=== Vidal Security AI ===
Contributors: jmvidal2013
Tags: security, hardening, security scanner, login security, firewall
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.12.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A friendly security guardian for WordPress: a 0–100 security scan explained in plain language, one-click hardening, and an optional AI guardian that watches your site from the cloud.

== Description ==

Most security plugins speak in logs and codes. **Vidal Security AI** speaks like a person: it scans your site, gives you a clear 0–100 score, explains every problem in one plain sentence, and fixes the safe things with a single click.

**Free features:**

* **Security scan with a 0–100 score** — 13 real checks (outdated WordPress, users exposed through the REST API, XML-RPC left on, author enumeration, public readme.html, missing security headers, debug mode, default database prefix, SSL, PHP version, an account named "admin", automatic updates) each with a plain-language explanation.
* **One-click hardening, fully reversible** — hide the user list from the REST API for visitors, disable XML-RPC, block author enumeration, hide the WordPress version, add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS on HTTPS), and block readme.html / license.txt.
* **A dashboard with its own identity** — your score front and center, color-coded status cards, and clear next steps. No cryptic logs.

**Optional AI Guardian (premium service):**

With a site key, the plugin can connect to the Vidal Security AI cloud service (operated by Vidal Digital Miami on n8n) to classify attacks with AI, receive temporary IP blocks ordered by the service, and show a daily "guard's report" in plain language. This connection is **optional and off by default**.

**Privacy:** Your data is yours. We do not sell your data, we do not use it for advertising, and we never train anything with it. Without a site key, the plugin makes **no external requests at all** - every free feature runs inside your own site (including loopback requests to your own homepage, used only when you press "Scan now").

== Installation ==

1. Upload the `vidal-security-ai` folder to `/wp-content/plugins/` or install it from the WordPress plugins screen.
2. Activate the plugin.
3. Go to **Vidal Security** in the admin menu and press **Scan now**.
4. Turn on the hardening switches you want and press **Save**. Everything is reversible.

== Frequently Asked Questions ==

= Does the free version phone home? =
No. The free version makes no external requests at all. The only HTTP requests it triggers are loopback requests to your own site, and only when you run a manual scan.

= Will the hardening break my site? =
Each switch is conservative and reversible. The only file ever touched is `.htaccess`, only for the readme/license block, only on Apache/LiteSpeed servers where the file is writable, and the rules are written between clearly marked `# BEGIN Vidal Security AI` / `# END Vidal Security AI` markers. Turning the switch off (or deactivating the plugin) removes them.

= What does the AI Guardian add? =
AI classification of attacks (noise vs. real threat), smart temporary IP blocks, a shared threat reputation network, and a daily plain-language report. It requires a site key and is a paid subscription service; the free plugin remains fully functional without it.

= Does it work on multisite? =
It is designed and tested for single-site installs in this version.

== Screenshots ==

1. The dashboard: hero with your 0-100 security score and color-coded check cards.
2. Watched IPs, the allowlist, two-factor authentication, the payments monitor and change watch.
3. The AI Guardian (premium) settings: site key, connection test and live counters.

== External services ==

This plugin can optionally connect to the **Vidal Security AI cloud service**, operated by Vidal Digital Miami, to power the premium AI Guardian. The connection is **off by default** and only happens when the site owner explicitly enables the AI Guardian and enters a site key in the plugin's settings.

* **What is sent, and when:** when the AI Guardian is enabled, the plugin sends technical security events in batches (about once an hour) to `https://v8.vidalbooking.com/webhook/sec-ingest`. Each event contains only: event type, IP address, user agent, requested path, and attempted username for login-related events. It also reads this site's own report from `https://v8.vidalbooking.com/webhook/sec-report`. No site content, no customer data, no order data and no passwords are ever sent.
* **Why:** the service classifies the events with AI (noise vs. real threat), can order temporary IP blocks back to the plugin, and produces the daily plain-language guard's report. Urgent alerts by WhatsApp, when enabled for the site, are sent by the service.
* **Terms of service:** https://vidaldigitalmiami.com/vidal-security-ai-terms.html
* **Privacy policy:** https://vidaldigitalmiami.com/vidal-security-ai-privacy.html

== Changelog ==

= 1.12.0 =
* New support card in the panel: open a support ticket with your site address and plugin version already filled in — no typing, no hunting for contact addresses.

= 1.11.0 =
* Bot shield: good bots are now separated from bad ones. Verified crawlers (Google, Bing, DuckDuckGo, Apple, Yandex, Meta) are confirmed by reverse DNS with forward confirmation — the method the search engines themselves recommend — and never earn points nor get blocked, by the shield or by AI Guardian orders. They appear in their own green section in the panel and in the email report. A fake "Googlebot" that fails verification keeps earning points like any other bot.

= 1.10.1 =
* FIX (email report): the score trend is only computed between real scores (a first report no longer shows a bogus jump), the bot-shield block count also sums the per-IP block history, and the AI Guardian lines no longer show a double bullet.


= 1.10.0 =
* NEW (premium): URGENT alerts by WhatsApp. When something truly urgent happens — a payment incident (webhook down, stuck paid order, a wave of failed payments), an unexplained file change, a sensitive setting changed, a new administrator account, a login burst, or a repeat offender blocked for 24 hours — the Guardian also sends it at once by WhatsApp to the phone registered for your site, on top of the email. Anti-repeat guard: the same incident never rings twice within 6 hours.


= 1.9.1 =
* FIX (email report): the score now shows for real (it is computed from the saved scan, not stored), the diagnosis lists failures and warnings with their explanation, the bot-shield block count is read correctly, and the AI Guardian section is included (it called a helper that did not exist, so it silently vanished).


= 1.9.0 =
* NEW: a full email REPORT (replaces the short weekly note): your score with its trend since the last report, live risks from the scan, the bot shield with who is blocked right now, the AI Guardian report, your store's week (flagged orders, failed payments, stuck orders), file changes and pending updates — in a designed HTML email.
* NEW: report frequency — weekly or monthly — and a "Send it now" button in the new Email report panel card.
* FIX: the admin menu icon is now a scalable vector, correctly sized in every admin theme (it could overflow the sidebar before).


= 1.8.1 =
* BUG FIX — The 2FA section on the user profile page used nested forms with their own nonce, which broke profile saving (\"The link you followed has expired\") and the 2FA buttons themselves. The section now travels with WordPress's own profile form and acts on its update hooks. If your profile would not save while the plugin was active, update to this version.

= 1.8.0 =
* The plugin now speaks English natively, with a full Spanish translation included (es_ES) — it follows your site language automatically. Same protection, ready for the world (and for WordPress.org).

= 1.7.0 =
* NEW — Change watch: instant email if your admin email, site URL, registration settings or ANY payment gateway setting changes, or if someone is promoted to administrator. NEW — File integrity watch: a daily fingerprint of critical files, plugins and themes; changes explained by updates stay quiet, unexplained edits (the classic injected-code signal) alert you and the AI Guardian. NEW — Weekly email report: your score, what the shield stopped, file changes and the Guardian's report, in plain language.

= 1.6.0 =
* NEW — Payments & webhook monitor for stores: hourly watch for silently disabled WooCommerce webhooks, paid-but-stuck orders and failed-payment waves, with clear email alerts that distinguish an attack from a gateway failure. Checkout protection now also covers the block checkout (Store API). NEW — Observe mode: the bot shield and checkout guard log what they WOULD have blocked without blocking anyone, so you can validate rules safely on a live store.

= 1.5.0 =
* NEW — Owner control over blocks: every blocked IP shows WHY it was blocked (hit-by-hit breakdown), with one-click Unblock and Unblock & always trust. New IP allowlist (your office, your payment gateway): allowlisted IPs are never watched or blocked — not even by the AI Guardian — and skip checkout-guard checks. Your site, your final word.

= 1.4.0 =
* NEW — Two-factor authentication (TOTP) for user accounts: standard authenticator apps, confirm-before-activate enrollment from the user profile, one-time backup codes, admin rescue — because most WordPress takeovers start with a stolen password, not a code flaw. The scan now also reports how many admins have 2FA on.

= 1.3.0 =
* NEW — Bot Shield: a self-building local IP watchlist. IPs earn points for bad behavior (failed logins, sensitive-path probes, 404 bursts, XML-RPC hits on a disabled endpoint) and get temporarily blocked at the threshold (1 hour, 24 for repeat offenders). Self-cleaning by design: max 200 IPs, 7-day expiry, no database bloat. Plus: the scan now flags pending core/plugin/theme updates.

= 1.2.0 =
* NEW — Checkout protection for stores (auto-enabled only when WooCommerce is active): invisible anti-bot honeypot + minimum fill time, a payment-attempt limiter that blocks card testing (3 failed payments in 1 hour = 30-minute checkout block), optional Cloudflare Turnstile, and Guardian-blocked IPs cannot check out.

= 1.1.0 =
* NEW — WooCommerce anti-fraud: every checkout order gets a local risk score (IP velocity, disposable emails, billing/shipping country mismatch, high-value first orders, failed-payment bursts), a traffic-light badge in the orders list, a downloadable evidence file for chargeback disputes, a panel summary and a clear email alert when the risk is high.

= 1.0.1 =
* Branding: the official shield logo now appears in the dashboard hero and as the admin menu icon.

= 1.0.0 =
* First public free release: security scan with a 0-100 score (13 checks in plain language), one-click reversible hardening, clear email alerts (login bursts, admins signing in from new IPs, new admin accounts), a bold custom dashboard, clean uninstall — plus the optional AI Guardian service (activated with a site key) with event reporting, brain-ordered IP blocks and the plain-language guard's report.

= 0.1.3 =
* Honest measurement: when one of our own hardening toggles is active but the internal self-check cannot confirm it (full-page cache or a host firewall can distort the loopback reading), the check now reports "Attention — not confirmed from inside" instead of a false "At risk".

= 0.1.2 =
* Fix: self-check requests now use a browser-like user agent and a cache-busting parameter, so full-page caches and WAFs no longer cause false "at risk" results for the security-headers and author-enumeration checks on some hosts.

= 0.1.1 =
* Fix: manual scan now always fetches fresh self-check data (the 1-hour cache could keep a just-fixed check flagged).
* Fix: author-enumeration block now also stops the canonical redirect to /author/<slug>/, which leaked usernames before the 404.
* Fix: readme.html check now verifies the actual file content, not just the response code (avoids false "safe" results).

= 0.1.0 =
* Initial release: security scan with 0–100 score (13 checks), one-click reversible hardening, custom dashboard design, and the (optional, key-activated) AI Guardian module with event logging, hourly batch reporting, brain-ordered IP blocks and the plain-language guard's report.

== Upgrade Notice ==

= 0.1.0 =
Initial release.
