=== ShieldZip ===
Contributors: aitoolstime
Tags: security, firewall, malware scanner, two factor, login security
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0
License: MIT

Complete security suite — pre-WordPress firewall, integrity & malware scanner, 2FA, country blocking, live traffic, local audit log. All free.

== Description ==

ShieldZip covers what the big security plugins paywall, with an architecture that answers their most common complaints:

* **A real WAF that runs before WordPress.** One click installs auto_prepend_file (with .htaccess/.user.ini marker blocks, fully reversible), so SQLi/XSS/LFI/RCE rule families, IP blocks, rate limits and country blocks execute before WordPress — and before any dropped rogue PHP file. Plugin-mode fallback for hosts that forbid prepend. Two-stage SQL-injection confirmation kills the classic false positives; a log-only learning mode is built in.
* **Integrity-first scanning with an open pipeline.** Core files verify against wordpress.org's own checksum API; plugin and theme files verify against the exact-version packages from the official repo; modified core files repair themselves from the source with one click. Layered on top: transparent obfuscation heuristics, an optional open GPL hash feed (Linux Malware Detect) — no proprietary signature feed, no 30-day delay for non-payers, ever.
* **Low-resource scans.** Batched background steps with a hash cache: unchanged files are skipped entirely, so repeat scans read only what changed. No CPU blowups on shared hosting.
* **Database scanning** — siteurl hijacks, obfuscated code in options, external script injections in published posts. A layer the market leader doesn't have.
* **Vulnerability alerts** for installed plugins/themes via the free Wordfence Intelligence Community feed.
* **Login security:** TOTP two-factor (RFC 6238, verified locally, single-use replay protection, recovery codes), brute-force lockouts in a dedicated table (object-cache safe), XML-RPC through the same counters, masked login errors, invalid-username insta-lock, and breached-password blocking via Have I Been Pwned k-anonymity (only 5 hash chars ever leave your server).
* **Country blocking — free.** IPv4 zone data compiled to a binary-searched range file, whole-site or login-only. Sold as premium almost everywhere else.
* **Live traffic** logged server-side (bots invisible to JS analytics included), one-click IP blocking, and a **local audit log** with unlimited retention — logins, lockouts, role changes, plugin/theme changes, critical option edits. No cloud storage tiers.
* **Hardening:** security headers, PHP execution blocked in uploads, version hiding, file-editor disable, 4-channel username-enumeration protection (query, REST, oEmbed, sitemap), XML-RPC policy, and a panic button that rotates your secret keys to kill every session.
* **No accounts, no API keys required, no phone-home.** External calls happen only for the features you invoke: wordpress.org (checksums/packages), HIBP (if enabled), IPdeny (if country blocking), the optional feeds. Nothing else leaves your server.

== Installation ==

1. Upload the `shieldzip` folder to `/wp-content/plugins/` and activate. Sane defaults protect immediately in plugin mode.
2. ShieldZip → Firewall → "Enable extended protection" to move the firewall in front of WordPress (recommended; reversible).
3. ShieldZip → Scanner → "Start scan", and ShieldZip → Login Security to set up 2FA for your account.

== Frequently Asked Questions ==

= Is anything paywalled or delayed? =
No. There is no premium tier. Detection is integrity-first (wordpress.org checksums), so it doesn't depend on a signature subscription at all.

= What if the firewall blocks something legitimate? =
Switch to log-only mode, check Live Traffic for the rule id, then allowlist the URL prefix or disable that one rule. The SQLi rules already require structural confirmation to avoid false alarms.
