health, and database content scans.
* Adds detailed WordPress core, plugin, and theme update inventory.
* Refines Smart 404 protection to a one-minute, per-IP threshold with a default of 50 requests.

= 1.0.4 =
* Adds the WordPress.org release panel and fixes Smart 404 throttling to use only a validated individual visitor IP.

= 1.0.0 =
* First WordPress.org-ready stable release.
