=== ZA Creative Login Shield ===
Contributors: sipho213
Tags: security, login protection, two-factor authentication, webauthn, passkeys
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 6.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enterprise WordPress login security with 2FA, WebAuthn passkeys, risk scoring, analytics, file integrity, and vulnerability scanning.

== Description ==

ZA Creative Login Shield is a comprehensive enterprise-grade security platform that protects your WordPress site against brute force attacks, unauthorized access, credential stuffing, file tampering, and known vulnerabilities. It provides 28 integrated security features with an intuitive dashboard.

= ⭐ Security Health Score =

Weighted security score (0-100) with star rating (⭐⭐⭐⭐⭐) and detailed check breakdown. 23 automated checks including 2FA, rate limiting, password policy, SSL, file integrity, vulnerability scanning, admin username, XML-RPC, debug mode, and more.

= 🔐 Two-Factor Authentication (2FA) =

Email OTP and Google Authenticator (TOTP) support with per-role enforcement. Force 2FA for administrators, editors, or any custom role.

= 🔑 Passkeys & WebAuthn =

Support for Windows Hello, Face ID, Touch ID, Android Passkeys, and physical security keys. Users can register multiple credentials from their profile page.

= ⚡ One-Click Security Wizard =

Apply all recommended security settings with one click: 2FA, rate limiting, password policy, email notifications, custom login URL, session timeout, device tracking, and more.

= 📊 Analytics Dashboard =

Professional analytics with login activity charts, browser distribution, operating systems, 24-hour attack timeline, top attackers, country statistics, success/failure rates, and most attacked usernames. AJAX-loaded with period switching.

= 🎯 Risk Scoring per Login =

Five-factor risk scoring engine evaluating IP reputation, new device detection, failed attempt history, TOR/VPN detection, and geolocation changes. Scores classify logins as Low, Medium, High, or Critical.

= 👤 Session Manager =

View all active sessions with user, device, browser, country, and last activity. Terminate individual sessions or force logout all sessions.

= 📱 Device Trust =

Recognize trusted devices via browser fingerprinting. Unknown devices trigger email verification before allowing access.

= 🛡️ Emergency Lockdown =

One-click lockdown disables all logins, XML-RPC, REST API authentication, and new user registration. Whitelist IPs for emergency access. Full audit trail logging.

= 📁 File Integrity Monitor =

Scan WordPress core files, plugins, themes, wp-config.php, and .htaccess for unauthorized changes. Detects modified, missing, and new files with hash verification.

= 🔍 Vulnerability Scanner =

Connects to WPScan API and GitHub vulnerability feeds to check installed plugins and themes against known security vulnerabilities. Severity ratings (Critical, High, Medium, Low).

= 🦠 Malware Scanner =

Detects suspicious PHP patterns including base64 encoded payloads, eval() execution, shell_exec() calls, and recently modified files during file integrity scans.

= 🔒 Password Policy =

Enforce minimum length, uppercase, lowercase, numbers, special characters, password expiration (days), password history (prevent reuse), and block 26+ common passwords.

= 🧠 AI Security Assistant =

Smart daily briefing generating natural-language security summaries: "You had 53 login attempts. 43 blocked. 8 from Russia. 2 from China." Contextual recommendations based on real-time activity.

= 🎨 Login Branding =

Customize login page with custom logo image, logo URL, logo title, background color, form background, text color, primary button color, custom CSS, header HTML, and footer HTML.

= 📧 Advanced Email Templates =

Six professional HTML email templates with inline CSS: login notification, blocked IP alert, scheduled report, device verification, OTP code, and default template. Dark-mode compatible.

= 🔔 Notification Center =

In-WordPress notification system with dismiss functionality and unread counts. Alerts for blocked attacks, new IPs, plugin updates, and 2FA changes. Stored per user.

= 📋 Audit Trail =

Complete action log for all security events: settings changes, IP blocks, lockdown activation, user sessions, file scans, vulnerability scans, report generation, and wizard actions.

= 📅 Scheduled Security Reports =

Daily, weekly, or monthly email reports delivered in beautiful HTML format. Includes login statistics, blocked IPs, top attackers, and country breakdown. PDF download available.

= 📤 Export Everything =

Export login logs, blocked IPs, and comprehensive security reports in CSV, JSON, and PDF formats. One-click download from any admin page.

= 🌐 Public REST API =

Eight REST API endpoints under `zacls/v1`: get stats, get logs, get blocked IPs, get analytics, get health score, get reports, enable lockdown, and disable lockdown.

= ⚡ Performance Dashboard =

Monitor memory usage, database size, cron job status, database query count, and per-table row counts for all plugin tables. Memory usage indicator with percentage.

= 🧹 Auto Cleanup =

Automatically delete old login logs, audit logs, expired sessions, and risk scores. Configurable frequency (daily, weekly, monthly) and retention period (7-365 days).

= 🔌 Integrations =

* **Cloudflare** - One-click import of Cloudflare IP ranges to restore real visitor IPs.
* **ip-api.com** - Free GeoIP country lookup (no API key required).
* **WPScan API** - Vulnerability database for plugin and theme scanning.

== Privacy ==

This plugin stores the following information:

* Login attempt records
* IP addresses
* Device fingerprint identifiers (opt-in, disabled by default)
* WebAuthn credential IDs (public key only, no private keys stored)
* Risk score evaluations
* Audit trail events
* Two-factor authentication status
* File integrity hashes
* Vulnerability scan results
* User notification preferences

All data is stored locally inside the WordPress database.

Country information may be retrieved via ip-api.com if GeoIP is enabled (opt-in, disabled by default). Cloudflare API requests (manual admin action) send no visitor data. WPScan API requests send installed plugin slugs and versions.

Site administrators are responsible for complying with local privacy laws.

Full data removal on uninstall (all database tables and options cleaned up).

== External Services ==

This plugin uses the following external services:

= Cloudflare API =

* **Purpose:** Fetch Cloudflare IP ranges for restoring real visitor IPs behind Cloudflare proxy.
* **Data Sent:** None beyond the standard HTTP request to api.cloudflare.com.
* **Trigger:** Manual admin action (button click on settings page).
* **Privacy Policy:** https://www.cloudflare.com/privacypolicy/
* **Terms of Service:** https://www.cloudflare.com/website-terms/

= ip-api.com =

* **Purpose:** GeoIP country code lookup for login attempts and blocked IPs.
* **Data Sent:** Visitor IP address.
* **Trigger:** Any login attempt when GeoIP is enabled in settings (opt-in, disabled by default).
* **Terms of Service:** https://ip-api.com/docs/legal
* **Privacy Policy:** https://ip-api.com/docs/legal

= WPScan API =

* **Purpose:** Check installed plugins against known WordPress vulnerabilities.
* **Data Sent:** Installed plugin slugs and version numbers.
* **Trigger:** Vulnerability scan initiated from admin panel.
* **Privacy Policy:** https://wpscan.com/privacy

== Installation ==

1. Upload the `za-creative-login-shield` folder to the `/wp-content/plugins/` directory, or install directly through the WordPress plugin installer.
2. Activate the plugin through the 'Plugins' screen.
3. Navigate to **Settings > ZA Creative Login Shield** to access the security dashboard and all features.
4. Run the Security Wizard for one-click configuration of all recommended settings.

= Minimum Requirements =

* WordPress 5.8 or higher.
* PHP 7.4 or higher.

== Frequently Asked Questions ==

= Will this work with any WordPress theme? =

Yes. ZA Creative Login Shield works with any WordPress theme. It does not modify theme templates and operates entirely through WordPress hooks and filters.

= Does it conflict with other security plugins? =

It is designed to complement other security measures like hosting-level firewalls. However, running multiple login protection plugins simultaneously may cause unexpected behavior. We recommend using ZA Creative as your primary login security solution.

= Does it work with caching plugins? =

Yes. The plugin respects WordPress hooks correctly and works with all major caching and CDN solutions.

= How does the 2FA work? =

Users can choose between Email OTP (one-time password sent via email) or Google Authenticator (TOTP via the Google Authenticator app). Each user can enable 2FA from their profile page, and administrators can enforce 2FA for specific user roles.

= What are Passkeys / WebAuthn? =

Passkeys use your device's built-in biometric authentication (Face ID, Touch ID, Windows Hello) or physical security keys (YubiKey) for passwordless login. They are more secure than passwords and resistant to phishing.

= How does the custom login URL work? =

The plugin creates a custom login page at a URL you define (default: `/be-login/`). When enabled, the standard `/wp-login.php` and `/wp-admin/` (for non-logged-in users) are blocked, effectively hiding your login page from automated bots.

= Does the plugin collect user data? =

The plugin stores only security-related data (login attempts, IP addresses, session tokens, device fingerprints, WebAuthn public keys) in your WordPress database. No visitor data is sent to external services except optional GeoIP lookups via ip-api.com (when an IP is logged). An admin-initiated Cloudflare IP range fetch contacts api.cloudflare.com but sends no visitor data. Vulnerability scans contact WPScan API with plugin slugs. GeoIP data is cached for 7 days.

= Can I delete all plugin data? =

Yes. When you uninstall the plugin via WordPress, all database tables and options are automatically removed. This includes login logs, blocked IPs, 2FA status, sessions, device fingerprints, WebAuthn credentials, risk scores, lockdown settings, file hashes, vulnerability data, and audit trail entries.

== Screenshots ==

1. Security Dashboard with health score ring, star rating, stats grid, activity chart, recommendations.
2. Security Health page with score ring, star rating, detailed check breakdown, recommendations.
3. Analytics Dashboard with browser stats, OS stats, country bars, top attackers.
4. AI Security Assistant with daily briefing, smart recommendations, country analysis.
5. File Integrity Monitor with scan results for core, config, and htaccess files.
6. Vulnerability Scanner with severity-rated results for installed plugins.
7. Session Manager with user, device, country info and terminate controls.
8. Risk Scoring with factor breakdown and recent score history.
9. WebAuthn / Passkeys management page and user profile registration.
10. Login Branding with logo, colors, CSS customization.
11. One-Click Security Wizard with step-by-step configuration.
12. Performance Dashboard with memory, database, and cron monitoring.
13. Emergency Lockdown controls with whitelist management.
14. Email notification template examples.

== Changelog ==

= 6.0.1 =
* Security: WebAuthn/Passkey login now performs full server-side cryptographic verification (CBOR, authenticator data, client data, origin, challenge, and signature via OpenSSL). Single-use challenges stored in a new `zacls_webauthn_challenges` table.
* Security: Sign-counter replay protection and user-handle binding for WebAuthn credentials.
* Security: OTP codes are stored as HMAC hashes, generated with a CSPRNG, limited to 5 attempts per code, with resend and per-account/IP rate limiting.
* Security: 2FA redirect targets are stored server-side instead of trusting client-supplied redirects.
* Security: Forwarded IP headers (X-Forwarded-For, X-Real-IP, CF-Connecting-IP) are only honored from configured trusted proxies or Cloudflare edge ranges; HTTP_CLIENT_IP is no longer trusted.
* Security: REST API endpoints enforce validated argument schemas with pagination caps.
* Security: CSV exports neutralize spreadsheet formula injection (leading =, +, -, @).
* Security: Session identifiers and 2FA tokens now use a CSPRNG; sessions are created after 2FA and passkey logins.
* Security: Custom login CSS sanitized; fixed PHP 8 array-offset warning in password policy.
* New: Passkey login button on the default and custom login pages; passkey management from user profiles.
* Updated: Plugin version to 6.0.1, DB version to 2.2.0. Database upgrade runs automatically.

= 6.0.0 =
* New: Security Health Score with star rating (5 stars) and 23 automated checks.
* New: 5 additional health checks (admin username, XML-RPC, WP_DEBUG, weak passwords, backup plugin).
* New: AI Security Assistant with daily natural-language briefing and smart recommendations.
* New: Performance Dashboard (memory, database, cron, query monitoring).
* New: Auto Cleanup system (configurable retention and frequency for old data).
* New: SVG score ring with animated dashoffset on dashboard and health pages.
* New: Country bar chart with most-targeted-username display in AI Assistant.
* New: Auto-cleanup settings section with retention and frequency controls.
* Enhanced: Dashboard widgets now show star rating, AI briefing snippet, and mini stats.
* Enhanced: Analytics page with browser/OS stats and 24-hour attack timeline.
* Enhanced: Health page with star rating, checkmark/cross icons, and one-click "Apply All" button.
* Updated: Plugin version to 6.0.0, DB version to 2.1.0.
* Updated: Autoloader with 30 class entries including 3 new classes.

= 5.0.0 =
* New: WebAuthn (Passkeys) support for Windows Hello, Face ID, Touch ID, security keys.
* New: Per-login Risk Scoring engine (5 factors: IP reputation, device, geo, TOR, failed attempts).
* New: Professional Analytics with browser, OS, country stats and world map data.
* New: File Integrity Monitor for core, config, plugin, theme, and .htaccess files.
* New: Vulnerability Scanner with WPScan API and GitHub feed integration.
* New: In-WordPress Notification Center with dismiss and unread count.
* New: Login Branding customization (logo, colors, CSS, header/footer HTML).
* New: 6 professional HTML email templates with inline CSS.
* New: Public REST API with 8 endpoints under zacls/v1.
* New: Background queue processor for deferred tasks.
* New: PDF report generation with Dompdf and HTML fallback.
* New: Multisite network activation support.
* Added: Password history checking, common-password blocking (26 forbidden passwords).
* Added: JSON export format, combined report export (CSV/JSON/PDF).
* Updated: Admin UI with 19 tabs, premium CSS (900+ lines), responsive design.
* Updated: Main plugin to v5.0.0 with DB v2.0.0 and 3 new database tables.

= 4.0.3 =
* Removed Author URI and Plugin URI (timeout issues).
* Updated stable version to 4.0.3.
* Removed WooCommerce requires/tested headers.
* Fixed broken UTF-8 characters in readme.txt.
* Added Privacy section to readme.txt.
* Added esc_sql() to uninstall DROP TABLE queries.
* Database migration now detects missing columns on MySQL 5.7.
* Column-existence checks added to login recording methods.

= 4.0.2 =
* Complete plugin rename to ZA Creative Login Shield with new slug and text domain.
* Moved admin menu to Settings > ZA Creative Login Shield via add_options_page().
* Replaced wp_hash() with hash('sha256') for device fingerprinting per security best practices.
* Hashed IP addresses in transient and cache keys to prevent database pollution.
* Removed all auth secret/salt usage from device tracking.
* Added External Services section to readme.txt documenting Cloudflare API and ip-api.com.
* Updated contributor information.
* Removed bundled screenshot and banner assets per WordPress.org guidelines.
* Full security review: sanitization, nonces, capabilities, escaping verified.
* Compliance with WordPress Plugin Directory Guidelines and Plugin Check requirements.

= 3.0.0 =
* Added audit trail with action filtering and clear functionality.
* Added country intelligence via ip-api.com GeoIP lookup.
* Added scheduled email security reports (daily/weekly/monthly).

= 2.9.0 =
* Added 5-step guided setup wizard replacing the old onboarding.
* Added WordPress Dashboard widgets (security score + recent activity).
* Added successful login recording to analytics chart.

= 2.1.0 =
* Added security score recommendations engine.
* Added dedicated IP whitelist management subpage.

= 1.9.0 =
* Added Cloudflare IP range import via AJAX.
* Redesigned dashboard with weighted score, 14-day chart, and quick action grid.
* Enhanced setup wizard with step indicators and AJAX step-saving.

= 1.0.0 =
* Initial release with 2FA (Email OTP + TOTP), login rate limiting, IP blocking, custom login URL, security dashboard, password policy, session management, device fingerprinting, emergency lockdown, and CSV export.

== Upgrade Notice ==

= 6.0.1 =
Security release. WebAuthn/Passkey login is now fully verified server-side (signature, challenge, origin, sign counter). OTP codes are hashed and rate-limited, proxy IP handling requires trusted proxies, REST and CSV export hardened, and sessions are tracked after 2FA/passkey logins. Database upgrade runs automatically — no data loss.

= 6.0.0 =
Major upgrade adding AI Security Assistant, Performance Dashboard, Auto Cleanup, SVG score rings, star ratings, 5 new health checks, enhanced analytics, and improved dashboard widgets. Database upgrade runs automatically — no data loss.

= 5.0.0 =
Major upgrade adding WebAuthn passkeys, risk scoring, analytics, file monitor, vulnerability scanner, notifications, branding, email templates, REST API, PDF export, and multisite support. 3 new database tables created automatically. Review new features under Settings > ZA Creative Login Shield.

= 4.0.3 =
Database migration now detects missing columns on MySQL 5.7 automatically. Login recording system now auto-creates tables if missing and logs insert errors. Fixed duplicate login log entries. All database tables preserved during upgrade — no data loss.

= 4.0.2 =
Complete plugin rename to ZA Creative Login Shield with new slug (za-creative-login-shield) and text domain (za-creative-login-shield). All option names, table prefixes, and hooks renamed from bslp_ to zacls_. Plugin now integrates under Settings menu. Security hardening applied.

= 1.1.0 =
Important upgrade adding audit trail, country intelligence, scheduled reports, wizard, and dashboard widgets. Database migration runs automatically. Review new audit trail under ZA Creative > Audit Trail after upgrading.
