ARGUS WordPress Defence 7.23.0

Real changes since 1.0.0, all live-verified before this release:

- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
  coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
  analysis score could disagree with no explanation (e.g. a benign file
  showing CRITICAL next to Score 0); both are now derived consistently
  and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
  for every other installed plugin and theme (Settings, on by default) --
  uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
  click on its own page, with an honest, specific description of exactly
  what's shared (an IP address, a reason code, a confidence score, a
  country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
  protecting the site, and surfaces the few real optional choices in one
  place.
- Dashboard: running version now visible in the header; new "IPs
  Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
  this codebase. Two real compliance issues found and fixed (see above:
  Global Threat Intelligence's default, and the self-update mechanism,
  which is excluded from this build entirely -- WordPress.org prohibits
  a plugin from using any update channel other than its own, even an
  inert one). This release is still self-distributed, not a WordPress.org
  submission -- that remains a future step.

Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -4,14 +4,14 @@ Automatic WordPress security. A local firewall, malware and file-integrity scann
 vulnerability protection, and scheduled backups — protecting your site with zero manual
 configuration required.
 
-**Version:** 1.0.0
+**Version:** 7.23.0
 **Requires:** WordPress 6.0+, PHP 7.4+
 **License:** GPLv2 or later
 
 ## What it does
 
-- **Firewall** — blocks malicious requests (SQL injection, cross-site scripting, and more)
-  before they reach your site.
+- **Firewall** — blocks malicious requests (SQL injection, cross-site scripting, remote code
+  execution, XXE, SSRF, and more) before they reach your site.
 - **Scanner** — regularly checks WordPress core, plugins, and themes for suspicious files
   and integrity changes, and quarantines confirmed threats instead of just reporting them.
 - **Vulnerability Protection** — checks your installed plugins, themes, and WordPress core
@@ -20,14 +20,21 @@ configuration required.
   outside the web root.
 - **Cache & Performance** — an optional page cache that can make your site faster, built
   to never interfere with the firewall or bans.
-- **Global Threat Intelligence** — automatically connected, no setup required.
+- **Automatic Updates** — ARGUS always keeps itself up to date, and can optionally do the
+  same for every other installed plugin and theme.
+- **Global Threat Intelligence (optional)** — share reputation data about the IP addresses
+  ARGUS blocks with a global network, and benefit from what every other connected site has
+  already seen. Off by default — turning it on is a single click, no fields to fill in, and
+  its own settings page shows exactly what is and isn't shared.
 
-Everything works out of the box. There is nothing to configure to get protected.
+Everything except Global Threat Intelligence works out of the box. There is nothing to
+configure to get protected.
 
 ## Status
 
 This is a self-distributed release: it is not listed on WordPress.org and has not gone
-through that team's plugin review process.
+through that team's plugin review process (a submission is planned for the future — this
+release is not it).
 
 - **Not independently security audited.** It has been reviewed internally (code review,
   static checks, a manual security pass over authentication/authorization/nonce/SQL
@@ -36,9 +43,11 @@ through that team's plugin review process.
 - **Tested in sandbox/disposable WordPress environments.** Verification so far — install,
   activation, all admin pages, deactivation, uninstall — was done on disposable WordPress
   instances, not on live production sites.
-- **Automatic updates are not currently active.** The signed-update mechanism is built in
-  but requires production update infrastructure (a manifest server and signing key) that
-  is not yet deployed. See [Updating](#updating) below for how to update manually.
+- **Automatic updates for ARGUS itself are not currently active.** The signed-update
+  mechanism is built in but requires production update infrastructure (a manifest server
+  and signing key) that is not yet deployed. See [Updating](#updating) below for how to
+  update manually. Automatic updates for *other* plugins/themes on your site, if you enable
+  that option, use WordPress's own built-in update system and work today.
 
 ## Installation
 
@@ -47,9 +56,10 @@ through that team's plugin review process.
    ZIP, then **Install Now**.
 3. Click **Activate**.
 
-That's it — ARGUS Defence begins protecting your site automatically. A new **ARGUS
-Defence** menu appears in your wp-admin sidebar with an overview of your site's
-protection status.
+That's it — ARGUS Defence begins protecting your site automatically. A short Welcome screen
+walks through what's already active and a couple of optional choices (a site-type template,
+Global Threat Intelligence). A new **ARGUS Defence** menu also appears in your wp-admin
+sidebar with an overview of your site's protection status.
 
 ## Updating