=== PRBLEM Security Guard ===
Contributors: prblem
Tags: security, firewall, malware, integrity, login, hardening, audit
Requires at least: 6.0
Requires PHP: 7.4
Stable tag: 4.0.0-beta2.4
License: GPLv2 or later

A lightweight local WordPress security suite by PRBLEM.


= 4.0.0-beta2.4 =
* Fixed a false positive that could classify legitimate WordPress theme/plugin ZIP packages as PHP payloads hidden behind a non-PHP filename.
* ZIP uploads are no longer scanned as a raw byte stream for the disguised-PHP rule; they are routed through bounded archive inspection instead.
* Existing archive path traversal, deceptive executable filename and high-confidence archive risk blocking remain enabled.
* Direct non-archive uploads containing disguised PHP continue to be blocked.

= 4.0.0-beta2.3 =
* Added administrator-controlled Scheduled Scans for Quick and Deep coverage with Off / Daily / Weekly controls; Quick Scan also preserves the existing Every 6 Hours option for upgrade continuity.
* Added site-time start controls, weekly-day selection, next-run visibility, and safe cron resynchronization after settings changes.
* Scheduled scans continue to use PRBLEM scan locks so automated and manual hunts cannot overlap.
* Replaced the rotating Live Threat Hunt stage arrow with a local file-scan beam animation and upgraded completed-stage badges for clearer, more premium scan feedback.
* Added reduced-motion handling and responsive Scheduled Scans controls.


= 4.0.0-beta2.1 =
* Replaced the plain TOTP enrollment block with a dedicated PRBLEM Two-Factor Authentication setup wizard.
* Added a local, browser-side QR code generated directly from the standards-compatible otpauth URI; no TOTP secret is sent to a remote QR service.
* Added Setup / Verify / Recovery Codes / Complete progress indicators, a copyable manual key, a focused 6-digit verification field and responsive/mobile layout.
* Added an explicit Cancel Setup action which clears only the pending enrollment secret and leaves existing account credentials unchanged.
* Bundled the MIT-licensed QRCode for JavaScript encoder locally and documented its license.

= 4.0.0-beta2 =
* Added real RFC 6238 TOTP two-factor authentication with verified account-owner enrollment.
* TOTP secrets are encrypted at rest with AES-256-GCM using key material derived from WordPress authentication salts; enrollment fails closed when secure local encryption is unavailable.
* Added 10 random single-use recovery codes. Only password hashes are retained after the one-time encrypted display.
* Added replay protection so the same accepted TOTP time step cannot be reused for a second login.
* Added a WordPress login security-code field for enrolled accounts, accepting either the current authenticator code or a valid unused recovery code.
* Added profile controls to begin enrollment, verify the authenticator, regenerate recovery codes and disable 2FA. Other administrators cannot view or manage another account's secret/recovery codes.
* Added an administrator enrollment reminder that does not silently lock out accounts which have not enrolled yet.
* No TOTP secret is sent to a third-party QR service; setup exposes a local manual key and standards-compatible otpauth URI.


= 4.0.0-beta1 =
* Entered Release Freeze: no new protection subsystem is introduced in beta1; work is limited to regression, performance, compatibility, recovery and UI correctness.
* Added local RC Readiness aggregation across exact-build Release Qualification, Compatibility preflight, package SHA-256 inventory, scan-lock health and duplicate-install detection.
* RC Readiness reports READY / REVIEW / BLOCKED without disabling live security engines or granting destructive authority. Package verification remains diagnostic-only.
* Qualification results are build-bound: an alpha27 result does not qualify beta1; the bounded harness must be run once after the beta build is installed.
* RC1 gate is explicit: zero BLOCKED readiness gates and zero failed qualification contracts. Environment-specific REVIEW items require an intentional staging/operator decision.
* Retained alpha27 attack/recovery qualification, alpha26 upgrade safety and alpha25 performance/false-positive hardening unchanged.

= 4.0.0-alpha27 =
* Added Release Qualification v1: a bounded, administrator-triggered regression harness for Firewall v2, Upload Protection, Behavioral correlation, Incident grouping, Compatibility preflight and real Recovery/Quarantine primitives.
* Qualification uses synthetic in-memory attack evidence plus one benign text canary inside the WordPress uploads directory. It never injects executable malware, never attacks the public site and never grants destructive authority to Autonomous Response.
* Added a real recovery round-trip contract: benign canary backup, live deletion, SHA-256-verified restore, quarantine move and restore, followed by same-run cleanup.
* Added an explicit release gate with QUALIFIED / REVIEW / FAILED result, per-contract timing, bounded local result retention and a zero-FAILED target before beta1.
* Added regression checks that strong SQLi is blocked while benign search traffic remains allowed, executable double-extension uploads are classified, request-controlled command execution remains high-confidence, independent behavior families correlate, and repeated evidence still collapses into one strongest incident.
* Release Qualification is evidence for regression control, not a claim of exhaustive hosting/attack coverage; environment-specific Compatibility items may remain REVIEW until staged.
* Fixed Virtual Patching readability: Mitigation Policy labels/copy, Recent Virtual Patch Blocks empty/event text and the Source Code / Patch Scope / Unsupported Vector / Fixed Version footer now use larger, dark, high-contrast typography on the light PRBLEM console.
* Existing recovery-first destructive gates, Emergency Cleanup, Autonomous Response, Fleet and Alpha26 upgrade-safety behavior remain unchanged.

= 4.0.0-alpha26 =
* Added Compatibility & Upgrade Safety preflight for PHP, WordPress core, WP-Cron, reverse-proxy/CDN signals, duplicate PRBLEM installs, Multisite, object cache and ZipArchive availability.
* Added a duplicate-install activation takeover guard: when a legacy PRBLEM Security Guard copy is already active, activating alpha26 deactivates sibling PRBLEM plugin entries instead of loading the same runtime classes twice and triggering a fatal redeclaration.
* Added local upgrade migration ledger. Version transitions merge newly introduced defaults without overwriting existing settings, clear stale scan locks older than one hour and invalidate cached compatibility state.
* Added Update URI: https://prblem.com/ to the plugin header so WordPress.org cannot accidentally substitute an unrelated similarly named plugin package.
* Added compatibility-aware Site Health output and a Settings preflight panel with explicit READY / REVIEW / BLOCKED state.
* Added integration signals for WooCommerce, LiteSpeed Cache, Cloudflare plugin, Jetpack and Redis Object Cache. Detection is informational and never edits third-party plugin files.
* Reverse-proxy safety remains fail-closed: CF-Connecting-IP and X-Forwarded-For are not trusted until the connecting proxy IP/range is explicitly trusted in PRBLEM settings.
* PHP runtimes newer than the current release-validation target are flagged for staging review instead of being falsely claimed as verified.
* Existing Autonomous Response, Emergency Cleanup, Fleet, Recovery Vault and false-positive hardening behavior is unchanged.

= 4.0.0-alpha25 =
* Added Release Hardening v1 with local scan performance telemetry, overlap prevention and bounded resource budgets.
* Scheduled and manual scans now use a single-scan lock so deep, quick and Live Threat Hunt jobs cannot pile up on the same WordPress process window.
* Added Conservative, Balanced and Complete scan performance profiles. Balanced is the production default; all profiles retain runtime ceilings and destructive-response safety rules.
* Full filesystem scopes now stop safely at both entry-count and runtime budgets, recording an informational continuation notice instead of treating resource limits as a security incident.
* Quick scans skip expensive post/comment content inspection; deep/manual scans keep content coverage with bounded row limits.
* Added False-Positive Hardening: repeated findings are deduplicated by evidence key while preserving the strongest severity; plugin/theme update availability becomes informational rather than malware-like warning noise.
* Public registration is context-aware when WooCommerce or membership plugins indicate intentional account creation. HTTPS proxy ambiguity and WP_DEBUG on non-production environments are downgraded to review information rather than escalated warnings.
* PHP heuristic review now distinguishes request-driven execution from encoded patterns found inside tests/examples/docs/fixtures, reducing development-fixture noise without suppressing exact malware markers or request-driven execution patterns.
* Added a Settings release-hardening panel with last scan duration, files checked, peak memory, scan-lock state, false-positive guard state and local environment metadata. No telemetry is uploaded.
* Emergency Cleanup, Autonomous Response, recovery-first destructive gates and exact IOC handling are unchanged.

= 4.0.0-alpha24.5 =
* Fixed Emergency Cleanup button contrast: white text is now forced above the later generic anchor-button text-fill rule that previously made the label appear almost black.
* Added a final destructive-action contrast override with explicit visited, hover and focus states so browser/WebKit text-fill behavior cannot hide the Emergency Cleanup label.
* No Emergency Cleanup execution, confirmation, recovery-first behavior or response policy logic changed in this release.

= 4.0.0-alpha24.4 =
* Rebuilt Behavioral Threat Engine Decision Policy rows for full contrast on the light PRBLEM console: larger dark copy, stronger score ranges and clearer separators.
* The current behavior score now highlights its active decision band with a CURRENT badge, making escalation state visible without interpreting the raw score manually.
* Added a persistent safety note clarifying that behavior correlation can raise incident priority but never authorizes destructive remediation by itself.

= 4.0.0-alpha24.3 =
* Added a dedicated PURGE ALL control to Recovery Vault v2 for deleting all stored file backups, quarantine copies, database recovery items and cron recovery items in one explicit action.
* PURGE ALL uses the existing verified per-store purge primitives, preserves lightweight Recovery Session audit history and reports failed deletions instead of silently hiding them.
* Reworked the bulk purge toolbar so the master action is visually distinct from per-store cleanup buttons.


= 4.0.0-alpha24.2 =
* Readability sweep: standardizes previously microscopic labels across SOC, policy, fleet, timeline, story, badges, tables and diagnostics to the larger alpha24.1 incident text baseline.
* Centers live hunt stage headings and summary metric headings for faster scanning.
* Preserves responsive layouts while removing the previous mobile font-size regression.

= 4.0.0-alpha24.1 =
* Increased Live Threat Hunt result typography for stage labels, status metadata, verification state and incident counters.
* Threat Hunt stage tiles are now actionable: Database opens Database Threat Detection, Uploads opens Upload Protection, Theme/Plugin/Integrity stages open File Integrity, Environment opens Hardening, and Verification returns to Incidents.
* Warning/failed stage tiles explicitly show CLICK TO REVIEW and retain subsystem-specific navigation even when JavaScript is unavailable.
* Active Incidents, Critical, Resolved History and Raw Evidence counters are now clickable drill-down controls with focused scrolling to the relevant evidence area.

= 4.0.0-alpha24 =
* Added Multisite + Agency Foundation with a local-first Fleet Control Plane.
* Multisite super administrators can view a bounded network inventory with per-site security score, active critical/warning findings, hunt freshness, policy profile, Firewall v2 coverage and Autonomous Response state.
* Added policy-drift detection and explicit one-time network policy broadcast using the existing Standard, Advanced, Enterprise, Maximum and Paranoid profiles. CUSTOM site profiles are preserved by default.
* Policy broadcast is advisory rather than silently enforced, preserves CUSTOM profiles by default and is bounded to 50 sites per action; Maximum/Paranoid compatibility guards continue to evaluate each site independently.
* Added a privacy-filtered Agency Snapshot JSON export for handoff/reporting. Exports omit passwords, API tokens, IP allow/block lists, file paths and payload bodies.
* Added local Fleet ID and per-site Node IDs for report identity and future opt-in pairing. They are not credentials and alpha24 does not transmit them.
* Added a dedicated Network Admin PRBLEM Guard page when WordPress Multisite is active, while keeping the normal WordPress PRBLEM sidebar compact.
* Added automatic baseline settings initialization and Node ID creation for newly created Multisite sites.
* Cross-install remote agency management is intentionally not claimed in alpha24; that requires a future opt-in PRBLEM Cloud/agency service.


= 4.0.0-alpha23.4 =
* Added Security Policies v2 with Standard, Advanced, Enterprise, Maximum and Paranoid operating profiles.
* Added Adaptive Site Profile recommendations using local compatibility signals such as Multisite, public registration, WooCommerce/membership plugins, Jetpack and administrator application passwords.
* Adaptive recommendations never silently escalate a site to Maximum or Paranoid; manual settings remain available and mark the control plane as CUSTOMIZED.
* Maximum applies compatibility guards when remote-auth signals are present; Paranoid intentionally prioritizes attack-surface reduction and can disable XML-RPC/application passwords.
* Added Distributed Credential Defense: repeated failures against the same username across multiple IPs are correlated into one identity attack instead of remaining isolated failed-login rows.
* Distributed response locks observed attacker IPs and tightens per-IP thresholds without ever creating a global username lock that an attacker could abuse for denial-of-service.
* Added temporary targeted XML-RPC shielding during distributed attacks, configurable independently for compatibility-sensitive sites.
* Existing retained login-audit history is evaluated by a bounded once-per-minute watch so an already-active attack can be recognized immediately after update.
* Identity drill-down now includes Distributed Attacks with target username, failure count, distinct IP count, login surfaces and retained attacker IPs.

= 4.0.0-alpha22 =
* Reorganized the growing admin console into seven stable workspaces: SOC, Incidents, Protection, Intelligence, Recovery, Activity and Settings.
* Protection now contains Firewall, Identity, Uploads, Database, File Integrity and Hardening as contextual sub-navigation instead of separate WordPress sidebar entries.
* Intelligence contains Threat Intel, Vulnerabilities, Virtual Patches, Behavior and Attack Story as contextual sub-navigation.
* Existing psg_tab deep links remain supported, while the WordPress sidebar is intentionally compact so new subsystems do not create an ever-growing flat menu.
* Added PRBLEM Threat Intelligence Foundation v1 with a normalized IOC schema and bounded local catalog for exact CRUX, AutoPrepend and webshell indicators already used by local defense engines.
* Added a stable lookup/feed contract for future PRBLEM Cloud IOC, reputation and exploit-signature feeds. This release makes no remote PRBLEM Cloud connection and transmits no site telemetry.
* Future remote intelligence is designed to require authenticated provider delivery before activation; remote data cannot silently replace the local catalog.
* SOC Operations Feed now states the local IOC record count and clearly labels PRBLEM Cloud as not connected.


= 4.0.0-alpha21 =
* Added Product Integrity & Signed Builds with Ed25519 publisher verification over the exact SHA-256 release manifest.
* Official builds expose a release ID, signing-key ID and public-key fingerprint; the private signing key is never shipped to WordPress.
* Added a dedicated Product Integrity workspace showing signature state, signed-file verification counts, missing/modified/unexpected files and build provenance.
* Added Product Integrity Safe Mode: if the signed package is tampered or the release signature fails, automatic destructive response is suspended instead of trusting modified security code.
* Existing manual operator recovery remains available so a tampered installation is not made impossible to repair.
* Added key-rotation-ready trusted public-key handling and a reusable Ed25519 verifier for future signed PRBLEM update metadata.
* Added release-public-key.txt, release-metadata.json, BUILD-PROVENANCE.md and COPYRIGHT.txt to every signed package.
* Existing SHA-256 self-integrity findings now derive from the signed manifest instead of trusting a mutable hash list by itself.

== 2.1.2 ==

Major architecture and interface release.

Local protection modules:
* Malware indicator scanning with the compromise patterns observed on the affected hosting account.
* Hidden PHP and random hex-name PHP detection.
* Strong-pattern heuristic PHP review during deep/manual scans.
* WordPress core checksum verification.
* Critical-file and administrator trusted baseline monitoring.
* Separate self-integrity inventory for PRBLEM Security Guard.
* SHA-256 self-integrity monitoring without chmod-based write protection, so normal installs and updates remain compatible.
* Lightweight application request firewall.
* Manual IP/CIDR allow and deny lists.
* Login attempt rate limiting and timed lockouts.
* Generic login errors.
* Author enumeration protection.
* Logged-out REST user endpoint shielding.
* Optional XML-RPC and application-password disabling.
* Security headers with optional HSTS.
* Uploads PHP execution hardening.
* Security event logging and critical email alerts.
* Six-hour quick scans and daily deep scans.
* Dashboard widget and Site Health integration.
* System Failure / arcade-vintage PRBLEM admin console.

Performance model:
The plugin does not run deep filesystem scans on normal front-end requests.
Request protection uses small in-memory/string checks and logs only security-relevant events.
Security events are capped and stored with autoload disabled.

Important:
This plugin is an independent implementation. It does not contain or copy code from Wordfence, All-In-One Security, Solid Security, Sucuri or MalCare.
A local WordPress plugin cannot provide CDN-edge WAF coverage, external reputation intelligence, off-site malware cleanup, or host-account/SSH protection by itself.
Those capabilities require a remote PRBLEM service or server-level component.

== 2.1.2 ==
* Removed chmod-based plugin write locking.
* Self-integrity monitoring remains active through SHA-256 baselines.
* Normal WordPress installs, manual ZIP replacements and updates remain compatible.
* Added PRBLEM.COM header link and a brighter arcade-vintage admin palette.

== 2.1.2 ==
* Dashboard widget now uses a clean native-white WordPress surface.
* Added uploads executable-file audit with harmless index.php placeholder suppression.
* Added suspicious WordPress cron persistence checks for known compromise indicators.
* Added active-plugin-record validation for missing plugin files.
* Added group/other write-permission checks for critical configuration files.
* Added administrator application-password visibility.
* Added one-click revocation of other administrator sessions.
* Existing low-overhead request path and scheduled scanning model remain unchanged.

== 2.1.2 ==
* Hotfix: restores the security-check methods and administrator-session revocation handler referenced by 2.1.0.
* Full Scan no longer fatals on check_active_plugin_files().

== 2.1.2 ==
* Replaced update-sensitive database self-baselines with a package SHA-256 integrity manifest.
* Legitimate plugin upgrades no longer produce false "file changed / unexpected file" critical findings.
* Package file deletion, modification and unexpected additions are still detected.
* Fixed primary action button hover/focus contrast in the PRBLEM console.

== 3.1.0 ==
* Major independent security-suite hardening release informed by a comparative architecture review of mature WordPress security products. No third-party plugin source code is included.
* Added manual quarantine vault with restore and permanent-delete controls.
* Added Emergency Lockdown with reversible registration, XML-RPC, application-password and core defense restrictions.
* Added trusted security snapshots with diffing for administrators, active plugins, cron hooks, MU-plugins, drop-ins, theme state and critical files.
* Added administrator trust UI and safe administrator-role removal with session revocation.
* Added bounded database persistence scanning for known compromise markers and strong obfuscation patterns.
* Added sensitive artifact detection for config backups, .env, SQL dumps, phpinfo and debug.log.
* Added inactive extension hygiene checks.
* Added trusted-proxy aware client-IP resolution. Forwarded headers are ignored unless REMOTE_ADDR matches configured proxy CIDRs.
* Added repeated high-risk 404 probe detection with temporary IP blocking.
* Added administrator session overview.
* Scanner findings can offer manual quarantine only when they resolve to a real file and the file is outside the Security Guard package.
* Reworked admin UI into a lighter premium PRBLEM System Failure operations console.

== 3.1.0 ==
* Premium visual refinement of the PRBLEM Security Operations console.
* Website CTA moved out of the score area into a subtle footer action.
* Header now gives the security score exclusive visual priority.
* Added a compact command/status strip below the hero.
* Rebalanced ivory surfaces, dark system panels, lime instrumentation and borders for a cleaner premium arcade-vintage feel.
* Improved button hierarchy, panel contrast and spacing without changing security behavior.

== 3.1.0 ==
* Fixed database persistence scanner self-recursion false positives.
* Security Guard now excludes only its own known internal telemetry/options from malware-content scanning.
* Added direct critical detection for legacy sc_persist_manifest, sc_own_manifest and sc_own_rec compromise options.
* Expanded incident marker coverage while preserving bounded database scanning.


== 3.1.0 ==
* Added staged AJAX full scans with a real phase-progress console. Normal front-end requests still never run a full scan.
* Added a ten-module scan pipeline: Server State, Persistence, File Changes, Malware, Content Safety, Public Files, Core Integrity, User Audit, Updates and Recovery.
* Added Automatic Backup Vault. Safe Remove and WordPress Core Repair create recoverable copies before modifying live files.
* Restoring over an existing file creates a second pre-restore safety copy first.
* Added verified WordPress core repair using the official WordPress core source and official MD5 checksums.
* Added Repair All Core for the current set of repairable core findings, capped for safety.
* Added Content Safety auditing for strong executable patterns in a bounded set of recent posts/comments.
* Added Server State auditing for PHP memory, disk space, cron posture and display_errors.
* Added administrator password policy enforcement on future admin password changes/resets.
* Recovery Center now unifies reversible quarantine and automatic rollback backups.
* Suppresses the unrelated "Reset the optimized data successfully" notice specifically on the PRBLEM Security Guard console.


= 3.2.0 =
* Added Active Defense for exact confirmed Crux/SC persistence indicators.
* Confirmed file removal/repair now creates a recovery copy before destructive action.
* Added a throttled five-minute IOC watch plus hourly Active Defense scheduled check.
* Added recoverable cleanup for sc_persist_manifest, sc_own_manifest and sc_own_rec database persistence options.
* Added strict SC_TH theme-block repair with PHP syntax validation before replacement.
* Added safe removal of confirmed .sc_* working directories, Crux marker artifacts and inert 8-hex PHP placeholders.
* Added one-click fixes for public registration and literal WP_DEBUG=true.
* Stale new-administrator findings are revalidated against current users and trusted baseline before display.
* New administrator findings include registration time; account audit events keep event time and show when the account no longer exists.
* Dashboard widget now shows the latest security event with timestamp and matches the PRBLEM console styling.

= 4.0.0-alpha1 =
* Part 1 of the Security Operations Center architecture.
* Replaced the legacy Overview surface with the new SOC Dashboard while preserving the existing 3.2 security engine behavior.
* Added real-data Threat Level, Security Score, Active Defense Status, Recovery Status, Firewall Status, Last Incident, Live Activity and Resource Usage cards.
* Added Security Timeline and Operations Feed driven by existing local event, scan, firewall, snapshot and recovery telemetry.
* Added a read-only PRBLEM_Security_SOC presentation layer; it performs no destructive response actions.
* Rebuilt the WordPress Dashboard widget with Threat Level, Active Defense, Firewall, Recovery, Last Incident, Last Scan, Last Backup, blocked requests and trusted-state change counters.
* Added the ivory / dark operations / lime telemetry visual foundation for v4.
* Scanner, Active Defense, firewall, login protection, quarantine, backups and existing 3.2 response behavior remain unchanged in this first incremental package.


= 4.0.0-alpha2 =
* Part 2 of the v4 Security Operations Center architecture: Incident Engine + Smart Grouping.
* Replaced the top-level Scanner tab with an Incidents workspace. The underlying scan engine remains intact as evidence collection, but the operator UX is now incident-first.
* Added PRBLEM_Security_Incident_Engine with deterministic grouping for CRUX persistence, AutoPrepend persistence, hidden drop-ins, cron persistence, database persistence, upload execution threats, malware/executable threats, integrity drift, administrator/identity risk, extension posture, sensitive artifacts, content abuse, WordPress hardening and runtime health.
* Incident cards expose severity, stable incident ID, confidence 0-100, evidence count, file/folder/database-option/cron/plugin/account grouping and raw evidence expansion.
* Incident state is persisted after manual, quick and deep scans. A small resolved-incident history is retained so a later clean hunt can show that an incident disappeared.
* SOC and Dashboard widget now use the grouped Incident Engine for Last Incident instead of selecting an arbitrary raw finding.
* Interactive scan language is now Threat Hunt and returns to the Incidents workspace after completion.
* Third-party WordPress admin notices are suppressed only while viewing the PRBLEM Security Guard console. They remain untouched everywhere else in wp-admin.
* Existing firewall, login defense, Active Defense, quarantine, backup, core repair and scanner evidence logic remain unchanged.

= 4.0.0-alpha4 =
* Added Persistence Hunter as a separate evidence layer over Threat Hunter correlation.
* Added a confirmed-vs-correlation split: exact CRUX/SC surfaces can be repaired, while time-only suspects are observation-only and are never auto-deleted.
* Added REMOVE CONFIRMED PERSISTENCE workflow for the CRUX family. It snapshots trusted state, backs up destructive targets, removes exact persistence options, malicious auto_prepend directives, marker-bearing drop-ins/MU-plugin files, hidden CRUX work directories/artifacts, exact Crux Monitor Lite, SC_TH theme blocks and confirmed CRUX cron events, then verifies again.
* Added reversible CRON RECOVERY storage. Confirmed CRUX cron events are copied before unscheduling and can be restored or purged from Recovery Center.
* Active Defense now includes exact CRUX cron persistence response with backup-first safety.
* Added a dedicated Persistence Hunter panel with status, confidence, confirmed-node counts, recreation count and correlation-only suspects.
* Internal Persistence Hunter / cron recovery telemetry is excluded from database malware scanning to prevent recursive false positives.

= 4.0.0-alpha3 =
* Added Threat Hunter persistence journal for Crux Monitor Lite recreation events.
* Added exact IOC fingerprinting for Crux Monitor Lite (path + plugin header identity/known marker).
* Active Defense now deactivates and recoverably removes the confirmed Crux package even when its body lacks legacy SC markers.
* Added WordPress-level Origin Graph ranking for drop-ins, MU plugins, theme functions, config/auto_prepend files, known CRUX options and suspicious CRUX cron hooks.
* Threat Hunt captures evidence before cleanup and verifies state after response so auto-removal does not erase the incident evidence.
* Added RECREATED counters and last recreation time to the incident workspace.


= 4.0.0-alpha5 =
* Added three Active Defense modes: Passive, Monitor and Aggressive.
* Monitor observes, correlates and verifies CRUX persistence without destructive response.
* Aggressive keeps the backup -> repair/remove -> verify pipeline and remains exact-IOC only.
* Reworked Recovery Vault action buttons into stable horizontal controls with fixed action width.
* Fixed Purge for incomplete/stale recovery records by deleting existing vault artifacts independently instead of requiring both files to exist.
* Purge now verifies that Recovery Vault files are actually absent before reporting success and records successful purge actions in the security event log.
* Incomplete recovery records are visibly marked and can still be purged safely.
* Hardened quarantine purge with the same stale-record behavior.


= 4.0.0-alpha6 =
* Added CRUX Prefix Guard for exact-name crux-monitor* artifacts.
* Monitor and Aggressive modes can automatically back up, remove and verify crux-monitor* files/directories on bounded WordPress surfaces; Passive remains manual.
* Matching plugin install/activation events trigger the guard immediately and direct filesystem recreation is rechecked on normal WordPress requests.
* Every file recovery copy must pass SHA-256 verification before live-file deletion.

= 4.0.0-alpha7 =
* Added Autonomous Response Engine with Safe, Balanced and Maximum response policies.
* Balanced policy can contain confirmed CRUX persistence and verified malware without waiting for an operator, while heuristic-only findings remain observation/review only.
* Added bounded verification passes and local response telemetry after automated containment/repair.
* Added automatic quarantine for exact malware executables under uploads and optional automatic uploads PHP-execution hardening.
* Maximum policy can enforce production hardening for registration, WP_DEBUG, XML-RPC and application passwords.
* Rebuilt every Control Plane checkbox as an explicit ON/OFF switch with strong selected/unselected state contrast and live state labels.
* Moved PRBLEM Security Guard out of Tools into its own top-level WordPress admin menu named PRBLEM Guard with a custom lime shield icon.
* Added top-level quick navigation for SOC, Incidents, Recovery Vault, Activity and Settings and migrated console URLs/redirects from tools.php to admin.php.
* Foreign WordPress admin-notice suppression remains scoped only to PRBLEM Guard screens after the menu migration.


= 4.0.0-alpha8 =
* Added Emergency Cleanup: one operator action creates a separate operation recovery point, runs confirmed/exact-IoC response, removes persistence, quarantines verified upload malware, repairs known CRUX surfaces, performs a fresh verification hunt and schedules bounded follow-up checks.
* Emergency Cleanup can force exact-IoC response even when normal Active Defense is Passive/disabled; heuristic-only evidence remains non-destructive.
* Recovery Points no longer overwrite the trusted integrity snapshot. Existing file/database/cron response primitives still create their normal verified Recovery Vault copies before changes.
* Added Emergency Cleanup history with recovery point ID, verification result, action/failure counts and Security Score before/after.
* Replaced the saturated raw-finding Security Score formula with Security Score v2. The score is incident-weighted, confidence-aware and repetition-capped, so multiple findings from one malware family cannot permanently pin the score at 0.
* Security Score v2 recalculates from the current saved hunt on every page load; a site with no completed hunt is shown as UNSCORED instead of being treated as a zero-security site.
* Fixed historical CRUX recreation telemetry remaining a permanent active critical finding after the live persistence had already been removed; recreation count remains visible in Threat Hunter history without pinning the current score.
* Exact persistence/malware incidents remain heavily weighted, but the score retains visible recovery range as incidents are removed.
* Emergency Cleanup schedules two bounded verification checks after the initial cleanup to catch immediate CRUX recreation.


= 4.0.0-alpha9 =
* Added Recovery Vault v2 operation sessions. Autonomous Response and Emergency Cleanup now group the recovery material they create into a single bounded session.
* Added scoped session restore for Everything, Files, Plugins, Themes, Config/Drop-ins, Database Options and Cron. A restore creates a separate pre-restore safety session before replacing live files.
* Added conservative Automatic Rollback after structural post-response verification failure. It restores repaired/replaced live files and pre-operation settings, but intentionally never resurrects deleted/quarantined malware, confirmed IOC database options or malicious cron persistence automatically.
* Added structural verification for essential WordPress bootstrap files and touched live PHP files after automated response.
* Added bulk Recovery Vault cleanup controls: Purge All Backups, Purge All Quarantine, Purge All DB Recovery, Purge All Cron Recovery and Purge Entire Vault.
* Bulk purge verifies the underlying vault primitives, keeps failed items visible, and retains lightweight session audit metadata after recovery material is removed.
* Added premium Recovery Session cards with status, verification state and file/quarantine/database/cron counts.


= 4.0.0-alpha11 =
* Added File Integrity v2 across WordPress core, plugins, themes, MU plugins, drop-ins and critical configuration surfaces.
* Every monitored security-relevant file records SHA256, modified time, permissions, scope/component identity and a trust level.
* WordPress core trust is anchored to official WordPress.org checksums. Core mismatch findings keep the existing recovery-first one-click repair action.
* Plugin/theme/MU/drop-in/config files are compared with a bounded local SHA256 trust baseline; exact CRUX-prefix paths override baseline trust and remain blocked IOC evidence.
* Added trust states for Official Core, Baseline Trusted, Expected Update, Modified, New, Missing, Blocked IOC and Permission Risk.
* WordPress-managed plugin/theme/core installs and updates are recorded as trusted updater transactions; the next integrity pass selectively synchronizes only those components, reducing false alarms without re-trusting unrelated files.
* Full/deep hunts now use File Integrity v2 in the Integrity stage and include its real file/entry counts in Live Threat Hunt telemetry. Quick scheduled scans retain the lightweight legacy critical-file comparison.
* Added a premium File Integrity v2 console to the Integrity workspace with trust counters, baseline timestamp and bounded recent trust-change details.
* Refresh File Baseline now refreshes both the legacy structural/admin baseline and the File Integrity v2 SHA256 baseline.
* File Integrity v2 remains bounded and excludes PRBLEM Security Guard itself because the plugin package already uses its separate signed SHA256 manifest check.

= 4.0.0-alpha10 =
* Added Live Threat Hunt v2 with seven evidence stages: Environment, Database, Uploads, Themes, Plugins, Integrity and Verification.
* Manual hunts now report progress only when a real stage completes; stage cards expose live state, elapsed time, findings delta, files checked and entries seen.
* Replaced the permanently identical checkmark row in Incidents with persisted stage state. Pending, running, completed, warning and failed states now have distinct visual treatment.
* Split manual filesystem analysis into bounded Uploads, Theme and Plugin/MU-plugin scopes so large filesystem work is distributed across separate AJAX requests instead of one opaque scan step.
* Added two-pass verification across two independent AJAX requests. The second pass can observe immediate CRUX recreation that occurs between requests.
* If verification pass 1 finds confirmed persistence and Autonomous Response is enabled, response is re-triggered before the independent second verification pass.
* A failed verification loop creates a critical incident evidence item instead of reporting a clean hunt.
* Scheduled/legacy scan paths now persist compatible Live Hunt stage metadata.
* Added Recovery Vault and Live Hunt telemetry options to the internal database-scan exclusion list to prevent the security engine from recursively flagging its own evidence records.
* Normal front-end requests still do not run full filesystem hunts.



= 4.0.0-alpha12 =
* Added Database Threat Detection v2 with bounded inspection of WordPress options, transients and cron arguments.
* Added known-IOC, obfuscation, serialized-payload, hidden-payload, autoload-abuse, rogue-cron and suspicious-transient telemetry.
* Added dedicated Database workspace in the top-level PRBLEM Guard menu and SOC tab navigation.
* Large autoloaded options and total autoload footprint are surfaced as exposure/performance signals without being mislabeled as malware.
* Serialized values are inspected only as raw text and are never unserialized during threat analysis.
* Exact CRUX-family database option names are integrated with the existing recovery-first Autonomous Response path. Generic suspicious database evidence remains observation-only.
* Live Threat Hunt Database stage now reports real option/transient/cron counts and attention state from Database Threat Detection v2.

= 4.0.0-alpha13 =
* Added Upload Protection v2 as a dedicated local subsystem and top-level PRBLEM Guard workspace.
* Added real-time WordPress media prefilter blocking for PHP-like executable uploads, deceptive double extensions, PHP payloads hidden behind non-PHP names, confirmed malware markers and high-confidence webshell behavior.
* Added bounded uploads inventory for PHP-like executables, hidden executable names, disguised PHP content and high-confidence webshell indicators.
* Added ZIP archive inspection without extraction. Normal PHP files inside ordinary plugin/theme archives are not treated as malicious by themselves; the detector focuses on path traversal, crux-monitor* entries, hidden executables and deceptive double extensions.
* Balanced/Maximum Autonomous Response can quarantine Upload Protection v2 candidates only at confidence 90+ or exact IOC confidence. Heuristic-only upload evidence remains non-destructive.
* Added Upload Protection telemetry for files checked, executable signals, deceptive names, webshell indicators, archives checked, risky archive entries and recently blocked media uploads.
* Live Threat Hunt Uploads stage now reports real Upload Protection v2 counts and state.
* Recovery Session cards with zero recoverable items no longer reserve a large empty action column or show a detached NO STORED ITEMS button-like box; they render as compact audit-only sessions.


= 4.0.0-alpha14 =
* Rebuilt the local request firewall as Firewall v2 with evidence-weighted SQL injection, XSS, path traversal, LFI, RFI and exploit-pattern detection.
* Added exact high-risk probe blocking for exposed configuration paths, Git metadata, PHPUnit eval-stdin probes and dangerous PHP/data stream wrappers.
* Added optional blocking of known offensive scanner User-Agent signatures including sqlmap, WPScan, Nikto and Nuclei; trusted IP/CIDR rules always bypass automated signatures.
* Added bounded per-IP request rate limiting with configurable request count and time window. Rate-limit responses use HTTP 429 while exploit blocks remain HTTP 403.
* Added per-category Firewall v2 counters and a capped recent-block audit stream that stores only method, route, category, confidence, status and IP; successful traffic is never logged.
* Rebuilt the Firewall workspace with live coverage state, attack-family counters, rate-control status and recent block telemetry.
* Added a dedicated Firewall submenu under PRBLEM Guard and new Control Plane switches for Firewall v2, scanner User-Agent blocking and adaptive rate limiting.
* Administrators retain a request-inspection bypass for legitimate code/config editing after trusted/manual-IP controls are evaluated, reducing self-lockout risk.



= 4.0.0-alpha17 =
* Added Vulnerability Intelligence v1 with installed WordPress core/plugin/theme inventory and optional live WPScan API v3 matching.
* No vulnerability or CVE is fabricated when the provider token is missing or a provider lookup fails.
* Provider refresh prioritizes WordPress core, the active theme and active plugins, then inactive components up to a configurable bounded lookup budget.
* Provider-confirmed cached vulnerability matches feed the existing Incident/Threat Hunt evidence path without making external network calls during normal scans.
* Added a dedicated Vulnerabilities menu/tab with severity counts, vulnerable-component counts, fixed-version metadata when supplied and provider-error visibility.
* Fixed Firewall > Active Coverage readability: control names and explanations are larger/darker and ACTIVE badges now use a lime surface with dark text.

= 4.0.0-alpha16 =
* Added interactive Identity Defense metrics. Failed Logins, Lockouts, Admin Sessions, Untrusted Admins, New-IP Admin Logins, Rapid IP Changes and Admin Application Passwords now open contextual detail drawers.
* Failed-login audit now retains a bounded last-100 history containing time, attempted username, client IP, login surface and WordPress error code. Passwords are never stored.
* Lifetime failed-login counters from earlier releases remain valid; detailed per-attempt history begins with alpha16.
* Fixed low-contrast administrator action buttons. REVOKE SESSIONS, TRUST & RELEASE and CONTAIN now use deterministic text/background colors that cannot be overridden by WordPress admin/theme button styles.
* Improved administrator action-cell spacing and responsive wrapping.

= 4.0.0-alpha15 =
* Added Identity Defense as a dedicated PRBLEM Guard subsystem and top-level Identity workspace.
* Added Administrator Trust Guard using the existing trusted administrator baseline plus reversible account containment. Untrusted administrators are never silently deleted.
* Balanced autonomous policy revokes sessions for a newly granted untrusted administrator pending review; Maximum policy can contain a new untrusted administrator so login is blocked until explicitly trusted and released.
* Added per-administrator TRUST & RELEASE, CONTAIN and REVOKE SESSION controls. The current administrator and the final remaining administrator cannot be contained from the console.
* Added bounded administrator login IP history with new-IP telemetry and rapid IP-change correlation. A different administrator IP observed within ten minutes raises a critical identity event; when safe current-session preservation is available, other sessions are revoked.
* Added administrator session concurrency limits with safe current-session preservation.
* Reworked brute-force controls so lockout state is applied by client IP and client-IP/username pair rather than globally locking a username, avoiding a trivial remote username-denial-of-service condition.
* XML-RPC authentication participates in the same adaptive login lockout state when XML-RPC Auth Guard is enabled.
* Added an option to disable WordPress application passwords for administrator accounts only, without disabling application passwords for non-admin integrations.
* Added Identity Defense evidence to full/manual Threat Hunts, including contained administrators and recent rapid-IP-change events.
* Added Identity telemetry cards for active admin sessions, untrusted/contained admins, new-IP logins, rapid IP changes and administrator application-password count.
* This release intentionally does not claim passkey/WebAuthn or TOTP enrollment yet; those need a separate authentication ceremony and recovery design rather than a cosmetic toggle.
= 4.0.0-alpha18 =
* Added Virtual Patching Engine v1. Provider-confirmed vulnerability advisories can now become temporary Firewall v2 mitigations without modifying third-party plugin/theme source files.
* Supported plugin attack classes include SQL injection, XSS, path traversal, file inclusion, executable file-upload abuse and strong RCE/command-execution probes.
* Virtual rules are component-scoped: a request must identify the vulnerable plugin surface before the lower-threshold advisory rule can block it. Generic admin-ajax traffic alone never triggers a plugin patch.
* Authentication-bypass, privilege-escalation and generic advisories remain UPDATE REQUIRED when provider metadata is insufficient for a safe route-specific mitigation. PRBLEM does not claim these are patched.
* WordPress-core advisories with supported vectors are marked FIREWALL COVERED rather than receiving a broad lower-threshold rule. Theme advisories remain monitoring/direct-path coverage because front-end requests usually cannot be mapped safely to a theme slug.
* Plugin updates automatically resync the patch inventory; when the installed version reaches the provider fixed version, the patch is retired.
* Added a Virtual Patches workspace with Active Patch, Firewall Covered, Update Required, Retired and blocked-exploit telemetry plus recent virtual-patch hit history.
* Added a Virtual Patching control-plane switch and manual SYNC PATCHES operation.
* Firewall v2 now records VIRTUAL PATCH as its own block category and links blocked requests back to the patch/CVE/component audit record.



= 4.0.0-alpha20 =
* Added Attack Story / Incident Timeline v2 as a read-only reconstruction layer over bounded local security telemetry.
* Correlates Firewall v2, Upload Protection, Identity Defense, Threat Hunter persistence journal, Behavioral Threat Engine, Recovery Vault, Emergency Cleanup, Autonomous Response and Threat Hunt evidence into ordered story clusters.
* Adds a dedicated Attack Story workspace and SOC summary status with story ID, confidence, source count, duration, earliest observed request-layer signal and response/verification timeline.
* Story clusters are separated by a 90-minute inactivity gap and retain at most 24 hours of source telemetry; request bodies are never stored by Attack Story.
* Distinguishes BLOCKED, RESPONDED, CONTAINED and ATTENTION states. A successful verification after the latest threat evidence is required before a story is labeled CONTAINED.
* Attack Story does not authorize destructive response and does not claim process-level causality. The earliest firewall event is explicitly labeled an observed entry signal, not proof of initial compromise.
* Exact persistence evidence and recreation events are visibly marked so operators can distinguish confirmed IOC evidence from time/correlation evidence.

= 4.0.0-alpha23.4 =
* Removed the runtime Product Integrity / Ed25519 Safe Mode feature after real-host false signature failures.
* Autonomous Response can no longer be disabled by a package-signature verification mismatch.
* Retained non-blocking local SHA-256 package file integrity diagnostics.
* Removed Product Integrity from Intelligence navigation and all signed-build verification banners/actions.

= 4.0.0-alpha23.5 =
* Migration build uses a new plugin filesystem path to bypass stale OPcache from older alpha23 builds.
* Added visible runtime version/release marker in PRBLEM admin screens.
* Purges retired Product Integrity transient state during runtime upgrade hygiene.
* Fixed Security Policy action buttons so labels remain visible on dark backgrounds.

