Weboria/argus-wp-defence
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 118 Wiki Activity

ARGUS WordPress Defence 7.23.0

Browse Source 
Real changes since 1.0.0, all live-verified before this release:

- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
  coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
  analysis score could disagree with no explanation (e.g. a benign file
  showing CRITICAL next to Score 0); both are now derived consistently
  and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
  for every other installed plugin and theme (Settings, on by default) --
  uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
  click on its own page, with an honest, specific description of exactly
  what's shared (an IP address, a reason code, a confidence score, a
  country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
  protecting the site, and surfaces the few real optional choices in one
  place.
- Dashboard: running version now visible in the header; new "IPs
  Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
  this codebase. Two real compliance issues found and fixed (see above:
  Global Threat Intelligence's default, and the self-update mechanism,
  which is excluded from this build entirely -- WordPress.org prohibits
  a plugin from using any update channel other than its own, even an
  inert one). This release is still self-distributed, not a WordPress.org
  submission -- that remains a future step.

Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ARGUS
2026-08-09 19:08:02 +00:00
co-authored by Claude Sonnet 5
parent 35742e05ab
commit 35efd3e485
21 changed files with 632 additions and 326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/views/anis.php
+29 -3
View File
@@ -11,6 +11,7 @@ $protection_display = array(
'active' => array( 'label' => __( 'ACTIVE', 'argus-wordpress-defence' ), 'chip' => 'chip-emerald' ),
'limited' => array( 'label' => __( 'TEMPORARILY LIMITED', 'argus-wordpress-defence' ), 'chip' => 'chip-amber' ),
'not_connected' => array( 'label' => __( 'CONNECTING...', 'argus-wordpress-defence' ), 'chip' => 'chip-off' ),
'disabled' => array( 'label' => __( 'NOT CONNECTED', 'argus-wordpress-defence' ), 'chip' => 'chip-off' ),
);
$state = $protection_display[ $anis_status['protection'] ];
@@ -28,15 +29,33 @@ $next_sync_display = $anis_status['next_sync'] ? wp_date( $date_format, strtotim
</div>
</div>
<?php if ( 'disabled' === $anis_status['protection'] ) : ?>
<div class="argus-wpd-panel">
<p style="font-size:14px;color:var(--text);margin:0 0 16px;">
<?php esc_html_e( 'Your local protection (firewall, scanner, integrity, brute-force defense) is already fully active on its own. ARGUS Cloud is an optional upgrade: it shares reputation data about the IP addresses ARGUS blocks on your site with a global intelligence network, and in return your site benefits from what every other connected site has already seen.', 'argus-wordpress-defence' ); ?>
</p>
<p style="font-size:13px;color:var(--faint);margin:0 0 20px;line-height:1.7;">
<?php esc_html_e( 'What this shares, honestly: when ARGUS blocks a visitor on your site, the visitor\'s IP address, a short reason code, a confidence score, and (if resolvable) its country are sent to ARGUS Cloud. Nothing else -- never usernames, passwords, page content, or anything else about your site or its legitimate visitors. An IP address can be personal data, which is why this is off by default and only turns on if you choose to enable it.', 'argus-wordpress-defence' ); ?>
</p>
<form method="post">
<?php wp_nonce_field( 'argus_wpd_anis_toggle', 'argus_wpd_anis_toggle_nonce' ); ?>
<input type="hidden" name="anis_action" value="enable" />
<button type="submit" class="button button-primary"><?php esc_html_e( 'Connect to ARGUS Cloud', 'argus-wordpress-defence' ); ?></button>
</form>
</div>
<?php else : ?>
<div class="argus-wpd-panel">
<p style="font-size:14px;color:var(--text);margin:0 0 20px;">
<?php
if ( 'active' === $anis_status['protection'] ) {
esc_html_e( 'ARGUS Defence is automatically protected by continuously updated global threat intelligence.', 'argus-wordpress-defence' );
esc_html_e( 'ARGUS Defence is connected to and protected by continuously updated global threat intelligence.', 'argus-wordpress-defence' );
} elseif ( 'limited' === $anis_status['protection'] ) {
esc_html_e( 'ARGUS Defence is continuing to protect your website while global threat intelligence connectivity is being restored automatically.', 'argus-wordpress-defence' );
} else {
esc_html_e( 'ARGUS Defence is automatically connecting to the global threat intelligence network. Your local protection is already fully active.', 'argus-wordpress-defence' );
esc_html_e( 'ARGUS Defence is connecting to the global threat intelligence network. Your local protection is already fully active.', 'argus-wordpress-defence' );
}
?>
</p>
@@ -68,7 +87,14 @@ $next_sync_display = $anis_status['next_sync'] ? wp_date( $date_format, strtotim
</div>
<div class="argus-wpd-panel">
<p style="font-size:13px;color:var(--faint);margin:0;line-height:1.7;"><?php esc_html_e( 'Threat intelligence is privacy-focused. ARGUS Defence only shares anonymous security signals from activity already identified as malicious -- never usernames, passwords, page content, or anything that identifies your site or visitors.', 'argus-wordpress-defence' ); ?></p>
<p style="font-size:13px;color:var(--faint);margin:0 0 16px;line-height:1.7;"><?php esc_html_e( 'What this shares, honestly: when ARGUS blocks a visitor on your site, the visitor\'s IP address, a short reason code, a confidence score, and (if resolvable) its country are sent to ARGUS Cloud. Nothing else -- never usernames, passwords, page content, or anything else about your site or its legitimate visitors.', 'argus-wordpress-defence' ); ?></p>
<form method="post">
<?php wp_nonce_field( 'argus_wpd_anis_toggle', 'argus_wpd_anis_toggle_nonce' ); ?>
<input type="hidden" name="anis_action" value="disable" />
<button type="submit" class="button"><?php esc_html_e( 'Disconnect', 'argus-wordpress-defence' ); ?></button>
</form>
</div>
<?php endif; ?>
<?php include ARGUS_WPD_DIR . 'admin/views/partials/footer.php'; ?>