- New: License section in Settings -- a 30-day trial with every
feature active starts automatically, no registration required to
start. Protection continues regardless of license status; the trial
only affects what's shown, never what's enforced. Enter a license
key to keep Premium features once the trial ends. This is the first
release where the license system is actually visible anywhere --
it existed in the codebase before but had no entry form and was
excluded from every published build.
- Intelligence page: rewrote descriptions in plain language about what
each thing does for your site's protection, not internal
implementation details (was showing raw technical descriptions like
a "signature corpus" and "RIR delegation database" range counts).
Verified end-to-end before publishing (not just code review): a real
signup and license created on the actual companion license service,
then submitted through the real Settings page form exactly as a
customer would -- status went from "TRIAL -- 30 DAYS LEFT" to
"LICENSED" on both the Settings and Overview pages. This exact ZIP was
also installed fresh and every admin page loaded with zero errors
before this commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Real changes since 1.0.0, all live-verified before this release:
- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
analysis score could disagree with no explanation (e.g. a benign file
showing CRITICAL next to Score 0); both are now derived consistently
and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
for every other installed plugin and theme (Settings, on by default) --
uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
click on its own page, with an honest, specific description of exactly
what's shared (an IP address, a reason code, a confidence score, a
country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
protecting the site, and surfaces the few real optional choices in one
place.
- Dashboard: running version now visible in the header; new "IPs
Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
this codebase. Two real compliance issues found and fixed (see above:
Global Threat Intelligence's default, and the self-update mechanism,
which is excluded from this build entirely -- WordPress.org prohibits
a plugin from using any update channel other than its own, even an
inert one). This release is still self-distributed, not a WordPress.org
submission -- that remains a future step.
Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Automatic WordPress security: local firewall, malware and file-integrity
scanning, vulnerability protection, quarantine, scheduled backups, an
optional page cache, and automatic global threat intelligence.
See README.md for installation, update, and uninstall instructions.
