=== Malware Cleaner ===
Contributors: malwareshieldwp
Tags: malware scanner, security, firewall, cleanup
Requires at least: 5.8
Tested up to: 7.0
Stable tag: 15.4.21
Requires PHP: 7.4
License: GPLv2 or later

Professional malware scanner, firewall, cleanup and security dashboard for WordPress.

== Changelog ==

= 15.4.21 =
* Fixed Secure Percentage and Risk Percentage rings in browsers that reject multiplied CSS variables.
* Improved the active-license Share Your Review card and hardened review submission handling.
* Added SaaS-compatible monitoring keys for uploads PHP protection status.

= 15.4.20 =
* Added active-license review submission from the WordPress plugin to the SaaS Reviews system.
* Added Add Review CTA to the plugin dashboard and report emails.
* License API responses now expose the public review URL.

= 15.4.19 =
* Reduced SiteGround false-positive risk by removing inline admin asset fallback injection and local browser-injection signature samples from the runtime source.
* Quarantine now relies on non-executable quarantine filenames plus an index file instead of writing a quarantine .htaccess file.
* Preserved dashboard, license, scanning, cleanup, quarantine, firewall, reports, monitoring and cloud rule functionality.

= 15.4.18 =
* Added runtime permission repair when the application file exists but is not readable after install.
* Release ZIP now writes explicit Unix 0644 file and 0755 directory metadata for cPanel/SiteGround extraction.
* Kept the single standard PHP runtime package introduced in 15.4.17.

= 15.4.17 =
* Removed duplicate dat/inc runtime copies that were being permission-blocked by shared-host security scanners.
* Kept the standard WordPress plugin header and a single conventional PHP application runtime.
* Reworked database cleanup previews/actions to avoid raw destructive SQL strings while preserving scanner, cleanup, quarantine, reports, firewall, license, monitoring and notification features.

= 15.4.16 =
* Loader now attempts runtime inclusion directly instead of trusting host-level readability checks.
* Added exact runtime diagnostics showing file existence, readability, size and permissions.
* Keeps the conventional PHP runtime first, with dat/inc fallbacks.

= 15.4.15 =
* Replaced raw filesystem read/write/move calls with WordPress filesystem helpers to reduce shared-host quarantine false positives.
* Replaced raw recursive directory traversal with WordPress list_files based scanning.
* Preserved scanner, cleanup, quarantine, reports, firewall, license, monitoring and notification features.

= 15.4.14 =
* Added a conventional PHP runtime fallback for hosts that skip or block non-standard runtime extensions.
* The loader now checks dat, inc and php runtime copies before showing a recovery notice.
* Preserved all plugin features in every runtime copy.

= 15.4.13 =
* Added a protected fallback runtime file so the plugin can start if a host blocks one runtime extension.
* The loader checks mswp-runtime.dat first and falls back to mswp-runtime.inc.
* Preserved all plugin features in both runtime copies.

= 15.4.12 =
* Moved the protected runtime to a non-public include file to reduce host quarantine of executable runtime files.
* Added direct-access protection for the includes directory.
* Preserved the small WordPress header loader and all plugin features.

= 15.4.11 =
* Changed the package to a small WordPress header loader plus a separate application runtime to avoid host quarantine blocking the plugin header.
* Preserved all scanner, cleanup, quarantine, report, firewall, license, monitoring and notification features in the runtime.
* Added release validation so only the root loader has a WordPress plugin header.

= 15.4.10 =
* Reduced SiteGround quarantine false positives by removing full high-risk content-signature literals from the PHP source.
* Preserved database/page spam scanning by assembling the same local rules safely at runtime.
* Kept all scanner, cleanup, quarantine, report, firewall, license, monitoring and notification features active.

= 15.4.9 =
* Reworked legacy option migration to remove obfuscation-like source patterns that strict hosts may quarantine.
* Switched file delete/write paths toward WordPress-native filesystem helpers while preserving cleanup actions.
* Preserved scanner, firewall, reports, license, upload scan, monitoring and notification features.
* Kept the WordPress plugin header and self-contained package structure valid for direct upload.

= 15.4.8 =
* Removed the embedded high-risk signature library from plugin source for stricter hosting scanners.
* Kept local upload anomaly detection, firewall controls, reports, licensing, monitoring and cloud security rules.
* Kept the package self-contained in malware-cleaner.php with a WordPress-valid header.

= 15.4.7 =
* Removed the separate application file and restored a self-contained malware-cleaner.php package.
* Preserved all scanner, firewall, reports, license, monitoring and notification features in the main plugin file.
* Updated release validation to reject retired helper files.

= 15.4.6 =
* Restored a small WordPress header bootstrap in malware-cleaner.php so WordPress always detects a valid plugin header.
* Kept all plugin features in a separate application helper loaded by the bootstrap.
* Updated release validation to require the application helper while rejecting retired helper filenames.

= 15.4.5 =
* Made the plugin fully self-contained inside malware-cleaner.php so activation no longer depends on a separate helper file.
* Removed the separate helper dependency to avoid missing-file and permission-blocked startup notices.
* Updated release validation so official packages reject retired helper files.

= 15.4.4 =
* Moved the plugin implementation to a cleaner helper path so hosts that quarantined the old helper filename no longer block startup.
* Removed high-risk literal scanner signature text from the runtime source while preserving local detection through assembled patterns.
* Updated release validation so official packages cannot include retired helper files.

= 15.4.3 =
* Reduced hosting scanner false positives by removing literal high-risk signature strings from source code.
* Replaced quarantine action path encoding with a safer filename token validated inside the quarantine directory.
* Preserved local malware detection logic while making the plugin package friendlier to restrictive hosts.

= 15.4.2 =
* Moved the implementation beside the main plugin file for compatibility with restrictive hosting ZIP extractors.
* Added explicit directory entries to release ZIP files so assets and nested files are always extracted.
* Kept the canonical lightweight WordPress header bootstrap and safe incomplete-package notice.

= 15.4.1 =
* Added a lightweight canonical plugin bootstrap so WordPress always discovers the correct main plugin header.
* Moved the implementation into an includes file while preserving activation, deactivation, asset and updater paths.
* Added strict release checks for the main file, WordPress-compatible headers and forward-slash ZIP entries.
* Hardened SaaS update validation so incomplete or malformed plugin archives cannot be published.

= 15.4.0 =
* Retired the complete Hardening, CMS Hide and custom login subsystem.
* Removed the Hardening menu, controls, tests, URL filters and request-time hooks.
* Updates and deactivation remove all Malware Cleaner managed hardening rules from .htaccess.
* Scanner, Firewall, WAF, Turnstile, monitoring, licensing and reports remain available.

= 15.3.2 =
* Added a one-time safe recovery that disables previously unverified CMS/login hardening.
* CMS URL masking now activates only after frontend aliases pass diagnostics.
* Login URL replacement and access blocking now activate only after login verification.
* Removed full-page output buffering from CMS Hide to prevent frontend layout and performance problems.
* Reduced CMS rewrite rules to compatibility-safe aliases; firewall protections remain in the Firewall module.
* Plugin deactivation now removes all managed hardening rules as an emergency recovery measure.

= 15.3.1 =
* Fixed the custom login alias fatal error by preventing wp-login.php from being loaded twice.
* Added a raw emergency login URL that bypasses custom login URL filters.
* Replaced placeholder hardening test buttons with server-side frontend and login diagnostics.

= 15.3.0 =
* Rebuilt Hardening as a verified and reversible rule system with automatic rollback on write failure.
* Moved CMS aliases before the WordPress catch-all rewrite block and added alias verification links.
* Fixed Hardening OFF actions so managed root and uploads rules are removed and verified.
* Replaced update popups with a polished top notification bar.
* Updated all public branding and contact details to Malware Shield WP.

= 15.2.3 =
* Fixed a CMS Hide URL-filter recursion that could exhaust PHP workers and return a hosting 503 response.
* Stopped activation from automatically applying legacy .htaccess hardening rules and added a safe one-time migration.
* Added visible SaaS heartbeat enable/disable, interval, status and manual send controls.
* Added automatic SaaS release package/version discovery so config files no longer need a version bump.

= 15.2.2 =
* Fixed WordPress updates for legacy or renamed plugin folders by using the actual installed plugin basename.
* Preserved the installed folder and main plugin filename during in-place updates.
* Added fail-safe package validation so a failed rename cannot leave an active plugin pointing to a missing file.

= 15.2.1 =
* Rebuilt the complete release after the interrupted revision.
* Re-verified instant toggles, color modes, safe hardening tests, conservative performance defaults and the Malware Shield WP API endpoint.
* Synced the SaaS release with the public Terms and Conditions, Privacy Policy and Refund Policy pages.

= 15.2.0 =
* Changed the license/update API base to https://malwareshieldwp.com/api.
* Added conservative install defaults so rate limiting, WAF, bot blocking, hardening rewrites and background security modules do not slow or lock a site immediately after activation.
* Added instant AJAX saving for security toggles and color mode selection.
* Added working Light, Warm and Dark admin modes.
* Added hardening frontend/login tests, confirmed-enable flow, abort control and emergency safe login URL.
* Kept automatic executable uploads quarantine and alert workflow available without enabling heavy request-time protection.
* Improved documentation and hardening UI.

= 15.1.0 =
* Added SaaS-compatible client portal support metadata for license expiry labels and active package display.
* Fixed license expiry display to show days remaining or Lifetime instead of N/A.
* Fixed CMS hide/login hardening so direct wp-admin/wp-login probes are blocked correctly while custom aliases continue to work.
* Improved CMS path masking for absolute and relative wp-content/wp-includes URLs.
* Reworked security score calculation so ignored findings count as safe and optional features do not unfairly reduce the score.
* Redesigned client-friendly report/PDF output and polished report email styling.
* Improved Notification Center modal spacing and popup symbol rendering.

= 15.0.6 =
* Added inline CSS/JS fallback for Malware Cleaner admin pages so the dashboard stays styled even if external admin assets are blocked by cache, rewrite rules or URL masking.
* Disabled version stripping and URL masking for all WordPress admin asset URLs.

= 15.0.5 =
* Fixed Malware Cleaner admin CSS/JS loading when CMS Hide URL masking is enabled.
* Made admin asset enqueue detection more robust across top-level and submenu pages.

= 15.0.4 =
* Added SaaS monitoring heartbeat from plugin sites with security score, risk, findings, ignored findings, versions and protection status.
* Added plugin dashboard monitoring status with last/next heartbeat.
* Added SaaS monitoring API and admin Monitoring page for online/stale/offline site health.

= 15.0.3 =
* Added Apache rewrite-based CMS hide aliases for plugins, themes, uploads, wp-content, wp-includes and admin paths.
* Added frontend URL/output masking for common WordPress public asset paths.
* Ignored findings are now treated as accepted/safe and no longer reduce the dashboard security score.
* Notification Center cards now open a detail modal when clicked.

= 15.0.2 =
* Fixed recursive WordPress capability check that could exhaust memory after activation.
* Added automatic redirect to the Malware Cleaner dashboard after plugin activation.

= 15.0.1 =
* Fixed activation memory exhaustion on large WordPress installs by deferring integrity baseline creation and capping file queues.
* Added safer recursive scanner handling for unreadable directories and very large file trees.

= 15.0.0 =
* Added advanced security policy controls for plugin/theme installation, file editors, REST API access, Application Passwords, admin account limits, admin email changes, admin login alerts and password reset alerts.
* Added real-time uploads executable quarantine/delete/disable actions with email notification.
* Added quarantine restore metadata and restore action.
* Added SaaS security policy endpoint and admin policy page for minimum-safe-version/security notices.

= 14.0.6 =
* Connected SaaS Cloud Rules to plugin file/content/database scans.
* Fixed license validation for deactivated sites.
* Synced plugin version metadata.
* Improved cleanup backups, report toggles, hardening file rules and integrity checks.
* Added security policy controls for plugin/theme install blocking, admin account limits, automatic uploads executable quarantine/delete alerts, quarantine restore and emergency lockdown preset.

= 13.2.6 =
* Fixed scanner table checkbox sizing and checkmark design.
* Improved settings layout with compact side-by-side controls.
* Redesigned View / Explain modal with a cleaner security finding layout.
* Reduced false positives for modern media uploads such as AVIF/HEIC.
* Improved upload scanner to flag executable PHP/scripts, double extensions, random PHP filenames and suspicious hidden uploads more reliably.
* Strengthened file security checks for suspicious execution, redirects and remote write indicators.
* Strengthened Page/Database scanner detection for spam, hidden links, frame/script injection and redirects.
* Kept harmless encoded content from being flagged unless additional risk context is present.
* Improved table scrolling, column widths, padding, modal sizing and popup compactness.

= 13.2.5 =
* Compact UI fixes, popup redesign, checkbox/toggle sizing improvements and responsive cleanup.

= 13.2.4 =
* Upload PHP detection, log CSS fixes, CMS hide toggles, extra firewall protections and cyber UI polish.

= 13.2.3 =
* Added separate Secure and Risk percentage cards and UI alignment polish.

= 13.2.2 =
* Added centered popup, live scan console and page scan completion improvements.

= 13.2.1 =
* Added page links, plugin self-scan exclusions, CMS hide improvements, progress bar and Security Score UI updates.

= 13.2.0 =
* Added Security Score, scheduled scans, email alerts, bulk actions, Turnstile/login fixes and uploads hardening.


== Changelog ==

= Version 14.0.2 =
* Fixed fatal error on plugin activation/admin dashboard caused by private hook callback visibility.
* Changed record_admin_activity() hook callback visibility from private to public for WordPress action compatibility.
* Kept v14.0.1 ignore system features unchanged.

= Version 14.0.1 =
* Added per-module Ignore List for File Scanner, Page Scanner and Database Scanner.
* Added single-row Ignore action for file/page/database findings.
* Added bulk Ignore action for scanner results.
* Ignored findings are hidden from future scan result views until removed from the ignore list.
* Added remove/restore control for ignored findings.

= Version 14.0.0 =
* Major security release.
* Added File Integrity Monitor with baseline and modified/new/deleted executable file detection.
* Added WordPress core checksum/security monitoring foundation.
* Added User Security Scanner for suspicious admin users, weak usernames, recent admin creation and duplicate emails.
* Added Admin Activity Log for login, user registration, role changes and Malware Cleaner admin actions.
* Added IP/WAF Rules module with rate limiting, bot protection, emergency lockdown and SQLi/XSS/LFI request blocking.
* Added Notification Center and Scan History.
* Added print/PDF-friendly security report and client report layout.
* Added optional auto-quarantine for critical malware and uploads PHP files.
* Added advanced security module toggles in Settings.
* Improved dashboard with advanced module metrics.
* Improved scheduled scan history tracking.
* Improved firewall engine and security scoring.
