=== NETSENSAI Shield ===
Contributors: rgierlicki
Tags: security, cybersecurity, hardening, wordpress-security, protection
Requires at least: 5.6
Tested up to: 6.8
Stable tag: 1.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

NETSENSAI Shield is a WordPress security plugin that manages essential settings for enhanced site protection.

== Description ==

NETSENSAI Shield offers a range of security features, including:

* Changing the login URL to reduce brute force attack risks.
* Disabling the REST API (WP API JSON) for non-logged-in users.
* Disabling XML-RPC to prevent unauthorized access.
* Disabling the WordPress file editor to avoid accidental or malicious changes.
* Disabling Application Passwords to block unauthorized API access.
* **Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).**

The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features and automatic protection enhancements.

== Installation ==

1. Download NETSENSAI Shield from the WordPress.org repository or manually upload the plugin files to the `/wp-content/plugins/netsensai-shield/` directory.
2. Activate the plugin from the WordPress Admin Dashboard under "Plugins".
3. Navigate to **Settings > Secure Options** and configure the plugin as needed.

== Frequently Asked Questions ==

= How do I change the WordPress login URL? =

Go to **Settings > Secure Options** and enter your preferred login URL in the "Change Login URL" field.

= How does disabling WP API JSON improve security? =

It reduces exposure of your site’s data via the REST API for non-logged-in users.

= Why disable XML-RPC? =

Disabling XML-RPC helps protect against brute force attacks targeting this protocol.

= What is the effect of disabling the file editor? =

It prevents code modifications via the dashboard, reducing the risk of malicious changes.

= What headers are included in Level 3 security? =

The plugin can apply the following headers:
* **Strict-Transport-Security (HSTS)**
* **X-Frame-Options**
* **X-Content-Type-Options**
* **Content-Security-Policy (CSP)**
* **Referrer-Policy**
* **Permissions-Policy**

== Screenshots ==

1. Secure Options Settings Page – an intuitive panel for configuring security settings.
2. Custom Login URL Setting – easily change your login URL for improved security.
3. Disable XML-RPC and WP API JSON – manage settings to restrict unauthorized access.
4. Security Headers Settings – activate key HTTP security headers with a click.

== Changelog ==

= 1.3 =
* Restored **Level 3: Advanced Security** options to the free version.
* Popup modal now shows **only once** when a feature is enabled (no repeat on Save).
* Fully localized modal text – all content is now translatable (`textdomain` ready).
* Fixed links to [securityheaders.com](https://securityheaders.com) and [Mozilla Observatory](https://observatory.mozilla.org).
* Removed `error_log()` calls flagged by Plugin Check.
* Minor UI & spacing fixes in popup design.
* Updated `Tested up to` to 6.8 and set `Stable tag` to 1.3.

= 1.2 =
* Moved Level 3 features to the PRO version for better support and performance.
* Added a promotional message for the PRO version.
* Simplified the free version for clarity and speed.

= 1.1 =
* Added option to disable Application Passwords.
* Enhanced UI with tooltips and simplified options.
* Improved security headers implementation.
* Fixed issues with login URL redirection and WP API JSON disable functionality.

= 1.0 =
* Initial release featuring options to change the login URL, disable WP API JSON, XML-RPC, the file editor, and apply security headers.

== Upgrade Notice ==

= 1.3 =
Level 3: Advanced Security features have been **restored** in the free version. Popup behavior has been improved, translations added, and Plugin Check compatibility enhanced. Please update for full functionality and WordPress 6.8 support.

= 1.2 =
Level 3 features were temporarily moved to the PRO version. Version 1.3 brings them back.