=== Cyber Securitise ===
Contributors: novatise
Tags: security, two-factor, malware, firewall, privacy
Requires at least: 5.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.21.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Two-step sign-in, login protection, malware and vulnerability scans, one-click fixes and privacy tools for Singapore, Japan and the US.

== Description ==

Cyber Securitise finds the common weaknesses of a WordPress site, fixes the safe ones with one click, explains the rest, and tells you when something changes.

**Scan & fix**

* About 30 checks, run daily and on demand, seen the way a visitor sees the site (CDN caches are bypassed so results are current).
* One-click fixes for anything safe to automate; plain instructions for the rest.
* A score, and alerts when a check gets worse.

**Malware, integrity and vulnerabilities**

* File scan: plugins from wordpress.org are compared file by file with the official release (modified and added files); everything else (premium plugins, themes, mu-plugins, uploads, cache) is checked against known-malware signatures and a token-level analyzer that scores combinations of signals and shows its evidence (rule, line, points). PHP in uploads, PHP hidden in images and handler overrides are flagged. Runs in the background, in slices; unchanged files are not re-read.
* Tamper-evident baseline of wp-config.php, .htaccess, must-use plugins, drop-ins, theme files and Cyber Securitise itself; site-state drift (new administrators, key options, new scheduled tasks); signed activity-log entries.
* Known vulnerabilities: every installed version is looked up daily (WPScan with your token, or a self-hosted feed built from Wordfence Intelligence for agencies), including holes with no fix yet.
* WordPress core files against official checksums, including files WordPress did not ship.
* Server configuration files everywhere, hidden ones included (.htaccess, .user.ini, php.ini): code run before every request, images run as PHP, redirects for search-engine visitors.
* The database: injected scripts, redirects, hidden links and gambling/pharma spam in posts, page-builder data, widgets and options; new autoloaded options carrying code.
* Administrators read straight from the database, so accounts hidden from the Users screen are found; new scheduled tasks with the file that holds their code.
* What visitors and Google see: the site is requested as a desktop visitor, a phone visitor, a visitor from Google search and Googlebot, and compared (redirects, cloaked spam, injected scripts).

**Protection**

* Two-step sign-in (authenticator app, passkeys, backup codes) for any user; can be required for administrators or all staff. Application passwords and API keys keep working; plain passwords over XML-RPC/REST are refused for enrolled accounts.
* Hides usernames: closes the REST user list, `?author=` and author archives to visitors. Apps and integrations that sign in keep working.
* Login rate limiting with doubling lockouts, proxy-aware (Cloudflare and platform proxies supported; the real visitor address is taken from the right-most untrusted hop). Behind an unconfirmed proxy it only monitors, so nobody can lock everyone out.
* Generic login, password-reset and API errors.
* XML-RPC and pingbacks off; file editor off.
* Security headers on every response (HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy) and a Content-Security-Policy that starts in report-only mode with its own privacy-safe report collector.
* Version hiding. WordPress's own readme.html and license.txt are removed (again after each WordPress update). Plugin and theme readme.txt files and debug.log are blocked by the server rules Cyber Securitise ships and verifies: .htaccess on Apache and LiteSpeed (rolled back if the server rejects it), a ready-made snippet on nginx that the setup wizard checks on the live site.
* Automatic updates by policy: everything (default), same major version, or security fixes only; WooCommerce shops get security fixes only unless you choose otherwise; a never-update list. Security fixes for known vulnerabilities are installed within minutes, not at the next twice-daily run. After every automatic update the home, login and checkout pages are checked and you are alerted if one breaks (WordPress 6.6+ also rolls back a plugin update that causes a fatal error).
* PHP never runs from the uploads folder (server rules), proven on the live site by the scan.
* Origin lock for sites behind Cloudflare: ready-made firewall, nginx and Apache rules, and an alert when login attempts bypass Cloudflare (proof the server's address is exposed).

**Incident clean-up**

* A guided clean-up when a site is hacked: quarantine (never deletes; restore with one click), automatic quarantine of known malware in places WordPress never loads code from, administrator review, one-click reinstall of wordpress.org plugins, secret-key rotation that keeps two-step sign-in working, sign everyone out, password-reset links, and a timeline export for breach records.

**Alerts & activity log**

* New administrators, role escalations, admin sign-ins from a new address, plugin/theme/core changes, lockouts, scan regressions.
* Email and a signed webhook (Slack, Discord, Google Chat, Mattermost, Zapier, your own endpoint). Instant for what matters (sent by WP-Cron, normally within seconds; at most 10 an hour, the rest folded into the summary), a weekly summary for the rest, silence when there is nothing to say.

**Privacy pack**

* Privacy policy generated for **Singapore PDPA** (English), **Japan APPI** (Japanese) or the **United States** (CCPA/CPRA and comparable state laws), matched to what the business does (shop, second-hand goods); a draft until every detail is filled in, never invented.
* Required consent at WooCommerce checkout (classic and block checkout, HPOS), stored with time and policy version on each order.
* Lightweight first-party cookie notice: opt-in in Singapore and Japan; in the US, a "Your Privacy Choices" opt-out that honours Global Privacy Control.
* Data breach response plan templates (PDPA, APPI, US).

**Reports & API**

* A plain-language client report (score, protection, attacks blocked, updates, open issues): print or PDF, or emailed monthly, with your agency's branding.
* REST API for central consoles (status, report, scan) with an application password.

**Built for production**

* No extra database queries, writes or external requests on ordinary page views; one small deferred script on the front end.
* English and Japanese, with a per-user language switch on Cyber Securitise's screens.
* WP-CLI: `wp nova-shield scan|fix|unlock|log|2fa`. Emergency off switch: `define('NOVA_SHIELD_DISABLE', true);`.

**Works on its own**

Everything above runs on your site. Nothing is sent to Cyber Securitise unless you connect the site to a Cyber Securitise dashboard; see "External services" below. The optional dashboard adds the threat database, fleet views and remote actions for agencies (paid plans, https://cybersecuritise.com/#pricing).

== Installation ==

1. In wp-admin go to Plugins → Add New, search for "Cyber Securitise", then Install and Activate (or upload the zip under Plugins → Add New → Upload Plugin).
2. The setup wizard opens: six short steps (site check, server rules, connection, privacy, alerts, first scan). Server rules and connection cannot be skipped silently: they decide whether login protection blocks and whether readme files are closed.
3. If the site is behind Cloudflare or a page cache, purge the cache once afterwards.

== Frequently Asked Questions ==

= How does Cyber Securitise itself get updated? =

Through WordPress.org, like any other plugin from the directory (Dashboard → Updates, or automatic updates if you turn them on).

= Does Cyber Securitise contact your servers? =

Not until you ask it to. Connecting the site to a Cyber Securitise dashboard (Settings → Dashboard connection, with an activation key you create in the dashboard) is what starts any exchange with Cyber Securitise. Every service the plugin can contact is listed under "External services".

= Is the "Secured by Cyber Securitise" line shown on my site? =

Only if you turn it on (Privacy → Security badge). It is off by default.

= Will it slow my site down? =

No measurable effect: zero extra database queries and no outbound requests on page views. Where the server rules are active, blocked requests (XML-RPC, readme files) are answered by the web server before WordPress runs; elsewhere XML-RPC is refused early in PHP.

= Can I get locked out? =

Lockouts apply per address and username, application passwords are never locked out, and any administrator can unlock from Login & access. As a last resort add `define('NOVA_SHIELD_DISABLE', true);` to wp-config.php.

= Alerts arrive late or not at all =

Instant alerts are sent by WP-Cron, which runs when the site gets traffic. If wp-config.php sets `DISABLE_WP_CRON`, the server must run `wp-cron.php` on a schedule (every 5 minutes is typical), or alerts, scans and summaries wait until it does. Cyber Securitise shows a warning on the Alerts page when WP-Cron is disabled.

= Does it keep plugins up to date? =

Yes, by the policy you choose under Hardening → Automatic updates. Cyber Securitise decides *which* updates WordPress installs; WordPress's own background updater installs them. It cannot run where file changes are disabled (`DISALLOW_FILE_MODS`, `AUTOMATIC_UPDATER_DISABLED`), on version-controlled installs, or where WordPress cannot write files directly; the scan then says why. Plugins that do not publish updates through WordPress (some commercial or abandoned plugins) cannot be updated or seen this way. Keep daily backups: an update can still change behaviour without breaking the page.

= I lost the phone with my authenticator app =

Sign in with a backup code. Or another administrator: Users → Reset two-step sign-in. Or `wp nova-shield 2fa reset <user>`. As a last resort, `define('NOVA_SHIELD_2FA_DISABLE', true);` in wp-config.php (remove it afterwards).

= Can I sign in with a passkey? =

Yes. Users → Two-step sign-in (or Profile → Two-step sign-in) → Passkeys → Add a passkey, with your password to confirm. Face ID, Touch ID, Windows Hello, Android, password managers and security keys work. On the login page, "Sign in with a passkey" signs you in with no username or password (the device checks your PIN, fingerprint or face). After a password, a passkey also works as the second step. A passkey counts as two-step sign-in where the site requires it. Your first passkey comes with backup codes if you had none; a lost device is handled as above. Passkeys belong to the site's address: moving the site to a new domain means adding them again. Checks are made in the plugin itself (no external service): a single-use challenge, the site's address, the device's user-presence and verification flags, and its signature counter.

= My site was hacked. What does Cyber Securitise do? =

Cyber Securitise -> Incident walks through the clean-up in order: scan everything (files, database, administrators, scheduled tasks, what Google sees), quarantine malicious files, clean injected database entries, remove unknown administrators, reinstall tampered plugins, rotate the secret keys and sign everyone out, then take new baselines and keep watching. Known malware in places WordPress never loads code from is quarantined automatically. It does not replace a professional clean-up for a badly compromised server, and it cannot clean what lives outside WordPress (other sites on the same hosting account, the hosting panel).

= Is the file scan an antivirus? =

It is a layered scanner, not a complete antivirus. Plugins from wordpress.org are verified exactly against the official files, so any tampering there is found. Premium and custom code has no official copy to compare with; there, known malware patterns and suspicious combinations are found, but a new obfuscation technique may not be. Each finding shows why it was flagged.

= Does it stop DDoS attacks? =

No plugin can: by the time a request reaches WordPress, the server is already doing the work. Use Cloudflare (or similar) in front of the site. Cyber Securitise then makes sure attackers cannot go around Cloudflare (origin lock rules) and alerts you when they try.

= Is the privacy policy legal advice? =

No. It is a structured starting point for the PDPA, APPI or US state privacy laws. Have it reviewed.

= Third-party code and data =

QR codes for two-step sign-in are drawn in the browser by qrcode-generator (MIT, Kazuhiko Arase; source: https://github.com/kazuhikoarase/qrcode-generator).

AI crawler list: built from ai.robots.txt (https://github.com/ai-robots-txt/ai.robots.txt), Copyright (c) 2024 ai.robots.txt, MIT License.

Secret detection (the "No API keys in public files" check): rules and method adapted from gitleaks (https://github.com/gitleaks/gitleaks), Copyright (c) 2019 Zachary Rice, MIT License. Both projects' MIT terms: Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The AI privacy filter's personal-data patterns, scores, context words and checksum logic are ported to PHP from Presidio (MIT License, Copyright (c) Presidio Contributors; source: https://github.com/data-privacy-stack/presidio). The full MIT notice is in includes/privacy/aifilter.php. Nothing is sent to Presidio or any other service.

The threat database (downloaded only by sites connected to a dashboard) includes data from Linux Malware Detect (R-fx Networks, GPLv2) and URLhaus (abuse.ch, CC0).

== External services ==

Cyber Securitise works without any of these. Each is contacted only in the situation described.

**Cyber Securitise dashboard** (app.cybersecuritise.com, or the dashboard address you enter), run by Novatise.

* When: only after you connect the site with an activation key (Settings → Dashboard connection). Then at the interval the dashboard sets (hourly by default), every 5 minutes to collect remote actions if you allow them, and once when the plugin is deactivated. Disconnecting stops it.
* What is sent: the site address; WordPress, PHP, Cyber Securitise, plugin and theme names and versions; scan results and findings (file paths and an excerpt of at most 300 characters); the security activity log (sign-in failures, lockouts, changes), with visitor IP addresses shortened as the dashboard setting chooses; quarantine and clean-up status; the monthly report figures; results of remote actions. Requests are signed with a key unique to the site.
* Terms: https://cybersecuritise.com/legal/terms/ — Privacy policy: https://cybersecuritise.com/legal/privacy/

**Threat database and AI crawler list** (from the same dashboard).

* When: once a day, only on sites connected to a dashboard, and only while the threat database setting (Hardening) is on, or, for the crawler list, while AI crawlers are not set to "Allow all". Sites that are not connected use the list built into the plugin.
* What is sent: an ordinary download request (your server's IP address and the user agent "NovaShield/<version>"). Nothing about the site, its files or its users.
* Both downloads are signed; the plugin uses them only if the signature verifies. They are data (fingerprints, domains, patterns, crawler names), never code.
* Terms and privacy: as for the dashboard above.

**Vulnerability lookups: WPScan** (wpscan.com, run by Automattic).

* When: only if you choose WPScan on the Vulnerabilities page and enter your own WPScan API token. Then daily, within the request budget you set.
* What is sent: your API token and the slugs and versions of WordPress, your plugins and your themes.
* Terms: https://wpscan.com/terms/ — Privacy policy: https://automattic.com/privacy/

**Vulnerability lookups: Cyber Securitise feed** (the connected dashboard, or a feed address you enter).

* When: daily, only if the site is connected or you enter a feed address and key on the Vulnerabilities page.
* What is sent: the site's host name and the slugs and versions of WordPress, your plugins and your themes.
* The vulnerability data comes from Wordfence Intelligence (Defiant, Inc.; https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/) and the CVE list (MITRE); their notices are shown next to each entry. Nothing is sent to Wordfence or MITRE.
* Terms and privacy: as for the dashboard above.

**WordPress.org** (api.wordpress.org, downloads.wordpress.org).

* When: during scans, while "Check core files against official checksums" (Hardening, on by default) is on; and when you reinstall a plugin from the Incident page.
* What is sent: your WordPress version and locale (core checksums), or a plugin's slug and version (plugin checksums and downloads).
* Privacy policy: https://wordpress.org/about/privacy/

**Alert webhooks** (Slack, Discord, Google Chat, Mattermost, Zapier or any address you enter).

* When: only if you enter a webhook address on the Alerts page, when an alert or summary is sent.
* What is sent: the alert text (for example "new administrator added", with the user name and the date), signed with your webhook secret.
* The terms and privacy policy of the service you choose apply.

**Backup storage** (Amazon S3 or another S3-compatible service you choose).

* When: only if you set up backups with your own storage credentials, on the schedule you set or when you start one.
* What is sent: the backup archives (database and files of the site).
* The terms and privacy policy of the storage provider you choose apply.

The visitor check (Scan) requests your own site's pages as a visitor would; it does not contact anyone else.

== Screenshots ==

1. Dashboard: the security score, what changed and what to fix first.
2. Scan & fix: results with one-click fixes and plain instructions.
3. File scan: findings, each with the evidence that flagged it.
4. Login & access: two-step sign-in and lockouts.
5. Privacy: the generated privacy policy, consent and cookie notice.
6. Report: the client report (print or PDF).

== Changelog ==

= 1.21.0 =
* Web application firewall: the OWASP Core Rule Set (paranoia level 1, anomaly scoring) with its WordPress exclusions blocks SQL injection, cross-site scripting, remote code execution, PHP injection, file inclusion, scanners and session fixation on public requests; wp-admin and signed-in editors are logged unless you choose to block there too. Optional early loader runs the firewall before other plugins.
* Backdoor lockdown: one-switch lockdown mode, a hold on administrators created outside WordPress until an existing administrator confirms, PHP blocked in uploads/upgrade/languages with a live check, instant reaction to new or changed PHP files (known malware quarantined; modified core and wordpress.org plugin files restored from the official checksummed copies), and daily checks for hidden backdoors.
* Threat database: more malware patterns from open rule sets, Spamhaus DROP networks blocked, optional Tor/VPN/datacenter blocking, fake search-engine and AI crawlers caught by their published IP ranges, country blocking without Cloudflare, "actively exploited" vulnerabilities flagged, libraries bundled inside plugins and themes checked.
* Chatbot guard: now scores messages (1.20.0 could not load its model) with separate thresholds for logging and blocking, set for very few false alarms.
