=== ARGUS WordPress Defence ===
Contributors: argus
Tags: security, firewall, malware, vulnerability, backup
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 7.49.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Automatic, intelligent WordPress security. A firewall, malware and file-integrity scanning,
vulnerability protection, and scheduled backups -- protecting your site with zero manual
configuration required.

== Description ==

ARGUS Defence protects your WordPress website automatically:

* **Firewall** -- blocks malicious requests (SQL injection, cross-site scripting, and more) before
  they reach your site.
* **Scanner** -- regularly checks WordPress core, plugins, and themes for suspicious files and
  integrity changes.
* **Vulnerability Protection** -- automatically checks your installed components against known
  security issues.
* **Backups** -- scheduled recovery points for your website, stored securely.
* **Global Threat Intelligence** -- continuously updated, automatically connected, no setup
  required.

Everything works out of the box. There is nothing to configure to get protected.

== Installation ==

1. Upload the plugin to your WordPress site (or install directly from the WordPress admin).
2. Activate the plugin.
3. That's it -- ARGUS Defence begins protecting your site automatically.

== Frequently Asked Questions ==

= Do I need to configure anything? =

No. ARGUS Defence is designed to work automatically. Advanced settings are available for
administrators who want them, but nothing is required to get protected.

= Will this slow down my website? =

No. ARGUS Defence's firewall and scanning run efficiently in the background, and the optional
page-cache feature can make your site faster, not slower.

= How do I update the plugin? =

Like any other WordPress.org plugin: you'll see an update notification right in your WordPress
dashboard whenever a new version is available, and you can update it in one click from there.

= I use Nginx and have the page cache turned on -- do I need to do anything extra? =

Cached pages are protected against direct access on any server automatically -- no configuration
needed. If you run Nginx and want an extra layer of protection at the web-server level as well
(the same optional hardening step security-conscious hosts often add for any sensitive upload
directory), add this to your site's server block:

`
location ^~ /wp-content/uploads/argus-wpd-data/ {
    deny all;
}
`

Apache hosts get the equivalent protection automatically via a `.htaccess` file ARGUS writes into
that directory -- no action needed there.

== Changelog ==

= 7.49.0 =
* A lower-severity WAF detection that keeps being triggered from the same source is now acted on
  automatically -- it is challenged after a sustained run of repeats, and blocked outright if it
  keeps going, instead of staying "allowed" indefinitely no matter how many times it recurs.
* Findings now describe this more specifically: repeated matches from the same source will be
  challenged, then blocked, rather than a generic promise that "ARGUS will act on it".

= 7.48.0 =
* Long operations started from the ARGUS portal -- backups, restores and security scans -- now
  run properly in the background on your site instead of inside the check-in that requested them,
  so a slow backup on a big site can no longer be cut short halfway or accidentally run twice.
* The portal now tells you what actually happened. A backup reports "completed" only once the
  archive exists and has passed its integrity check, and a scan reports "completed" only when the
  scan has genuinely finished -- not the moment it starts.
* While a scan is running you can see real progress from the site (how many files it has examined
  so far) rather than a made-up percentage.
* If an operation is interrupted -- a timeout, a restart, the site going offline mid-way -- it is
  now reported honestly as timed out instead of appearing to run forever. Anything that cannot be
  safely repeated on its own, such as a restore, is flagged for you to check rather than quietly
  retried.

= 7.47.0 =
* The Vulnerabilities page now really does check every plugin and every theme you have
  installed -- active and inactive alike -- instead of leaving some of them sitting at
  "Check Pending" indefinitely.
* Each component now shows its latest available version alongside the installed one, so you
  can see at a glance what has an update waiting. An available update is shown as exactly
  that, and is never treated as a security problem on its own.
* When ARGUS genuinely cannot check something -- a premium or custom plugin that is not
  distributed through WordPress.org, for example -- it now says so plainly and explains why,
  instead of quietly showing it as safe or leaving it pending forever.
* The page now tells you how many components were checked out of how many were found, so you
  can confirm the scan really covered everything.
* "Force Scan Now" reports the real result of the scan, and anything it could not finish in
  the moment is completed automatically in the background.

= 7.46.0 =
* License and registration are now fully unified under WAD (wad.weboria.eu): the License page
  clearly explains how to register this installation and go Premium using the WAD ID already
  shown in Settings, and "Upgrade to Premium" now takes you straight there.
* Removed the last references to an older, no-longer-used ARGUS service -- your license status is
  now checked over this installation's existing WAD connection, with nothing new to set up.

= 7.45.5 =
* The Firewall page's Trusted Allowlist table now updates immediately after adding an IP,
  instead of requiring a page refresh to show it.

= 7.45.4 =
* Fixed "Add to trusted allowlist" on the Firewall page showing an "Unknown action" error
  instead of adding the IP.

= 7.45.3 =
* Added a new Security Header Protection panel to Cache & Performance -> Overview. It checks
  a real request to your own website (not just your settings) to confirm your security headers
  actually reach visitors, explains plainly if a caching setup could still be affecting them,
  and -- only with your confirmation -- can apply the missing server-level configuration for
  you when that's possible on your hosting setup.

= 7.45.2 =
* Fixed a gap where a page served from ARGUS's own page cache could be delivered without the
  security headers (X-Frame-Options, Content-Security-Policy, X-Content-Type-Options,
  Referrer-Policy) that Security Headers is configured to add. Uncached pages were never
  affected; only cached ones. No action needed -- this is applied automatically.

= 7.45.1 =
* Findings that ARGUS classified as automatically handled can now be archived directly from the
  local Findings page, matching what was already available from your WAD account.
* Fixed a message that could go missing after running a one-click fix on a finding that had
  already been dealt with elsewhere.

= 7.45.0 =
* Findings that are still open now ask for a short reason before they can be archived, so an
  unaddressed issue is never dismissed by accident -- archiving something already resolved or
  accepted still takes one click, as before.
* Resolving a finding now shows a clear reminder that ARGUS cannot verify the fix for you.
* A finding you archived will reopen automatically if ARGUS detects the same underlying issue
  again, instead of staying silently hidden.
* Added False Positive, Reopen, and Restore actions directly to the local Findings page, matching
  what was already available from your WAD account.

= 7.44.0 =
* Fixed a bug where a genuinely open finding could be missing from your WAD account's Findings/
  Issues view on a site with a long history of findings, even though your overall protection score
  still correctly counted it. Findings needing your attention are now always included first,
  regardless of how many older, already-resolved findings the site has accumulated.

= 7.43.0 =
* ARGUS's own automatic updates no longer create a flood of integrity findings for the files that
  update legitimately changed -- each one is now checked against that exact release's own signed
  file list, so a genuine ARGUS update stays quiet while anything unexpected (a file that update
  did not actually add, or one it removed but this version still needs) is still caught and
  reported, not silently ignored.

= 7.42.0 =
* If this site is connected to a WAD account, findings shown there now include ARGUS's full
  explanation -- what was found, why it matters, and what to check -- not just the recommended
  fix, so you no longer need to open wp-admin to see the complete picture.

= 7.41.0 =
* Findings now have a complete lifecycle: Resolve, Reopen, Accept Risk, False Positive/Suppress,
  Archive and Restore are all real, tracked actions (who did it, when, and why), available here in
  wp-admin and, if this site is connected to a WAD account, from there too -- WAD is never a
  separate copy of this data, every action there is carried out on this site the same way.
* Contact Form 7's public feedback submission endpoint is now correctly recognised as an
  intentional, documented part of that plugin's own public API, the same way WooCommerce's Store
  API and Jetpack's public endpoints already were -- it no longer creates an unnecessary finding.

= 7.40.0 =
* Security hardening: this site's IP-based protections (firewall, brute-force login protection,
  REST/API abuse protection, WooCommerce checkout guard, two-factor) now correctly recognise real
  visitor IP addresses when this site runs behind a reverse proxy, load balancer, or CDN, using the
  same trusted-proxy configuration already available under Form Protection. Previously, sites in
  that setup could see every visitor as the same address, weakening these protections.
* Hardened the replay protection added in 7.39.0 further: it now remembers a short history of
  recently-applied WAD actions instead of only the single most recent one.

= 7.39.9 =
* Security hardening: disconnecting this site from WAD (or uninstalling the plugin) now also
  invalidates its connection secret on WAD's side, not just locally -- previously the secret stayed
  valid indefinitely. This site also now detects if a WAD account disconnects it remotely and shows
  a clear notice instead of retrying silently.

= 7.39.8 =
* Fixed a serious bug where a scan started remotely from your WAD account could get stuck showing
  "Preparing" forever and never actually run, even though a scan started from this plugin's own
  Scanner page worked fine. A scan already stuck this way on your site is automatically resumed.

= 7.39.7 =
* If this site is connected to a WAD account, its Overview there now shows whether this site is
  connected to ARGUS Network Intelligence (ANIS), instead of always saying that isn't visible from
  WAD.

= 7.39.6 =
* Improved Form Protection's comment-spam detection to also catch promotional comments that repeat
  their own submitted website or email domain in the message body, a common pattern automated
  comment spam wasn't previously being flagged for.

= 7.39.5 =
* If this site is connected to a WAD account, its Cache & Performance compression preset can now be
  changed remotely from there too, the same Balanced/Maximum Performance/Compatibility First choice
  already available in this plugin's own Cache & Performance page.

= 7.39.4 =
* If this site is connected to a WAD account, its findings now also report their category there, so
  WAD can show the same "Top Threat Types" breakdown this plugin's own Threats page shows.

= 7.39.3 =
* If this site is connected to a WAD account, its Audit Log now correctly appears there too, the
  same fix as 7.39.2 below but for the Audit Log tab instead of Findings.

= 7.39.2 =
* If this site is connected to a WAD account, its findings now correctly appear there. Findings
  were always visible here in wp-admin, but a sync gap meant they sometimes weren't showing up in
  WAD's Findings tab even though WAD's own summary counts already reflected them.

= 7.39.1 =
* Comments that Form Protection identifies as automated spam are now sent straight to your
  Spam folder instead of sitting in Pending Review, so fewer spam comments need manual cleanup.
  Comments that only look unusual, rather than clearly automated, still go to Pending Review as
  before.

= 7.39.0 =
* Updated the Privacy Policy suggestion (Settings > Privacy) to clearly describe what WAD syncs
  and can remotely do when you connect this site to a WAD account, and to more accurately describe
  how long a banned IP address is kept after a ban is lifted.
* Banned IP addresses are now automatically cleaned up 90 days after a ban is lifted, instead of
  being kept forever.
* Uninstalling the plugin now also removes your WAD pairing information, so nothing is left behind.
* Hardened WAD's remote-action channel against a very old, previously-seen action being replayed.

= 7.38.0 =
* If connected to WAD, you can now unban an IP, and add or remove a trusted IP from your
  allowlist, directly from the WAD portal -- and your Firewall tab there now also shows which
  rules have been active in the last 24 hours. Your ban list on WAD also now always reflects your
  site's real, current bans (it previously only showed sample data).

= 7.37.1 =
* Hardening for the WAD remote settings added in 7.37.0: a remotely-adjusted custom login URL now
  goes through the exact same safety checks as changing it here in wp-admin (it can no longer be
  set to something that collides with a reserved WordPress path), and a value of the wrong type
  for a setting is rejected instead of applied.
* Fixed: requesting a scan from WAD while one was already running incorrectly reported success
  without actually starting a new scan.

= 7.37.0 =
* If connected to WAD, you can now see and manage a lot more remotely: run a security scan,
  restore or permanently delete a quarantined file, re-check for vulnerable plugins/themes, purge
  your page cache, and adjust Bot Protection, Form Protection, Cache & Performance, and general
  Settings -- all from the WAD portal, the same way it already worked for Backups and WAF mode.

= 7.36.0 =
* If connected to WAD, your Sites list there now always shows your real, current plugin version --
  previously it could get stuck showing an older version after an update.

= 7.35.0 =
* If connected to WAD, changes made there (like switching WAF mode, or a backup action) now
  apply within about a minute instead of up to an hour.

= 7.34.0 =
* Your WAD ID now shows up as soon as WAD connection is enabled, even before it's linked to an
  account -- previously it only appeared after fully connecting.

= 7.33.0 =
* If connected to WAD, you can now see and manage your backups remotely -- create a backup,
  restore or delete an existing one, and adjust the automatic schedule, all from the WAD portal.
  Nothing changes about how backups work locally; this just adds a remote view and controls on
  top of the same feature you already have here in wp-admin.

= 7.32.0 =
* WAD connection: your Installation ID is now shown clearly on the WAD Settings panel with a
  one-click copy button, and connecting no longer requires pasting a separate connection key --
  just start the connection on WAD and confirm a short code shown here, right in your WordPress
  admin.
* This also makes WAD able to support more remote actions over time (like managing backups),
  beyond just the WAF mode setting.

= 7.31.0 =
* New: optionally connect your site to WAD, a customer portal for managing all your protected
  sites in one place -- dashboards, licenses, and (progressively) remote settings. Fully optional
  and off by default; your site is fully protected either way.
* If connected, you can request a WAF mode change (Monitor/Block/Strict) from the WAD portal.
  Your site cryptographically verifies and applies the request itself -- nothing is ever changed
  without your site's own confirmation.

= 7.30.0 =
* If ARGUS Network is enabled, your site now shares richer fleet-visibility data (protected
  domain names, and aggregate counts of security activity like WAF/bot/login-abuse decisions) so
  ARGUS Network's fleet dashboard can show an accurate picture -- always totals, never individual
  visitor records.
* New: an ARGUS Network administrator can request a WAF mode change (Monitor/Block/Strict) for
  your site. Your site cryptographically verifies and applies the request itself -- nothing is
  ever changed without your site's own confirmation.
* Updated the Privacy Policy content this plugin adds to your site's policy page to reflect both
  of the above.

= 7.29.4 =
* Fixed the Security Score improving when a finding was simply marked "seen" (acknowledged)
  instead of actually resolved or accepted -- an acknowledged finding still needs your attention
  and now correctly keeps affecting your score until it's genuinely resolved.

= 7.29.2 =
* Fixed a bug where the Scanner's very first check of your site (or one run after resetting it)
  could flag every core WordPress file as suspicious at once, dropping your Security Score to 0
  for no real reason. A first-time check now quietly learns what your site looks like, exactly
  like every check after it, and only flags files that are genuinely new or changed.

= 7.29.1 =
* Findings no longer stay stuck as "Needs Attention" for routine actions ARGUS already handled
  automatically, like blocking or challenging a malicious request -- these clear on their own and
  no longer affect your Security Score. Genuine unresolved issues still show up and still count.
* Fixed wording that could describe an already-handled request incorrectly.
* Fixed the Global Threat Intelligence connection status incorrectly showing as unavailable in
  some cases.

= 7.29.0 =
* New: Form Protection -- stops automated spam and abuse on comments, registration, and popular
  contact-form plugins (Contact Form 7, WPForms, Gravity Forms), with no CAPTCHA and nothing for
  real visitors to prove. It also protects any other form on your site out of the box, including
  hand-written and page-builder forms, with no setup required.
* Several independent signals -- not just one rule -- are combined into a single risk score, so
  people sharing an office, school or mobile network are never blocked just for their address
  being busy.
* New Form Protection page: see what was blocked or held for review, which forms are being
  targeted, and adjust sensitivity, trusted addresses, and logging to match your site.

= 7.28.6 =
* Findings now clear from "Needs Attention" at a pace that matches their own severity, instead of
  all waiting up to 30 days -- a minor, already-stopped event (like a single blocked login attempt)
  no longer lingers in your list as long as a serious, ongoing attack does.
* Fixed a few more places (checkout-fraud protection among them) where an attack ARGUS had already
  stopped could still show up as something needing your attention.
* Fixed the Threats page on mobile, where two of its summary cards could squeeze into a narrow
  sliver instead of stacking one below the other.

= 7.28.5 =
* Fixed a serious bug where the firewall could block a real visitor (including search engines
  like Google) on sites using certain page-builder widgets, showing them a "Forbidden" page
  instead of your content -- and could go on to ban their IP address, keeping them locked out.
* The firewall no longer bans a visitor's IP address after a single suspicious-looking request --
  it still blocks that one request immediately as before, but only bans the IP once a real
  pattern of repeated or combined attack behavior is seen. Genuine attacks are still detected and
  blocked exactly as before; this only prevents an isolated false alarm from locking someone out.

= 7.28.4 =
* Fixed a bug where a brute-force login attack that ARGUS had already blocked could keep showing
  as an active finding and unnecessarily lower your Security Score, even though the attack was
  already stopped. Blocked attacks are now correctly marked as automatically handled.

= 7.28.3 =
* Fixed "Run a scan now" occasionally not returning to the Scanner page after starting a scan.
* Scan errors (for example, a scan already in progress) are now shown clearly instead of the
  button silently doing nothing.
* Improved the reliability of scheduled protection tasks (scans, threat intelligence updates,
  and firewall enforcement) so they keep running even in unusual hosting situations.

= 7.28.2 =
* License & Account now has clear sections (Overview, Account, License & Activation, Plan &
  Entitlements, Service Connection, Activity) instead of one long page, and the Activity list is
  now easy to page through.
* Scanner's File Integrity and Malware status now use the same clear protection indicator as the
  rest of the dashboard.
* The Intelligence page's threat chart now respects the time range you select instead of always
  showing the last 7 days.

= 7.28.1 =
* MFA is now a full Authentication & Access Security Center: see your account's protection status
  at a glance, with clearer policy and enrollment options.
* Settings has been split into focused sections (Overview, Protection, Automatic Updates, Access
  Control, Network & GeoIP) instead of one long page.
* Fixed a validation gap on the IP Whitelist field.

= 7.28.0 =
* Major dashboard refresh: Overview, Firewall, Bot Protection, Threats, Findings, Vulnerabilities,
  Cache & Performance, and Backups all got clearer layouts, real time-range filters (15 minutes up
  to 30 days), and easier navigation through large lists.
* Firewall now has one unified place to view, block, unblock, and whitelist IP addresses instead
  of two separate pages.
* Bot Protection now includes a searchable list of known bots and how they're classified, so you
  can see why a visitor was treated as safe, suspicious, or malicious.
* Findings now opens on what actually needs your attention, with search and filtering by severity
  and category.
* Fixed a bug where scheduled quick scans always reported "0 files scanned" in Scan History even
  though the scan really ran.
* Fixed an issue where the Vulnerabilities page could show a reassuring "no known vulnerabilities"
  message even when vulnerability data was actually unavailable or out of date.
* Fixed a bug where deleting your most recent backup left the dashboard pointing at a backup that
  no longer existed; Backups now also shows real storage usage instead of a size-history chart.
* Fixed inaccurate wording on the License & Account page's connection status, and removed
  background connection-check noise from the account Activity feed.
* Audit Log stats are now always exact instead of estimated from a sample, and its list is easier
  to page through.

= 7.27.3 =
* Fixed a mobile layout bug that made every admin page slightly wider than the screen, causing a
  small horizontal scroll -- most noticeable on the Bot Protection page's new charts.

= 7.27.2 =
* Bot Protection now shows charts for what kind of automated traffic was seen and acted on.
* Blocked bot traffic is now reflected in the Overview dashboard's own threat breakdown.

= 7.27.1 =
* Attack Types on the Threats page is back to a donut chart.

= 7.27.0 =
* Redesigned the Threats page: attack types and live threat activity now sit side by side for a
  quicker read.
* Added Bot Protection -- a new dedicated page to identify and act on automated traffic (known
  bad bots, AI crawlers, and generic scripts), while always keeping search engines allowed.

= 7.26.0 =
* Fixed a large empty gap that could appear below the dashboard content on shorter pages.
* Added a Light Mode / Dark Mode toggle to the ARGUS dashboard (top-right of the header) --
  your choice is remembered, and it follows your system setting until you choose one.

= 7.25.7 =
* The "Block an IP manually" and "auto-update every plugin/theme" actions now save instantly
  without reloading the page.

= 7.25.6 =
* Fixed uneven card sizing on the Quarantine and Cache & Performance pages, and removed a
  duplicated panel on the Compression tab.
* Quarantine, Backups, and Cache & Performance summary cards now explain what each number means.

= 7.25.5 =
* Redesigned the Threats page's summary tiles: each number now comes with a plain-language
  explanation, and Malicious IPs / Security Events show a breakdown of what's behind each count.

= 7.25.4 =
* Redesigned the Firewall page's summary tiles: each number now comes with a plain-language
  explanation of what it means, and Malicious IPs shows a breakdown of where those blocks came
  from.

= 7.25.3 =
* The ANIS Global Protection summary on the Overview dashboard now always agrees with Recent
  Intelligence Activity -- it no longer says "no threats detected" when ANIS has actually
  identified and blocked something.
* The Intelligence and ANIS pages have been combined into one clearer Intelligence page.
* Renamed "ARGUS Cloud" to "ARGUS Network" throughout, for consistency.

= 7.25.2 =
* Fixed a bug where a repeated request from an already-blocked visitor could overwrite how that
  block was originally attributed, making ARGUS Intelligence's protection numbers look lower than
  they really are.

= 7.25.1 =
* The Overview dashboard's Recent Firewall Activity panel now updates live and shows a clear
  explanation of what each protection number actually means, with a legend on every chart.
* Fixed a login-security finding that could show a misleadingly low failure count.
* Simplified some technical labels ("Local WAF" is now just "WAF").

= 7.25.0 =
* The Overview dashboard's key numbers now show a breakdown chart of what's actually behind each
  count, and you can instantly switch between Today, 7 Days, and 30 Days without the page reloading.

= 7.24.9 =
* Added trend sparklines to the Overview dashboard's key numbers, so you can see at a glance
  whether things are trending up or down, not just the current count.

= 7.24.8 =
* Fixed the ANIS Global Protection card on Overview losing its live animation.

= 7.24.7 =
* Scan History now updates automatically the moment a scan finishes -- no more manual page refresh
  to see the latest run.
* Replaced the "Scanning" icon with a clearer radar-sweep animation.

= 7.24.6 =
* The Cache & Performance page's "Refresh" controls and the Settings page's IP Whitelist no longer
  reload the whole page for a simple change -- they update instantly in place.

= 7.24.5 =
* Redesigned the Intelligence page: a clearer at-a-glance view of ARGUS's global threat network
  connection, how intelligence flows into your site's protection, every real intelligence source and
  its status, and recent intelligence activity -- all in one place.

= 7.24.4 =
* Fixed a Scanner bug that could report WordPress core files as deleted when they were never
  actually touched, on a Full Scan of a larger site. If you saw "core file was deleted" findings
  after running a Full Scan, please re-run it -- they should no longer reappear.

= 7.24.3 =
* Scanner: added a live progress ring showing real percentage complete on a full scan, and a
  running-scan indicator visible from any ARGUS page so you always know a scan is still working in
  the background, wherever you are in the dashboard.
* Redesigned the File Integrity and Malware status cards on the Scanner page into an at-a-glance
  dashboard layout.

= 7.24.2 =
* Redesigned the Scanner: scans now run in the background with live progress instead of tying up
  the page, so they never time out on large sites and you can keep working while one runs. Added a
  Stop button and expandable details on each past scan.
* Minor wording fix on the Settings page.

= 7.24.1 =
* Redesigned the Audit Log: a new activity summary (events over time, by type, and
  system-vs-administrator activity) at a glance, quick filter presets (Last 24 Hours, Security
  Events, Authentication, Bans, and more), and instant filtering/pagination that no longer reloads
  the whole page.

= 7.24.0 =
* Redesigned Compression: choose from simple presets (Balanced, Maximum Performance, Compatibility
  First, or Custom) instead of individual technical settings. Balanced and Maximum Performance now
  also minify HTML, CSS, and JavaScript for faster page loads, in addition to existing Gzip/Brotli
  compression.
* Redesigned Preload: choose a preload strategy (Smart Preload, Essential Pages, Full Site, or On
  Demand) instead of manually tuning technical preload settings. Clearer live status showing
  current preparation progress and cache health.

= 7.23.56 =
* Fixed an issue where, with a custom login URL configured, visiting the standard wp-admin address
  while logged out could reveal your custom login address instead of simply being blocked.

= 7.23.55 =
* Added optional HTTP security headers (helps protect against clickjacking and content-sniffing
  attacks).
* Added an optional custom login URL, so your login page isn't sitting at the address every
  automated attacker already knows to try first.
* File-integrity monitoring now also watches your .htaccess file, not just wp-config.php.
* Added optional checkout protection for WooCommerce stores: recognizes scripted/bot checkout
  attempts and repeated failed orders, a common sign of payment-fraud testing.
* Improved login protection to recognize credential-stuffing attacks (many different usernames
  tried from one source), not just simple repeated password guessing.
* ARGUS Cloud can now recognize when the same attack pattern is seen across multiple protected
  sites, strengthening protection for everyone connected.
* Simplified how this site connects to your ARGUS Account -- one-click connect, no code to copy.

= 7.23.54 =
* Redesigned the Global Network card on Overview: a compact live view of what ARGUS Cloud is
  actually doing for your site -- blocks, active protections, and recent activity -- in place of
  generic network statistics.

= 7.23.53 =
* The Global Network status now tells you exactly what's going on -- connected, still connecting for
  the first time, temporarily unavailable, a real connection error, or that your license needs
  renewing -- instead of always saying "still connecting" no matter what. A brief hiccup no longer
  interrupts an already-working connection either.

= 7.23.52 =
* A brief login slip-up that you then logged in normally from now clears itself from Findings,
  instead of sitting in Needs Attention.

= 7.23.51 =
* Fixed the previous fix: "Last Failed Update" could still briefly show a resolved problem right
  after updating. It now always matches whatever actually happened most recently.

= 7.23.50 =
* Fixed the Settings page sometimes showing an old "Last Failed Update" message even after a later
  update had already succeeded.

= 7.23.49 =
* Closed a way an unauthenticated visitor could still probe usernames through the site's REST API,
  even with the login page already hardened against this.

= 7.23.48 =
* Hardened login against username enumeration: a failed login attempt now always shows the same
  generic message, whether or not the username you tried actually exists on this site.

= 7.23.47 =
* You can now optionally link a site to your ARGUS Account, so it shows up alongside your other
  sites on your account dashboard. Never required to use ARGUS or the free trial.

= 7.23.46 =
* Findings for an attacking IP that ARGUS has since banned now clear themselves automatically,
  instead of sometimes sitting in "Needs Attention" until they aged out on their own.
* Added a standard WordPress Privacy Policy suggestion, describing what ARGUS Defence processes
  and why (Settings > Privacy).

= 7.23.45 =
* The License page now shows your service connection status (last check-in, next check), plugin
  version and update status, and a recent license activity history -- all in one place.
* Hardened license activation against repeated/automated attempts.

= 7.23.44 =
* Faster, smoother browsing on several pages (Audit Log, Vulnerabilities, Firewall, Cache &
  Performance, Quarantine) -- switching pages or filters no longer reloads the whole screen.
* Two-factor authentication reliability and security improvements.
* Added a new Legal & Privacy page.

= 7.23.43 =
* Added an optional ARGUS Account on the License page -- manage your license and see it across
  every site you run ARGUS on, in one place. Never required to use ARGUS or the free trial.

= 7.23.42 =
* Premium sites can now receive new firewall protection rules automatically, without waiting for
  a plugin update.

= 7.23.41 =
* Behind-the-scenes groundwork for a future update -- no visible changes in this release.

= 7.23.40 =
* The Findings page is now available to everyone -- you no longer need Premium to see what ARGUS
  has detected on your site.

= 7.23.39 =
* Your Protection Score now also factors in whether WordPress core, your plugins and themes are
  up to date, and whether you have at least one backup.
* Bug fixes and reliability improvements.

= 7.23.38 =
* Findings that ARGUS already handled automatically (a blocked WAF request, a blocked file
  upload, blocked REST user-enumeration probing) no longer sit in "Needs Attention" -- the same
  fix already shipped for brute-force login findings in 7.23.37 now covers every place this
  happened. Existing findings from before this fix are cleaned up automatically on update, not
  just new ones going forward.
* The Protection Score on Overview is now color-coded (green/yellow/orange/red) instead of always
  the same color regardless of how healthy your site actually is.
* Backup integrity is now fully automatic end to end -- no "Verify" button to click; ARGUS
  re-checks every backup's integrity once a day on its own, on top of the check it already does
  the moment a backup is created.
* The Backups page now displays properly on a phone.
* New "Purge Audit Log" option on the Audit Log page, for clearing it manually at any time.

= 7.23.37 =
* Backups can now be restored, not just created and downloaded. Every backup is automatically
  integrity-verified the moment it's created (with a "Verify" button to re-check any backup at
  any time), and restoring one first takes an automatic safety backup of your current state so a
  restore is always undoable.
* Brute-force login attempts that ARGUS has already blocked automatically no longer sit in Findings
  "Needs Attention" as if they require action from you.
* The Threats page now opens with the same at-a-glance summary cards (Threats Blocked Today,
  Malicious IPs, Blocked Requests, Security Events) already shown on Overview.
* The license status on Overview now shows which domain your Premium license or trial is activated
  for, and a clearer started/renews date range next to the countdown ring.

= 7.23.36 =
* Fixed a real gap found via a direct customer report: "Automatic Security Updates" kept your
  plugins and themes current, but not WordPress core itself -- a core security/point release could
  sit unapplied. It's now included too (major version upgrades are never forced automatically --
  you stay in control of those).

= 7.23.35 =
* The license days-remaining on Overview now shows as the same visual countdown ring the License
  page already uses, not just plain text.

= 7.23.34 =
* Overview now shows how many days are left on your active Premium license alongside the
  renewal/expiry date, matching what the trial state already showed.

= 7.23.33 =
* The self-check findings for scanner/update timing now use simpler, calmer wording instead of
  naming internal technical details -- they explain that it's usually temporary and clears on its
  own, with a clear next step if it doesn't.

= 7.23.32 =
* Fixed a real bug found on a live production site right after 7.23.31 shipped: the new
  self-health-check for the scanner and the update mechanism compared timestamps in the wrong
  format, so it could report "hasn't run in hours" / "hasn't checked in 2 days" even seconds after
  they genuinely had. Both are now correctly recognized as healthy when they actually are.

= 7.23.31 =
* Fixed: right after ARGUS checked for updates, its own health check could momentarily read that
  timestamp before it was refreshed and report "hasn't checked for updates" -- the two checks now
  run in the correct order.
* The health-check findings for scanner/update/intelligence timing now explain the most common
  real cause specifically -- WordPress's own scheduled-task system (WP-Cron) not firing reliably,
  common on low-traffic sites or hosts without a real system cron configured -- instead of a
  generic "contact support."

= 7.23.30 =
* Findings quality: routine, expected activity from legitimate plugins (like WooCommerce's cart/
  checkout endpoints and Jetpack's public API) no longer shows up as a security issue just because
  it doesn't require login -- ARGUS now recognizes it as normal.
* Fixed a real false-positive: a legitimate WordPress core update could previously be flagged as a
  suspicious file appearing or disappearing inside WordPress core. It's now correctly recognized as
  an expected part of the update.
* Fixed: repeated attacks matching the same firewall rule from different sources no longer create a
  growing pile of near-identical findings -- they're now tracked as one finding with an occurrence
  count, so your Findings list stays readable.
* Fixed: a vulnerability finding (including "WordPress core is out of date") now automatically
  clears itself once you actually update the affected plugin, theme, or WordPress core -- it no
  longer stays open forever, or gets duplicated every time a newer version comes out.
* Each finding now shows how confident ARGUS actually is (Confirmed, High confidence, Likely,
  Suspicious, or Informational), so it's clear what's been verified versus what's an inference.
* "Resolve All Open" is now "Archive All Open" -- same one-click way to clear your queue, but it no
  longer implies everything was fixed; archived findings stay fully available in your history.
* ARGUS now periodically checks its own health in the background (its files, database, scanner,
  firewall, quarantine storage, and update mechanism) and can fix common problems automatically;
  if something stays broken, you'll see it as a finding until it's verified resolved.
* Two-factor authentication data is now fully removed when you uninstall the plugin.
* Backups page: new charts showing your backup success/failure history and size trend over time.
* License page: "What's Included" is now a simple, readable list instead of a dense table.

= 7.23.28 =
* Redesigned the Overview page to be understandable at a glance, whether or not you know anything
  about website security: a single "Your website is protected" summary explains what's happening
  and whether you need to do anything, your protection score now explains itself ("Why is my score
  X?"), findings are shown in plain language instead of technical rule names, and ARGUS can turn
  your firewall back on for you with one click if it's ever off.
* The Firewall page's Rule Activity and Blocked IPs tables now lead with plain language (what was
  detected, how it was handled) instead of raw internal rule/ban codes -- the technical detail is
  still there behind a "Technical details" toggle for anyone who wants it.
* Settings is now organized into Protection, Automatic Protection, Account, and Advanced sections
  instead of one long list of unrelated panels.
* Calmed down the visual style throughout -- removed constant pulsing/glowing effects on routine,
  everything-is-fine status indicators; motion is now reserved for things that actually need your
  attention.

= 7.23.27 =
* Reverted the dashboard's visual redesign (sidebar navigation, larger ring cards) back to the
  familiar layout while keeping the real fixes that came with it:
  - The dashboard no longer scrolls the whole WordPress admin page -- the ARGUS header and
    navigation stay in place while only the dashboard content scrolls.
  - An active Premium license no longer shows "0 days left" next to a correct future renewal
    date.
  - The Blocked Requests chart's hover tooltip no longer fails on the most recent data point and
    no longer renders off-screen near the chart's edge.
  - IPs Tracked, ANIS Protections, and Global Network cards explain what a "0" means (not
    connected, still connecting, or genuinely clean) instead of showing a bare number, and the
    Global Network panel now shows correct instance/indicator/feed numbers instead of always
    showing 0.

= 7.23.26 =
* Fixed: the dashboard no longer scrolls the whole WordPress admin page -- the ARGUS navigation
  and header now stay in place while only the dashboard content scrolls, like a real application
  panel inside wp-admin (your normal WordPress menu is completely unaffected).
* Fixed: an active Premium license could show "0 days left" next to a correct future renewal
  date. The countdown now always matches the renewal date shown next to it.
* Fixed: the Global Network (ANIS) card could show 0 for every stat even when actually connected,
  due to a data-mapping bug -- real connected-instance, indicator, and feed-health numbers now
  display correctly.
* Cards that used to show a bare "0" (ANIS Protections, IPs Tracked, Global Network) now explain
  what that means -- not connected, still connecting, or genuinely clean -- instead of looking
  broken or empty.
* The License card clearly distinguishes Premium Active, Free Trial, and Expired, each with its
  own explanation and call to action.
* The main "Blocked Requests" chart is now a real analytics chart: labeled axes, hover tooltips
  showing the exact breakdown by threat type (not just a total), and a category legend.
* Dashboard cards and charts are noticeably larger and denser, closer to the rest of the ARGUS
  product family's look.

= 7.23.25 =
* Redesigned the entire admin dashboard to match the rest of the ARGUS product family: a
  persistent navigation sidebar with a status bar (protection state, version, notifications,
  account) above it, replacing the old horizontal tab bar. Your normal WordPress admin menu is
  untouched -- this lives alongside it, not instead of it.
* The Overview page has been rebuilt around ring-style stat cards with trend sparklines, an
  hoverable blocked-requests chart with an exact-value tooltip, a Global Network card summarizing
  your ARGUS Cloud connection, and Top Threat Types / Top Blocked IPs / Recent Activity at a
  glance -- all real data, nothing decorative implies a number that isn't actually tracked.
* Every other page (Firewall, Threats, Findings, Scanner, Quarantine, Cache & Performance,
  Backups, Vulnerabilities, Intelligence, ANIS, Audit Log, MFA, License, Settings) now shares the
  same navigation and visual language.

= 7.23.24 =
* Clarified what's included without an active trial or license: core protection (firewall, ban
  engine, malware/integrity scanning, quarantine) always keeps running and WordPress is never
  disabled. On this Base tier, the Findings page, the ANIS Global Threat Network connection, and
  automatic scheduled backups require a trial or license; automatic scanning runs weekly instead
  of hourly (manual scans and backups are always available regardless).
* The License page has been redesigned: a countdown ring shows days remaining and your exact
  expiration date, and a new "What's Included" table shows exactly what each tier includes, with
  quick-jump links to every section.
* Fixed: a file change made by a normal WordPress, plugin, theme, or ARGUS update could sometimes
  be left flagged as an unresolved suspicious-file finding instead of being automatically resolved
  like other update-related changes.
* Scheduled backups now pace themselves to avoid competing with normal site traffic.

= 7.23.23 =
* Premium license management now has its own dedicated "License" page (moved out of Settings):
  status, your license key (safely masked), renewal date, and a new option to deactivate a key on
  this site.

= 7.23.22 =
* The Findings page now updates instantly when you switch filters or change pages -- no more full
  page reload for something that small. Same Back/Forward and copy-link behavior as before.

= 7.23.21 =
* Fixed the new mobile navigation strip so it's clear there are more sections to scroll to -- it
  only showed the first few before.
* Fixed a real cross-browser rendering issue that could make the "Blocked Requests" chart appear
  completely blank on some phones/browsers.
* The Security Score card is now a clickable link straight to your Findings, and MFA backup codes
  now display correctly on small screens.
* Vulnerability status and Firewall Rule Activity now use donut charts and a compact "all clear"
  indicator, consistent with the rest of the dashboard.

= 7.23.20 =
* Improved the admin dashboard on phones and small tablets: wide tables (blocked IPs, WAF rule
  activity, vulnerabilities) now show as easy-to-read cards instead of a cramped, tiny table, the
  top navigation scrolls smoothly instead of wrapping into several rows, and a layout bug that
  caused the whole page to scroll sideways on narrow screens is fixed.

= 7.23.19 =
* Hardened the optional page cache: cached pages can no longer be reached directly as raw files --
  every request still goes through ARGUS's normal security checks, including an active IP block,
  before anything is served.
* Fixed a rare timing issue where, under heavy simultaneous traffic to the same page right as its
  cache was refreshing, a visitor could in theory receive an incomplete page. Cache updates are now
  published in a single, all-or-nothing step.

= 7.23.18 =
* Added a way to download your MFA backup codes as a file right after they're generated, so you
  don't have to copy them down by hand. You can optionally protect the file with your own
  passphrase -- it's encrypted in your browser before saving, and a matching offline tool (linked
  from the same page) lets you read it back later even if you can't reach your site's admin area.
* Fixed an edge case in Safe Mode (the wp-config.php recovery switch) where a fresh security event
  happening while Safe Mode was on could still block the request -- Safe Mode now reliably means no
  blocking at all, matching what it has always said it does.

= 7.23.17 =
* Reduced false-positive security findings for recognized WordPress and WooCommerce functionality
  -- normal, expected WooCommerce cart/storefront activity no longer shows up as a security issue
  requiring your attention.
* Findings you resolve or accept no longer reappear on their own within the hour.
* Added a new "Automatically Handled" section on the Findings page, showing what ARGUS verified
  and handled on its own -- separate from anything you decided yourself.
* Replaced "Delete" with "Archive" for findings -- your security history is kept, not destroyed,
  when you clear something from your queue.
* Findings actions (Acknowledge, Resolve, Accept Risk, Archive) now show a short explanation of
  what each one actually means.
* The Security Score and Findings counts on the dashboard no longer count routine technical
  inventory as active security issues.
* An ARGUS Defence update verified through its own signed update process is no longer shown as a
  file-integrity warning.

= 7.23.16 =
* Vulnerability checking now also runs immediately whenever a plugin or theme is installed or
  updated (when connected to ARGUS Cloud), instead of only on the regular hourly schedule -- so you
  find out right away if something you just installed has a known issue. The regular hourly check
  continues to run as before for everything else.

= 7.23.15 =
* Added a "Force Scan Now" button to the Vulnerabilities page -- checks WordPress core, and (when
  connected to ARGUS Cloud) plugins and themes, immediately instead of waiting for the next
  automatic check.

= 7.23.14 =
* Fixed a serious bug: the Firewall could block ordinary visitors just for arriving from an
  everyday link -- for example, a link shared on Facebook, whose own redirect URL happened to
  match a pattern the Firewall treated as suspicious. The underlying cause was broader than that
  one case: 132 of the Firewall's 137 protection rules were checking a visitor's Referer,
  User-Agent, and X-Forwarded-For information -- values a visitor doesn't control -- when they
  should only ever have been checking what a visitor actually submits (search terms, form fields,
  comments, and similar). Those three values are now excluded everywhere except the handful of
  rules that specifically need them (Log4Shell-style attacks are delivered through exactly those
  values, so detection there is unchanged). No settings change needed; this takes effect
  automatically.

= 7.23.13 =
* Plugin and theme vulnerability detection is now real when connected to ARGUS Cloud (previously
  showed "Check Pending" indefinitely for plugins/themes -- WordPress core currency checking
  already worked). No settings change needed if ARGUS Cloud is already connected; it starts
  syncing automatically.

= 7.23.12 =
* Fixed a serious bug: the Firewall could block your own navigation to ordinary wp-admin pages
  (Dashboard, Users, Plugins, Tools, Settings, and others) with no query string in the URL. A
  single overly broad security rule treated any URL ending in ".php" as suspicious -- which is
  every plain WordPress admin page. Removed that rule; all other protection is unaffected.
* The Two-Factor Authentication code-entry screen (shown during login) now has a proper Argus
  Defence look instead of a plain WordPress-styled page.

= 7.23.11 =
* Two-Factor Authentication now has its own dedicated "Argus Defence MFA" page (Settings still
  links to it) and shows a real scannable QR code during setup -- no more typing in a long setup
  key by hand unless you want to.

= 7.23.10 =
* New: Two-Factor Authentication. Turn it on from Settings to require a code from an
  authenticator app (Google Authenticator, Authy, 1Password, etc.) in addition to your password
  when logging into wp-admin. Includes one-time backup codes for if you lose access to your
  authenticator app.

= 7.23.9 =
* Fixed the Firewall and Intelligence pages showing "43" active rules -- the real number (138,
  including the OWASP CRS signatures added in 7.23.4) was already fully active and protecting your
  site, this only fixes what was displayed.

= 7.23.8 =
* Settings/Overview: the Premium panel now clearly shows "Connected -- Premium" or "Connected --
  Trial" with the real expiry date, persistently -- not just as a message right after activating.
* Fixed a real bug: submitting the license form with an empty field could wipe out an already-
  active license. The key is never shown back to you once entered (masked), and a blank submission
  is now always a safe no-op.
* Fixed getting stuck on "Connecting..." after activation -- a failed background check now retries
  within minutes instead of waiting up to 12 hours.
* Automatic updates now check every 5 minutes instead of every 6 hours.

= 7.23.7 =
* Fixed a real false-positive: updating a plugin (including ARGUS itself) could, in rare cases, get
  your own IP address extended-banned by the correlation engine, locking you out of wp-admin.
  Legitimate plugin/theme/core updates are now correctly recognized and never treated as suspicious.
* Added an emergency Safe Mode (a wp-config.php constant, see the plugin's README) that instantly
  disables all blocking if you're ever locked out for any reason, without needing database access.

= 7.23.6 =
* Settings: after an update installs, you'll now see a plain-language "What's new" summary right
  there, instead of having to go looking for a changelog -- signed as part of the update itself, so
  it can't be tampered with.

= 7.23.5 =
* Automatic updates: the update channel is now configured automatically, the same way ARGUS Cloud
  and the license service already are -- no wp-config.php editing required. A site updating from
  an older version still needs one manual update to reach this release; every update after that
  is fully automatic.

= 7.23.4 =
* Firewall: real OWASP Core Rule Set (CRS) 4.26.0 signatures ported into the local firewall engine
  -- 95 additional rules across SQL injection, XSS, command injection, PHP injection, path
  traversal, remote file inclusion, generic injection, and Java/JNDI injection, adapted from the
  real, current CRS ruleset rather than hand-written approximations.
* Firewall: cookies are now inspected the same way as GET/POST parameters.

= 7.23.3 =
* Premium trial: no signup or login is required to use ARGUS or start the 30-day trial anymore --
  it starts automatically, tracked by your site's domain, the moment the plugin is active.
  Uninstalling and reinstalling the plugin no longer resets it. Local protection (firewall,
  scanner, quarantine, hardening) keeps working in full after the trial ends, whether or not you
  upgrade.

= 7.23.2 =
* Settings: added a License section -- a 30-day trial with everything active, then enter a
  license key to keep Premium features. Protection never stops regardless of license status.
* Intelligence page: rewrote descriptions in plain language focused on what's protecting your
  site, not internal implementation details.

= 7.23.1 =
* Automatic updates: fixed a bug where a normal (non-critical) update would be detected and
  shown as available, but never actually installed -- now any newer, compatible, verified
  update installs automatically, the same way updates to other plugins already do.

= 7.23.0 =
* Firewall: broadened local rule coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, and deeper SQL injection / XSS / PHP injection signatures).
* Scanner: fixed a case where a quarantined file's severity label and its content-analysis score
  could disagree; both are now always shown together and derived consistently.
* Console: the running plugin version is now shown in the admin header.
* First production release: firewall, scanner, quarantine, vulnerability protection, backups,
  cache & performance, and automatic global threat intelligence.
