ARGUSandClaude Sonnet 5
35efd3e485
Real changes since 1.0.0, all live-verified before this release: - Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool detection, deeper SQL injection/XSS/PHP-injection). - Fixed a real bug: a quarantined file's severity badge and its content analysis score could disagree with no explanation (e.g. a benign file showing CRITICAL next to Score 0); both are now derived consistently and shown together. - ARGUS now always keeps itself updated, and can optionally do the same for every other installed plugin and theme (Settings, on by default) -- uses WordPress's own native update system, nothing custom. - Global Threat Intelligence is now opt-in, not automatic -- a single click on its own page, with an honest, specific description of exactly what's shared (an IP address, a reason code, a confidence score, a country). Previously connected automatically on activation. - New first-run Welcome screen after activation: confirms what's already protecting the site, and surfaces the few real optional choices in one place. - Dashboard: running version now visible in the header; new "IPs Tracked" and "ANIS Protections" metrics. - Full WordPress.org Plugin Directory readiness audit performed against this codebase. Two real compliance issues found and fixed (see above: Global Threat Intelligence's default, and the self-update mechanism, which is excluded from this build entirely -- WordPress.org prohibits a plugin from using any update channel other than its own, even an inert one). This release is still self-distributed, not a WordPress.org submission -- that remains a future step. Verified before publishing: this exact ZIP was installed, activated (14 admin pages loaded clean, zero PHP errors/warnings), and uninstalled (zero leftover database tables or options) in a fresh, disposable WordPress + MySQL environment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
109 lines
5.0 KiB
Markdown
109 lines
5.0 KiB
Markdown
# ARGUS WordPress Defence
|
|
|
|
Automatic WordPress security. A local firewall, malware and file-integrity scanning,
|
|
vulnerability protection, and scheduled backups — protecting your site with zero manual
|
|
configuration required.
|
|
|
|
**Version:** 7.23.0
|
|
**Requires:** WordPress 6.0+, PHP 7.4+
|
|
**License:** GPLv2 or later
|
|
|
|
## What it does
|
|
|
|
- **Firewall** — blocks malicious requests (SQL injection, cross-site scripting, remote code
|
|
execution, XXE, SSRF, and more) before they reach your site.
|
|
- **Scanner** — regularly checks WordPress core, plugins, and themes for suspicious files
|
|
and integrity changes, and quarantines confirmed threats instead of just reporting them.
|
|
- **Vulnerability Protection** — checks your installed plugins, themes, and WordPress core
|
|
against known security issues.
|
|
- **Backups** — scheduled recovery points for your site's database and files, stored
|
|
outside the web root.
|
|
- **Cache & Performance** — an optional page cache that can make your site faster, built
|
|
to never interfere with the firewall or bans.
|
|
- **Automatic Updates** — ARGUS always keeps itself up to date, and can optionally do the
|
|
same for every other installed plugin and theme.
|
|
- **Global Threat Intelligence (optional)** — share reputation data about the IP addresses
|
|
ARGUS blocks with a global network, and benefit from what every other connected site has
|
|
already seen. Off by default — turning it on is a single click, no fields to fill in, and
|
|
its own settings page shows exactly what is and isn't shared.
|
|
|
|
Everything except Global Threat Intelligence works out of the box. There is nothing to
|
|
configure to get protected.
|
|
|
|
## Status
|
|
|
|
This is a self-distributed release: it is not listed on WordPress.org and has not gone
|
|
through that team's plugin review process (a submission is planned for the future — this
|
|
release is not it).
|
|
|
|
- **Not independently security audited.** It has been reviewed internally (code review,
|
|
static checks, a manual security pass over authentication/authorization/nonce/SQL
|
|
handling), but no third-party security audit or penetration test has been performed.
|
|
- **No CI pipeline yet.** Tests are run manually before each release, not on every commit.
|
|
- **Tested in sandbox/disposable WordPress environments.** Verification so far — install,
|
|
activation, all admin pages, deactivation, uninstall — was done on disposable WordPress
|
|
instances, not on live production sites.
|
|
- **Automatic updates for ARGUS itself are not currently active.** The signed-update
|
|
mechanism is built in but requires production update infrastructure (a manifest server
|
|
and signing key) that is not yet deployed. See [Updating](#updating) below for how to
|
|
update manually. Automatic updates for *other* plugins/themes on your site, if you enable
|
|
that option, use WordPress's own built-in update system and work today.
|
|
|
|
## Installation
|
|
|
|
1. Download the latest release ZIP (see [Releases](#releases) below).
|
|
2. In your WordPress admin: **Plugins → Add New → Upload Plugin**, choose the downloaded
|
|
ZIP, then **Install Now**.
|
|
3. Click **Activate**.
|
|
|
|
That's it — ARGUS Defence begins protecting your site automatically. A short Welcome screen
|
|
walks through what's already active and a couple of optional choices (a site-type template,
|
|
Global Threat Intelligence). A new **ARGUS Defence** menu also appears in your wp-admin
|
|
sidebar with an overview of your site's protection status.
|
|
|
|
## Updating
|
|
|
|
Automatic in-dashboard updates require an update channel to be configured for your
|
|
deployment (`ARGUS_WPD_UPDATE_MANIFEST_URL` and `ARGUS_WPD_UPDATE_PUBLIC_KEY` in
|
|
`wp-config.php`). Without one configured, update the plugin the same way you installed
|
|
it: download the new release ZIP and upload it again through **Plugins → Add New →
|
|
Upload Plugin** — WordPress will offer to replace the existing version.
|
|
|
|
## Uninstalling
|
|
|
|
Deactivate and delete the plugin from the **Plugins** page as you would any other
|
|
WordPress plugin. All ARGUS Defence data (settings, scan history, quarantined files,
|
|
database tables) is removed automatically — nothing is left behind.
|
|
|
|
## Releases
|
|
|
|
Each release is published as a ZIP with an accompanying SHA-256 checksum. Verify the
|
|
download before installing it on a production site:
|
|
|
|
```
|
|
sha256sum argus-wordpress-defence-X.Y.Z.zip
|
|
```
|
|
|
|
Compare the result against the checksum published alongside that release.
|
|
|
|
## Source layout
|
|
|
|
```
|
|
argus-wordpress-defence.php Plugin entry point (admin UI, cron, activation)
|
|
mu-loader/ Tamper-resistant enforcement core (installed as a Must-Use
|
|
plugin, keeps running even if the main plugin is deactivated)
|
|
includes/ Firewall, ban/policy engine, scanner, quarantine, backups,
|
|
vulnerability intelligence, cache
|
|
admin/ wp-admin dashboard and settings pages
|
|
bin/ Release packaging and signing tools (not shipped in the
|
|
plugin ZIP)
|
|
```
|
|
|
|
## Support
|
|
|
|
Please open an issue in this repository.
|
|
|
|
## License
|
|
|
|
GPLv2 or later. See [LICENSE](LICENSE).
|