=== Guard by MPTY ===
Tags: security, malware, two-factor, integrity, hardening
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.51.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress malware scanning, protection and recovery with clear, actionable results.

== Description ==

Guard by MPTY helps WordPress administrators find security problems, protect important WordPress entry points and recover safely after an incident.

It checks WordPress files, plugins, themes, the database, administrator accounts, suspicious content, persistence and exposed sensitive files. It also provides login protection, 2FA, scheduled scans and reversible quarantine.

The interface prioritizes issues that need action. High-confidence threats appear first, uncertain evidence is clearly marked for review, and destructive actions are kept reversible where possible.

Free checks WordPress.org components against official integrity data where available and scans premium and custom components for suspicious behavior. Guard Pro adds optional comparison with an exact, known-clean vendor ZIP.

Free includes basic database and persistence checks. Guard Pro adds deeper database investigation and quarantine of eligible records, with a backup saved before removal. Existing quarantined records remain available for recovery if Pro expires.

Free includes manual and weekly automatic scans. Guard Pro adds daily and other configurable schedules. Security alerts avoid repeatedly emailing unchanged High or Critical findings.

Authenticator app two-factor authentication (TOTP) can be enabled per user and works with Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy, Apple Passwords and other RFC 6238-compatible apps. Setup and code verification happen locally; Guard by MPTY does not use a hosted 2FA service.

Guard by MPTY operates inside WordPress. It cannot certify hosting-panel accounts, SSH/SFTP credentials, server processes, sibling sites or databases that the WordPress database user cannot access.

== Installation ==

1. Upload and activate Guard by MPTY.
2. Open Guard by MPTY in WordPress admin.
3. Run the first security scan.
4. Review findings before taking remediation actions.
5. Configure Protection and email notifications as needed.

== Privacy and data ==

Guard by MPTY stores security settings, scan results, security history, quarantine evidence, persistence-watch state and per-user 2FA data locally in WordPress. Security history can include request IP addresses when they are relevant to a security event. Guard does not send this data to MPTY Projects.

TOTP authenticator secrets are encrypted at rest when Guard can create its protected private key storage outside the public WordPress root. Recovery codes are stored only as password-style hashes; the one-time display copy is encrypted and deleted after it is read.


== Frequently Asked Questions ==

= Does Guard by MPTY automatically delete suspicious files? =

No. Live files are quarantined first so remediation remains reversible.

= Does Guard by MPTY scan the database? =

Yes. Free includes basic database and persistence checks; Guard Pro adds deeper investigation and database quarantine.

= Do I need clean ZIP files for every premium plugin or theme? =

No. Free scans premium and custom components for suspicious behavior without a ZIP. Guard Pro's clean-package comparison is optional, for checking a specific component against its known-clean copy.

= Which authenticator apps work with Guard by MPTY 2FA? =

Any standard TOTP/RFC 6238 authenticator app should work, including Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy and Apple Passwords.

== Changelog ==

= 0.51.0 =
* Introduces Guard Pro with advanced monitoring, investigation, reporting and recovery, while keeping essential protection and existing recovery access available in Free.
* Adds local comment protection and improves scan completeness, finding history and change monitoring on larger sites.
* Improves detection of encoded database threats and newly added administrator accounts.
* Strengthens clean-package identity verification and repair safety, including Windows uploads.
* Clarifies findings, affected items, incomplete coverage and results that need a fresh scan; improves narrow-screen and keyboard use.

= 0.50.0 =
* Improved reliability of scanning, quarantine, database evidence handling, two-factor authentication state, and recovery through focused internal safeguards and expanded automated coverage.
* Added versioned, resumable data migrations with concurrency protection, clear failure diagnostics, and safeguards against unsafe downgrades.
* Added secure direct-update support with stable and opt-in beta channels, fresh install-time authorization, release pause/revocation controls, and mandatory package checksum verification. The WordPress.org package continues to use WordPress.org updates.
* Added privacy-safe support diagnostics with administrator preview and export, clearer diagnostic codes, and documented outbound data behavior without telemetry or automatic uploads.
* Made data retention and uninstall choices explicit, verifiable, and easier to understand while preserving recovery-oriented defaults and protected cleanup behavior.
* Improved translation readiness, accessibility, customer-facing guidance, production packaging, and Guard installation-integrity checks, including accurate behavior for local source-checkout development.
* Removed obsolete compatibility code for retired predecessor products, reducing maintenance surface without changing current Guard data or protection behavior.

= 0.46.13 =
* Improved private-storage portability by accepting a pre-provisioned writable directory outside WordPress even when its parent is not writable, while preserving fail-closed creation and containment rules.
* Hardened database quarantine evidence handling and extracted focused database-quarantine and quarantine-transaction components without changing stored formats.
* Improved interrupted and malformed scan-state handling.
* Expanded unit and disposable WordPress integration coverage for quarantine transactions, database evidence, scan state, private storage, and real 2FA enrollment, encrypted storage, verification, and replay rejection.

= 0.46.12 =
* Added focused regression coverage for TOTP validation and replay windows, quarantine path containment and integrity checks, scan progress state, and malware code-risk scoring while preserving existing behavior.
* Added safe inert scanner fixtures for known-positive, known-negative, and boundary scoring cases.
* Expanded CI coverage across the declared PHP minimum, current PHP versions, and minimum/latest WordPress activation environments.
* Unified CI and release packaging behind one explicit production manifest, with exact artifact validation, version agreement checks, and pre-/post-ZIP content digest verification.
* Added release preflight and publishing automation that waits for required GitHub checks before creating a release tag.

= 0.46.11 =
* Added focused TOTP vector tests while preserving the existing authenticator code-generation behavior.
* Added automated code-quality, Plugin Check and release-artifact validation workflows.
* Uses GMT-safe formatting when selecting current and previous upload-month directories for rapid malware monitoring.

= 0.46.10 =
* Fixed destructive-action button styling so plugin quarantine uses a clear outlined danger treatment instead of conflicting primary/danger styles.
= 0.46.9 =
* Added whole-plugin quarantine for high-confidence malware behavior using Guard's verified plugin archive and restore workflow.
* Removed pointless Deactivate actions for plugins that are already inactive; active high-risk plugins can still be deactivated without removing files.
* Consolidated duplicate Critical malware findings when the deep malware scan and plugin heuristic identify the same plugin file, while retaining both evidence sources.

= 0.46.8 =
* Added Guard Suspend access / Restore access actions directly to administrator rows on the native WordPress Users screen.
* Unified manual and finding-based account suspension on the same reversible suspension engine.

= 0.46.7 =
* Fixed quarantine restore/delete path resolution so existing current and migrated quarantine items remain recoverable while traversal and out-of-directory paths are rejected.


= 0.46.6 =
* Fixed quarantine Restore/Delete actions to use fresh POST nonces rather than brittle filename-bound GET links.
* Existing quarantined items remain restorable after upgrade.
= 0.46.5 =
* Fixed rapid malware monitoring so executable PHP-family files in uploads are detected between full scans even when their contents are otherwise harmless.
* Prevented large plugin trees from starving writable-area monitoring by keeping independent resumable cursors and alternating scopes.
* Added a tiny high-risk uploads check on every malware-monitor cycle while retaining strict shared-host resource limits.
* Calibrated checksum mismatch severity so package drift alone is not Critical without malicious behavior.
* Successful 2FA enablement and ordinary user creation now log as informational events; administrator role promotion logs as High rather than automatically Critical.


= 0.46.4 =
* Reduced fresh-install false positives: missing files from official plugin reference packages are summarized as scan notes rather than security issues.
* WordPress home/site URL differences are no longer treated as compromise; only malformed non-HTTP(S) values are flagged.
* WordPress core URL-details transients are contextualized as cache data when no executable PHP behavior is present.
* Administrator-change detection now establishes a baseline on the first completed scan and reports administrators added on later scans.

= 0.46.3 =
* Improves first-run spacing and turns Getting Started into a simple checklist instead of a numbered wizard.
* Adds an explicit Malware monitoring toggle under Protection. Monitoring remains on by default and recommended, but administrators can disable it.
* Includes Malware monitoring in the recommended-protection state and only shows the bulk enable action when a recommended protection is actually off.

= 0.46.2 =
* Fresh-install dashboard no longer reports a clean site before the first completed scan.
* Uses a neutral Scan required state and hides severity totals until a baseline scan exists.
* Fixes onboarding action layout when multiple administrator/2FA actions are shown.

= 0.46.1 =
* Fixed automatic scans stalling on low-traffic sites when delayed WP-Cron batches outlived a short-lived execution token.
* Automatic scan batches now use stable job/phase claims and remain valid when cron execution is delayed.
* Stale automatic scans self-requeue instead of being converted into a manual paused state.

= 0.46.0 =
* Harden destructive actions for release QA: stable finding IDs prevent stale action URLs from targeting shifted findings.
* Make file restore transactional: copy, SHA-256 verify, then remove the quarantine payload.
* Verify restored database rows before removing quarantine backups.
* Verify wp-config.php safety backups, writes and automatic rollback by SHA-256 before reporting success.
* Fail closed when permanent quarantine deletion cannot be completed.

= 0.45.2 =
* Production copy and status audit across Overview, Issues, Protection, Recovery and History.
* Simplified diagnostics and History wording; routine software updates are informational events.
* Removed internal event codes from the normal History table and clarified completed-scan messages.

= 0.45.1 =
* Made plugin integrity verification resumable within the same full scan, so slow hosts continue until every installed plugin has been processed instead of repeatedly stopping at the same 24-second boundary.
* Removed the misleading Medium partial-integrity issue; additional batches are normal scan progress, not a security finding.
* Deduplicated retired pre-MPTY Guard package notes.
* Added a narrow WordPress Coding Standards annotation for the Guard-owned account-suspension metadata lookup used by Recovery.

= 0.45.0 =
* Adds MPTY Threat Intelligence Corpus v1 from validated public WordPress malware incident research.
* Adds exact high-confidence incident artifacts for documented supply-chain, rogue-admin, hidden-plugin and persistence campaigns without treating ordinary vulnerable plugins as malware.
* Adds an exact published malicious-file SHA-256 rule for the documented WowShipping Pro dropper.
* Expands generic behavioral detection for header-controlled command execution, reflected request-driven command execution, remote-controlled callable execution and login credential exfiltration.
* Expands the permanent assurance corpus with real-world campaign-derived regressions plus a benign dynamic-callback control.
* Keeps normal UI simple: campaign details are only surfaced when local evidence actually matches.

= 0.44.4 =
* Performance: removed a duplicate recursive plugin-code traversal from the early known-threat phase.
* Detection coverage is preserved by running the existing backdoor/control-behavior assessment inside the resumable plugin malware pass that already reads each candidate file.
* Known-malicious plugin inventory checks remain in the early threat phase.

= 0.44.3 =
* Optimized plugin malware scanning by caching plugin metadata and trusted checksum manifests per resumable batch.
* Added per-phase scan timing under History > Advanced diagnostics for slow-scan troubleshooting.
* Removed the misleading final "File change check" status row after a scan is already complete.
* Scan completion duration is now shown in a human-readable format.

= 0.44.2 =
* Adds the agreed Malware monitoring status to Protection with a single clear On · Recommended state and plain-language description.
* Keeps scheduling, work limits and adaptive backoff internal so the Protection screen stays simple.
* Shows Not scheduled only when WordPress has no rapid-monitor cron event, avoiding a misleading enabled status.

= 0.44.1 =
* Hardened automatic malware monitoring for shared hosting with a smaller 1.5-second/600-entry normal work slice and an even smaller constrained profile.
* Added adaptive backoff after repeated slow runs or server interruptions instead of increasing work to catch up.
* Guaranteed rapid-monitor lock cleanup with try/finally and kept operational monitor failures out of security Issues.
* Preserved the 15-minute nominal cadence, resumable cursor, no-overlap behavior and automatic skip while a full scan is active.

= 0.44.0 =
* Added a bounded background malware watch between full scans for high-confidence PHP threats in writable and plugin locations.
* Added evidence-based plugin attribution to security findings without claiming a plugin is vulnerable when Guard cannot prove that.
* Added safe one-click plugin deactivation for strong local malware evidence; files are never deleted by this action.
* Kept component attribution concise in Issues, with technical detail available only where already appropriate.

= 0.43.1 =
* Fixed Recovery rendering stopping after step 4 by restoring the missing suspended-account query helper.
* Added recovery-render regression validation so all 11 recovery steps and their helper dependencies are verified before packaging.


= 0.43.0 =
* Hardens the resumable scanner for shared hosting with shorter bounded filesystem batches and deterministic cursor-based traversal that no longer rescans the directory prefix on every batch.
* Skips symlinks and prevents resumable malware traversal from following files outside the intended scan root.
* Deduplicates background scan watchdog scheduling so browser-driven scans do not create repeated cron jobs for the same job/phase.
* Retries an interrupted scan batch automatically twice, then pauses safely instead of converting scanner failure into a security finding or falsely marking the scan complete.
* Automatically resumes stale interrupted scheduled scans when the next automatic scan tick runs, while preserving completed phases.
* Preserves manual/automatic scan concurrency locking and resumability.

= 0.42.1 =
* Rebuilt Recovery as an explicit, ordered incident-response checklist with direct actions for administrator review, password changes, 2FA, session invalidation, authentication key/salt rotation, external credential changes, clean software replacement, rescanning and persistence monitoring.
* Combined authentication-key rotation and session invalidation into one recommended action to avoid redundant logouts while retaining a separate logout-only option.

= 0.42.0 =
* Added a permanent detection regression corpus covering representative malicious behavior and known-clean false-positive cases.
* Expanded engine assurance to validate severity thresholds, database decoding, hacked-content detection, benign REST/plugin behavior, and static-analysis fixture handling.
* Calibrated newly created administrator accounts to Medium unless stronger suspicious evidence is present.
* No new protection features were introduced in this release.

= 0.41.1 =
* Cleans up uninstall.php for WordPress coding standards by scoping cleanup variables inside a prefixed uninstall function.
* Documents the two intentional uninstall-only custom-table drops with narrow Plugin Check exceptions; uninstall behavior is unchanged.

= 0.41.0 =
* Encrypts authenticator-app TOTP secrets at rest using a dedicated Guard key stored outside the public WordPress root; existing plaintext enrollments migrate without re-enrollment when protected storage is available.
* Encrypts the temporary recovery-code display and makes it one-time; stored recovery codes remain password-hashed.
* Requires a fresh, non-replayed authenticator code before disabling 2FA or regenerating recovery codes.
* Removes browser download of wp-config.php; protected server-side backup remains available for key rotation.
* Adds explicit uninstall cleanup and documents Guard's local data/privacy behavior.

= 0.40.0 =
* Safety/reliability release: manual and automatic scans now share the resumable scan engine with concurrency protection.
* File quarantine is transactional and SHA-256 verified before commit and before restore.
* Suspicious user containment is now reversible account suspension; passwords and roles are preserved.
* Known-malicious plugins are deactivated and archived to verified quarantine before live files are removed, with restore support.

= 0.39.3 =
* Improved Getting Started so upgraded/migrated sites see a one-time orientation even when setup is already complete.
* 2FA onboarding now reflects all administrator accounts, not only the current user.
* Added a per-user Got it dismissal after verified setup completion.

= 0.39.2 =
* Added a lightweight first-run Getting Started checklist on Overview.
* Setup state is derived from real scan, recommended-protection, and administrator 2FA status.
* The setup checklist disappears automatically when all three steps are complete.

= 0.39.1 =

= 0.39.0 =
* Canonical plugin slug, text domain, PHP/JS/CSS identifiers, WordPress actions, cron hooks, options, user meta, custom tables and quarantine storage now use MPTY naming.


= 0.38.11 =
* Completed a second full product-language audit across Overview, Issues, Protection, Recovery, History, 2FA, scan progress, notices and advanced tools.
* Simplified remaining technical terms in normal workflows while keeping detailed evidence available inside advanced/technical sections.
* Clarified recovery, quarantine, database-watch, scheduling and notification wording and removed older terminology such as posture, threat intelligence and containment from the primary UX.
* Simplified readme/product description language without changing scanner, protection or remediation behavior.

= 0.38.10 =
* Simplified the primary admin copy across Overview, Issues, Protection, Recovery and History.
* Moved the site-recovery CTA directly below Site Status and rewrote it as a clear, non-alarming emergency path.
* Simplified scan coverage, protection status, recent activity and database-history language for non-security users.
* Updated live scan-completion copy so AJAX status updates use the same clear language as the server-rendered Overview.
* Shortened recovery and notification guidance while keeping advanced diagnostics available behind collapsed details.

= 0.38.9 =
* False-positive regression: recognizes Automattic VIPWPCS ruleset test fixtures as static-analysis test data only when both their dependency path and expected test annotations match.
* Keeps generic malware heuristics active for other vendor/test-looking files; there is no blanket vendor, tests, fixture-name, or Plugin Check exclusion.
* Applies the contextual fixture guard consistently to resumable malware scanning, fallback plugin heuristic scanning, and deep filesystem scanning.
* Adds an engine-assurance regression check so the known Plugin Check/VIPWPCS fixture stays quiet while an unrelated lookalike path remains untrusted.

= 0.38.8 =
* Fixed stale relative scan age after completed scans.
* Simplified engine assurance into collapsed Advanced diagnostics for troubleshooting.

= 0.38.7 =
* Fixed the encoded-database assurance fixture so it exercises the same minimum-length Base64 decode path used by production scanning.
* No production database-decoding thresholds or detection logic were weakened.

= 0.38.6 =
* Add manual detection/protection assurance checks using inert synthetic malicious and benign samples.
* Verify required scanner subsystems and runtime protection hooks after upgrades.
* Add History diagnostics for latest scan, persistence watches, protection settings, scheduled scan state and latest security event.
* Clarify that a quiet/clean scan is separate from engine-health validation.

= 0.38.5 =
* Stabilize Security event log column widths so expanding Request / writer context no longer shifts or resizes the table.
* Constrain forensic detail content to the Event column with independent wrapping/overflow.

= 0.38.4 =
* Capture the exact scheduled hook currently executing when a blocked persistence write occurs.
* Resolve the executing cron callback against the active hook where trace evidence permits.
* Prevent WordPress core cron-runner files from being promoted to Likely origin.
* Tighten direct SQL persistence blocking so a known option name must be the actual wp_options target, not merely text inside an unrelated option value.

= 0.38.3 =
* For blocked persistence writes during WP-Cron, capture the active scheduled hook and resolve the executing callback to its component/source file when possible.
* Preserve the bounded cron/action hook stack as supporting forensic evidence.
* History now separates cron hook/callback attribution from generic call-path components.

= 0.38.2 =
* Improved persistence-write attribution with deeper bounded call-path analysis and conservative likely-origin scoring.
* Added request-URL correlation to WordPress content plus SEO-spam/redirect signals for persistence incidents.
* Added transliterated gambling-spam terms to content forensics.
* Prevented duplicate blocked-persistence History rows from the same request while retaining cross-context evidence.
* Renamed weak writer attribution to call-path component unless stronger origin evidence exists.

= 0.38.1 =
* Adds bounded forensic request/writer attribution for blocked database persistence writes.
* History now distinguishes request user/IP from code authorship and exposes request type, URI, client classification and plausible component caller.
* Captures a short technical call path only after a suspicious persistence write has already been blocked.
* Refines blocked-write event deduplication by request context so distinct external and authenticated triggers remain visible without log flooding.

= 0.38.0 =
* Adds recommended password-login rate limiting with bounded per-source and per-account/source thresholds.
* Adds optional protection against unauthenticated WordPress REST user enumeration.
* Expands generic malware behavior detection for remote loaders/droppers, conditional redirects/cloaking, browser-history hijacking, programmatic administrator creation and plugin-list hiding.
* Adds hacked-content detection for hidden external iframes/links and scripted redirects in WordPress posts.
* Adds configuration detection for dangerous public-registration/default-role combinations.
* Keeps known malware-family indicators as attribution evidence rather than requiring family-specific strings for generic attack detection.

= 0.37.14 =
* Generalizes known-family malware intelligence into behavior-based plugin backdoor detection.
* Keeps Link Factory and Agile Collector indicators as attribution intelligence rather than privileged scanner logic.
* Adds generic known-threat artifact registries for administrator/database indicators.
* Preserves high-confidence exact-package and payload signatures while retaining generic execution, persistence, integrity, database, cron, upload and content detection.
* Detection-regression audit confirms the pre-rename scanner subsystems remain present after the Guard by MPTY rename.

= 0.37.13 =
* Make persistence-watch recovery self-healing from preserved DB quarantine evidence.
* Add watch-recovery diagnostics when no active watch can be reconstructed.

= 0.37.12 =
* Uses the WordPress site timezone when calculating reconstructed watch expiry.
* Deduplicates repeated identical known-persistence direct-SQL block events to one History/email event per five minutes while continuing to block every write attempt.

= 0.37.11 =
* Refresh Overview status, severity totals and latest-scan metadata immediately when an AJAX scan completes.
* Reconstruct still-valid database persistence watches from recovered quarantine evidence when migration state is missing.

= 0.37.10 =
* Recognizes exact SHA-256 hashes of known pre-MPTY development releases so retired scanner code is reported as migration cleanup rather than misclassified as malware. Modified or unknown copies remain fully scannable.
* Keeps quarantine evidence authoritative and preserves the existing 14-day passive persistence-watch window.

= 0.37.9 =

= 0.37.8 =

= 0.37.6 =
* Gives authoritative official plugin checksums precedence over heuristic malware scoring, preventing verified clean test/vendor fixtures from being mislabeled as malware.
* Moves non-executable readme/license/changelog checksum drift, protected UpdraftPlus backup verification, and unavailable core checksum manifests into Scan notes instead of actionable Issues.
* Suppresses structured plugin/cache/transient database values when no executable/decode chain is present and application context makes them probably legitimate.
* Treats ordinary plugin/theme/core updates as Low/informational maintenance findings unless separate vulnerability evidence exists.
* Renames the update category to Software updates so ordinary maintenance is not presented as a known vulnerability.

= 0.37.5 =
* Replaced PHP parse_url() with WordPress wp_parse_url() in TOTP issuer generation.
* Documented the nonce exception for the WordPress login second-factor field, which participates in core authentication rather than an admin state-changing form.

= 0.37.4 =
* Caps Guard by MPTY security-event History at the newest 200 events while keeping pagination at 25 events per page.
* Pruning affects only the custom event log; active findings, quarantine records, scan state and other forensic data are not removed.

= 0.37.3 =
* Keeps relative scan age in consistent English (for example, “3 hours ago”) instead of inheriting localized WordPress time abbreviations inside the otherwise-English Guard UI.
* Adds server-side History pagination at 25 security events per page with total/event-range context.
* Refactors database History into diagnostics with assessments, recommended next steps and deep links to the canonical Issues workflow.
* Removes duplicate database-quarantine presentation from History; containment remains in Issues where actions belong.


= 0.37.2 =
* Keeps completed scan progress out of the Overview: the detailed phase/progress workspace now appears only while a scan is running, paused, or has just completed in the current page session.
* Uses the Overview status card as the persistent source of truth for latest-scan age and exact completion time.
* Replaces the misleading aggregate “core controls” count with separate recommended-protection and optional-hardening metrics derived from the actual Protection settings.

= 0.37.1 =

= 0.37.0 =
* Completes the controlled product rename to Guard by MPTY across the plugin header, slug, text domain, main file, PHP class, UI copy, assets, actions, cron hooks, option/meta keys, quarantine storage and internal identifiers.
* Adds one-time migration from pre-release predecessor settings, findings, scan state, event/quarantine tables, authenticator enrollment data and quarantine storage.
* Retains former plugin slugs and SSG identifiers only inside the narrowly scoped migration path so existing development installations can transition safely.
* Keeps the product at a pre-1.0 development version while the broader industrialization/security audit continues.

= 0.36.3 =
* Makes latest-scan timing explicit on Overview using relative age plus the exact completion timestamp; scan duration is no longer presented as primary status metadata.
* Moves the compromise-recovery entry point out of routine scan actions into a dedicated Incident Response call-to-action.
* Introduces a restrained traffic-light status system: Critical is red, High/Medium attention is amber, healthy scan state is green, and informational states remain neutral.
* Changes scan-coverage findings from red to amber because coverage cards do not encode finding severity.

= 0.36.2 =
* Promoted authenticator app 2FA into a dedicated Login security section under Protection.
* Added clear per-account enabled/disabled state and administrator 2FA coverage.
* Added contextual Enable, Manage/disable, and Review administrators actions without introducing a misleading site-wide 2FA toggle.

= 0.36.1 =
* Removed the ambiguous Tools primary tab and moved its remaining functions into contextual workflows.
* Quarantine now appears in Issues only when isolated file or database items exist.
* Clean-package comparison now lives as optional Advanced verification at the bottom of Issues.
* Recovery links directly to quarantined items only when quarantine contains something.

= 0.36.0 =
* Adds native authenticator-app two-factor authentication (TOTP) for WordPress accounts using standard RFC 6238-compatible apps.
* Adds local QR-code enrollment, manual setup keys, verification-before-activation, one-time recovery codes, replay protection and short lockout after repeated invalid second-factor attempts.
* Adds self-service 2FA management to WordPress user profiles and administrator reset capability for another user without exposing their secret.
* Adds administrator 2FA coverage to Protection and links the Recovery workflow directly to Guard by MPTY 2FA setup.
* Bundles the MIT-licensed Kazuhiko Arase QR Code Generator locally; no TOTP secret is sent to an external QR or authentication service.

= 0.35.9 =
* Promoted hacked-site recovery to a first-class Recovery tab instead of burying it inside Tools.
* Added a clear Start site recovery CTA to Overview and Tools.
* Kept Tools focused on supporting utilities such as quarantine and clean-package comparison.
* Updated recovery action redirects and quarantine links for the new navigation structure.

= 0.35.8 =
* Rebuilds Tools around a single plain-language hacked-site recovery checklist instead of abstract tool cards.
* Places session invalidation and authentication key/salt rotation directly inside the account-security recovery step.
* Adds direct WordPress paths for changing the current administrator password and sending password reset links to trusted administrators.
* Removes duplicated administrator-review steps and reduces advanced terminology in the primary recovery workflow.
* Keeps quarantine and clean-package verification as secondary tools below the recovery checklist.

= 0.35.7 =
* Renames the primary Activity tab to History while preserving the existing internal tab slug for backward-compatible deep links.
* Updates user-facing references so forensic events, persistence evidence and notification settings consistently refer to History rather than the ambiguous Activity label.
* Refines the Overview event section to Recent security events with a single View history destination.
* Keeps raw technical logging as a concept within History rather than using Logs as the top-level navigation label.

= 0.35.6 =
* Reworks Tools around explicit jobs: compromise recovery, quarantine, access containment and advanced clean-package verification.
* Makes Tools summary cards functional in-page navigation instead of non-interactive status boxes.
* Removes the duplicate Overview “Open Issues” next-step card; the Site Status hero is now the single primary issues CTA.
* Adds a guided eight-step compromise-recovery playbook with clear Guard by MPTY actions, WordPress actions and hosting/external actions.
* Adds context around session invalidation, authentication salt rotation, password changes, 2FA, updates, external credential rotation and final verification.


= 0.35.5 =
* Improved scheduled-scan UX with equal-size controls and cadence-aware progressive disclosure.
* Twice-daily scheduling now honors the selected first-run time before repeating every 12 hours.
* Scheduled scans now publish complete latest-scan metadata and reset scan coverage so Overview always reflects the newest scan.
* Overview identifies whether the latest completed scan was automatic or manual.


= 0.35.4 =
* Resolves the final two Plugin Check direct-database warnings caused by PHPCS directive placement without changing forensic query behavior.
* Keeps live schema discovery and orphan administrator-capability analysis uncached because stale state could weaken security conclusions.
* Removes the internal Direct Database Exception Register markdown file from the production plugin package; the exception rationale remains documented at each retained SQL call site and in development records.
* Preserves the v0.35.3 functional surface while preparing the production package for a zero-warning Plugin Check verification.

= 0.35.3 =
* Completes a call-by-call audit of the remaining direct database operations and adds a Direct Database Exception Register.
* Replaces recent-post and historical-post forensic reads with WP_Query where WordPress APIs are semantically equivalent.
* Retains exact raw-row reads for reversible database quarantine so serialized evidence is not normalized before backup.
* Retains uncached direct SQL for custom Guard by MPTY tables, schema discovery, arbitrary-table forensics, live persistence evidence and exact restore operations where core APIs are insufficient.
* Adds narrow, documented PHPCS exceptions only at retained direct-query sites; no global suppression or generic SQL gateway is introduced.
* Does not introduce caching where stale state could alter a security or remediation decision.

= 0.35.2 =
* Audits every remaining direct database operation against available WordPress APIs.
* Uses delete_option() and delete_metadata_by_mid() for quarantined live-record removal after the exact raw database row has been backed up.
* Uses get_option() and get_metadata_by_mid() for database restore conflict checks.
* Uses get_option() for option investigation, new-option follow-up and reviewed-value hashing where raw SQL is not required.
* Removes the remaining blanket mpty_guard_* shortcut from new-option detection and recognizes only explicit Guard by MPTY-owned internal options.
* Keeps direct uncached SQL only for raw forensic evidence, schema/table discovery, exact reversible row restoration and Guard by MPTY custom tables where no equivalent WordPress API exists.
* Does not add caching to forensic reads where stale data could change a security decision.

= 0.35.1 =
* Removes the generic database gateway that prevented Plugin Check from proving queries were prepared.
* Restores direct prepared $wpdb calls at each forensic query site while keeping narrowly scoped no-cache/direct-query rationale.
* Removes the five PreparedSQL.NotPrepared errors and matching unescaped-database-parameter warnings caused by the gateway abstraction.
* Restructures capability and post-metadata finding data to avoid false slow-query meta_key warnings without removing forensic checks.
* Preserves the same scan, quarantine and database-remediation behavior.

= 0.35.0 =
* Consolidates intentional uncached forensic database access behind a documented internal gateway.
* Removes dynamically assembled SQL from the known-indicator and generic table scanners.
* Uses WordPress %i identifier placeholders for dynamic table and column names.
* Removes the remaining Plugin Check upload-input warning with a narrow, documented field-by-field validation exception.
* Avoids an unnecessary postmeta meta_key scan warning by resolving matched metadata through the WordPress metadata API.
* Documents the exact administrator-capability meta_key query that remains necessary for orphan-record forensics.
* Rewrites readme.txt using standard WordPress.org sections with a bounded Description.

= 0.34.0 =
* Plugin Check compliance hardening for escaping, prepared SQL identifiers, request sanitization, filesystem APIs and readme metadata.


== Third-party libraries ==

Guard by MPTY bundles QR Code Generator for JavaScript by Kazuhiko Arase (MIT License) for local authenticator enrollment QR rendering. The license is included under assets/vendor/.
