ARGUSandClaude Sonnet 5
35efd3e485
Real changes since 1.0.0, all live-verified before this release: - Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool detection, deeper SQL injection/XSS/PHP-injection). - Fixed a real bug: a quarantined file's severity badge and its content analysis score could disagree with no explanation (e.g. a benign file showing CRITICAL next to Score 0); both are now derived consistently and shown together. - ARGUS now always keeps itself updated, and can optionally do the same for every other installed plugin and theme (Settings, on by default) -- uses WordPress's own native update system, nothing custom. - Global Threat Intelligence is now opt-in, not automatic -- a single click on its own page, with an honest, specific description of exactly what's shared (an IP address, a reason code, a confidence score, a country). Previously connected automatically on activation. - New first-run Welcome screen after activation: confirms what's already protecting the site, and surfaces the few real optional choices in one place. - Dashboard: running version now visible in the header; new "IPs Tracked" and "ANIS Protections" metrics. - Full WordPress.org Plugin Directory readiness audit performed against this codebase. Two real compliance issues found and fixed (see above: Global Threat Intelligence's default, and the self-update mechanism, which is excluded from this build entirely -- WordPress.org prohibits a plugin from using any update channel other than its own, even an inert one). This release is still self-distributed, not a WordPress.org submission -- that remains a future step. Verified before publishing: this exact ZIP was installed, activated (14 admin pages loaded clean, zero PHP errors/warnings), and uninstalled (zero leftover database tables or options) in a fresh, disposable WordPress + MySQL environment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
140 lines
9.1 KiB
PHP
140 lines
9.1 KiB
PHP
<?php
|
|
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
$argus_active_page = 'welcome';
|
|
include ARGUS_WPD_DIR . 'admin/views/partials/header.php';
|
|
|
|
$features = array(
|
|
array(
|
|
'title' => __( 'Firewall', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Blocks malicious requests -- SQL injection, cross-site scripting, and dozens of other known attack patterns -- before they reach your site.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['waf_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'Malware Scanner & Quarantine', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Watches for suspicious files, moves anything genuinely dangerous into a protected quarantine automatically, and lets you review or restore it.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['malware_scan_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'File Integrity Monitoring', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Cross-checks WordPress core against official checksums and tracks plugin/theme file changes, so tampering doesn\'t go unnoticed.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['integrity_scan_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'Login & Brute-Force Protection', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Detects and blocks repeated failed login attempts, and locks down XML-RPC/REST API endpoints commonly abused for credential-stuffing.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['login_protection_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'Vulnerability Intelligence', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Checks WordPress core and every installed plugin/theme version against known security issues, so you know what needs updating and why.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['vuln_intel_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'Backups', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Scheduled database and file backups, stored securely, so you have a real recovery point if something ever goes wrong.', 'argus-wordpress-defence' ),
|
|
'active' => 'automatic' === $settings['backup_schedule_mode'],
|
|
),
|
|
array(
|
|
'title' => __( 'Automatic Updates', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'ARGUS always keeps itself up to date, and can optionally do the same for every other plugin and theme -- unpatched software is one of the most common ways sites get compromised.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['auto_update_all_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'Cache & Performance', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'An optional page cache that can make your site noticeably faster -- it never bypasses the firewall or serves cached pages to already-blocked visitors.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['static_cache_enabled'],
|
|
),
|
|
array(
|
|
'title' => __( 'ARGUS Cloud (Global Threat Intelligence)', 'argus-wordpress-defence' ),
|
|
'desc' => __( 'Optional: share reputation data about IPs ARGUS blocks with a global network, and benefit from what every other connected site has already seen.', 'argus-wordpress-defence' ),
|
|
'active' => $settings['anis_enabled'],
|
|
),
|
|
);
|
|
?>
|
|
|
|
<div class="argus-wpd-welcome-hero">
|
|
<h1><?php esc_html_e( 'Welcome to ARGUS Defence', 'argus-wordpress-defence' ); ?></h1>
|
|
<p><?php esc_html_e( 'Your site is already protected -- ARGUS activated its core defenses the moment you installed it. Nothing below is required. It\'s here so you know exactly what\'s running, and to offer a couple of optional upgrades.', 'argus-wordpress-defence' ); ?></p>
|
|
</div>
|
|
|
|
<?php if ( ! empty( $template_applied ) ) : ?>
|
|
<div class="notice notice-success" style="padding:14px 18px;margin:0 0 20px;"><p style="margin:0">
|
|
<?php printf( esc_html__( '"%s" protection template applied. You can fine-tune anything later in Settings.', 'argus-wordpress-defence' ), esc_html( $template_applied ) ); ?>
|
|
</p></div>
|
|
<?php endif; ?>
|
|
|
|
<div class="argus-wpd-panel">
|
|
<h2><?php esc_html_e( 'What\'s protecting your site right now', 'argus-wordpress-defence' ); ?></h2>
|
|
<div class="argus-wpd-feature-grid">
|
|
<?php foreach ( $features as $feature ) : ?>
|
|
<div class="argus-wpd-feature-card">
|
|
<div class="argus-wpd-feature-card-head">
|
|
<span class="argus-wpd-feature-card-title"><?php echo esc_html( $feature['title'] ); ?></span>
|
|
<span class="argus-wpd-status-pill"><?php echo $feature['active'] ? esc_html__( 'ACTIVE', 'argus-wordpress-defence' ) : esc_html__( 'OFF', 'argus-wordpress-defence' ); ?></span>
|
|
</div>
|
|
<p class="argus-wpd-feature-card-desc"><?php echo esc_html( $feature['desc'] ); ?></p>
|
|
</div>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
</div>
|
|
|
|
<?php if ( ! empty( $templates ) ) : ?>
|
|
<div class="argus-wpd-panel">
|
|
<h2><?php esc_html_e( 'Optional: tailor it to your site', 'argus-wordpress-defence' ); ?></h2>
|
|
<p style="color:var(--faint);font-size:12.5px;margin:-8px 0 16px;"><?php esc_html_e( 'A starting point, not a lock-in -- applying a template sets sensible defaults, which you can hand-tune later in Settings.', 'argus-wordpress-defence' ); ?></p>
|
|
<div class="argus-wpd-template-grid">
|
|
<?php foreach ( $templates as $key => $template ) : ?>
|
|
<div class="argus-wpd-template-card<?php echo $active_template === $key ? ' active' : ''; ?>">
|
|
<div class="argus-wpd-template-title">
|
|
<?php echo esc_html( $template['label'] ); ?>
|
|
<?php if ( $recommended_template === $key ) : ?><span class="argus-wpd-template-badge"><?php esc_html_e( 'Recommended -- store plugin detected', 'argus-wordpress-defence' ); ?></span><?php endif; ?>
|
|
<?php if ( $active_template === $key ) : ?><span class="argus-wpd-template-badge active"><?php esc_html_e( 'Currently applied', 'argus-wordpress-defence' ); ?></span><?php endif; ?>
|
|
</div>
|
|
<p class="argus-wpd-template-desc"><?php echo esc_html( $template['description'] ); ?></p>
|
|
<form method="post">
|
|
<?php wp_nonce_field( 'argus_wpd_apply_template', 'argus_wpd_apply_template_nonce' ); ?>
|
|
<input type="hidden" name="template" value="<?php echo esc_attr( $key ); ?>" />
|
|
<button type="submit" class="button<?php echo $active_template === $key ? '' : ' button-primary'; ?>"><?php echo $active_template === $key ? esc_html__( 'Re-apply', 'argus-wordpress-defence' ) : esc_html__( 'Apply', 'argus-wordpress-defence' ); ?></button>
|
|
</form>
|
|
</div>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<div class="argus-wpd-panel">
|
|
<h2><?php esc_html_e( 'Optional: keep everything patched automatically', 'argus-wordpress-defence' ); ?></h2>
|
|
<p style="color:var(--faint);font-size:12.5px;margin:-8px 0 16px;"><?php esc_html_e( 'ARGUS always updates itself. Turning this on extends the same automatic updates to every other installed plugin and theme -- unpatched software is one of the most common ways WordPress sites get compromised.', 'argus-wordpress-defence' ); ?></p>
|
|
<form method="post">
|
|
<?php wp_nonce_field( 'argus_wpd_save_auto_update_all', 'argus_wpd_auto_update_all_nonce' ); ?>
|
|
<label style="display:block;"><input type="checkbox" name="auto_update_all_enabled" <?php checked( $settings['auto_update_all_enabled'] ); ?> /> <?php esc_html_e( 'Also auto-update every other installed plugin and theme (recommended)', 'argus-wordpress-defence' ); ?></label>
|
|
<button type="submit" class="button" style="margin-top:10px;"><?php esc_html_e( 'Save', 'argus-wordpress-defence' ); ?></button>
|
|
</form>
|
|
</div>
|
|
|
|
<div class="argus-wpd-panel">
|
|
<h2><?php esc_html_e( 'Optional: connect to ARGUS Cloud', 'argus-wordpress-defence' ); ?></h2>
|
|
<?php if ( $settings['anis_enabled'] ) : ?>
|
|
<p style="font-size:13px;color:var(--emerald);margin:0;">✓ <?php esc_html_e( 'Connected. Manage this any time on the ANIS page.', 'argus-wordpress-defence' ); ?></p>
|
|
<?php else : ?>
|
|
<p style="font-size:13px;color:var(--faint);margin:0 0 16px;line-height:1.7;"><?php esc_html_e( 'Shares reputation data about IPs ARGUS blocks on your site with a global intelligence network, and benefits from what every other connected site has already seen. What this shares, honestly: the visitor\'s IP address, a short reason code, a confidence score, and (if resolvable) its country. Nothing else -- never usernames, passwords, or page content. Off by default because an IP address can be personal data; you can disconnect any time from the ANIS page.', 'argus-wordpress-defence' ); ?></p>
|
|
<form method="post">
|
|
<?php wp_nonce_field( 'argus_wpd_anis_toggle', 'argus_wpd_anis_toggle_nonce' ); ?>
|
|
<input type="hidden" name="anis_action" value="enable" />
|
|
<button type="submit" class="button button-primary"><?php esc_html_e( 'Connect to ARGUS Cloud', 'argus-wordpress-defence' ); ?></button>
|
|
</form>
|
|
<?php endif; ?>
|
|
</div>
|
|
|
|
<div class="argus-wpd-panel" style="text-align:center;">
|
|
<h2 style="margin-bottom:10px;"><?php esc_html_e( 'You\'re all set', 'argus-wordpress-defence' ); ?></h2>
|
|
<p style="color:var(--faint);font-size:13px;margin:0 0 18px;"><?php esc_html_e( 'ARGUS Defence is protecting your site. Come back to this checklist any time from Settings if you want to revisit these choices.', 'argus-wordpress-defence' ); ?></p>
|
|
<a class="button button-primary button-hero" href="<?php echo esc_url( admin_url( 'admin.php?page=argus-wpd-dashboard' ) ); ?>"><?php esc_html_e( 'Go to Dashboard', 'argus-wordpress-defence' ); ?></a>
|
|
</div>
|
|
|
|
<?php include ARGUS_WPD_DIR . 'admin/views/partials/footer.php'; ?>
|