- New: License section in Settings -- a 30-day trial with every
feature active starts automatically, no registration required to
start. Protection continues regardless of license status; the trial
only affects what's shown, never what's enforced. Enter a license
key to keep Premium features once the trial ends. This is the first
release where the license system is actually visible anywhere --
it existed in the codebase before but had no entry form and was
excluded from every published build.
- Intelligence page: rewrote descriptions in plain language about what
each thing does for your site's protection, not internal
implementation details (was showing raw technical descriptions like
a "signature corpus" and "RIR delegation database" range counts).
Verified end-to-end before publishing (not just code review): a real
signup and license created on the actual companion license service,
then submitted through the real Settings page form exactly as a
customer would -- status went from "TRIAL -- 30 DAYS LEFT" to
"LICENSED" on both the Settings and Overview pages. This exact ZIP was
also installed fresh and every admin page loaded with zero errors
before this commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Fixes a real bug: a normal (non-critical) update was previously
detected and shown as available, but nothing ever actually installed
it -- there was no button, cron path, or any other code that did.
Automatic updates only ever worked for updates flagged critical, which
isn't what "automatic" means. Now any newer, compatible,
signature-verified update installs on its own.
This is also the first release where the self-update mechanism itself
ships in this self-distributed channel -- it was unconditionally
excluded from every previous build (a WordPress.org-only restriction
that doesn't apply here, since this channel isn't WordPress.org).
manifest.json in this repo is the real, live update manifest: signed
with Ed25519 (public key documented in README.md's Updating section),
pointing at this exact release's ZIP and its real SHA-256. Verified
end-to-end before publishing -- not just "the code looks right": ran a
full real update cycle (an older installed version checking this
manifest, downloading this exact package, verifying its signature and
hash, replacing itself, and the site continuing to work with zero
errors afterward) using the actual signing key and the actual
package this commit ships.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Real changes since 1.0.0, all live-verified before this release:
- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
analysis score could disagree with no explanation (e.g. a benign file
showing CRITICAL next to Score 0); both are now derived consistently
and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
for every other installed plugin and theme (Settings, on by default) --
uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
click on its own page, with an honest, specific description of exactly
what's shared (an IP address, a reason code, a confidence score, a
country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
protecting the site, and surfaces the few real optional choices in one
place.
- Dashboard: running version now visible in the header; new "IPs
Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
this codebase. Two real compliance issues found and fixed (see above:
Global Threat Intelligence's default, and the self-update mechanism,
which is excluded from this build entirely -- WordPress.org prohibits
a plugin from using any update channel other than its own, even an
inert one). This release is still self-distributed, not a WordPress.org
submission -- that remains a future step.
Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ARGUS