# Changelog — Malware Inspector

All notable changes to this plugin are documented here.
Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

---

## [1.3.1] — 2026-04-16

No changes to the free plugin in this release — version bumped to stay in sync with Malware Inspector Pro 1.3.1.

---

## [1.3.0] — 2026-04-13

### Changed
- Plugin renamed from **WP Malware Inspector** to **Malware Inspector**.
- Author updated to **BroodWeb** across all plugin headers.

### Improved — Scanner accuracy (false positive reduction)
- **Core checksum fast-path**: WordPress core files that match the official checksum are now skipped entirely before any filename or content analysis. Legitimate core files (e.g. `wp-admin/includes/file.php`, `wp-includes/load.php`) no longer appear as suspicious.
- **JS-aware pattern matching**: 20 PHP-only patterns (`exec`, `system`, `shell_exec`, `base64_decode`, `file_put_contents`, `chmod`, `unlink`, etc.) are no longer applied to `.js` files where they have no meaning.
- **Minified/bundled JS detection**: Files ending in `.min.js`, files inside `/dist/`, `/build/`, `wp-includes/js/dist/`, or any JS file with lines exceeding 500 characters are automatically classified as build artifacts. For these files the following checks are skipped: `eval()`, `new Function()`, `atob()`, `fromCharCode()`, `document.write()`, `window.location`, very long lines, base64-like strings, and entropy analysis.
- **External URL check skipped for JS/CSS**: Plugin and theme assets legitimately reference CDN URLs — this signal is no longer raised for JavaScript files.
- **Variable function call skipped for JS**: The `$variable()` pattern no longer fires on `.js` files where it matches jQuery's `$('.selector')` syntax.

### Fixed — Plugin Check (PHPCS) compliance
- Escaped all integer values in scan history output with explicit `(int)` cast and `wp_kses()` for HTML delta badges.
- `$_POST['chunk']` now sanitized with `absint()`.
- `$_POST['quarantine']` now wrapped with `sanitize_text_field( wp_unslash() )`.
- Three direct database queries in the DB scanner marked with `phpcs:ignore` (intentional real-time queries; caching would return stale malware scan results).
- `$_GET` display-only parameters in `render_admin_notice()` marked with `phpcs:ignore NonceVerification` (values are set by our own `wp_safe_redirect` calls).
- `$_SERVER['SCRIPT_FILENAME']` in Custom Login now sanitized with `sanitize_text_field( wp_unslash() )` before `basename()`.
- Nonce-check ignore comments added to `block_direct_login()` for field-presence checks that pass through to WordPress core login handler.
- Nonce-check ignore comments added to `render_card()` for display-only redirect params.
- Nonce value in `save_slug()` now sanitized before being passed to `wp_verify_nonce()`.
- `$_POST['wmt_login_slug']` sanitization inlined directly into `sanitize_title()` call.

---

## [1.2.0] — 2026-03-15

### Added
- **Custom Login URL** — hide `/wp-login.php` behind a secret slug; direct access is silently redirected to the homepage.
- **Database Scanner** — scans `wp_options`, `wp_posts`, and `wp_users` for injected scripts, suspicious patterns, and rogue admin usernames.
- **Scheduled scans** — daily, weekly, and monthly automatic scans with email alert on findings.
- **File Integrity Monitor** — baseline snapshot with email alerts on changes.
- **Quarantine system** — move suspicious files to a protected `wmt-quarantine/` directory with one click.
- **Whitelist** — permanently suppress false positives for trusted files.
- Export scan reports as JSON or CSV.

### Improved
- Chunked AJAX scanning (200 files per request) prevents timeouts on large sites.
- Shannon entropy analysis (optional) to detect obfuscated payloads.
- Spam keyword detection in file content.

---

## [1.1.0] — 2026-01-20

### Added
- WordPress core checksum verification via the official WordPress.org API.
- Plugin checksum verification (optional, requires API call per plugin).
- Visitor cloaking behaviour detection (user-agent switching heuristic).
- XOR-decoded JavaScript loader detection.
- Late front-end script injection detection (`wp_footer` hook abuse).

### Improved
- Risk scoring system with five levels: Critical, High, Medium, Low, Info.
- Minimum report score threshold to suppress low-signal findings.

---

## [1.0.0] — 2025-12-01

### Added
- Initial release.
- Recursive file scanner with 30 suspicious code patterns.
- Suspicious filename pattern matching.
- File permission checks (world-writable detection).
- Recent modification flag.
- Risk score calculation and sortable results table.
- Quarantine and restore actions.
- Admin menu under Tools → Malware Inspector.