=== PhantomGuard === Contributors: phantomguard Requires at least: 6.5 Tested up to: 6.9 Stable tag: 1.0.1 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-3.0.html WordPress hardening: presets, audit log, modern UI. Free core rules; Pro adds scanning & CDN/DNS. == Description == **PhantomGuard** helps you harden WordPress without editing code by hand. Pick a preset (Basic, Recommended, or Advanced), turn rules on or off, and review activity in the audit log—all from a modern admin interface. **What you get in the free version** * **Security presets** — Start with Basic, Recommended, or Advanced and adjust as needed. * **Core hardening rules** — Force HTTPS for the admin area, hide the WordPress version, enable audit logging, and obscure login feedback to reduce information leaks. * **Clear dashboard** — Overview, onboarding, settings, and support in one place. * **Plugin vulnerability check** — Compares installed plugins against public advisories (WPVulnerability API) and links to WordPress updates when a fix is available. * **Translations** — Admin UI available in English, German, and Italian. **PhantomGuard Pro** (optional license) adds malware scanning, extended hardening rules, DNS/CDN management, traffic analytics, and more. You can enter a license key in the plugin when you’re ready. **Legal** By using PhantomGuard you agree to our [Terms of Service](https://phantomguard.io/terms) and [Privacy Policy](https://phantomguard.io/privacy). == Installation == 1. Upload the plugin folder to `/wp-content/plugins/`, or install **PhantomGuard** from the WordPress.org plugin directory. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Open **PhantomGuard** in the admin menu to configure hardening and explore the dashboard. No extra configuration file is required for the free version—everything is managed in the plugin screens. == Frequently Asked Questions == = Does the free version need a license? = No. Hardening and the rules listed above work without a license. A PhantomGuard license is only required for Pro features such as malware scanning and advanced tools. = Where do I change security rules? = Go to **WordPress Admin → PhantomGuard** and use **Security Hardening** (and other tabs as labeled). Presets and individual rules are explained in the interface. = What about malware scanning and Pro features? = Those require **PhantomGuard Pro** and a valid license. The free plugin still shows where those features live so you can upgrade when you want full protection. = Does PhantomGuard replace my security plugin? = PhantomGuard focuses on **hardening and logging** in the free tier. Pro adds scanning and related tools. You can use it alongside other plugins if their features don’t overlap in a conflicting way. == Screenshots == 1. Dashboard overview and stats (some areas show Pro features when unlocked) 2. Malware scanner (Pro) 3. Security hardening rules and presets 4. CDN / DNS management (Pro) 5. Settings and license 6. Plugin vulnerability checker and patcher == Changelog == = 1.0.1 = * Dashboard: plugin vulnerability check (WPVulnerability API) with update links via WordPress core update flow. = 1.0.0 = * Initial release of PhantomGuard on WordPress.org. == Upgrade Notice == = 1.0.1 = Adds the dashboard plugin vulnerability overview and WPVulnerability disclosure in the readme. = 1.0.0 = First public release. Install and activate, then open PhantomGuard from the admin menu to get started. == Source code == The admin area is built with **React** and **webpack**. The files shipped in this plugin (`assets/js/*.js`, `assets/css/*.css`) are minified for performance. **Full source code** (readable and forkable) is here: https://github.com/bitninjaio/PhantomGuardFree **Build from source (developers)** 1. Clone the repository and `cd` into the plugin directory. 2. Run `npm install` 3. Run `npm run build` for production assets, or `npm run build:dev` / `npm run dev` for development builds. See **README.md** in the repository for more detail. == External services == PhantomGuard loads **Google Fonts** (Mulish) for the admin UI. Loading fonts may involve a request to Google; see their terms and privacy policy linked below. **PhantomGuard Pro** may connect to additional services when you use a license (scanning, 2FA QR, license checks, CDN/DNS, etc.). Details: = WPVulnerability API (www.wpvulnerability.net) = * **What it does:** Supplies vulnerability metadata used to flag plugins that may need updates on the dashboard. * **Data sent:** For each installed plugin, the plugin slug is requested in the URL path (no WordPress content or credentials). * **When:** When you open the PhantomGuard dashboard (or when the dashboard requests a refresh of this data). * **Terms:** See the service operator’s site for current terms. * **Privacy:** See the service operator’s site for their privacy policy. = Google Fonts (fonts.googleapis.com) = * **What it does:** Loads the Mulish font for the plugin’s admin screens. * **Data sent:** No site content—only font requests (Google may log IP per their policy). * **When:** While using PhantomGuard in the WordPress admin. * **Terms:** https://developers.google.com/fonts/faq * **Privacy:** https://policies.google.com/privacy = BitNinja API (api.bitninja.io) — Pro only = * **What it does:** Malware scanning, quarantine, license validation, and related Pro features. * **Data sent:** May include file hashes, file content for deep scans, license key, site domain, and server IP as needed for the feature you use. * **When:** While using Pro features that rely on the API. * **Terms:** https://bitninja.com/terms-and-conditions/ * **Privacy:** https://bitninja.com/privacy-policy/ = GoQR API (api.qrserver.com) — Pro only = * **What it does:** Generates QR codes for two-factor authentication setup. * **Data sent:** OTP Auth URI in the request URL only (no separate account with GoQR required for basic use). * **When:** Enabling 2FA in Pro hardening options. * **Terms:** https://goqr.me/legal/tos-api.html * **Privacy:** https://goqr.me/privacy-safety-security/ = IPify (api.ipify.org) — Pro only = * **What it does:** Helps determine the server’s public IP for license validation. * **Data sent:** Minimal request; response is your public IP. * **When:** License validation in Pro. * **Terms:** https://geo.ipify.org/terms-of-service * **Privacy:** https://geo.ipify.org/privacy-policy/ = WordPress.org (api.wordpress.org, downloads.wordpress.org) — Pro only = * **What it does:** Core/plugin checksum checks during scanning workflows. * **Data sent:** WordPress version and plugin slug as needed for the check. * **When:** During relevant Pro scan steps. * **Terms:** https://wordpress.com/tos/ * **Privacy:** https://wordpress.org/about/privacy/ = Consent = The dashboard plugin check uses WPVulnerability as described above. Using a PhantomGuard Pro license and Pro features means those additional services may process data as described above. Core free hardening does not require a license.