=== WPPulso ===
Contributors: devcodes
Tags: security, backup, health, monitoring, updates
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 7.4
Stable tag: 1.2.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress site health, backup, security and update risk monitoring for every website owner.

== Description ==

Version 1.2.4 adds the owner-first risk dashboard, first-run checklist, health score deductions, restore-readiness status, richer update-risk reasons and direct support actions. The default production licence API is https://devcodes.cc/wp-json/devcodes/v1/license.

Version 1.2.1 adds Security Center pages, opt-in query signatures, IP rules, login activity, diagnostics, and report integration. Query inspection is limited and does not replace a server firewall.

WPPulso helps WordPress users understand website risk in plain English.

It shows a site risk score, scans common WordPress health signals, checks backup freshness, highlights basic security issues, and logs important activity.

Version 1.0.8 adds an automatic WordPress Dashboard summary widget. Site admins can see WPPulso risk score, backup age, updates, suspicious files, license plan and quick actions directly from the main WordPress Dashboard.

Version 1.0.7 introduced suspicious file review workflows. In the public launch build, suspicious files are detected, explained and escalated for manual review; automatic quarantine, deletion and restore actions are intentionally disabled.

The plugin also includes customer-safe billing and hosted Start Free license validation. Free keys created through DevCodes register the site and validate remotely, but they do not unlock paid Pro or Agency features.

== V1.0.8 WordPress Dashboard Summary Widget ==

* Added automatic WPPulso Site Summary widget to the main WordPress Dashboard.
* Shows latest risk score, status label, current plan, backup age, pending updates, suspicious files and login protection state.
* Includes quick actions for Run Scan, Open WPPulso and File Monitor.
* Uses existing scan/status data so the WordPress Dashboard does not run heavy checks on every page load.
* Widget can be collapsed, moved or hidden using normal WordPress Screen Options.

== V1.0.7 Suspicious File Review ==

* Added suspicious file findings from the latest File Monitor scan.
* Findings explain why a file needs review and what the owner should do next.
* Automatic quarantine, restore, deletion and database cleanup are disabled in the public launch build.
* Sensitive root files such as wp-config.php, .htaccess and index.php are never changed by WPPulso.
* Keeps advanced file monitoring gated behind the existing Pro/Agency file monitoring feature.

== V1.0.2 Customer-Safe Billing & License Validation ==

* Removed customer-side payment provider settings from the WordPress plugin.
* Removed local mark-paid upgrade actions.
* Removed local checkout generation and local subscription cancellation actions.
* Removed customer-side payment webhook registration.
* Removed customer-side license server routes from the distributed plugin.
* Changed Billing to a safe Plan & Billing status screen.
* Paid Pro and Agency activation now requires remote license validation.
* Free license keys created from the hosted Start Free flow can validate remotely without unlocking paid features.
* Gateway keys, webhook secrets, wallet addresses and license issuing belong only on DevCodes.

== V1.0.1 Product Polish & Reliability ==

* No new product modules added.
* Updated plugin version and stable tag to 1.0.1.
* Added an upgrade routine so existing installs apply storage, schedule and schema maintenance when updating.
* Moved new backup file storage to a protected uploads-based WPPulso folder, while preserving legacy backup path support.
* Improved backup writing with temporary files and finalisation checks before marking a backup complete.
* Improved ZIP backup reliability by counting only files successfully added to the archive.
* Improved admin dashboard hierarchy with priority findings shown near the risk score.
* Refined admin UI styling to match the dark grey, light grey and white commercial website theme.
* Removed stale V0.x wording from admin screens.
* Improved license activation and plan messages.
* Hardened settings validation for alert email, backup warning age and log retention values.
* Improved downloadable client report styling and empty-state handling.
* Improved weekly email report styling.
* Preserved Free, Pro and Agency feature gates, pricing and payment options.

== Stable Commercial Features ==

* WordPress risk score
* Manual health scan
* PHP version check
* SSL check
* WordPress core update check
* Plugin/theme update count
* Backup age detection
* Debug mode check
* XML-RPC check
* File editor check
* WordPress cron check
* Activity log
* Basic settings page
* Manual database backup
* Backup history
* Secure backup download
* Backup delete action
* Backup checksum and file size
* Dashboard backup status
* Automatic WordPress Dashboard summary widget
* Security settings screen
* Login attempt limiting
* Temporary IP/username lockouts
* XML-RPC disable toggle
* Author enumeration protection
* Public REST user listing protection
* WordPress generator version hiding
* Dashboard security status
* Update Shield screen
* Pending plugin/theme/core update risk list
* Update safety score
* Pre-update database backup action
* Homepage response check
* Update risk review activity log
* Dashboard Update Shield summary
* Daily scheduled health scan
* Weekly health report email
* Critical risk email alert
* Old or missing backup alert
* High update risk alert
* Monitoring admin screen
* Test alert email tool
* Dashboard monitoring status
* Files backup ZIP
* Full backup ZIP with database.sql
* Backup verification
* ZIP integrity check
* Database backup header verification
* Backup download content type handling
* File change monitoring
* Trusted file baseline
* Added/modified/deleted file detection
* Suspicious PHP file detection in uploads
* Suspicious code pattern detection
* Suspicious file review workflow
* Review-only malware findings with no automatic file deletion
* Daily scheduled file integrity scan
* File Monitor admin screen
* Dashboard file monitor summary
* Client-ready health report generator
* Reports admin screen
* Agency and client report settings
* Downloadable HTML health report
* Report summary for health, backup, security, update risk, monitoring, and file changes
* Recommended client action list
* Optional recent activity section
* Free, Pro, and Agency plan definitions
* License & Plans admin screen
* Pro/Agency license activation workflow
* License deactivation
* Pro feature gate helper
* Pro gating for file change monitoring actions
* Pro gating for client report downloads
* Dashboard license status
* Customer-safe Plan & Billing screen
* Monthly/yearly Pro pricing and monthly-only Agency pricing
* License-derived plan status tracking
* DevCodes checkout links
* No payment provider secrets stored inside the customer plugin
* Dashboard plan status
* Public website package
* Long homepage content
* Product pages: About, Why WPPulso, How It Works, Pricing and Comparison
* User documentation page
* Legal pages: Terms, Privacy, Refund Policy, License Policy and Security Disclaimer
* Clean public website URLs
* Page-specific SEO titles
* Page-specific meta descriptions
* Meta keywords for launch targeting
* Canonical URLs
* Open Graph metadata
* Twitter card metadata
* WebPage structured data
* Breadcrumb structured data
* Sitemap.xml
* Robots.txt
* llms.txt
* Crawl-friendly updates page
* Hourly sitemap crawl hint for updates page
* Contextual internal link building
* Keyword-focused SEO landing pages
* Image alt and title attributes
* Search-safe X-Robots-Tag headers
* DevCodes checkout handoff
* Remote license activation request
* Local license status and feature gates
* Site activation identity tracking

== Installation ==

1. Upload the `wppulso` folder to `/wp-content/plugins/`.
2. Activate WPPulso from the WordPress Plugins screen.
3. Open WPPulso from the WordPress admin menu.
4. Run your first manual scan.

== Changelog ==

= 1.0.7 =
* Added suspicious file review workflow.
* Added review-only malware findings for suspicious file detections.
* Disabled automatic file quarantine, restore, deletion and database cleanup in the public launch build.
* Kept advanced file monitoring gated behind Pro/Agency file monitoring access.

= 1.0.2 =
* Customer-Safe Billing & License Validation hotfix.
* Removed local mark-paid, local checkout and local subscription cancellation actions from the customer plugin.
* Removed customer-side gateway secret fields, webhooks and license-server routes.
* Paid Pro and Agency activation now requires official DevCodes license validation.
* Added remote validation support for hosted WPPulso Free license keys.
* Existing installs strip old customer-side commercial secrets during activation/upgrade cleanup.

= 1.0.1 =
* Product Polish & Reliability release.
* Added upgrade handling for existing installs.
* Improved persistent backup storage and temporary backup file handling.
* Improved admin dashboard, admin CSS, client report and email report styling.
* Improved settings and license input validation.
* Removed stale internal/version wording from admin screens.
* No new feature modules were added.

= 1.0.0 =
* Stable commercial release.
* Updated plugin version and stable tag to 1.0.0.
* Aligned Pro and Agency pricing with the public website.
* Finalized customer-facing admin copy for billing and license activation.
* Confirmed health score, backup engine, security protection, Update Shield, monitoring, file-change monitoring, reports, licensing and customer-safe plan status modules.
* Prepared V1.0 packaging, regression checklist and public website release artifacts.

= 0.8.5 =
* Prepared hosted checkout handoff for paid plans.
* Prepared customer-side license activation flow.
* Payment providers, webhooks, license issuing and API secrets belong on DevCodes, not in this distributed customer plugin.
* Added payment options page to the public website.

= 0.8.4 =
* Added SEO launch layer for the public website.
* Added clean URL versions of all public pages.
* Added sitemap.xml and robots.txt.
* Added llms.txt.
* Added page-specific titles, descriptions, canonical tags and social metadata.
* Added structured data for WebPage and BreadcrumbList.
* Added contextual internal links and predefined SEO anchor text.
* Added product updates page with hourly sitemap crawl hint.
* Added SEO landing pages for WordPress health score, backup monitoring, security monitoring, update risk monitoring, uptime monitoring and maintenance reports.
* Added image alt/title metadata for the dashboard preview image.

= 0.8.3 =
* Added public website package for launch.
* Added long homepage content.
* Added product pages for About, Why WPPulso, How It Works, Pricing and Comparison.
* Added user documentation page.
* Added legal pages for Terms, Privacy, Refund Policy, License Policy and Security Disclaimer.

= 0.8.2 =
* Added customer-side plan status screen.
* Added hosted checkout links.
* Added license-derived plan status on dashboard.
* Updated plan prices: Pro unchanged, Agency monthly only at $75 for 15 sites.

= 0.8.1 =
* Added Licensing module.
* Added Free, Pro, and Agency plan definitions.
* Added License & Plans admin screen.
* Added local license activation/deactivation workflow.
* Added plan status on dashboard.
* Added Pro feature gates for file monitoring and client report downloads.
* Added upgrade messaging for locked Pro features.

= 0.8.0 =
* Added Reports module.
* Added client-ready health report generator.
* Added downloadable HTML report.
* Added Reports admin screen.
* Added agency/client report settings.
* Added report summary across health, backups, security, update risk, monitoring, and file monitor.
* Added recommended action list for client reports.

= 0.7.0 =
* Added File Monitor module.
* Added trusted file baseline creation.
* Added manual file integrity scan.
* Added added, modified, and deleted file detection.
* Added suspicious executable file detection in uploads.
* Added suspicious code pattern scanning.
* Added daily scheduled file integrity check.
* Added File Monitor admin screen and dashboard summary.

= 0.6.0 =
* Added files backup ZIP creation.
* Added full backup ZIP creation with database export.
* Added backup verification action.
* Added ZIP integrity verification.
* Added database backup header verification.
* Updated backup UI with database, files, full, download, verify, and delete actions.

= 0.5.0 =
* Added Monitoring & Alerts module.
* Added daily scheduled health scan.
* Added weekly health report email.
* Added critical risk, backup, and update risk alerts.
* Added Monitoring admin screen.
* Added test alert email action.
* Added dashboard monitoring summary.

= 0.4.0 =
* Added Update Shield module.
* Added pending update risk scoring.
* Added Update Shield admin screen.
* Added pre-update database backup action.
* Added homepage response check.
* Added update risk review logging.
* Added dashboard Update Shield summary.

= 0.3.0 =
* Added security protection module.
* Added Security admin screen.
* Added failed login attempt tracking and lockouts.
* Added XML-RPC blocking option.
* Added author enumeration protection.
* Added REST API user listing protection.
* Added WordPress generator version hiding.
* Added dashboard security summary.

= 0.2.0 =
* Added manual database backup engine.
* Added Backups admin screen.
* Added backup download and delete actions with nonce and capability checks.
* Added backup status cards to dashboard.

= 0.1.0 =
* Initial V0.1 architecture and plugin MVP.
