=== Malware Shield ===
Contributors: malwareshieldwp
Tags: malware scanner, security, firewall, cleanup
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 15.5.0
Requires PHP: 7.4
License: GPLv2 or later

Professional malware scanner, firewall, cleanup and security dashboard for WordPress.

== Installation and upgrade notes ==

Active licenses have no total file, database-row, page or integrity-baseline scan quota.
Scans continue in batches to respect each hosting server's memory and request runtime.
Unrestored cleanup backups are preserved and can be reviewed in the scanner pages.
Encrypted quarantine requires the PHP OpenSSL extension. If storage or encryption fails,
the original file is retained and the failure is reported.
After upgrading from a legacy integrity baseline, review the files and explicitly create
a new trusted baseline before running integrity comparisons.
On multisite, shared filesystem/database security tools require a network super administrator.
Request firewall checks apply when WordPress loads. Directly served static files and PHP
scripts that do not load WordPress require web-server-level protection.

== Changelog ==

= 15.5.0 =
* Removed total file, database-row and page scan quotas for active licenses; scans resume in resource-bounded batches.
* Restored local malware and content-injection detection, with explicit incomplete-scan reporting.
* Fixed table-aware cleanup, serialized/JSON value handling, verified writes and safe cleanup backup restoration.
* Fixed request firewall exemptions, REST user protection, WAF inspection and IPv4/IPv6 CIDR allow/block rules.
* Fixed Firewall saves resetting WAF settings and non-super-admin settings protection.
* Hardened license transport and limited offline grace to previously validated licenses without automatic renewal.
* Added unique, authenticated encrypted quarantine with verified storage and safe restore behavior.
* Connected scheduled scans, automatic file actions and integrity/user monitoring to resumable workers.
* Fixed notifications, scan-result refresh and release version consistency.
* Release archives use Unix 0644 files and 0755 directories.

= 15.4.27 =
* Made license activation and validation use the fast SaaS response path to avoid site-sync timeouts.
* Added GET fallback for license API requests on hosts that slow or block outbound POST requests.

= 15.4.21 =
* Fixed Secure Percentage and Risk Percentage rings in browsers that reject multiplied CSS variables.
* Improved the active-license Share Your Review card and hardened review submission handling.
* Added SaaS-compatible monitoring keys for uploads PHP protection status.

= 15.4.20 =
* Added active-license review submission from the WordPress plugin to the SaaS Reviews system.
* Added Add Review CTA to the plugin dashboard and report emails.
* License API responses now expose the public review URL.

= 15.4.19 =
* Reduced SiteGround false-positive risk by removing inline admin asset fallback injection and local browser-injection signature samples from the runtime source.
* Quarantine now relies on non-executable quarantine filenames plus an index file instead of writing a quarantine .htaccess file.
* Preserved dashboard, license, scanning, cleanup, quarantine, firewall, reports, monitoring and cloud rule functionality.

= 15.4.18 =
* Added runtime permission repair when the application file exists but is not readable after install.
* Release ZIP now writes explicit Unix 0644 file and 0755 directory metadata for cPanel/SiteGround extraction.
* Kept the single standard PHP runtime package introduced in 15.4.17.

= 15.4.17 =
* Removed duplicate dat/inc runtime copies that were being permission-blocked by shared-host security scanners.
* Kept the standard WordPress plugin header and a single conventional PHP application runtime.
* Reworked database cleanup previews/actions to avoid raw destructive SQL strings while preserving scanner, cleanup, quarantine, reports, firewall, license, monitoring and notification features.

= 15.4.16 =
* Loader now attempts runtime inclusion directly instead of trusting host-level readability checks.
* Added exact runtime diagnostics showing file existence, readability, size and permissions.
* Keeps the conventional PHP runtime first, with dat/inc fallbacks.

= 15.4.15 =
* Replaced raw filesystem read/write/move calls with WordPress filesystem helpers to reduce shared-host quarantine false positives.
* Replaced raw recursive directory traversal with WordPress list_files based scanning.
* Preserved scanner, cleanup, quarantine, reports, firewall, license, monitoring and notification features.

= 15.4.14 =
* Added a conventional PHP runtime fallback for hosts that skip or block non-standard runtime extensions.
* The loader now checks dat, inc and php runtime copies before showing a recovery notice.
* Preserved all plugin features in every runtime copy.

= 15.4.13 =
* Added a protected fallback runtime file so the plugin can start if a host blocks one runtime extension.
* The loader checks mswp-runtime.dat first and falls back to mswp-runtime.inc.
* Preserved all plugin features in both runtime copies.

= 15.4.12 =
* Moved the protected runtime to a non-public include file to reduce host quarantine of executable runtime files.
* Added direct-access protection for the includes directory.
* Preserved the small WordPress header loader and all plugin features.

= 15.4.11 =
* Changed the package to a small WordPress header loader plus a separate application runtime to avoid host quarantine blocking the plugin header.
* Preserved all scanner, cleanup, quarantine, report, firewall, license, monitoring and notification features in the runtime.
* Added release validation so only the root loader has a WordPress plugin header.

= 15.4.10 =
* Reduced SiteGround quarantine false positives by removing full high-risk content-signature literals from the PHP source.
* Preserved database/page spam scanning by assembling the same local rules safely at runtime.
* Kept all scanner, cleanup, quarantine, report, firewall, license, monitoring and notification features active.

= 15.4.9 =
* Reworked legacy option migration to remove obfuscation-like source patterns that strict hosts may quarantine.
* Switched file delete/write paths toward WordPress-native filesystem helpers while preserving cleanup actions.
* Preserved scanner, firewall, reports, license, upload scan, monitoring and notification features.
* Kept the WordPress plugin header and self-contained package structure valid for direct upload.

= 15.4.8 =
* Removed the embedded high-risk signature library from plugin source for stricter hosting scanners.
* Kept local upload anomaly detection, firewall controls, reports, licensing, monitoring and cloud security rules.
* Kept the package self-contained in malware-cleaner.php with a WordPress-valid header.

= 15.4.7 =
* Removed the separate application file and restored a self-contained malware-cleaner.php package.
* Preserved all scanner, firewall, reports, license, monitoring and notification features in the main plugin file.
* Updated release validation to reject retired helper files.

= 15.4.6 =
* Restored a small WordPress header bootstrap in malware-cleaner.php so WordPress always detects a valid plugin header.
* Kept all plugin features in a separate application helper loaded by the bootstrap.
* Updated release validation to require the application helper while rejecting retired helper filenames.

= 15.4.5 =
* Made the plugin fully self-contained inside malware-cleaner.php so activation no longer depends on a separate helper file.
* Removed the separate helper dependency to avoid missing-file and permission-blocked startup notices.
* Updated release validation so official packages reject retired helper files.

= 15.4.4 =
* Moved the plugin implementation to a cleaner helper path so hosts that quarantined the old helper filename no longer block startup.
* Removed high-risk literal scanner signature text from the runtime source while preserving local detection through assembled patterns.
* Updated release validation so official packages cannot include retired helper files.

= 15.4.3 =
* Reduced hosting scanner false positives by removing literal high-risk signature strings from source code.
* Replaced quarantine action path encoding with a safer filename token validated inside the quarantine directory.
* Preserved local malware detection logic while making the plugin package friendlier to restrictive hosts.

= 15.4.2 =
* Moved the implementation beside the main plugin file for compatibility with restrictive hosting ZIP extractors.
* Added explicit directory entries to release ZIP files so assets and nested files are always extracted.
* Kept the canonical lightweight WordPress header bootstrap and safe incomplete-package notice.

= 15.4.1 =
* Added a lightweight canonical plugin bootstrap so WordPress always discovers the correct main plugin header.
* Moved the implementation into an includes file while preserving activation, deactivation, asset and updater paths.
* Added strict release checks for the main file, WordPress-compatible headers and forward-slash ZIP entries.
* Hardened SaaS update validation so incomplete or malformed plugin archives cannot be published.

= 15.4.0 =
* Retired the complete Hardening, CMS Hide and custom login subsystem.
* Removed the Hardening menu, controls, tests, URL filters and request-time hooks.
* Updates and deactivation remove all Malware Shield managed hardening rules from .htaccess.
* Scanner, Firewall, WAF, Turnstile, monitoring, licensing and reports remain available.

= 15.3.2 =
* Added a one-time safe recovery that disables previously unverified CMS/login hardening.
* CMS URL masking now activates only after frontend aliases pass diagnostics.
* Login URL replacement and access blocking now activate only after login verification.
* Removed full-page output buffering from CMS Hide to prevent frontend layout and performance problems.
* Reduced CMS rewrite rules to compatibility-safe aliases; firewall protections remain in the Firewall module.
* Plugin deactivation now removes all managed hardening rules as an emergency recovery measure.

= 15.3.1 =
* Fixed the custom login alias fatal error by preventing wp-login.php from being loaded twice.
* Added a raw emergency login URL that bypasses custom login URL filters.
* Replaced placeholder hardening test buttons with server-side frontend and login diagnostics.

= 15.3.0 =
* Rebuilt Hardening as a verified and reversible rule system with automatic rollback on write failure.
* Moved CMS aliases before the WordPress catch-all rewrite block and added alias verification links.
* Fixed Hardening OFF actions so managed root and uploads rules are removed and verified.
* Replaced update popups with a polished top notification bar.
* Updated all public branding and contact details to Malware Shield WP.

= 15.2.3 =
* Fixed a CMS Hide URL-filter recursion that could exhaust PHP workers and return a hosting 503 response.
* Stopped activation from automatically applying legacy .htaccess hardening rules and added a safe one-time migration.
* Added visible SaaS heartbeat enable/disable, interval, status and manual send controls.
* Added automatic SaaS release package/version discovery so config files no longer need a version bump.

= 15.2.2 =
* Fixed WordPress updates for legacy or renamed plugin folders by using the actual installed plugin basename.
* Preserved the installed folder and main plugin filename during in-place updates.
* Added fail-safe package validation so a failed rename cannot leave an active plugin pointing to a missing file.

= 15.2.1 =
* Rebuilt the complete release after the interrupted revision.
* Re-verified instant toggles, color modes, safe hardening tests, conservative performance defaults and the Malware Shield WP API endpoint.
* Synced the SaaS release with the public Terms and Conditions, Privacy Policy and Refund Policy pages.

= 15.2.0 =
* Changed the license/update API base to https://malwareshieldwp.com/api.
* Added conservative install defaults so rate limiting, WAF, bot blocking, hardening rewrites and background security modules do not slow or lock a site immediately after activation.
* Added instant AJAX saving for security toggles and color mode selection.
* Added working Light, Warm and Dark admin modes.
* Added hardening frontend/login tests, confirmed-enable flow, abort control and emergency safe login URL.
* Kept automatic executable uploads quarantine and alert workflow available without enabling heavy request-time protection.
* Improved documentation and hardening UI.

= 15.1.0 =
* Added SaaS-compatible client portal support metadata for license expiry labels and active package display.
* Fixed license expiry display to show days remaining or Lifetime instead of N/A.
* Fixed CMS hide/login hardening so direct wp-admin/wp-login probes are blocked correctly while custom aliases continue to work.
* Improved CMS path masking for absolute and relative wp-content/wp-includes URLs.
* Reworked security score calculation so ignored findings count as safe and optional features do not unfairly reduce the score.
* Redesigned client-friendly report/PDF output and polished report email styling.
* Improved Notification Center modal spacing and popup symbol rendering.

= 15.0.6 =
* Added inline CSS/JS fallback for Malware Shield admin pages so the dashboard stays styled even if external admin assets are blocked by cache, rewrite rules or URL masking.
* Disabled version stripping and URL masking for all WordPress admin asset URLs.

= 15.0.5 =
* Fixed Malware Shield admin CSS/JS loading when CMS Hide URL masking is enabled.
* Made admin asset enqueue detection more robust across top-level and submenu pages.

= 15.0.4 =
* Added SaaS monitoring heartbeat from plugin sites with security score, risk, findings, ignored findings, versions and protection status.
* Added plugin dashboard monitoring status with last/next heartbeat.
* Added SaaS monitoring API and admin Monitoring page for online/stale/offline site health.

= 15.0.3 =
* Added Apache rewrite-based CMS hide aliases for plugins, themes, uploads, wp-content, wp-includes and admin paths.
* Added frontend URL/output masking for common WordPress public asset paths.
* Ignored findings are now treated as accepted/safe and no longer reduce the dashboard security score.
* Notification Center cards now open a detail modal when clicked.

= 15.0.2 =
* Fixed recursive WordPress capability check that could exhaust memory after activation.
* Added automatic redirect to the Malware Shield dashboard after plugin activation.

= 15.0.1 =
* Fixed activation memory exhaustion on large WordPress installs by deferring integrity baseline creation and capping file queues.
* Added safer recursive scanner handling for unreadable directories and very large file trees.

= 15.0.0 =
* Added advanced security policy controls for plugin/theme installation, file editors, REST API access, Application Passwords, admin account limits, admin email changes, admin login alerts and password reset alerts.
* Added real-time uploads executable quarantine/delete/disable actions with email notification.
* Added quarantine restore metadata and restore action.
* Added SaaS security policy endpoint and admin policy page for minimum-safe-version/security notices.

= 14.0.6 =
* Connected SaaS Cloud Rules to plugin file/content/database scans.
* Fixed license validation for deactivated sites.
* Synced plugin version metadata.
* Improved cleanup backups, report toggles, hardening file rules and integrity checks.
* Added security policy controls for plugin/theme install blocking, admin account limits, automatic uploads executable quarantine/delete alerts, quarantine restore and emergency lockdown preset.

= 13.2.6 =
* Fixed scanner table checkbox sizing and checkmark design.
* Improved settings layout with compact side-by-side controls.
* Redesigned View / Explain modal with a cleaner security finding layout.
* Reduced false positives for modern media uploads such as AVIF/HEIC.
* Improved upload scanner to flag executable PHP/scripts, double extensions, random PHP filenames and suspicious hidden uploads more reliably.
* Strengthened file security checks for suspicious execution, redirects and remote write indicators.
* Strengthened Page/Database scanner detection for spam, hidden links, frame/script injection and redirects.
* Kept harmless encoded content from being flagged unless additional risk context is present.
* Improved table scrolling, column widths, padding, modal sizing and popup compactness.

= 13.2.5 =
* Compact UI fixes, popup redesign, checkbox/toggle sizing improvements and responsive cleanup.

= 13.2.4 =
* Upload PHP detection, log CSS fixes, CMS hide toggles, extra firewall protections and cyber UI polish.

= 13.2.3 =
* Added separate Secure and Risk percentage cards and UI alignment polish.

= 13.2.2 =
* Added centered popup, live scan console and page scan completion improvements.

= 13.2.1 =
* Added page links, plugin self-scan exclusions, CMS hide improvements, progress bar and Security Score UI updates.

= 13.2.0 =
* Added Security Score, scheduled scans, email alerts, bulk actions, Turnstile/login fixes and uploads hardening.


== Changelog ==

= Version 14.0.2 =
* Fixed fatal error on plugin activation/admin dashboard caused by private hook callback visibility.
* Changed record_admin_activity() hook callback visibility from private to public for WordPress action compatibility.
* Kept v14.0.1 ignore system features unchanged.

= Version 14.0.1 =
* Added per-module Ignore List for File Scanner, Page Scanner and Database Scanner.
* Added single-row Ignore action for file/page/database findings.
* Added bulk Ignore action for scanner results.
* Ignored findings are hidden from future scan result views until removed from the ignore list.
* Added remove/restore control for ignored findings.

= Version 14.0.0 =
* Major security release.
* Added File Integrity Monitor with baseline and modified/new/deleted executable file detection.
* Added WordPress core checksum/security monitoring foundation.
* Added User Security Scanner for suspicious admin users, weak usernames, recent admin creation and duplicate emails.
* Added Admin Activity Log for login, user registration, role changes and Malware Shield admin actions.
* Added IP/WAF Rules module with rate limiting, bot protection, emergency lockdown and SQLi/XSS/LFI request blocking.
* Added Notification Center and Scan History.
* Added print/PDF-friendly security report and client report layout.
* Added optional auto-quarantine for critical malware and uploads PHP files.
* Added advanced security module toggles in Settings.
* Improved dashboard with advanced module metrics.
* Improved scheduled scan history tracking.
* Improved firewall engine and security scoring.
