\=== NETSENSAI Shield ===
Contributors: rgierlicki
Tags: security, cybersecurity, hardening, wordpress-security, protection, w3-total-cache, site-health
Requires at least: 5.6
Tested up to: 6.8
Stable tag: 1.4
License: GPLv2 or later
License URI: [https://www.gnu.org/licenses/gpl-2.0.html](https://www.gnu.org/licenses/gpl-2.0.html)

NETSENSAI Shield is a WordPress security plugin that manages essential settings for enhanced site protection.

\== Description ==

NETSENSAI Shield offers a range of security features, including:

* Changing the login URL to reduce brute force attack risks.
* Disabling the REST API (WP API JSON) for non-logged-in users.
* Disabling XML-RPC to prevent unauthorized access.
* Disabling the WordPress file editor to avoid accidental or malicious changes.
* Disabling Application Passwords to block unauthorized API access.
* **Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).**
* **Integration with W3 Total Cache**:

  * Permanently disable `.htaccess` writes by W3TC,
  * Runtime disabling of Page Cache UI,
  * One-time full cache flush on first admin page load,
  * Automatic cache flush on Secure Options save,
  * Physical cleanup and permanent disable via the W3TC API.
* **Suppression of Site Health REST API availability notices** for non-logged-in users (removes false Site Health errors while maintaining full API blocking according to your settings).

The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features and automatic protection enhancements.

\== Installation ==

1. Download NETSENSAI Shield from the WordPress.org repository or manually upload the plugin files to the `/wp-content/plugins/netsensai-shield/` directory.
2. Activate the plugin from the WordPress Admin Dashboard under "Plugins".
3. Navigate to **Settings > Secure Options** and configure the plugin as needed.

\== Frequently Asked Questions ==

\= How do I change the WordPress login URL? =

Go to **Settings > Secure Options** and enter your preferred login URL in the "Change Login URL" field.

\= How does disabling WP API JSON improve security? =

It reduces exposure of your site’s data via the REST API for non-logged-in users.

\= Why disable XML-RPC? =

Disabling XML-RPC helps protect against brute force attacks targeting this protocol.

\= What is the effect of disabling the file editor? =

It prevents code modifications via the dashboard, reducing the risk of malicious changes.

\= What headers are included in Level 3 security? =

The plugin can apply the following headers:

* **Strict-Transport-Security (HSTS)**
* **X-Frame-Options**
* **X-Content-Type-Options**
* **Content-Security-Policy (CSP)**
* **Referrer-Policy**
* **Permissions-Policy**

\= How does the W3 Total Cache integration work? =

Upon activation or when saving settings, NETSENSAI Shield automatically clears the W3 Total Cache, disables the Page Cache UI to avoid conflicts and configuration overwrites, and prevents future `.htaccess` writes by W3TC.

\= How does the suppression of Site Health REST API notice work? =

The plugin removes the default REST API availability test from Site Health for guest users, while still enforcing your REST API blocking settings.

\== Screenshots ==

1. Secure Options Settings Page – an intuitive panel for configuring security settings.
2. Custom Login URL Setting – easily change your login URL for improved security.
3. Disable XML-RPC and WP API JSON – manage settings to restrict unauthorized access.
4. Security Headers Settings – activate key HTTP security headers with a click.
5. W3TC Integration Panel – displays the synchronization status with W3 Total Cache.

\== Changelog ==

\= 1.4 =

* Added **W3 Total Cache integration**:

  * Disabled `.htaccess` writes by W3TC,
  * Hid Page Cache UI at runtime,
  * One-time full cache flush on first admin page load,
  * Automatic cache flush on Secure Options save,
  * Physical cleanup & permanent disable via the W3TC API.
* Added **suppression of Site Health REST API availability test** for non-logged-in users.
* Documentation updated to reflect new features.

\= 1.3 =

* Restored **Level 3: Advanced Security** options to the free version.
* Popup modal now shows **only once** when a feature is enabled (no repeat on Save).
* Fully localized modal text – all content is now translatable (`textdomain` ready).
* Fixed links to [securityheaders.com](https://securityheaders.com) and [Mozilla Observatory](https://observatory.mozilla.org).
* Removed `error_log()` calls flagged by Plugin Check.
* Minor UI & spacing fixes in popup design.
* Updated `Tested up to` to 6.8 and set `Stable tag` to 1.3.

\= 1.2 =

* Moved Level 3 features to the PRO version for better support and performance.
* Added a promotional message for the PRO version.
* Simplified the free version for clarity and speed.

\= 1.1 =

* Added option to disable Application Passwords.
* Enhanced UI with tooltips and simplified options.
* Improved security headers implementation.
* Fixed issues with login URL redirection and WP API JSON disable functionality.

\= 1.0 =

* Initial release featuring options to change the login URL, disable WP API JSON, XML-RPC, the file editor, and apply security headers.

\== Upgrade Notice ==

\= 1.4 =
This release adds full integration with W3 Total Cache (cache flushing, UI disable, `.htaccess` protection) and hides Site Health errors related to the REST API for non-logged-in users. Please update to benefit from these enhancements.

\= 1.3 =
Level 3: Advanced Security features have been **restored** in the free version. Popup behavior has been improved, translations added, and Plugin Check compatibility enhanced. Please update for full functionality and WordPress 6.8 support.

\= 1.2 =
Level 3 features were temporarily moved to the PRO version. Version 1.3 brings them back.