=== Defneo Shield ===
Contributors: defneo
Tags: security, firewall, waf, brute force, malware
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Firewall that stops brute force, injection and exploit probes before WordPress runs, plus traffic analysis and an optional community blocklist.

== Description ==

Defneo Shield protects a WordPress site at three levels:

* **Real-time firewall** — runs before WordPress on every PHP request (you enable it with one click): path traversal and file inclusion, code injection, Log4Shell probes, PHPUnit eval-stdin, known web shells, PHP executed from wp-content/uploads, and wp-login / xmlrpc brute force. A successful login resets the counter, so the owner who mistypes a password is never locked out.
* **Static secrets** — a managed block at the top of .htaccess refuses .env, .git, wp-config.php backup copies, SQL dumps and debug.log.
* **Traffic analysis** — every 5 minutes it reads the site's traffic (your hosting account's raw access logs when available, otherwise its own request log) and finds what one request does not show: user enumeration, plugin probing, 404 storms, floods.

It also inventories the site: WordPress version, installed plugins and themes, PHP files in the upload folder (the classic backdoor), a public debug.log, WP_DEBUG left on.

**Monitor first.** The plugin starts in monitor mode: it detects and reports, and blocks nothing. Switch to block when you have looked at what it would have blocked.

**Never blocked:** private and reserved addresses, the site's own server, your allowlist, and Cloudflare edges (behind Cloudflare without the real visitor address, blocking an edge would take the site offline for everyone). If the firewall itself fails, the request goes through — a broken security plugin must not take your site down.

= Optional: Defneo account and community feed =

Everything above works locally, with no account. Optionally, create a free account on defneo.com (a code by e-mail, no password), add your site and paste the token in Settings → Defneo Shield. You then get:

* the signed Defneo community blocklist (Ed25519-verified with a key built into the plugin);
* a dashboard with this site's traffic and threats, and a monitor / block switch;
* your site's detections shared with the community (can be turned off).

== External services ==

This plugin connects to the **Defneo feed service** (https://node1.defneo.com), operated by VAULT APPS SRL, **only after you paste a token** in Settings → Defneo Shield. Until then it makes no external request.

When connected, every 5 minutes it:

* downloads the community blocklist (IP addresses and attack type);
* sends the IP addresses that attacked this site, with the rule that detected them and a time (turn off with "Stop sharing" — an empty heartbeat then keeps your access);
* sends a summary for your dashboard: request counts per domain and status class, detections, the firewall counters, the WordPress/plugin versions and security findings of this site, and the PHP version.

No visitor data other than the addresses that attacked the site is sent; no content, no files, no user accounts.

Terms: https://defneo.com/en/terms — Privacy: https://defneo.com/en/privacy

== Installation ==

1. Install and activate the plugin.
2. Settings → Defneo Shield → "Enable real-time firewall".
3. Optional: connect your free Defneo account (token from https://defneo.com/en/account).
4. After a few days in monitor mode, review the threats and switch to block.

== Frequently Asked Questions ==

= Does it work without an account? =

Yes. The firewall, the .htaccess protection, the traffic analysis and the inventory are local. The account adds the community blocklist and the dashboard.

= Does it work with Wordfence? =

Yes. If another plugin already uses auto_prepend_file through .user.ini, Defneo Shield keeps it and loads it after its own check; uninstalling puts it back.

= What does uninstall leave behind? =

Nothing: the .htaccess / .user.ini lines are removed, the configuration and the wp-content/defneo-shield folder are deleted.

== Changelog ==

= 1.2.1 =
* Core 1.2.1 (web installer for hosting accounts without SSH; no plugin change).

= 1.2.0 =
* Core 1.2.0 (the mail filter of the stand-alone package is not part of the plugin).

= 1.1.0 =
* Defneo account: dashboard with traffic and threats, monitor / block switch (signed).
* Request log of its own when the host does not expose raw access logs.

= 1.0.0 =
* First release.
