=== PW Security and Backup ===
Contributors: poyrazweb
Tags: security, backup, firewall, malware scanner, login security
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 3.1.9
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Security monitoring, login protection, file integrity checks, full backups, comparison, and selected-file recovery in one panel.

== Description ==

PW Security and Backup brings practical WordPress security and backup tools into one administration panel.

Main features:

* Login attempt limiting and temporary IP bans.
* Optional custom login path, additional password, and challenge question.
* WordPress hardening controls with rollback support.
* Suspicious-code scanning for WordPress files.
* SHA-256 file integrity baselines and chunked full-directory monitoring.
* Email notifications for administrator login, file changes, and IP bans.
* Full WordPress file and database backups in ZIP format.
* Backup comparison and selected-file recovery.
* Security logs, traffic records, and a security analysis report.
* English source interface with a bundled Turkish translation.

Login-path hiding and live traffic recording are disabled by default. They can be enabled after the administrator reviews the related settings and confirms that the hosting or proxy configuration is compatible.

The plugin does not require a license key, send telemetry, or load remote scripts. Email notifications are sent through the WordPress mail system to the configured address when enabled.

Important: WordPress scheduled events depend on site traffic unless the hosting provider runs a real server cron. FTP changes are reported after a complete scheduled integrity scan finishes.

== Installation ==

1. Upload the plugin ZIP through Plugins > Add New > Upload Plugin, or install it from the WordPress Plugin Directory.
2. Activate PW Security and Backup.
3. Open PW Security in the WordPress administration menu.
4. Review the login, hardening, notification, scan, integrity, and backup settings before enabling changes.
5. Create a file-integrity baseline after confirming that the site files are clean.

== Frequently Asked Questions ==

= Does the plugin send data to an external service? =

No. It does not send telemetry or security scan data to Poyraz Web or PW Feed.

= Are FTP file changes detected immediately? =

Not at the exact moment of the FTP operation. WordPress cannot observe an FTP event directly. The chunked integrity scan detects new, modified, or deleted files when the scheduled scan reaches them and sends a summary after the scan completes.

= Why can scheduled scans run late? =

WP-Cron normally runs when the site receives a request. On low-traffic sites, configure a real server cron to request WordPress cron regularly.

= Where are backups stored? =

Backups are stored in a protected directory below the WordPress uploads directory. Access-blocking files are created for common Apache and IIS configurations.

= Does uninstalling remove plugin settings? =

Yes. Uninstalling from the WordPress Plugins screen removes plugin settings, reports, logs, and scheduled events. Backup ZIP files are deliberately preserved so an uninstall does not destroy recovery data.

== Privacy ==

The plugin does not send telemetry, scan results, traffic records, credentials, or backup contents to Poyraz Web, PW Feed, or another external service.

Security logs may store an IP address, WordPress username, event time, and event description. When live traffic recording is explicitly enabled, the plugin locally stores a limited rolling set of request paths, IP addresses, request methods, referrers, and user-agent strings. Administrators can clear these records from the plugin screens. The configured retention period applies to security logs.

Quarantined files and their local metadata are stored below `wp-content` in a randomly named, access-protected directory. They are not sent to an external service.

Email notifications are sent through the site's WordPress mail configuration to the address selected by the administrator. Full backups can contain personal and sensitive site data because they include WordPress files and database tables. Backup archives are placed in a randomly named directory with access-blocking files and are downloaded through a capability- and nonce-protected administration action. Server-level access rules should also protect the uploads directory on hosting configurations that do not honor Apache or IIS access files.

== Screenshots ==

1. Security center and current security score.
2. Login security and notification settings.
3. File scanner and integrity monitoring.
4. Backup creation, comparison, and recovery tools.

== Changelog ==

= 3.1.9 =

* Corrected translatable numbered placeholders reported by the WordPress.org automated plugin scan.
* Added the remaining Reporting label to the translation catalogue.
* Updated the plugin version and stable tag for the corrected WordPress.org submission package.

= 3.1.8 =

* Corrected numbered sprintf placeholders in translatable administrator-login and IP-ban notification messages for WordPress Plugin Check compatibility.
* Moved the remaining Reporting label into the standard translation catalogue.
* Completed a source-level English and Turkish localization audit and removed all HTML and JavaScript from translation entries.
* Moved administration interactions and confirmation prompts to an enqueued JavaScript file.
* Corrected remaining mixed-language labels, stored scanner risk keys, traffic status keys, plural strings, and locale-sensitive analysis reports.
* Hardened request handling, verified client IP handling, CSV exports, secure-cookie behavior, notification preferences, and private backup directory naming.
* Disabled login-path hiding and live traffic recording by default for safer first activation and documented local privacy-related data.
* Added administrator-login notifications and cleared all plugin cron hooks during uninstall.

= 3.1.7 =

* Audited the complete translation catalogue and corrected mixed Turkish-English source strings.
* Removed nested gettext calls and corrected untranslated conditional interface messages.
* Rebuilt the POT, PO and MO language files from the corrected English source.

= 3.1.6 =

* Replaced the legacy runtime translation dictionary with standard WordPress gettext source strings.
* Completed English-source coverage for administration screens, notices, email messages, scheduled tasks, scanner results, backup operations, and conditional interface states.

= 3.1.5 =

* Added English translations for short Latin-only Turkish status labels and dynamic analysis metrics missed by the previous character-based audit.
* Covered scan totals, skipped files, traffic metrics, protection level, risk labels, action labels, and empty-state values.

= 3.1.4 =

* Expanded English coverage for legacy Turkish administration text, scanner findings, hardening controls, backup messages, reports, and emergency recovery guidance.
* Added complete sentence translations to prevent mixed Turkish-English interface output.

= 3.1.3 =

* Moved explicit translation loading to the WordPress `init` action.
* Removed early translation calls from stored default settings to prevent WordPress 6.7+ just-in-time translation warnings and related header warnings.

= 3.1.2 =

* Fixed invalid translated default parameter expressions that caused a PHP fatal error while loading the plugin.
* Kept translated fallback messages inside the affected methods for PHP 7.4 and later compatibility.

= 3.1.1 =

* Prepared the package for the WordPress Plugin Directory.
* Standardized the permanent slug and text domain as `pw-security-and-backup`.
* Added a WordPress.org-compatible readme and uninstall cleanup.
* Connected legacy interface text to standard WordPress gettext calls while retaining a compatibility fallback.
* Expanded the POT and Turkish PO/MO catalogs for administration, email, log, CSV, and error messages.
* Preserved chunked full-directory integrity monitoring from version 3.0.8.

== Upgrade Notice ==

= 3.1.9 =

Corrects the internationalization issues reported by the WordPress.org automated plugin scan. Existing settings, logs, backups and security data are preserved during the update.

= 3.1.8 =

Completes the localization and WordPress.org readiness audit, strengthens security-sensitive request and backup handling, and uses safer defaults for new installations.

= 3.1.6 =

Uses English source strings and the standard Turkish translation catalog throughout the plugin.

= 3.1.5 =

Completes English coverage for remaining short Turkish labels in scan, traffic, hardening, and analysis screens.

= 3.1.4 =

Fixes Turkish text remaining in the administration interface when WordPress uses English.

= 3.1.3 =

Fixes early translation loading notices on WordPress 6.7 and later.

= 3.1.2 =

Fixes a fatal activation error in login security and hardening services.

= 3.1.1 =

WordPress.org packaging, translation-domain, and cleanup improvements.
