=== Scantide Guard for WordPress ===
Contributors: scantide
Tags: security, audit, vulnerability, firewall, monitoring
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 0.9.9.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Explainable WordPress security monitoring, behavioral blocking, auditing and vulnerability/lifecycle intelligence.

== Description ==

Scantide Guard for WordPress provides WordPress-aware monitoring, behavioral protection, auditing and optional Scantide intelligence.

Local capabilities include security-event monitoring, configurable web protection, high-risk username blocking, excessive 403/404 burst detection, Tor exit-node protection, Site Audit, block/safelist handling, reports and email notifications.

Optional Scantide integrations add software/vulnerability/lifecycle intelligence, external posture assessment, site entitlement and Global Reputation. Optional third-party intelligence integrations are disabled until configured.

Scantide is designed around deterministic, explainable observations. A finding is evidence to review, not proof that a site is compromised or secure. False positives and false negatives are possible.

== Installation ==

1. Install and activate the plugin.
2. Open Scantide in wp-admin. Start with Overview; use Diagnostics only for troubleshooting.
3. Review Protection before changing blocking behavior.
4. Configure only the optional integrations you intend to use.
5. Configure Reports and scheduled Site Audit delivery as required.
6. Keep current backups and recovery access before changing security or file-permission settings.

A local Scantide Guard service is optional. Local WordPress features remain available without it.

== External services ==

The plugin contains optional integrations. Enable only the services you intend to use.

= Scantide services =

Used for optional site entitlement/licensing, vulnerability/lifecycle intelligence, external assessment, product news and Scantide Global Reputation.

Depending on the feature, requests can include the site hostname/URL, installation identifier, software/runtime inventory and normalized public-IP security observations. Global Reputation is designed not to intentionally send usernames, passwords, secrets, raw request bodies or full raw logs.

Service: https://www.scantide.com/

= AbuseIPDB =

Optional reputation lookup/reporting for public source IP addresses. When enabled, public IP addresses and security-report metadata can be sent to AbuseIPDB.

Service: https://www.abuseipdb.com/

= AlienVault OTX =

Optional threat-intelligence lookup for public source IP addresses.

Service: https://otx.alienvault.com/

= Wordfence Intelligence =

Optional vulnerability-intelligence feed retrieval using the configured API credential.

Service: https://www.wordfence.com/threat-intel/

= IP context providers =

When independent IP enrichment is enabled or explicitly requested, the plugin can query ipwho.is or ipapi.co with a public source IP address.

Services:
https://ipwho.is/
https://ipapi.co/

= Tor Project =

When Tor protection is enabled or manually refreshed, the plugin retrieves a public Tor exit-node list. Default source:
https://check.torproject.org/torbulkexitlist

= SMTP / mail provider =

If the Scantide SMTP override is configured, alert/report contents are sent through the administrator-selected SMTP server. Otherwise the plugin uses the site's normal wp_mail transport.

== Privacy ==

The plugin can retain source IP addresses, security events, request paths, block/safelist state, software/runtime inventory and audit/report data in the WordPress database.

Suggested privacy-policy text is added to the WordPress privacy-policy tools. Optional external services are described above. Administrators are responsible for selecting suitable integrations, retention periods and privacy/legal settings for their environment.

Deleting the plugin through WordPress removes Scantide plugin settings, retained event/block data, reports, cached intelligence and plugin transients. Deactivation alone does not delete stored data.

== Security limitations ==

Scantide and associated intelligence/services operate on a best-effort basis. Automated detections, vulnerability correlation, lifecycle mapping, reputation data, geolocation/ASN data and Site Audit findings can be incomplete, delayed, stale, ambiguous or inaccurate.

A finding does not prove compromise. Absence of a finding does not prove security. Blocking or remediation can affect legitimate users or site operation. Maintain backups/recovery access and verify important findings before acting.

== Frequently Asked Questions ==

= Is this a WAF or a Wordfence replacement? =
No. Scantide focuses on explainable WordPress-aware monitoring, behavioral protection, auditing and intelligence rather than reproducing a large signature WAF or malware-cleaning suite.

= Does the plugin require Scantide Guard? =
No. Guard integration is optional.

= Does Scantide block every suspicious request? =
No. Profiles, scores, confidence, repetition, safelists and proxy-safety determine the action. Monitor-only mode is available.

= Can Site Audit prove my site is safe? =
No. Site Audit provides observations and review heuristics, not a guarantee.


= How does Scantide treat URL parameters? =

Public request paths, query strings and form values are treated as untrusted security-observation input. They are inspected for attack evidence but are not used to change Scantide configuration, select an external scan target, alter blocks/safelists, or choose service endpoints. Administrative state changes require an authenticated administrator and a WordPress nonce; value-carrying block/safelist/report actions use POST.

External posture scans always derive their target from the WordPress site's configured `home_url()` host rather than from a visitor-supplied URL parameter.

== Changelog ==

= 0.9.9.2 =
* Simplify the Integrations tab with clearer Scantide/third-party status cards and move GBL diagnostics into an advanced collapsible section.
* Add a prominent Run reports launcher at the top of Reports.
* Keep matching run actions in the External posture, Software intelligence, Site Audit and statistics sections.


= 0.9.9.1 =
* Restore missing AbuseIPDB, AlienVault OTX and Wordfence live integration-test methods.
* Ensure integration-test exceptions are returned as JSON instead of WordPress HTML critical-error pages.

= 0.9.9.0 =
* Fix Global Blacklist enable-state persistence and make manual Refresh explicitly enable/apply the authenticated feed when credentials are provisioned.
* Show enabled/disabled separately from credential provisioning status.

= 0.9.8.8 =
* Added shared-hosting-safe Global Blacklist diagnostics under Troubleshooting.
* One-click diagnostic traces saved settings, credential readback, authenticated feed response, normal refresh parsing, and WordPress option persistence without displaying the HMAC secret.

= 0.9.8.7 =
* Fixed Global Blacklist HMAC canonical-path signing. Feed and contribution requests now sign the full `/api/v1/guard/reputation/...` path required by the backend protocol instead of only `/feed.php` or `/report.php`.
* This fixes authenticated GBL clients that showed connected credentials but remained at feed version 0 with no contributions.


= 0.9.8.6 =
* Corrected release packaging so clean installs use the stable scantide-guard-wordpress plugin directory.
* Added explicit diagnostics when enrollment succeeds but Global Blacklist credentials are not stored locally.
* Existing-license enrollment now reports whether the backend returned GBL credentials and whether local persistence succeeded.

= 0.9.8.5 =
* Added automatic .php fallback when the extensionless WordPress trial endpoint returns HTTP 404.
* Added a prominent reinstall/recovery flow for reconnecting an existing Scantide account and license.
* Removed an unrelated Scheduled Site Audit row that had been accidentally embedded in the license recovery form.


= 0.9.8.3 =
* Replaced the expandable web-rule editor with a clear Edit web rules button and focused editor overlay.
* Moved public file/path exemptions into the web-rule editor and placed them first for easier discovery.
* The editor now shows the built-in standard exemptions alongside site-specific additions.

= 0.9.8.2 =
* Added configurable public file/path exemptions under Protection, one root-relative path per line with optional * wildcards.
* Custom exemptions are additive to built-in discovery paths and apply only to clean GET/HEAD requests without query strings.
* Custom exemptions are excluded from web-rule matching, active web-rule blocks and 403/404 burst counting; Geo, Tor and Global Reputation policy still apply.

= 0.9.8 =
* Added remediation responsibility guidance that visually separates WordPress-admin findings from hosting/server/CDN-managed runtime findings and carries ownership into reports and CSV exports.
* Expanded runtime-stack inventory: web server/version, reverse-proxy/frontend evidence, normalized MySQL/MariaDB server and client versions, OS/distribution/kernel/architecture, Zend/PHP build details, OpenSSL/libcurl and versioned PHP extensions.
* Runtime components with strong product/version evidence are submitted through Scantide CVE/lifecycle intelligence; raw evidence is retained separately and hidden/ambiguous versions are not guessed.
* Inventory CSV and Runtime/Reports views now include the expanded hosting stack.
* Release hardening and WordPress.org packaging pass.
* Added Guard-style URL canonicalization and clearer web-rule family explanations.
* Added scheduled Site Audit reports and Reports access.
* Added explicit blocked/detected email status and block-only email filtering.
* Added excessive 403/404 behavioral protection.
* Added optional Geo blocking with deny-list / allow-only policy, monitor mode, safelist/proxy/admin safety, cached lookups and fail-open behavior.
* Added Site Audit readability, limitations and liability notices.
* Added privacy-policy disclosure, deactivation cron cleanup and uninstall cleanup.
* Replaced third-party flag image loading with local Unicode flags.
* Added WordPress.org metadata and external-service documentation.


= Outbound-request security =

Release builds deliberately do not provide an arbitrary URL-fetch primitive. Scantide cloud/news/intelligence endpoints are restricted to Scantide HTTPS hosts; Tor, AbuseIPDB, OTX, Wordfence and IP-context requests are restricted to their documented HTTPS hosts. Redirect following is disabled for security-sensitive provider requests, responses are size-limited, and WordPress safe HTTP APIs are used for Internet destinations.

The local Guard endpoint defaults to loopback and non-loopback Guard targets are refused unless the server operator explicitly enables `SCANTIDE_WP_ALLOW_REMOTE_GUARD`. Public request data is never used to choose an outbound destination.

Attack-controlled request targets, query parameters, POST values, paths and user agents are processed with bounded sizes/counts before being retained or forwarded as security evidence.


= How does Geo blocking work? =

Geo blocking is optional and off by default. It can deny listed ISO country codes or allow only listed country codes, and it can run in monitor-only mode.

Country lookup uses public source-IP context and is cached. Configured country lists are shown with locally rendered Unicode flags in wp-admin; no flag image service is contacted. Manual/learned safelists take precedence, logged-in administrators are exempt, private addresses are ignored, ambiguous proxy attribution is not blocked, and unknown/failed country lookups fail open. Geo-policy blocks are local access policy and are not automatically reported to AbuseIPDB or Scantide Global Reputation.

Because country mapping can be incomplete or inaccurate, Geo blocking should be treated as access policy rather than proof that traffic is malicious.


= Geo country picker =

Geo blocking includes a searchable visual country picker. Click a flag to select or deselect a country, then choose Block selected, Monitor selected, Allow only selected, or Monitor outside selected. The underlying policy is still stored as normalized ISO 3166-1 alpha-2 country codes. Flags are rendered locally as Unicode and do not contact a flag CDN.

= External posture report =

The external posture HTML report is rendered from the detailed Scantide Online JSON schema. It presents scan summary and per-host scores separately, external versus locally confirmed software evidence, all probed service states, TLS/certificate posture, security-header analysis, DNS/email controls, CVE intelligence, passive web evidence, consent/privacy observations, third-party dependencies, jurisdiction/compliance, reputation sources and lifecycle data. A complete expandable evidence tree is retained so returned fields are not silently discarded.


= Local country flag assets =

Country flags used by Geo blocking and event displays are bundled inside the plugin under `assets/flags/`.
The WordPress site does not contact FlagCDN or another flag service at runtime.

= External dependency inventory =

Site Audit combines two evidence sources where available: scripts/styles registered by WordPress and third-party
hosts/assets observed on the public page by the latest Scantide Online external posture scan. This avoids a
registry-only false zero when front-end assets are not registered during a wp-admin request.


= Software report workflow =

After Software analysis completes, Reports now shows the full graphical Software & vulnerability intelligence report
directly on the page, following the same workflow as External posture. The first view prioritizes what needs attention,
then component mix/lifecycle, affected CVEs, inventory, provider status and complete expandable evidence. HTML and JSON
downloads remain available.

Report actions carry an allow-listed return-tab value so a user returns to the tab the action was launched from.
External posture and Software analysis launched from Reports therefore stay on Reports instead of jumping to Overview.


= Path Traversal family =

The Path Traversal family includes representative raw, slash/backslash, encoded and double-encoded traversal forms.
These signatures supplement the canonicalization engine: Scantide separately evaluates raw, once-decoded and
twice-decoded request targets and treats a canonical URL path that escapes the web root as semantic traversal.
The signature list is therefore intentionally broad enough to be understandable without becoming the only source
of truth for traversal detection.


= Path Traversal rule migration =

Web-rule signatures use a dedicated schema version rather than relying only on the public plugin version.
This ensures updated traversal defaults are merged into existing 0.9.8 installations even when the release
candidate version string has not changed. Administrator-added patterns are preserved.

The catch-all sanitizer also explicitly preserves dot-segment traversal patterns such as `*../*`; dots are
semantic path data and are no longer stripped when testing whether a rule is merely a wildcard catch-all.


= Detection & Blocking interface =

The former Protection tab is labelled **Detection & Blocking** to make its purpose explicit.
Its settings are grouped into three areas: Detection policy, Blocking behavior, and Network & location policy.
The page also provides quick navigation to Active blocks and Trusted sources. The internal `protection` tab slug
is unchanged so existing links and administrative handlers remain compatible.


= Integration connection status =

When a WordPress installation is connected to Scantide through a verified site credential and/or local Scantide Guard,
the Integrations tab displays a prominent light-green connection panel. It summarizes the site, connection route and
current service mode before the detailed integration cards.

= Events and active blocks =

Active WordPress-layer blocks are displayed under Events rather than Detection & Blocking. Events is the operational
"what is happening now" view: live block count, recent event groups, last event/source, the active-block table and the
event timeline are kept together. Detection & Blocking remains the policy/configuration area.


= Global Blacklist local override =

Events includes an exact-IP search against the locally cached Scantide Global Blacklist feed. An administrator can
locally whitelist a legitimate source directly from the result. The local manual allow list has higher precedence
than Global Blacklist, Tor, Geo and web-attack blocking; the override is local and does not change the shared feed.

= Verified search crawlers =

Scantide can exempt verified Google and Bing/Microsoft crawlers from blocking. A crawler-like User-Agent is only a
candidate signal and is never trusted by itself. Scantide verifies reverse DNS, checks an approved provider domain,
and confirms the hostname resolves forward to the original source IP. Positive results are cached and DNS lookups
are budget-limited; failed verification creates no exemption.

= Event filters =

The Events timeline can be filtered by free text, severity, blocked/detected outcome, rule family and country.
Up to 50 recent grouped incidents remain filterable in the live timeline, with older retained groups available
separately.


= Lifecycle community sharing =

Software analysis sends explicit lifecycle-sharing consent to the Scantide WordPress intelligence service. Sharing
is enabled by default to match Scantide Auditor and can be disabled under Integrations. Lifecycle evaluation remains
active when sharing is disabled.

= Event retention and filtering =

Scantide retains up to 500 recent raw events locally. All grouped incidents created from those retained rows are
searchable/filterable. Severity filtering matches any severity contained in a group rather than only the group's
highest severity, so a mixed Medium/High group appears under both filters.

= Active block enrichment =

Active Blocks shows retained/cached country, city, ASN/provider, reverse DNS and configured AbuseIPDB/OTX context
per source IP when available. Event enrichment is reused first and uncached admin-view enrichment is bounded.


= Lifecycle sharing control visibility =

The lifecycle community-sharing control is a dedicated first-party Scantide row under Integrations, directly below
the Scantide Intelligence API. It is no longer nested inside Third-party intelligence. The control is enabled by
default, matching the other Scantide lifecycle clients, and the Integrations summary card links directly to it.


= Community-observed lifecycle display =

Software reports now distinguish authoritative vendor lifecycle data from Scantide Community version observations.
If a component has no confirmed vendor lifecycle record but has been observed by Scantide, the report shows
"Community observed current" (or "Community: newer version observed") instead of misleadingly presenting the row
only as "Lifecycle data unavailable". Community observations remain explicitly labelled as version evidence rather
than vendor EOL/support declarations.

The cached software-intelligence result also retains backend lifecycle-sharing counters (requested, consent,
stored, skipped, updated latest) so administrators can see whether a Software analysis actually contributed rows.


= Backend-first IP enrichment =

Licensed/enrolled WordPress sites ask Scantide Intelligence for IP context before using public providers. The
Scantide endpoint answers from Guard Reputation's central enrichment cache, recent enriched observations, or the
local DB-IP Lite database when available. It makes no public enrichment API request.

Direct ipwho.is / ipapi.co lookups remain as resilience fallback. HTTP 429 places the affected provider into a
one-hour local cooldown so a busy attacked site does not keep retrying and worsen throttling. Enrichment is
context-only and never changes whether an already-classified hostile request is blocked.


= SMTP override persistence =

The Scantide SMTP override is preserved across partial settings updates. When enabled, Scantide's phpmailer_init
handler runs at the final WordPress hook priority for Scantide-generated mail so a hosting/site SMTP plugin cannot
replace the saved Scantide SMTP host, authentication, encryption or sender settings. Disabling the override returns
Scantide mail to the site's normal wp_mail transport.


= Why are /, robots.txt and sitemap XML treated specially? =

A clean GET or HEAD request for the site root, robots.txt, favicon.ico or a root-level sitemap XML file is normal public discovery traffic and is not attack evidence by itself. The recommended public-discovery safety option keeps those exact requests out of web-rule matching and 403/404 burst counting.

The exemption is deliberately narrow. Query strings, POST/other methods, other paths, and Geo/Tor/Global Reputation policy are still evaluated normally. During an active web-rule IP block, clean discovery endpoints may remain readable so a previous web-rule hit does not unnecessarily break normal site or search-engine discovery.


= 0.9.8.9 =
* Added an always-visible runtime version/plugin-directory banner.
* Added Global Blacklist live diagnostics directly to Integrations as well as Diagnostics.
* Helps identify duplicate or stale plugin folders after manual reinstall/update.
