=== apSecurity ===
Contributors: artistpromedia
Tags: security, brute-force, cloudflare, lockout, firewall
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.4.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress login protection, IP and country blocking controls, 2FA, native Turnstile and reCAPTCHA checks, optional edge-provider sync, scanner workflows, and emergency access tools.

== Description ==

apSecurity is a comprehensive WordPress security plugin that protects your site from brute force attacks, tracks suspicious activity, and integrates with Cloudflare and AWS WAF for edge-level protection.

= Key Features =

* **Brute Force Protection** - Automatically lockout IPs after failed login attempts
* **Two-Factor Authentication (2FA)** - TOTP support (Google Authenticator, Authy, etc.)
* **reCAPTCHA Integration** - Both v2 (checkbox) and v3 (invisible) supported
* **Native Cloudflare Turnstile** - Standard and passwordless login protection with replay defense and configurable provider-outage policy
* **Emergency Magic Link Unlock** - Send one-time unlock links by email when a locked IP needs recovery
* **Emergency Access Recovery** - URL token-based emergency access system
* **Edge Provider Integrations** - Block attacks at the edge with Cloudflare or AWS WAF
* **Country Blocking** - Block or allow entire countries with GeoIP database
* **IP Whitelisting/Blacklisting** - Manual control over access with CIDR support
* **Optional AI Help** - Gemini chat helper when the site owner configures an API key
* **Comprehensive Logging** - Track login attempts with detailed logs and exports
* **Dashboard** - Review security activity, lockouts, provider state, and scanner results
* **Security Notifications** - Email alerts for suspicious activity
* **Portal Integration** - Works with ArtistPro customer portal

= Emergency Unlock Feature =

If your IP is locked out, the login page can show a "Send Unlock Link to My Email" button. The one-time link is valid for one hour and removes the locked IP from the lockout table after the email is delivered and the link is clicked.

= Support =

For help with apSecurity, contact support@artistpro.com.

Licensed customers can also use the account and license tools on artistprowp.com.

= AI Help Assistant =

If you configure a Gemini API key, the plugin can show an AI chat helper for common setup questions. Ask questions like:
* "How do I whitelist my IP?"
* "I'm locked out, help!"
* "How does Cloudflare work?"

= Edge Provider Integrations =

Connect your Cloudflare account to:
* Block IPs at the edge (before they reach your server)
* Create firewall rules from explicit admin actions
* Adjust security levels dynamically

Connect AWS WAF to:
* Add and remove blocked IPs/CIDRs from a configured WAFv2 IP set
* Support REGIONAL or CLOUDFRONT scope
* Keep the plugin independent from a single edge provider

= Provider Credential Storage =

Environment variables are the preferred credential source for production sites. They keep provider secrets out of the WordPress database and can be managed by the host, deployment system, or external secret manager.

Supported environment variables:
* `ARTISTPRO_SECURITY_CLOUDFLARE_API_TOKEN`
* `ARTISTPRO_SECURITY_AWS_WAF_ACCESS_KEY_ID`
* `ARTISTPRO_SECURITY_AWS_WAF_SECRET_ACCESS_KEY`
* `ARTISTPRO_SECURITY_AWS_WAF_SESSION_TOKEN`
* `ARTISTPRO_SECURITY_RECAPTCHA_SITE_KEY`
* `ARTISTPRO_SECURITY_RECAPTCHA_SECRET_KEY`
* `ARTISTPRO_SECURITY_TURNSTILE_SITE_KEY`
* `ARTISTPRO_SECURITY_TURNSTILE_SECRET_KEY`
* `ARTISTPRO_SECURITY_MAXMIND_LICENSE_KEY`
* `ARTISTPRO_SECURITY_GEMINI_API_KEY`
* `ARTISTPRO_SECURITY_SECRET_KEY`

If environment variables are not available, apSecurity stores provider credentials as encrypted WordPress options. The admin settings page does not render saved credential values back into the page. Leaving a credential field blank preserves the current saved value.

`ARTISTPRO_SECURITY_SECRET_KEY` is optional but recommended when using encrypted WordPress options. If it is changed after credentials have already been saved, provider credentials should be re-entered so they can be encrypted with the new key.

Credential priority:
1. Environment variable
2. Encrypted WordPress option

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/artistpro-security/`
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to apSecurity Dashboard to configure your settings
4. **IMPORTANT:** Whitelist your own IP first before making changes!

== Frequently Asked Questions ==

= I locked myself out! What do I do? =

Go to the login page. You'll see a yellow box with an unlock button. Enter your username and click "Send Unlock Link to My Email" - you'll be unlocked in seconds!

= Do I need Cloudflare? =

No! The plugin works great without Cloudflare. But if you use Cloudflare (it's free), the integration makes blocking even more effective.

= Will this slow down my site? =

Security checks also run on selected public requests, scheduled scans, and configured provider synchronizations. The plugin is designed to keep that work bounded and to avoid loading public-facing JavaScript or CSS except where a configured challenge requires it.

= What happens if I block my own country? =

Don't worry - whitelisted IPs bypass all blocking, including country blocks. Whitelist your IP first!

== Screenshots ==

1. Dashboard - Real-time security monitoring
2. IP Lists - Manage whitelists, blacklists, and lockouts
3. Country Blocking - Block or allow entire countries
4. Edge Provider Integration - Cloudflare and AWS WAF edge-level protection
5. Emergency Unlock - Magic link unlock on login page
6. AI Help Assistant - Instant support chat

== Changelog ==

= 1.4.2 =
* Record WordPress comment IPs through apSecurity's trusted-proxy resolver.
* Add opt-in enforcement that closes public comments, pingbacks, REST comment creation, and legacy XML-RPC comment methods.
* Add discussion-surface and debug-log exposure status reporting.
* Add backup-backed wp-content/debug.log Apache protection.

= 1.4.1 =
* Security: Made emergency access URLs single-use
* Security: Removed username and mail-delivery disclosure from emergency unlock requests
* Security: Removed request-body and exception logging from IP-list AJAX handling
* Compliance: Removed remotely executed QR-code JavaScript
* Compliance: Updated release metadata and product links for WordPress 7.0

= 1.4.0 =
* Added: Cloudflare Free Services control panel and current provider-health checks
* Improved: Edge-provider configuration, security scanner workflows, and release packaging
* Improved: Shared encrypted secret storage and operational diagnostics

= 1.3.0 =
* Added: Native Cloudflare Turnstile provider for standard WordPress login, registration, password reset, magic-link, SMS-code, and passkey challenge issuance
* Added: Encrypted, write-only Turnstile credential settings
* Added: Local one-time-token replay protection plus hostname and action validation
* Added: Explicit fail-open and fail-closed controls for provider outages; invalid and replayed tokens always fail
* Added: Isolated provider tests for success, invalid token, replay, action mismatch, and both outage policies

= 1.2.1 =
* Added: Edge provider selector with Cloudflare and AWS WAF support
* Added: AWS WAFv2 IP set block/unblock support
* Added: Provider credentials can be supplied by environment variables
* Added: Encrypted WordPress option fallback for provider secrets
* Improved: Provider credential fields no longer render saved secrets in admin HTML

= 1.2.0 =
* Added: Attack Surface Manager - comprehensive attack vector monitoring
* Added: xmlrpc.php blocking with .htaccess rule writer
* Added: Username enumeration protection (REST API, author archives, oEmbed, sitemaps)
* Added: Dashboard security alerts - prominent warnings for open attack vectors
* Added: Real-time accessibility checks for xmlrpc and username enumeration
* Added: One-click .htaccess rule management (Add/Remove server-level blocks)
* Added: Cloudflare proxy status monitoring with dashboard alerts
* Added: Settings page "Attack Surface Protection" section with live status indicators
* Improved: Security oversight monitoring - plugin now alerts when fundamentals are exposed
* Fixed: Critical security gaps - xmlrpc and username enumeration now properly monitored

= 1.1.9 =
* Added: Emergency access magic link now automatically emails to admin
* Fixed: Cloudflare health check now supports Global API Keys
* Fixed: Cloudflare API base URL corrected (/client/v4/)
* Improved: Emergency access email includes expiration and security notes

= 1.1.7 =
* Fixed: Gemini AI model updated to 2.5 Flash
* Fixed: Plugin branding consistency (apSecurity)
* Improved: API key obfuscation
* Improved: Emergency unlock documentation

= 1.1.6 =
* Added: Emergency magic link unlock system
* Added: Gemini AI chat helper widget
* Added: Comprehensive Help system (9th grade reading level)
* Updated: Color scheme to match logo branding
* Fixed: Dark mode compatibility

= 1.0.0 =
* Initial release
* Brute force protection
* IP management (whitelist/blacklist)
* Country blocking
* Cloudflare integration
* Security logging

== Upgrade Notice ==

= 1.2.0 =
IMPORTANT: Major security enhancement - adds attack surface monitoring, xmlrpc blocking, username enumeration protection, and dashboard alerts for exposed vulnerabilities. Recommended for all sites.

= 1.1.7 =
Production release with Gemini AI 2.5, emergency unlock, and improved security.
