=== VulnTitan – Security Scanner, Firewall & WAF ===
Tags: security, firewall, vulnerability, malware
Donate link: https://www.paypal.com/ncp/payment/TPGXWZTJX7TDE
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 2.0.0
License: GPLv2
License URI: https://www.gnu.org/licenses/gpl-2.0.html

VulnTitan is a lightweight WordPress security plugin that combines vulnerability scanning, malware detection, file integrity monitoring, and a built-in firewall with WAF rules and login protection.

== Description ==
VulnTitan protects WordPress sites with a focused, practical security stack: vulnerability scanner, malware scanner, file integrity scanner, and firewall protection in one plugin.

It uses real-time vulnerability intelligence from the VulnTitan API to detect known issues in WordPress core, plugins, and themes, while local scanners inspect files for malware patterns and unauthorized file changes.

Firewall capabilities include early MU-plugin runtime loading, suspicious path traversal and sensitive-file probe blocking, SQL injection and command injection WAF payload checks, endpoint whitelisting, and login lockout protection against repeated brute-force attempts.

Key features:
- Vulnerability scanner for WordPress core, plugins, and themes (API-backed threat intelligence)
- Malware scanner with problematic-file overview, code preview context, and safe-fix workflow with backups
- File integrity scanner with baseline comparison, queue-based processing, and actionable status legends
- Firewall with WAF payload rules (SQLi + command injection), whitelist controls, and login protection
- Security-first storage and cleanup routines for scan queues, logs, and backup artifacts

== External services ==

This plugin connects to an external API at https://vulntitan.com/api/vulnerabilities to fetch up-to-date vulnerability data for WordPress core, plugins, and themes. This data is essential to detect known vulnerabilities during scan operations.

When a scan is performed, the following data is sent to the VulnTitan API:
- The slug and version of each plugin, theme, or WordPress core installation on the site.

This data is transmitted only during scans initiated by the user or by scheduled scan settings. No personal or user-identifying information is collected, transmitted, or stored.

The external service is provided by VulnTitan.com.

- Terms of Service: https://vulntitan.com/terms
- Privacy Policy: https://vulntitan.com/privacy

== Screenshots ==

1. Dashboard view of the vulnerability scanner.
2. Example vulnerability detection results.

== Installation ==

= From your WordPress dashboard =

1. Navigate to **Plugins > Add New**
2. Click **Upload Plugin**
3. Upload the downloaded ZIP file of the plugin
4. Click **Install Now**, then **Activate**

= From FTP or File Manager =

1. Upload the extracted `vulntitan` folder to the `/wp-content/plugins/` directory
2. Go to your WordPress dashboard
3. Navigate to **Plugins > Installed Plugins**
4. Find **VulnTitan Scanner** and click **Activate**

= Once activated =

- Go to **VulnTitan** in your admin menu
- Click **Scan Now** to start scanning your plugins, themes, and core files
- View detailed vulnerability results in real-time

== Frequently Asked Questions ==

= Who owns the VulnTitan API? =
The VulnTitan API is developed, owned, and maintained by the same team behind this plugin. It is not a third-party service. The API is hosted and operated solely by the plugin authors to provide accurate and real-time vulnerability data for WordPress sites.

= What data does the plugin send to the API? =
The plugin sends only non-personal information such as plugin slugs, theme slugs, and WordPress core version numbers. No personal user data, login credentials, email addresses, or any sensitive site information is transmitted or stored.

= Why does the plugin need to connect to the VulnTitan API? =
The VulnTitan API provides up-to-date vulnerability data for plugins, themes, and the WordPress core. This connection is required to scan and detect known security issues based on your installed components.

= Is API usage optional? =
No. The API connection is required for the plugin to function as intended. However, no personal data is collected or stored, and the API is subject to fair use limits to ensure consistent availability.

== Changelog ==

= v2.0.0 - 25 Feb, 2026 =
* Major release with redesigned Vulnerability/Malware/Integrity scan UX.
* Malware scanner now includes detailed problematic-files panel, code preview, and guided safe-fix actions.
* Integrity scanner now includes better legends, problematic summary, next steps, and adaptive safe batch performance tuning.
* New Firewall module added as a dedicated section, including MU runtime request guards and login lockout protection.
* New WAF payload protection added for SQL injection and command injection with configurable whitelist path patterns.
* Security hardening added for malware-fix backups (outside `ABSPATH` by default, web-root fallback disabled by default).
* Automated cleanup/rotation added for integrity queues and malware backup files.

For full release history and detailed notes, see `CHANGELOG.md` included in this plugin package.