=== Wonderful Secure Cleanup ===
Contributors: wonderfulplugins
Tags: cleanup, security, hardening, performance, optimization
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.3.2
License: GPLv3
License URI: https://www.gnu.org/licenses/gpl-3.0.html

A simple way to clean and secure WordPress by disabling unnecessary features like comments, XML-RPC, and RSS feeds.

== Description ==

Keep your WordPress site clean and secure! **Wonderful Secure Cleanup** provides a simple interface to disable unnecessary and often risky core features.

This plugin helps you harden your WordPress installation by reducing the attack surface. It selectively disables functions like comments, XML-RPC, pingbacks, and RSS feeds. By blocking risky endpoints like `xmlrpc.php` and feed URLs, you can significantly reduce spam and automated attacks, leading to better security and improved performance.

It is the ideal tool for business websites, landing pages, and any WordPress setup that doesn't require legacy blogging functionality.

== Installation ==

1.  Upload the `wonderful-secure-cleanup` folder to the `/wp-content/plugins/` directory.
2.  Activate the plugin through the 'Plugins' menu in WordPress.
3.  Go to **Settings > Secure Cleanup** in your admin dashboard.
4.  Check the features you want to disable and save your settings.

== Frequently Asked Questions ==

= Why should I disable these features? =

Many core WordPress features like XML-RPC or comments are designed for blogging but are often unused on business websites. These unused features can create security vulnerabilities (attack surfaces) and add unnecessary "bloat" to your site. Disabling them makes your site leaner and more secure.

= Is this plugin for every website? =

This plugin is ideal for websites that do not function as a traditional blog. If you rely heavily on comments, RSS feeds for subscribers, or third-party apps that require XML-RPC, you should not disable those specific features.

= Can I easily re-enable a feature? =

Yes. All changes are non-destructive. Simply go to the settings page, uncheck the box for the feature you want to restore, and save the settings.

= What happens if my .htaccess file is missing or not writable? =

Nothing breaks. The two `.htaccess` options simply stay inactive and the settings page shows a status notice telling you that the file could not be written. All PHP-level options keep working independently of the web server configuration.

= Can I lock myself out of my site with this plugin? =

No. The plugin never touches wp-login.php, wp-admin or the REST API, and it never changes user capabilities. Only the specific endpoints you select (XML-RPC, feeds, comments, version output) are affected, and every option can be switched off again on the settings page. Deactivating the plugin removes the `.htaccess` block automatically.

= Does the plugin send any data anywhere? =

No. Wonderful Secure Cleanup contacts no external service, collects no data and stores nothing besides its own settings option.

== Screenshots ==

1. The clear and simple settings page to enable or disable cleanup features.

== Changelog ==

= 1.3.2 =
* Fix: .htaccess rules are now rewritten immediately when the settings are saved.
* Fix: The status cache used mismatched keys, so the .htaccess check ran on every admin page load.
* Fix: Removed a PHP notice caused by deregistering the comment-reply script too early.
* Fix: Output buffering no longer starts in the admin area when only feeds are disabled.
* Enhancement: Inline styles moved to a stylesheet that is loaded on the settings page only.

= 1.3.1 =
* Tested up to WordPress 7.0.

= 1.3.0 =
* Security Hardening: The plugin now features a robust "self-healing" mechanism. It automatically detects and repairs the .htaccess rules if they are removed during a plugin update, by another plugin, or through manual edits.
* Fix: .htaccess rules are now restored immediately after a plugin update is completed, closing a potential temporary security vulnerability.

= 1.2.0 =
* Fix: The .htaccess rules are now reliably applied on the first save after a fresh plugin installation.
* Enhancement: A new status indicator on the settings page shows whether the .htaccess rules are active and whether the file is writable. This improves troubleshooting and provides immediate feedback.

= 1.1.0 =
* Fix: Prevented a fatal error ("Path cannot be empty") on sites using themes without a 404.php file. The feed redirect now includes a robust fallback.

= 1.0.0 =
* Initial release.