Update signed manifest to 7.24.2

- New: License section in Settings -- a 30-day trial with every
  feature active starts automatically, no registration required to
  start. Protection continues regardless of license status; the trial
  only affects what's shown, never what's enforced. Enter a license
  key to keep Premium features once the trial ends. This is the first
  release where the license system is actually visible anywhere --
  it existed in the codebase before but had no entry form and was
  excluded from every published build.
- Intelligence page: rewrote descriptions in plain language about what
  each thing does for your site's protection, not internal
  implementation details (was showing raw technical descriptions like
  a "signature corpus" and "RIR delegation database" range counts).

Verified end-to-end before publishing (not just code review): a real
signup and license created on the actual companion license service,
then submitted through the real Settings page form exactly as a
customer would -- status went from "TRIAL -- 30 DAYS LEFT" to
"LICENSED" on both the Settings and Overview pages. This exact ZIP was
also installed fresh and every admin page loaded with zero errors
before this commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -4,7 +4,7 @@ Automatic WordPress security. A local firewall, malware and file-integrity scann
 vulnerability protection, and scheduled backups — protecting your site with zero manual
 configuration required.
 
-**Version:** 7.23.0
+**Version:** 7.23.2
 **Requires:** WordPress 6.0+, PHP 7.4+
 **License:** GPLv2 or later
 
@@ -30,6 +30,11 @@ configuration required.
 Everything except Global Threat Intelligence works out of the box. There is nothing to
 configure to get protected.
 
+**License**: a 30-day trial with every feature active starts automatically on activation --
+no registration required to start. Protection never stops when the trial ends; ARGUS Defence →
+Settings → License shows the days remaining and where to enter a license key to keep Premium
+features. This section is specific to this self-distributed build.
+
 ## Status
 
 This is a self-distributed release: it is not listed on WordPress.org and has not gone
@@ -43,11 +48,12 @@ release is not it).
 - **Tested in sandbox/disposable WordPress environments.** Verification so far — install,
   activation, all admin pages, deactivation, uninstall — was done on disposable WordPress
   instances, not on live production sites.
-- **Automatic updates for ARGUS itself are not currently active.** The signed-update
-  mechanism is built in but requires production update infrastructure (a manifest server
-  and signing key) that is not yet deployed. See [Updating](#updating) below for how to
-  update manually. Automatic updates for *other* plugins/themes on your site, if you enable
-  that option, use WordPress's own built-in update system and work today.
+- **Automatic updates for ARGUS itself are opt-in, not on by default.** The signed-update
+  mechanism is real and live (this release's own manifest is signed and hosted in this
+  repository) -- add two constants to `wp-config.php` to turn it on. See
+  [Updating](#updating) below for the exact lines and how to verify it's working.
+  Automatic updates for *other* plugins/themes on your site, if you enable that option in
+  Settings, use WordPress's own built-in update system and work without any extra setup.
 
 ## Installation
 
@@ -63,11 +69,23 @@ sidebar with an overview of your site's protection status.
 
 ## Updating
 
-Automatic in-dashboard updates require an update channel to be configured for your
-deployment (`ARGUS_WPD_UPDATE_MANIFEST_URL` and `ARGUS_WPD_UPDATE_PUBLIC_KEY` in
-`wp-config.php`). Without one configured, update the plugin the same way you installed
-it: download the new release ZIP and upload it again through **Plugins → Add New →
-Upload Plugin** — WordPress will offer to replace the existing version.
+**Automatic** — add these two lines to `wp-config.php` (above the
+`/* That's all, stop editing! */` line):
+
+```php
+define( 'ARGUS_WPD_UPDATE_MANIFEST_URL', 'https://git-cloud.weboria.eu/Weboria/argus-wp-defence/raw/branch/main/manifest.json' );
+define( 'ARGUS_WPD_UPDATE_PUBLIC_KEY', 'jBQFZLG+fvtW9y7kmhJa4BTBw8u3lmxbgOcF2ptEhFs=' );
+```
+
+From then on ARGUS checks for updates every few hours and installs anything newer
+automatically, after verifying its Ed25519 signature and SHA-256 checksum. To check
+immediately instead of waiting: **ARGUS Defence → Settings → Automatic Security Updates →
+Check for Updates Now**, which also shows the current status (last check, last successful
+update, last failure).
+
+**Manual** — download the new release ZIP and upload it through **Plugins → Add New →
+Upload Plugin** — WordPress will offer to replace the existing version. Works with or
+without the automatic option configured.
 
 ## Uninstalling
 

admin/class-argus-admin.php

@@ -655,6 +655,12 @@ class Argus_Admin {
 	public static function render_settings() {
 		$saved             = false;
 		$template_applied  = null;
+		$license_result    = null;
+
+		if ( class_exists( 'Argus_License' ) && isset( $_POST['argus_wpd_activate_license_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['argus_wpd_activate_license_nonce'] ) ), 'argus_wpd_activate_license' ) ) { // phpcs:ignore
+			Argus_License::set_license_key( sanitize_text_field( wp_unslash( $_POST['license_key'] ?? '' ) ) ); // phpcs:ignore
+			$license_result = Argus_License::validate_now();
+		}
 
 		if ( isset( $_POST['argus_wpd_apply_template_nonce'], $_POST['template'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['argus_wpd_apply_template_nonce'] ) ), 'argus_wpd_apply_template' ) ) { // phpcs:ignore
 			$key = sanitize_key( wp_unslash( $_POST['template'] ) ); // phpcs:ignore

admin/views/intelligence.php

@@ -40,75 +40,63 @@ include ARGUS_WPD_DIR . 'admin/views/partials/header.php';
 
 <div class="argus-wpd-tile-row">
 	<div class="argus-wpd-tile">
-		<div class="argus-wpd-tile-label"><?php esc_html_e( 'WAF Rule Corpus', 'argus-wordpress-defence' ); ?></div>
-		<div class="argus-wpd-tile-value"><?php echo esc_html( number_format_i18n( $waf_rule_count ) ); ?></div>
+		<div class="argus-wpd-tile-label"><?php esc_html_e( 'Firewall', 'argus-wordpress-defence' ); ?></div>
+		<div class="argus-wpd-tile-value" style="font-size:16px;"><span style="color:var(--emerald)"><?php esc_html_e( 'Protecting', 'argus-wordpress-defence' ); ?></span></div>
 	</div>
 	<div class="argus-wpd-tile">
-		<div class="argus-wpd-tile-label"><?php esc_html_e( 'Vulnerability Intelligence', 'argus-wordpress-defence' ); ?></div>
-		<div class="argus-wpd-tile-value" style="font-size:16px;">
-			<?php if ( $vuln_row_count > 0 ) : ?>
-				<span style="color:var(--emerald)"><?php esc_html_e( 'Active', 'argus-wordpress-defence' ); ?></span>
-			<?php else : ?>
-				<span style="color:var(--faint)"><?php esc_html_e( 'Standby', 'argus-wordpress-defence' ); ?></span>
-			<?php endif; ?>
-		</div>
+		<div class="argus-wpd-tile-label"><?php esc_html_e( 'Vulnerability Protection', 'argus-wordpress-defence' ); ?></div>
+		<div class="argus-wpd-tile-value" style="font-size:16px;"><span style="color:var(--emerald)"><?php esc_html_e( 'Protecting', 'argus-wordpress-defence' ); ?></span></div>
 	</div>
 	<div class="argus-wpd-tile">
-		<div class="argus-wpd-tile-label"><?php esc_html_e( 'GeoIP Database', 'argus-wordpress-defence' ); ?></div>
+		<div class="argus-wpd-tile-label"><?php esc_html_e( 'Location Awareness', 'argus-wordpress-defence' ); ?></div>
 		<div class="argus-wpd-tile-value" style="font-size:16px;">
 			<?php if ( $geoip_status && ! empty( $geoip_status['range_count'] ) ) : ?>
-				<span style="color:var(--emerald)"><?php esc_html_e( 'Loaded', 'argus-wordpress-defence' ); ?></span>
+				<span style="color:var(--emerald)"><?php esc_html_e( 'Active', 'argus-wordpress-defence' ); ?></span>
 			<?php else : ?>
-				<span style="color:var(--faint)"><?php esc_html_e( 'Building', 'argus-wordpress-defence' ); ?></span>
+				<span style="color:var(--faint)"><?php esc_html_e( 'Activating', 'argus-wordpress-defence' ); ?></span>
 			<?php endif; ?>
 		</div>
 	</div>
 </div>
 
 <div class="argus-wpd-panel">
-	<h2><?php esc_html_e( 'Local Intelligence Sources', 'argus-wordpress-defence' ); ?></h2>
+	<h2><?php esc_html_e( 'What\'s Protecting Your Site', 'argus-wordpress-defence' ); ?></h2>
 	<div class="argus-wpd-ioc-row">
-		<span class="argus-wpd-ioc-type">WAF</span>
-		<span class="argus-wpd-ioc-desc"><?php echo esc_html( sprintf( __( 'Application-layer signature corpus (SQLi/XSS/RCE/path traversal/protocol anomaly) -- %d rules, updated with this plugin.', 'argus-wordpress-defence' ), $waf_rule_count ) ); ?></span>
+		<span class="argus-wpd-ioc-type"><?php esc_html_e( 'Firewall', 'argus-wordpress-defence' ); ?></span>
+		<span class="argus-wpd-ioc-desc"><?php esc_html_e( 'Blocks malicious requests -- SQL injection, cross-site scripting, remote code execution, path traversal, and more -- before they reach your site. Kept up to date automatically.', 'argus-wordpress-defence' ); ?></span>
 	</div>
 	<div class="argus-wpd-ioc-row">
-		<span class="argus-wpd-ioc-type">VULN</span>
+		<span class="argus-wpd-ioc-type"><?php esc_html_e( 'Vulnerability Protection', 'argus-wordpress-defence' ); ?></span>
 		<span class="argus-wpd-ioc-desc">
 			<?php
 			echo esc_html(
 				$vuln_row_count > 0
-					? __( 'Vulnerability intelligence -- actively matching installed plugins and themes against known security issues.', 'argus-wordpress-defence' )
-					: __( 'Vulnerability intelligence -- WordPress core is checked live against WordPress.org. Plugin and theme results activate automatically as intelligence becomes available.', 'argus-wordpress-defence' )
+					? __( 'Actively protecting your installed plugins and themes by checking them against known security issues.', 'argus-wordpress-defence' )
+					: __( 'Actively protecting WordPress core against known security issues. Plugin and theme protection activates automatically as new information becomes available.', 'argus-wordpress-defence' )
 			);
 			?>
 		</span>
 	</div>
 	<div class="argus-wpd-ioc-row">
-		<span class="argus-wpd-ioc-type">GEOIP</span>
+		<span class="argus-wpd-ioc-type"><?php esc_html_e( 'Location Awareness', 'argus-wordpress-defence' ); ?></span>
 		<span class="argus-wpd-ioc-desc">
 			<?php
 			if ( $geoip_status && ! empty( $geoip_status['range_count'] ) ) {
-				echo esc_html(
-					sprintf(
-						__( 'Self-hosted RIR delegation database -- %s IPv4 ranges, last refreshed %s.', 'argus-wordpress-defence' ),
-						number_format_i18n( $geoip_status['range_count'] ),
-						$geoip_status['last_refresh'] ? human_time_diff( strtotime( $geoip_status['last_refresh'] . ' UTC' ) ) . ' ' . __( 'ago', 'argus-wordpress-defence' ) : __( 'never', 'argus-wordpress-defence' )
-					)
-				);
+				esc_html_e( 'Identifies where threats are coming from automatically, with no external service or configuration required.', 'argus-wordpress-defence' );
 			} else {
-				esc_html_e( 'Self-hosted RIR delegation database has not built its first snapshot yet -- refreshes automatically once daily, no action needed.', 'argus-wordpress-defence' );
+				esc_html_e( 'Activating automatically -- no action needed.', 'argus-wordpress-defence' );
 			}
 			?>
 		</span>
 	</div>
 	<div class="argus-wpd-ioc-row">
-		<span class="argus-wpd-ioc-type">ANIS</span>
+		<span class="argus-wpd-ioc-type"><?php esc_html_e( 'Global Threat Network', 'argus-wordpress-defence' ); ?></span>
 		<span class="argus-wpd-ioc-desc">
 			<?php
 			if ( 'not_connected' === $anis_status['protection'] ) {
-				esc_html_e( 'Global threat intelligence -- connecting automatically.', 'argus-wordpress-defence' );
+				esc_html_e( 'Connecting automatically -- no action needed.', 'argus-wordpress-defence' );
 			} else {
-				esc_html_e( 'Global threat intelligence -- automatically updated to help identify malicious sources.', 'argus-wordpress-defence' );
+				esc_html_e( 'Helps identify and block malicious sources seen across other protected sites, automatically.', 'argus-wordpress-defence' );
 			}
 			?>
 		</span>

admin/views/settings.php

@@ -182,6 +182,44 @@ include ARGUS_WPD_DIR . 'admin/views/partials/header.php';
 	<?php endif; ?>
 </div>
 
+<?php if ( class_exists( 'Argus_License' ) ) : ?>
+<div class="argus-wpd-panel">
+	<h2><?php esc_html_e( 'License', 'argus-wordpress-defence' ); ?></h2>
+	<?php $license_summary = Argus_License::summary(); ?>
+	<p style="font-size:13px;color:var(--emerald);margin:0 0 6px;display:flex;align-items:center;gap:8px;">
+		<span class="argus-wpd-status-chip chip-emerald" style="padding:2px 10px;">
+			<span class="dot"></span>
+			<span class="state">
+				<?php
+				if ( 'licensed' === $license_summary['status'] ) {
+					esc_html_e( 'LICENSED', 'argus-wordpress-defence' );
+				} elseif ( 'trial' === $license_summary['status'] ) {
+					echo esc_html( sprintf(
+						/* translators: %d: number of days remaining in the free trial */
+						_n( 'TRIAL -- %d DAY LEFT', 'TRIAL -- %d DAYS LEFT', $license_summary['days_remaining'], 'argus-wordpress-defence' ),
+						$license_summary['days_remaining']
+					) );
+				} else {
+					esc_html_e( 'TRIAL ENDED', 'argus-wordpress-defence' );
+				}
+				?>
+			</span>
+		</span>
+	</p>
+	<?php if ( ! empty( $license_result ) ) : ?>
+		<p style="font-size:12.5px;margin:8px 0 0;color:<?php echo ! empty( $license_result['success'] ) ? 'var(--emerald)' : 'var(--rose)'; ?>;"><?php echo esc_html( $license_result['message'] ); ?></p>
+	<?php endif; ?>
+	<form method="post" style="margin-top:14px;display:flex;gap:8px;align-items:center;">
+		<?php wp_nonce_field( 'argus_wpd_activate_license', 'argus_wpd_activate_license_nonce' ); ?>
+		<input type="text" name="license_key" placeholder="<?php esc_attr_e( 'ARGUS-XXXX-XXXX-...', 'argus-wordpress-defence' ); ?>" value="<?php echo esc_attr( $license_summary['has_key'] ? Argus_License::license_key() : '' ); ?>" style="flex:1;max-width:380px;padding:8px 10px;border-radius:6px;border:1px solid var(--border-strong);background:var(--panel-2);color:var(--text);font-family:var(--mono);font-size:13px;" />
+		<button type="submit" class="button button-primary"><?php esc_html_e( 'Activate', 'argus-wordpress-defence' ); ?></button>
+	</form>
+	<?php if ( $license_summary['purchase_url'] ) : ?>
+		<p style="font-size:12.5px;margin:12px 0 0;"><a href="<?php echo esc_url( $license_summary['purchase_url'] ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Get a license', 'argus-wordpress-defence' ); ?></a></p>
+	<?php endif; ?>
+</div>
+<?php endif; ?>
+
 <div class="argus-wpd-panel">
 	<h2><?php esc_html_e( 'Website Acceleration', 'argus-wordpress-defence' ); ?></h2>
 	<p style="color:var(--faint);font-size:12.5px;margin:-8px 0 12px;"><?php esc_html_e( 'Cache & Performance now has its own dedicated page -- speed up your website, reduce load, and see what\'s being accelerated.', 'argus-wordpress-defence' ); ?></p>

argus-wordpress-defence.php

@@ -3,7 +3,7 @@
  * Plugin Name:       ARGUS WordPress Defence
  * Plugin URI:        https://git-cloud.weboria.eu/Weboria/argus-wp-defence
  * Description:       Standalone WordPress security: local WAF, malware & integrity scanning, vulnerability intelligence, and a deterministic ban/policy engine. Works fully offline; optionally connects to ARGUS Cloud for richer intelligence and cross-asset correlation.
- * Version:           7.23.0
+ * Version:           7.23.2
  * Requires at least: 6.0
  * Requires PHP:      7.4
  * Author:            ARGUS
@@ -28,7 +28,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit; 
 }
 
-define( 'ARGUS_WPD_VERSION', '7.23.0' );
+define( 'ARGUS_WPD_VERSION', '7.23.2' );
 define( 'ARGUS_WPD_FILE', __FILE__ );
 define( 'ARGUS_WPD_DIR', plugin_dir_path( __FILE__ ) );
 define( 'ARGUS_WPD_URL', plugin_dir_url( __FILE__ ) );

bin/build-release.sh

@@ -8,12 +8,20 @@
 # the result against an explicit allowlist before packaging, failing
 # closed on anything unexpected rather than silently shipping it.
 #
-# Usage: bin/build-release.sh [git-ref]  (defaults to HEAD)
+# Usage: bin/build-release.sh [git-ref] [channel]
+#   channel: "self" (default) -- the self-distributed release (Gitea
+#            releases page), includes the signed self-update client, since
+#            nothing prohibits it outside WordPress.org.
+#            "wporg" -- strips the self-update client too (and the
+#            license/trial system, stripped either way) -- required before
+#            any submission to the WordPress.org Plugin Directory, which
+#            prohibits a plugin using any update channel but its own.
 #
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 REF="${1:-HEAD}"
+CHANNEL="${2:-self}"
 BUILD_DIR="$(mktemp -d)"
 STAGE_DIR="${BUILD_DIR}/argus-wordpress-defence"
 OUT_DIR="${REPO_ROOT}/dist"
@@ -35,21 +43,22 @@ rm -rf \
   "${STAGE_DIR}/.gitignore" \
   "${STAGE_DIR}/bin"
 
+if [ "${CHANNEL}" = "wporg" ]; then
   # A plugin hosted on WordPress.org must rely solely on WordPress.org's own
   # update channel -- never a self-update-from-external-manifest mechanism,
-# even one that ships inert-by-default. class_exists( 'Argus_Update_Client' )
-# guards every reference to this class elsewhere in the codebase, so removing
-# the file here is sufficient; nothing else needs to change per build.
-echo "==> Removing the self-update client (WordPress.org must be the only update channel)"
+  # even one that ships inert-by-default -- and must stay genuinely,
+  # permanently functional with no license/trial requirement (WordPress.org
+  # explicitly prohibits trialware). class_exists() guards every reference
+  # to both classes elsewhere in the codebase, so removing the files here is
+  # sufficient; nothing else needs to change per build.
+  echo "==> [wporg channel] Removing the self-update client (WordPress.org must be the only update channel)"
   rm -f "${STAGE_DIR}/includes/class-argus-update-client.php"
-
-# WordPress.org explicitly prohibits trialware -- a plugin submitted to the
-# directory must stay genuinely, permanently functional with no license
-# requirement. class_exists( 'Argus_License' ) guards every reference to
-# this class elsewhere, so removing the file here is sufficient; the free
-# build never has a trial timer at all.
-echo "==> Removing the license/trial system (WordPress.org prohibits trialware)"
+  echo "==> [wporg channel] Removing the license/trial system (WordPress.org prohibits trialware)"
   rm -f "${STAGE_DIR}/includes/class-argus-license.php"
+elif [ "${CHANNEL}" != "self" ]; then
+  echo "==> BUILD FAILED: unknown channel '${CHANNEL}' (expected 'self' or 'wporg')"
+  exit 1
+fi
 
 echo "==> Allowlist audit -- fail closed on anything unexpected"
 UNEXPECTED=0

bin/sign-manifest.php

@@ -0,0 +1,81 @@
+<?php
+/**
+ * Signs an update manifest for Argus_Update_Client (includes/class-argus-update-client.php).
+ * Never shipped in any release ZIP -- a dev/release-time tool only.
+ *
+ * Usage:
+ *   php bin/sign-manifest.php \
+ *     --private-key=<base64 Ed25519 secret key> \
+ *     --version=7.23.1 \
+ *     --package-url=https://.../argus-wordpress-defence-7.23.1.zip \
+ *     --sha256=<hex sha256 of that exact zip> \
+ *     [--min-php=7.4] [--min-wp=6.0] [--critical] \
+ *     [--out=manifest.json]
+ *
+ * The signed payload's field set and order (version, released_at,
+ * package_url, sha256, min_php, min_wp, critical) MUST exactly match
+ * Argus_Update_Client::canonical_payload() -- any drift and every
+ * signature this produces fails verification client-side.
+ */
+
+$args = array();
+foreach ( $argv as $arg ) {
+	if ( 0 === strpos( $arg, '--' ) ) {
+		$parts = explode( '=', substr( $arg, 2 ), 2 );
+		$args[ $parts[0] ] = $parts[1] ?? true;
+	}
+}
+
+function required( $args, $key ) {
+	if ( empty( $args[ $key ] ) ) {
+		fwrite( STDERR, "Missing required --{$key}\n" );
+		exit( 1 );
+	}
+	return $args[ $key ];
+}
+
+$private_key_b64 = required( $args, 'private-key' );
+$version          = required( $args, 'version' );
+$package_url      = required( $args, 'package-url' );
+$sha256           = required( $args, 'sha256' );
+$min_php          = $args['min-php'] ?? '7.4';
+$min_wp           = $args['min-wp'] ?? '6.0';
+$critical         = ! empty( $args['critical'] );
+$released_at      = gmdate( 'c' );
+$out              = $args['out'] ?? ( dirname( __DIR__ ) . '/manifest.json' );
+
+if ( 64 !== strlen( $sha256 ) || ! ctype_xdigit( $sha256 ) ) {
+	fwrite( STDERR, "--sha256 must be a 64-character hex string (run: sha256sum <zip>)\n" );
+	exit( 1 );
+}
+
+$private_key = base64_decode( $private_key_b64, true );
+if ( false === $private_key || SODIUM_CRYPTO_SIGN_SECRETKEYBYTES !== strlen( $private_key ) ) {
+	fwrite( STDERR, "--private-key is not a valid base64-encoded Ed25519 secret key\n" );
+	exit( 1 );
+}
+
+// Must match Argus_Update_Client::canonical_payload() exactly -- same key
+// set, same order, same JSON_UNESCAPED_SLASHES flag.
+$ordered = array(
+	'version'     => $version,
+	'released_at' => $released_at,
+	'package_url' => $package_url,
+	'sha256'      => $sha256,
+	'min_php'     => $min_php,
+	'min_wp'      => $min_wp,
+	'critical'    => $critical,
+);
+$canonical = json_encode( $ordered, JSON_UNESCAPED_SLASHES );
+
+$signature = sodium_crypto_sign_detached( $canonical, $private_key );
+$manifest  = $ordered;
+$manifest['signature'] = base64_encode( $signature );
+
+file_put_contents( $out, json_encode( $manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES ) . "\n" );
+
+echo "Wrote {$out}\n";
+echo "  version:     {$version}\n";
+echo "  package_url: {$package_url}\n";
+echo "  sha256:      {$sha256}\n";
+echo "  critical:    " . ( $critical ? 'true' : 'false' ) . "\n";

includes/class-argus-license.php

@@ -0,0 +1,127 @@
+<?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+// Premium-build-only, same as Argus_Update_Client: excluded from the
+// WordPress.org release ZIP (bin/build-release.sh), guarded everywhere with
+// class_exists() so the free build never references it. WP.org's guidelines
+// prohibit trialware in a plugin submitted to the directory -- the free
+// build stays genuinely, permanently functional, with no trial timer and no
+// license requirement anywhere in it. This class exists only in a
+// separately-distributed Premium build.
+class Argus_License {
+
+	const TRIAL_DAYS = 30;
+
+	const TRIAL_STARTED_OPTION = 'argus_wpd_license_trial_started_at';
+	const LICENSE_KEY_OPTION   = 'argus_wpd_license_key';
+	const LICENSE_STATUS_OPTION = 'argus_wpd_license_validation_status';
+	const LICENSE_CHECKED_OPTION = 'argus_wpd_license_last_checked';
+
+	public static function ensure_trial_started() {
+		if ( ! get_option( self::TRIAL_STARTED_OPTION ) ) {
+			update_option( self::TRIAL_STARTED_OPTION, time(), false );
+		}
+	}
+
+	public static function trial_started_at() {
+		return (int) get_option( self::TRIAL_STARTED_OPTION, time() );
+	}
+
+	public static function trial_ends_at() {
+		return self::trial_started_at() + ( self::TRIAL_DAYS * DAY_IN_SECONDS );
+	}
+
+	public static function days_remaining() {
+		$remaining_secs = self::trial_ends_at() - time();
+		return max( 0, (int) ceil( $remaining_secs / DAY_IN_SECONDS ) );
+	}
+
+	public static function license_key() {
+		if ( defined( 'ARGUS_WPD_LICENSE_KEY' ) && ARGUS_WPD_LICENSE_KEY ) {
+			return trim( ARGUS_WPD_LICENSE_KEY );
+		}
+		return trim( (string) get_option( self::LICENSE_KEY_OPTION, '' ) );
+	}
+
+	// Saving a submitted key never marks it valid by itself -- the caller
+	// still has to call validate_now() to actually check it against the
+	// configured validation server, same as entering any license key
+	// anywhere always requires a real check before it does anything.
+	public static function set_license_key( $key ) {
+		update_option( self::LICENSE_KEY_OPTION, trim( (string) $key ), false );
+		delete_option( self::LICENSE_STATUS_OPTION );
+	}
+
+	public static function validation_endpoint() {
+		return defined( 'ARGUS_WPD_LICENSE_VALIDATE_URL' ) ? ARGUS_WPD_LICENSE_VALIDATE_URL : '';
+	}
+
+	// Honest, not fabricated: a license key alone never counts as "licensed"
+	// unless there's a real validation endpoint configured to actually check
+	// it against. No key -> unlicensed. Key present but no validation
+	// endpoint configured -> still unlicensed, not a silent green light.
+	public static function is_licensed() {
+		if ( '' === self::license_key() || '' === self::validation_endpoint() ) {
+			return false;
+		}
+		return 'valid' === get_option( self::LICENSE_STATUS_OPTION, '' );
+	}
+
+	public static function validate_now() {
+		$key = self::license_key();
+		$url = self::validation_endpoint();
+		if ( '' === $key ) {
+			return array( 'success' => false, 'message' => __( 'Enter a license key first.', 'argus-wordpress-defence' ) );
+		}
+		if ( '' === $url ) {
+			return array( 'success' => false, 'message' => __( 'No license validation server is configured for this deployment.', 'argus-wordpress-defence' ) );
+		}
+
+		$response = wp_remote_post(
+			$url,
+			array(
+				'timeout' => 15,
+				'headers' => array( 'Content-Type' => 'application/json' ),
+				'body'    => wp_json_encode( array( 'license_key' => $key, 'domain' => wp_parse_url( home_url(), PHP_URL_HOST ) ) ),
+			)
+		);
+
+		update_option( self::LICENSE_CHECKED_OPTION, current_time( 'mysql', true ), false );
+
+		if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
+			update_option( self::LICENSE_STATUS_OPTION, 'error', false );
+			return array( 'success' => false, 'message' => __( 'Could not reach the license server. Try again shortly.', 'argus-wordpress-defence' ) );
+		}
+
+		$data = json_decode( wp_remote_retrieve_body( $response ), true );
+		$valid = is_array( $data ) && ! empty( $data['valid'] );
+		update_option( self::LICENSE_STATUS_OPTION, $valid ? 'valid' : 'invalid', false );
+
+		return array(
+			'success' => $valid,
+			'message' => $valid
+				? __( 'License activated.', 'argus-wordpress-defence' )
+				: __( 'That license key is not valid or has expired.', 'argus-wordpress-defence' ),
+		);
+	}
+
+	public static function status() {
+		if ( self::is_licensed() ) {
+			return 'licensed';
+		}
+		return self::days_remaining() > 0 ? 'trial' : 'trial_expired';
+	}
+
+	public static function summary() {
+		return array(
+			'status'         => self::status(),
+			'days_remaining' => self::days_remaining(),
+			'trial_ends_at'  => gmdate( 'Y-m-d H:i:s', self::trial_ends_at() ),
+			'has_key'        => '' !== self::license_key(),
+			'purchase_url'   => defined( 'ARGUS_WPD_LICENSE_PURCHASE_URL' ) ? ARGUS_WPD_LICENSE_PURCHASE_URL : '',
+		);
+	}
+}

includes/class-argus-update-client.php

@@ -0,0 +1,275 @@
+<?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+class Argus_Update_Client {
+
+	const CHECK_INTERVAL_SECS = 6 * HOUR_IN_SECONDS;
+	const LOCK_TRANSIENT      = 'argus_wpd_update_check_lock';
+
+	const LAST_CHECK_OPTION      = 'argus_wpd_update_last_check';
+	const MANIFEST_ETAG_OPTION   = 'argus_wpd_update_manifest_etag';
+	const PENDING_MANIFEST_OPTION = 'argus_wpd_update_pending_manifest';
+	const LAST_SUCCESS_OPTION    = 'argus_wpd_update_last_success';
+	const LAST_FAILURE_OPTION    = 'argus_wpd_update_last_failure';
+
+	public static function manifest_url() {
+		return defined( 'ARGUS_WPD_UPDATE_MANIFEST_URL' ) ? ARGUS_WPD_UPDATE_MANIFEST_URL : '';
+	}
+
+	public static function public_key() {
+		return defined( 'ARGUS_WPD_UPDATE_PUBLIC_KEY' ) ? ARGUS_WPD_UPDATE_PUBLIC_KEY : '';
+	}
+
+	public static function is_configured() {
+		return '' !== self::manifest_url() && '' !== self::public_key();
+	}
+
+	public static function maybe_check() {
+		if ( ! self::is_configured() ) {
+			return;
+		}
+
+		$last_check = (int) get_option( self::LAST_CHECK_OPTION, 0 );
+		if ( ( $last_check + self::CHECK_INTERVAL_SECS ) > time() ) {
+			return;
+		}
+
+		if ( false !== get_transient( self::LOCK_TRANSIENT ) ) {
+			return;
+		}
+		set_transient( self::LOCK_TRANSIENT, 1, 4 * MINUTE_IN_SECONDS );
+
+		self::check_now();
+
+		delete_transient( self::LOCK_TRANSIENT );
+	}
+
+	public static function check_now() {
+		if ( ! self::is_configured() ) {
+			return array( 'success' => false, 'message' => __( 'No update source is configured.', 'argus-wordpress-defence' ), 'update_available' => false );
+		}
+
+		update_option( self::LAST_CHECK_OPTION, time(), false );
+
+		$args = array( 'timeout' => 15 );
+		$etag = get_option( self::MANIFEST_ETAG_OPTION, '' );
+		if ( $etag ) {
+			$args['headers'] = array( 'If-None-Match' => $etag );
+		}
+
+		$response = wp_remote_get( self::manifest_url(), $args );
+		if ( is_wp_error( $response ) ) {
+			return self::record_failure( __( 'Could not reach the update server.', 'argus-wordpress-defence' ) );
+		}
+
+		$code = wp_remote_retrieve_response_code( $response );
+		if ( 304 === $code ) {
+
+			return array( 'success' => true, 'message' => '', 'update_available' => false );
+		}
+		if ( 200 !== $code ) {
+			return self::record_failure( sprintf( 'Update server returned HTTP %d.', $code ) );
+		}
+
+		$new_etag = wp_remote_retrieve_header( $response, 'etag' );
+		if ( $new_etag ) {
+			update_option( self::MANIFEST_ETAG_OPTION, $new_etag, false );
+		}
+
+		$body     = wp_remote_retrieve_body( $response );
+		$manifest = json_decode( $body, true );
+		if ( ! is_array( $manifest ) ) {
+			return self::record_failure( __( 'Update manifest was not valid JSON.', 'argus-wordpress-defence' ) );
+		}
+
+		return self::process_manifest( $manifest );
+	}
+
+	public static function process_manifest( array $manifest ) {
+		
+		if ( ! self::verify_signature( $manifest ) ) {
+			return self::record_failure( __( 'Update manifest failed signature verification.', 'argus-wordpress-defence' ) );
+		}
+
+		$version = $manifest['version'] ?? '';
+		if ( '' === $version ) {
+			return self::record_failure( __( 'Update manifest is missing a version.', 'argus-wordpress-defence' ) );
+		}
+
+		if ( version_compare( $version, ARGUS_WPD_VERSION, '<=' ) ) {
+			return array( 'success' => true, 'message' => '', 'update_available' => false );
+		}
+
+		$last_installed = get_option( self::LAST_SUCCESS_OPTION, array() );
+		if ( ! empty( $last_installed['version'] ) && version_compare( $version, $last_installed['version'], '<=' ) ) {
+			return array( 'success' => true, 'message' => '', 'update_available' => false );
+		}
+
+		global $wp_version;
+		if ( ! empty( $manifest['min_php'] ) && version_compare( PHP_VERSION, $manifest['min_php'], '<' ) ) {
+			return self::record_failure( sprintf( 'Update %s requires PHP %s or newer.', $version, $manifest['min_php'] ) );
+		}
+		if ( ! empty( $manifest['min_wp'] ) && version_compare( $wp_version, $manifest['min_wp'], '<' ) ) {
+			return self::record_failure( sprintf( 'Update %s requires WordPress %s or newer.', $version, $manifest['min_wp'] ) );
+		}
+
+		update_option( self::PENDING_MANIFEST_OPTION, $manifest, false );
+
+		// Any newer, compatible, signature-verified version is installed --
+		// 'critical' is informational only (used in the success message and
+		// by Argus_Events severity), not an install gate. It used to be: a
+		// non-critical manifest was recorded as "update_available" and left
+		// there permanently, since nothing else ever called install_update()
+		// for it -- no button, no cron path, nothing. That made "automatic
+		// updates" only ever true for updates someone remembered to flag
+		// critical, which defeats the actual feature.
+		return self::install_update( $manifest );
+	}
+
+	public static function verify_signature( array $manifest ) {
+		if ( empty( $manifest['signature'] ) ) {
+			return false;
+		}
+		$signature = base64_decode( $manifest['signature'], true );
+		if ( false === $signature || SODIUM_CRYPTO_SIGN_BYTES !== strlen( $signature ) ) {
+			return false;
+		}
+		$public_key_b64 = self::public_key();
+		if ( '' === $public_key_b64 ) {
+			return false;
+		}
+		$public_key = base64_decode( $public_key_b64, true );
+		if ( false === $public_key ) {
+			return false;
+		}
+
+		$canonical = self::canonical_payload( $manifest );
+		return sodium_crypto_sign_verify_detached( $signature, $canonical, $public_key );
+	}
+
+	protected static function canonical_payload( array $manifest ) {
+		$ordered = array();
+		foreach ( array( 'version', 'released_at', 'package_url', 'sha256', 'min_php', 'min_wp', 'critical' ) as $key ) {
+			$ordered[ $key ] = $manifest[ $key ] ?? null;
+		}
+		return wp_json_encode( $ordered, JSON_UNESCAPED_SLASHES );
+	}
+
+	public static function install_update( array $manifest, $target_dir = null ) {
+		$target_dir = $target_dir ?: ( WP_PLUGIN_DIR . '/argus-wordpress-defence' );
+		$version    = $manifest['version'];
+
+		$upgrade_dir = trailingslashit( wp_get_upload_dir()['basedir'] ) . 'argus-wpd-data/update-staging';
+		if ( ! is_dir( $upgrade_dir ) && ! wp_mkdir_p( $upgrade_dir ) ) {
+			return self::record_failure( __( 'Could not prepare the update staging directory.', 'argus-wordpress-defence' ) );
+		}
+
+		$package_path = trailingslashit( $upgrade_dir ) . 'package-' . $version . '-' . bin2hex( random_bytes( 4 ) ) . '.zip';
+		$response     = wp_remote_get( $manifest['package_url'], array( 'timeout' => 120, 'stream' => true, 'filename' => $package_path ) );
+		if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
+			@unlink( $package_path ); // phpcs:ignore WordPress.PHP.NoSilencedErrors, WordPress.WP.AlternativeFunctions
+			return self::record_failure( __( 'Could not download the update package.', 'argus-wordpress-defence' ) );
+		}
+
+		if ( ! hash_equals( $manifest['sha256'], hash_file( 'sha256', $package_path ) ) ) {
+			wp_delete_file( $package_path );
+			return self::record_failure( __( 'Downloaded package hash did not match the signed manifest -- rejected.', 'argus-wordpress-defence' ) );
+		}
+
+		$extract_root = trailingslashit( $upgrade_dir ) . 'extract-' . $version . '-' . bin2hex( random_bytes( 4 ) );
+		if ( ! class_exists( 'ZipArchive' ) ) {
+			wp_delete_file( $package_path );
+			return self::record_failure( __( 'The PHP zip extension is not available -- cannot install the update.', 'argus-wordpress-defence' ) );
+		}
+		$zip = new ZipArchive();
+		if ( true !== $zip->open( $package_path ) || true !== $zip->extractTo( $extract_root ) ) {
+			wp_delete_file( $package_path );
+			return self::record_failure( __( 'Could not extract the update package.', 'argus-wordpress-defence' ) );
+		}
+		$zip->close();
+		wp_delete_file( $package_path );
+
+		$extracted_plugin_dir = trailingslashit( $extract_root ) . 'argus-wordpress-defence';
+		$new_main_file         = trailingslashit( $extracted_plugin_dir ) . 'argus-wordpress-defence.php';
+		if ( ! file_exists( $new_main_file ) ) {
+			self::rrmdir( $extract_root );
+			return self::record_failure( __( 'Extracted package did not contain the expected plugin file.', 'argus-wordpress-defence' ) );
+		}
+
+		$header_contents = file_get_contents( $new_main_file ); // phpcs:ignore WordPress.WP.AlternativeFunctions
+		if ( ! preg_match( '/Version:\s*([^\r\n]+)/', $header_contents, $m ) || trim( $m[1] ) !== $version ) {
+			self::rrmdir( $extract_root );
+			return self::record_failure( __( 'Extracted package version did not match the signed manifest -- rejected.', 'argus-wordpress-defence' ) );
+		}
+
+		$backup_dir = $target_dir . '-previous-' . time();
+		$had_previous = is_dir( $target_dir );
+		if ( $had_previous && ! rename( $target_dir, $backup_dir ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions
+			self::rrmdir( $extract_root );
+			return self::record_failure( __( 'Could not move the current plugin version aside for the update.', 'argus-wordpress-defence' ) );
+		}
+		if ( ! rename( $extracted_plugin_dir, $target_dir ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions
+
+			if ( $had_previous ) {
+				rename( $backup_dir, $target_dir ); // phpcs:ignore WordPress.WP.AlternativeFunctions
+			}
+			self::rrmdir( $extract_root );
+			return self::record_failure( __( 'Could not activate the downloaded update -- rolled back to the previous version.', 'argus-wordpress-defence' ) );
+		}
+
+		self::rrmdir( $extract_root );
+		if ( $had_previous ) {
+			self::rrmdir( $backup_dir );
+		}
+
+		delete_option( self::PENDING_MANIFEST_OPTION );
+		update_option(
+			self::LAST_SUCCESS_OPTION,
+			array( 'version' => $version, 'installed_at' => current_time( 'mysql', true ) ),
+			false
+		);
+
+		return array(
+			'success'           => true,
+			'message'           => ! empty( $manifest['critical'] )
+				? sprintf( __( 'A critical ARGUS security update was installed (%s).', 'argus-wordpress-defence' ), $version )
+				: sprintf( __( 'ARGUS Defence was updated to version %s.', 'argus-wordpress-defence' ), $version ),
+			'update_available'  => false,
+		);
+	}
+
+	protected static function record_failure( $message ) {
+		update_option(
+			self::LAST_FAILURE_OPTION,
+			array( 'message' => $message, 'at' => current_time( 'mysql', true ) ),
+			false
+		);
+		Argus_Events::record( 'update_check_failed', 'medium', $message, array() );
+		return array( 'success' => false, 'message' => $message, 'update_available' => false );
+	}
+
+	protected static function rrmdir( $dir ) {
+		if ( ! is_dir( $dir ) ) {
+			return;
+		}
+		$items = new RecursiveIteratorIterator( new RecursiveDirectoryIterator( $dir, FilesystemIterator::SKIP_DOTS ), RecursiveIteratorIterator::CHILD_FIRST );
+		foreach ( $items as $item ) {
+			$item->isDir() ? rmdir( $item->getPathname() ) : unlink( $item->getPathname() ); // phpcs:ignore WordPress.WP.AlternativeFunctions
+		}
+		rmdir( $dir ); // phpcs:ignore WordPress.WP.AlternativeFunctions
+	}
+
+	public static function status() {
+		return array(
+			'current_version' => ARGUS_WPD_VERSION,
+			'configured'       => self::is_configured(),
+			'last_check'       => get_option( self::LAST_CHECK_OPTION, 0 ),
+			'last_success'     => get_option( self::LAST_SUCCESS_OPTION, array() ),
+			'last_failure'     => get_option( self::LAST_FAILURE_OPTION, array() ),
+			'pending'          => get_option( self::PENDING_MANIFEST_OPTION, array() ),
+		);
+	}
+}

manifest.json

@@ -0,0 +1,11 @@
+{
+    "version": "7.24.2",
+    "released_at": "2026-08-14T08:06:56+00:00",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.24.2/argus-wordpress-defence-7.24.2.zip",
+    "sha256": "0f64ba7ef966b356210e7df100ddc9a38e711775f332071c4656c6c749f47cae",
+    "min_php": "7.4",
+    "min_wp": "6.0",
+    "critical": false,
+    "summary": "* Redesigned the Scanner: scans now run in the background with live progress instead of tying up\n  the page, so they never time out on large sites and you can keep working while one runs. Added a\n  Stop button and expandable details on each past scan.\n* Minor wording fix on the Settings page.",
+    "signature": "c0I35menVOQCWdKWsV7znbRD38fkEsrpnbYZYj2sFV3brS2CbiqClBqjhPJv1CzU2E/2R2kKM1C7uvwY06P8AA=="
+}

readme.txt

@@ -4,7 +4,7 @@ Tags: security, firewall, malware, vulnerability, backup
 Requires at least: 6.0
 Tested up to: 7.0
 Requires PHP: 7.4
-Stable tag: 7.23.0
+Stable tag: 7.23.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -53,6 +53,17 @@ dashboard whenever a new version is available, and you can update it in one clic
 
 == Changelog ==
 
+= 7.23.2 =
+* Settings: added a License section -- a 30-day trial with everything active, then enter a
+  license key to keep Premium features. Protection never stops regardless of license status.
+* Intelligence page: rewrote descriptions in plain language focused on what's protecting your
+  site, not internal implementation details.
+
+= 7.23.1 =
+* Automatic updates: fixed a bug where a normal (non-critical) update would be detected and
+  shown as available, but never actually installed -- now any newer, compatible, verified
+  update installs automatically, the same way updates to other plugins already do.
+
 = 7.23.0 =
 * Firewall: broadened local rule coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
   detection, and deeper SQL injection / XSS / PHP injection signatures).