=== itsMalicious – Security, Malware Scanner, Firewall & Gambling Spam Cleaner ===
Contributors: mahbubmasum
Tags: security, malware, firewall, scanner, two-factor
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Complete security suite: malware scanner & cleaner, web application firewall, brute force protection, IP/country blocking, 2FA, live traffic and gambling-spam Content Guard.

== Description ==

**itsMalicious** protects your WordPress site automatically from the moment you activate it, and gives you the tools to find and clean an infection yourself.

= Scanner & cleaner =
* Compares WordPress core and WordPress.org plugin files against official checksums, flags modified, missing and unknown files and **repairs them with one click**.
* Built-in malware signatures for backdoors, webshells, obfuscated code, SEO/pharma spam, cryptominers, card skimmers, JavaScript injections and known malicious domains.
* Scans posts, comments, widgets, theme options and menus for injected scripts and dangerous URLs.
* Finds vulnerable plugins, themes and core versions (WPVulnerability feed), outdated and abandoned plugins.
* Checks for weak and breached passwords, suspicious administrator accounts, publicly reachable backup/config/log files, directory listing, debug mode, disk space, server errors and domain/IP blocklists.
* Quick, Limited, Standard, High Sensitivity and Custom scan types; automatic or manually scheduled scans; resumable, low-resource, time- and memory-limited.
* **Quarantine**: every file you delete or repair is backed up first and can be restored.
* Optional proactive clean-up that quarantines critical malware the moment it is found.

= Gambling spam Content Guard =
* Detects casino / judi slot / togel / betting spam keywords in any language (editable list, allowlist).
* Blocks new posts, pages, comments, profile fields, categories and site title/tagline that contain them, including through the REST API and XML-RPC.
* Finds and removes (trash, delete or clean) existing spam posts, with a configurable threshold to protect legitimate articles.
* The homepage is never deleted: keywords, hidden spam blocks and spam links are stripped from the stored sources **and from the live HTML output**, leaving the rest of the page exactly as it was.

= Firewall =
* Web Application Firewall with SQL injection, XSS, file inclusion, remote code execution, object injection, malicious upload and scanner rules plus your own regex rules.
* Learning mode that allowlists legitimate requests automatically.
* Optional **Extended Protection**: runs before WordPress loads via `auto_prepend_file` (Apache, LiteSpeed, NGINX/PHP-FPM).
* Rate limiting for humans and crawlers (page views, 404s, global), verified Googlebot handling, throttle or block.
* Fake crawler detection, blank-user-agent POST blocking, honeypot URLs.
* Block by IP, range, CIDR, wildcard, hostname, user agent, referer or country, temporary or permanent, with hit counters.
* Country blocking with login/site/REST scope, redirect, bypass URL and bypass cookie.
* Allowlisted IPs and well-known services (Sucuri, Pingdom, UptimeRobot, StatusCake, ManageWP, Facebook, Seznam).

= Login security =
* Brute force protection with configurable thresholds, lockouts, banned usernames, invalid-username lockouts.
* Two-factor authentication (TOTP apps), recovery codes, remembered devices, required roles with grace period, IP allowlist.
* Breached password prevention (Have I Been Pwned k-anonymity), strong password enforcement.
* Hides login errors, blocks author/REST/oEmbed user enumeration, prevents "admin" registration, optional reCAPTCHA v3, XML-RPC and pingback controls, application password toggle.

= Hardening & monitoring =
* Disable file editor, block PHP in uploads, protect config/log/backup files, disable directory listing, security headers, hide version.
* Proactive defense alerts when plugins are activated, administrators created or critical options changed outside a legitimate admin session.
* Live Traffic view with one-click blocking and Whois, audit log, diagnostics, import/export of settings.
* Email alerts for every event type with hourly cap, daily/weekly activity report, dashboard widget and admin-bar badge.

== External services ==

itsMalicious works fully offline for most features. The following services are contacted only for the purposes described, and only when the related option is enabled:

* **WordPress.org API** (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org) – fetches official file checksums, plugin information and original files to repair modified core/plugin files. Sends the WordPress version, locale, plugin slugs and versions. [Privacy policy](https://wordpress.org/about/privacy/)
* **WPVulnerability API** (www.wpvulnerability.net) – vulnerability lookups when "Check installed plugins, themes and core against the vulnerability database" is enabled. Sends plugin/theme slugs only. [Terms](https://www.wpvulnerability.com/)
* **Have I Been Pwned Pwned Passwords API** (api.pwnedpasswords.com) – breached password checks when enabled. Sends only the first 5 characters of the SHA-1 hash of the password (k-anonymity); the password itself never leaves your server. [Privacy](https://haveibeenpwned.com/Privacy)
* **Geolocation providers** – only when Country Blocking is enabled and you select a provider: ip-api.com ([terms](https://ip-api.com/docs/legal)), ipapi.co ([privacy](https://ipapi.co/privacy/)) or ipinfo.io ([privacy](https://ipinfo.io/privacy-policy)). Visitor IP addresses are sent to determine the country; results are cached locally. The "Cloudflare header" option contacts nothing.
* **Google reCAPTCHA** (www.google.com/recaptcha) – only when you enable reCAPTCHA and enter your own keys. Google's script loads on the login/registration forms and tokens are verified server-side. [Privacy](https://policies.google.com/privacy) · [Terms](https://policies.google.com/terms)
* **DNS blocklists** (Spamhaus DBL/ZEN, SpamCop, Barracuda) – DNS queries containing your domain / reversed server IP during the "blocklist check" scan stage.
* **WHOIS servers** (port 43) – only when you use the Whois tool, sending the IP or domain you typed.
* **Reverse DNS** – `gethostbyaddr()` lookups of visitor IPs to verify crawler claims and match hostname patterns.

No usage data, telemetry or site information is ever sent to the plugin author.

== Installation ==

1. Upload the `itsmalicious` folder to `/wp-content/plugins/` or install it from the Plugins screen.
2. Activate the plugin. Protection starts immediately with safe defaults.
3. Go to **itsMalicious › Scan** and run your first scan.
4. (Recommended) Go to **itsMalicious › Firewall** and click *Optimize the Firewall* to enable Extended Protection.
5. Enable two-factor authentication from your profile page.

== Frequently Asked Questions ==

= Will the plugin delete my content automatically? =
Only the Content Guard can remove posts, and only posts that contain gambling keywords at or above the threshold you set. Removed posts go to the Trash by default (permanent deletion is opt-in and keeps a JSON backup). Deleted or repaired files always go to the Quarantine first, from where they can be restored. The homepage is never deleted; it is cleaned instead.

= I locked myself out. What do I do? =
Add your IP to **Firewall › Allowlist** from another network, or delete your IP row from the `wp_itsm_blocks` / `wp_itsm_lockouts` tables. Lockouts expire automatically.

= The site broke after enabling Extended Protection =
Delete the lines between `# BEGIN itsMalicious WAF` and `# END itsMalicious WAF` in `.htaccess` and/or `.user.ini`.

= Does it work with Cloudflare / a reverse proxy? =
Yes. Visitor IPs are detected automatically from the common proxy headers; you can force a specific header under Firewall › Allowlist.

= Does it replace a server-level product? =
It runs inside PHP, so it cannot see other users' accounts on the server or block traffic at the network layer, but it covers everything a WordPress-level product can and more.

== Screenshots ==

1. Dashboard with security score, blocked attacks and protection status.
2. Scanner with stage progress and one-click Repair / Delete / Clean actions.
3. Content Guard finding and cleaning gambling spam.
4. Firewall options and Extended Protection.
5. Blocking rules and Live Traffic.

== Changelog ==

= 1.0.1 =
* Fix: .htaccess hardening rules were written on a single line, causing a 500 Internal Server Error on Apache. Rules are now one directive per line and are rolled back automatically if the server stops responding.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
