=== NETSENSAI Shield ===
Contributors: rgierlicki
Tags: security, cybersecurity, hardening, wordpress-security, protection
Requires at least: 5.6
Tested up to: 6.8
Stable tag: 1.4.3
License: GPLv2 or later
License URI: [https://www.gnu.org/licenses/gpl-2.0.html](https://www.gnu.org/licenses/gpl-2.0.html)

Hardens and protects your site by locking down login, REST API, XML-RPC, file editor, and applying HTTP security headers.

== Description ==

NETSENSAI Shield offers a range of security features, including:

* Changing the login URL to reduce brute force attack risks.
* Disabling the REST API (WP API JSON) for non-logged-in users.
* Disabling XML-RPC to prevent unauthorized access.
* Disabling the WordPress file editor to avoid accidental or malicious changes.
* Disabling Application Passwords to block unauthorized API access.
* **Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).**
* **Integration with W3 Total Cache**:

  * Permanently disable `.htaccess` writes by W3TC,
  * Runtime disabling of Page Cache UI,
  * One-time full cache flush on first admin page load,
  * Automatic cache flush on Secure Options save,
  * Physical cleanup and permanent disable via the W3TC API.
* **Suppression of Site Health REST API availability notices** for non-logged-in users (removes false Site Health errors while maintaining full API blocking).

The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features, and automatic protection enhancements.

== Installation ==

1. Download NETSENSAI Shield from the WordPress.org repository or upload the plugin files to `/wp-content/plugins/netsensai-shield/`.
2. Activate the plugin on the WordPress Admin Dashboard under **Plugins**.
3. Navigate to **Settings > Secure Options** and configure as needed.

== Frequently Asked Questions ==

= How do I change the WordPress login URL? =

Go to **Settings > Secure Options** and enter your preferred path in the **Change Login URL** field.

= How does disabling WP API JSON improve security? =

It reduces exposure of your site’s data via the REST API for non-logged-in users.

= Why disable XML-RPC? =

Disabling XML-RPC helps protect against brute force attacks targeting that protocol.

= What is the effect of disabling the file editor? =

It prevents code modifications via the dashboard, reducing the risk of malicious changes.

= What headers are included in Level 3 security? =

The plugin can apply:

* **Strict-Transport-Security (HSTS)**
* **X-Frame-Options**
* **X-Content-Type-Options**
* **Content-Security-Policy (CSP)**
* **Referrer-Policy**
* **Permissions-Policy**

= How does the W3 Total Cache integration work? =

On activation or settings save, NETSENSAI Shield clears the W3TC cache, disables the Page Cache UI to prevent conflicts, and blocks future `.htaccess` writes by W3TC.

= How does suppression of the Site Health REST API notice work? =

The plugin removes the default REST API availability test in Site Health for guest users, while still enforcing your REST API blocking settings.

== Screenshots ==

1. Secure Options Settings Page – intuitive panel for configuring security features.
2. Custom Login URL Setting – change your login path for improved security.
3. Disable XML-RPC and WP API JSON – restrict unauthorized access.
4. Security Headers Settings – activate HTTP headers with one click.
5. W3TC Integration Panel – view synchronization status with W3 Total Cache.

== Changelog ==

= 1.4.3 =

* Fixed readme parsing by removing Markdown syntax from the License URI and ensuring a plain URL.
* Updated short description to fit 150-character limit.
* Removed calls to error\_log() flagged by Plugin Check.

== Upgrade Notice ==

= 1.4.3 =
This release fixes `readme.txt` parsing on WordPress.org by removing Markdown syntax from the License URI and shortening the short description.

= 1.4.2 =
This minor release fixes README parsing on WordPress.org by cleaning up the file formatting and bumps the version to 1.4.2.

= 1.4.1 =
This minor update reduces plugin tags to five, shortens the short description to comply with WordPress.org limits, and bumps the version to 1.4.1.

= 1.4 =
This release adds integration with W3 Total Cache (cache flushing, UI disable, `.htaccess` protection) and hides Site Health errors related to the REST API for non-logged-in users.

= 1.3 =
Level 3: Advanced Security features have been restored in the free version. Popup behavior improved, translations added, and Plugin Check compatibility enhanced.

= 1.2 =
Level 3 features were temporarily moved to the PRO version. Version 1.3 brings them back.