=== CiBRAI WPGuard ===
Contributors: cibrai
Tags: security, firewall, malware, two-factor, ai
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 4.11.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

All-in-one AI security for WordPress: malware & vulnerability scanning, firewall, hardening, 2FA, AI chatbot, and scam detection.

== Description ==

CiBRAI WPGuard is the unified security and AI intelligence plugin for WordPress, powered by the CiBRAI enterprise platform.

**Security Features (Free)**

* Vulnerability scanning (local + cloud)
* Web Application Firewall (WAF) with rate limiting
* Brute force protection and login lockout
* Security hardening (one-click fixes)
* File integrity monitoring
* Login activity logging
* Live traffic monitoring
* Breach check (email/domain)
* Activity log
* Trust seal badge
* Voice scam detector (requires a free connected account)

**AI Intelligence Features (CiBRAI Backend)**

* Cyber Guru — AI chatbot with SSE streaming, configurable persona
* Knowledge Base — RAG-powered document and URL ingestion
* AI Security Scanner — CiBRAI threat intelligence scanning
* AI Analytics — session, message, and token usage tracking

Features can be toggled by subscription tier (free, pro, enterprise).

== Installation ==

1. Upload the `cibrai-cyber` folder to `/wp-content/plugins/`.
2. Activate the plugin through the Plugins menu.
3. Go to CiBRAI WPGuard > Settings to configure your API key.
4. For AI features, set your CiBRAI server URL and tenant key.

== Frequently Asked Questions ==

= How do I get started? =

After activating, open **CiBRAI WPGuard > Dashboard**. Three steps get you protected: (1) connect your account from **Settings > Get Started** (free — this unlocks the AI features and threat feed), (2) run a scan from the **Scans** page, and (3) turn the **Firewall** on in Monitor mode and let it learn for a few days before switching to Enforce.

= Do I need a CiBRAI account? =

No account is needed for the core security features — vulnerability scanning, firewall, brute-force protection, hardening, file integrity, login logging and 2FA all work on their own. A free CiBRAI account adds the AI features (Cyber Guru chatbot, Knowledge Base, AI scanner) and the live threat-intelligence feed. You can connect it any time from Settings.

= What does it cost? =

The core security plugin is free. Optional Pro and Enterprise tiers add AI capacity, the managed threat feed and platform integration. Pricing and signup are on the CiBRAI website.

= I run nginx — how do I protect the firewall's data folder? =

The plugin writes an `.htaccess` (Apache) and `web.config` (IIS) deny into `wp-content/cibrai-waf/`, but nginx ignores both. On nginx, add this to your server block so the folder is never served:

`location ~* /wp-content/cibrai-waf/ { deny all; return 403; }`

(With PHP-FPM the one sensitive file is executed rather than served, so its contents are not disclosed in any case — this is defence in depth.)

= Upgrading from CiBRAI Security =

CiBRAI WPGuard replaces the older CiBRAI Security plugin and includes everything it did (scans, firewall, login protection, 2FA, logs, trust seal). The two cannot run together, so CiBRAI WPGuard switches CiBRAI Security off if it finds it active.

Your data carries over automatically. Both plugins use the same settings and tables, so scan history, login and activity logs, 2FA choices and schedules are already there. The old WAF and Brute Force settings are merged into CiBRAI WPGuard's single Firewall model (where they differ, the stricter value is kept). The result is listed under CiBRAI WPGuard > Settings > Advanced.

When the import is done, use **Remove old plugin** in the notice on the Plugins screen. It deletes the `cibrai-security` folder without running any of its code, so your CiBRAI WPGuard settings and history are not touched. You can also delete it from the Plugins screen; CiBRAI Security has no uninstall routine that removes data.

= The firewall locked me out. How do I turn it off? =

Add this line to `wp-config.php`, above `/* That's all, stop editing! */`:

`define( 'CIBRAI_FIREWALL_DISABLED', true );`

It switches off the WAF, the IP and country deny lists and login lockouts before any of them runs. Your settings are not changed, and wp-admin shows a red notice while the line is there. Delete the line to turn protection back on. (WP-CLI alternative: `wp option update cibrai_waf_enabled 0`, which turns off only the WAF.)

= Should I start in Monitor or Enforce? =

Start in **Monitor** on a live site. The WAF runs every rule and logs, alerts and reports what it would block, but lets every request through. When the WAF log shows no "Would block" rows for real visitors or your own forms for a few days, switch to **Enforce** on the WAF page.

== Screenshots ==

1. Security dashboard — overall site security score, status and quick actions.
2. Firewall (WAF) — rules, mode (Monitor/Enforce) and live block log.
3. Scanner — vulnerability, malware and file-integrity results.
4. Login security — two-factor setup, brute-force protection and login activity.
5. Cyber Guru — the built-in AI security assistant.
6. Scam detector — the visitor-facing scam-check widget.

== Upgrade Notice ==

= 4.11.2 =
Pairs with a CiBRAI platform security update that tightens account isolation between connected sites. Recommended for all sites.

= 4.11.0 =
The dashboard now works fully offline with no account, activation no longer phones home, and the firewall gains deeper encoding and nesting coverage. Recommended for all sites.

= 4.10.1 =
Security hardening for the firewall's own trust logic (client-IP spoofing and the system-request exemption) plus smaller fixes. Recommended for all sites.

== Changelog ==

= 4.11.2 =
* Connecting a site that is already registered now shows the platform's explanation (enter your existing API key, or contact support to have it reissued) instead of a generic "API request failed". The platform no longer re-issues an existing site's key to anyone who knows its domain and admin email.

= 4.11.1 =
* Polish from an end-to-end interactive QA pass: the "Copy Report" button on the Scanner now falls back cleanly (and tells you to press Ctrl+C) instead of failing silently when the browser blocks clipboard access; the breach "Check" button now prompts you to enter a password instead of doing nothing on an empty field; and saving the Scam Detector settings now shows the same confirmation toast as the rest of the plugin.

= 4.11.0 =
* Dashboard now shows your security score, firewall status, scan history and the full hardening checklist with no CiBRAI account — the local scanner and firewall protect the site on their own, and connecting an account is presented as an optional upgrade for the AI features and cloud scans.
* Privacy: activation no longer contacts the CiBRAI platform. The site's details are sent only when an administrator explicitly connects an account from Settings, and the CiBRAI Link event feed is now off until it is turned on.
* Firewall: rule matching fails closed if a crafted value trips PCRE's backtrack limit; request scanning now reaches deeply nested parameters, multi-level URL-encoded payloads and raw non-form request bodies (text/plain, XML, undecoded JSON).
* Pro upgrade: the "Activate Pro" flow verifies the plan with the platform instead of unlocking on any key, and links to the shop for plans and pricing.
* Hardening: scanner backup details require the delete-plugins capability; Activity Log CSV export is guarded against spreadsheet formula injection; file-integrity restore re-checks path containment and asks before quarantining wp-config.php and other critical files; the Cyber Guru tenant key is now a masked secret field.

= 4.10.1 =
* Firewall hardening: the client-IP resolver now trusts a CF-Connecting-IP / X-Real-IP / single-hop X-Forwarded-For header only when the TCP peer is actually one of your proxies, so a visitor hitting the origin directly can no longer forge an address to evade the deny list, rate limiter and lockout — or forge an allowlisted IP to switch the firewall off.
* Firewall hardening: the "system request" exemption is honoured only for genuinely local, non-proxied requests (WP-Cron is still recognised), so an external visitor behind a proxy can no longer claim it with a spoofed cache-preloader User-Agent.
* Firewall default: the broad rule-and-rate-limit exemption now defaults to administrators (manage_options) instead of any post editor.
* Public Cyber Guru chat now rate-limits by the hardened client IP, so the limit cannot be bypassed by spoofing forwarding headers.
* Faster activation: the first account-registration call no longer blocks activation for up to 30 seconds on sites that cannot reach the platform.
* Added an IIS deny file (and a documented nginx snippet) for the firewall data folder; declared two class properties to remove a PHP 8.2+ deprecation notice.

= 4.10.0 =
* AI tool access (MCP): optional, off-by-default connector that exposes this site's own security data (firewall status, latest scan findings, recent security events and lockouts, and the vulnerability summary) to AI tools through WordPress's official Abilities API / MCP Adapter convention. Administrator-gated, every request written to the Activity Log, and state-changing abilities (such as blocking an IP) stay disabled until an admin explicitly allows them. Configure it under Settings; the live MCP server runs on the CiBRAI platform.

= 4.9.0 =
* Firewall: optional early protection that runs before WordPress loads; 33 rules in 13 categories with per-rule switches; allowlisted URLs and parameters; separate rate limits for people and verified crawlers, page views and 404s; country blocking from a local DB-IP Lite database; blocking by IP range, user agent, referrer and hostname.
* Threat feed: rules, blocklist and malware signatures from the CiBRAI platform, signature-verified, synced hourly or on demand.
* Login security: authenticator-app 2FA with recovery codes, Cloudflare Turnstile or reCAPTCHA v3, lost-password limits, username-enumeration protection with generic login errors, blocked usernames, strong passwords for chosen roles, XML-RPC requires application passwords for 2FA users.
* Scanner: plugin and theme files compared with the wordpress.org originals, known-vulnerability check through CiBRAI, closed and abandoned plugins, publicly downloadable config and backup files, loadable signatures, scan sensitivity and a content scan of posts, comments and options.

= 4.8.1 =
* Firewall mode: Off, Monitor (learning) or Enforce, switched with one click on the WAF page. Monitor logs, alerts and reports what it would block but lets every request through. New installs start in Monitor; a WAF that was already on keeps enforcing.
* Emergency off switch: `define( 'CIBRAI_FIREWALL_DISABLED', true );` in wp-config.php turns off the WAF, IP and country deny lists and login lockouts, with a notice in wp-admin while it is set.
* CiBRAI Link now reports WAF blocks and would-blocks, login lockouts, failed logins and failed-login spikes, File Integrity changes and new administrators to the SOC. Events are sent in batches by a one-minute background job, never during a visitor's page load.
* Far fewer false positives: each form field, query value and cookie is checked on its own, rules are narrowed to real SQL / HTML syntax, editors and the site's own cron, loopback and cache-preload requests are exempt, and WordPress nonces and analytics cookies are skipped. Double-encoded attacks are now caught.
* Live Traffic logging can be sampled or switched off. Behind a proxy, X-Forwarded-For now uses the right-most untrusted hop, so visitors cannot forge their IP.

= 4.8.0 =
* Web access: Cyber Guru can search the web and a curated list of scam-database sites, read pages safely, and remember what it learns for follow-up questions.
* Live "Searching the web" status and clickable sources in the chat.
* CiBRAI Link telemetry works over HTTPS with a self-signed platform certificate.

= 4.7.0 =
* Intelligence: upload documents (PDF, Word, PowerPoint, Excel, text), build a web research pool, and generate cited reports; Cyber Guru answers show their sources.
* Real-time security alert emails with throttling and a test button.
* File Integrity no longer flags CiBRAI's own updates; results grouped by component; Quarantine always asks first.
* Safe import from CiBRAI Security and a Remove old plugin button; the two plugins can no longer run together.
* Activity Log shows who did what in plain language, hides housekeeping noise, and prunes old entries.
* Top 404s card on Live Traffic; stale backup clean-up; many layout and contrast fixes.

= 4.0.0 =
* Merged CiBRAI Security and Cyber Guru into one unified plugin.
* Added Knowledge Base management (text + URL scraping with RAG).
* Added AI Security Scanner powered by CiBRAI threat intelligence.
* Added AI Analytics dashboard (sessions, messages, tokens, documents).
* Subscription tier feature toggling (free/pro/enterprise).
* SSE streaming chat widget with configurable persona name.
* Direct API fallback (OpenAI/Anthropic) when no CiBRAI server.

= 3.2.0 =
* Voice Scam Detector with premium dark UI.
* Scam Detector admin page.

= 3.1.0 =
* Activity log with severity tracking.
* CiBRAI Link telemetry page.
* Dashboard widget.
* Email alerts for security events.

= 3.0.0 =
* Initial release with full security suite.
