argus-wp-defence/README.md

ARGUS WordPress Defence

Automatic WordPress security. A local firewall, malware and file-integrity scanning, vulnerability protection, and scheduled backups — protecting your site with zero manual configuration required.

Version: 1.0.0 Requires: WordPress 6.0+, PHP 7.4+ License: GPLv2 or later

What it does

• Firewall — blocks malicious requests (SQL injection, cross-site scripting, and more) before they reach your site.
• Scanner — regularly checks WordPress core, plugins, and themes for suspicious files and integrity changes, and quarantines confirmed threats instead of just reporting them.
• Vulnerability Protection — checks your installed plugins, themes, and WordPress core against known security issues.
• Backups — scheduled recovery points for your site's database and files, stored outside the web root.
• Cache & Performance — an optional page cache that can make your site faster, built to never interfere with the firewall or bans.
• Global Threat Intelligence — automatically connected, no setup required.

Everything works out of the box. There is nothing to configure to get protected.

Status

This is a self-distributed release: it is not listed on WordPress.org and has not gone through that team's plugin review process.

• Not independently security audited. It has been reviewed internally (code review, static checks, a manual security pass over authentication/authorization/nonce/SQL handling), but no third-party security audit or penetration test has been performed.
• No CI pipeline yet. Tests are run manually before each release, not on every commit.
• Tested in sandbox/disposable WordPress environments. Verification so far — install, activation, all admin pages, deactivation, uninstall — was done on disposable WordPress instances, not on live production sites.
• Automatic updates are not currently active. The signed-update mechanism is built in but requires production update infrastructure (a manifest server and signing key) that is not yet deployed. See Updating below for how to update manually.

Installation

1. Download the latest release ZIP (see Releases below).
2. In your WordPress admin: Plugins → Add New → Upload Plugin, choose the downloaded ZIP, then Install Now.
3. Click Activate.

That's it — ARGUS Defence begins protecting your site automatically. A new ARGUS Defence menu appears in your wp-admin sidebar with an overview of your site's protection status.

Updating

Automatic in-dashboard updates require an update channel to be configured for your deployment (ARGUS_WPD_UPDATE_MANIFEST_URL and ARGUS_WPD_UPDATE_PUBLIC_KEY in wp-config.php). Without one configured, update the plugin the same way you installed it: download the new release ZIP and upload it again through Plugins → Add New → Upload Plugin — WordPress will offer to replace the existing version.

Uninstalling

Deactivate and delete the plugin from the Plugins page as you would any other WordPress plugin. All ARGUS Defence data (settings, scan history, quarantined files, database tables) is removed automatically — nothing is left behind.

Releases

Each release is published as a ZIP with an accompanying SHA-256 checksum. Verify the download before installing it on a production site:

sha256sum argus-wordpress-defence-X.Y.Z.zip

Compare the result against the checksum published alongside that release.

Source layout

argus-wordpress-defence.php   Plugin entry point (admin UI, cron, activation)
mu-loader/                    Tamper-resistant enforcement core (installed as a Must-Use
                               plugin, keeps running even if the main plugin is deactivated)
includes/                     Firewall, ban/policy engine, scanner, quarantine, backups,
                               vulnerability intelligence, cache
admin/                        wp-admin dashboard and settings pages
bin/                          Release packaging and signing tools (not shipped in the
                               plugin ZIP)

Support

Please open an issue in this repository.

License

GPLv2 or later. See LICENSE.