=== NETSENSAI Shield ===
Contributors: rgierlicki
Tags: security, cybersecurity, hardening, wordpress-security, protection
Requires at least: 5.6
Tested up to: 6.7
Stable tag: 1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

NETSENSAI Shield is a security plugin designed to help you manage key settings to enhance your WordPress site's security. It provides an intuitive interface for configuring essential security measures without requiring extensive technical knowledge.

== Description ==

**NETSENSAI Shield** offers a range of security features, including:
* Changing the login URL to minimize brute force attack risks.
* Disabling the REST API (WP API JSON) for non-logged-in users.
* Disabling XML-RPC to prevent unauthorized access.
* Disabling the WordPress file editor to avoid accidental or malicious changes.
* Disabling Application Passwords to block unauthorized API access.
* Applying critical security headers (e.g., HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) for enhanced protection.

The free version provides essential security functionalities. A PRO version with additional features is available for users seeking extended protection.

== Installation ==

1. Download NETSENSAI Shield from the WordPress.org repository or manually upload the plugin files to the `/wp-content/plugins/netsensai-shield/` directory.
2. Activate the plugin from the WordPress Admin Dashboard under "Plugins".
3. Navigate to **Settings > Secure Options** and configure the plugin according to your requirements.

== Frequently Asked Questions ==

= How do I change the WordPress login URL? =
Navigate to **Settings > Secure Options** after installing the plugin. In the “Change Login URL” field, enter your preferred custom URL (for example, change `/wp-login.php` to `/secure_login/`) and save your changes.

= How does disabling the WP API JSON improve security? =
Disabling the WP API JSON for users who are not logged in minimizes the exposure of your site’s data through the REST API, reducing the risk of unauthorized data access.

= Why disable XML-RPC? =
XML-RPC is often targeted in brute force attacks. Disabling it helps protect your site against attempts to exploit this protocol for unauthorized access.

= What is the effect of disabling the file editor? =
Disabling the file editor prevents direct editing of plugin and theme files through the WordPress dashboard, safeguarding against inadvertent or malicious code changes. You will need to perform any code modifications manually (e.g., via FTP).

== Screenshots ==

1. Secure Options Settings Page – An intuitive panel for configuring security settings.
2. Custom Login URL Setting – Easily change your login URL for better security.
3. Disable XML-RPC and WP API JSON – Manage settings to restrict non-authorized access.
4. Security Headers Settings – Activate key HTTP security headers with a click.

== Changelog ==

= 1.1 =
* Added option to disable Application Passwords.
* Enhanced the user interface with tooltips and simplified options.
* Improved security headers implementation.
* Fixed issues with login URL redirection and disabling WP API JSON.

= 1.0 =
* Initial release featuring options to change the login URL, disable WP API JSON, XML-RPC, the file editor, and apply security headers.

== Upgrade Notice ==

= 1.1 =
This update resolves the issue related to the rewrite rules function present in version 1.0 and introduces a new advertising banner in the plugin panel. It is recommended to update immediately to enjoy all the improvements.