=== 360 Orbit Login Guard ===
Contributors: joergliwa
Tags: security, login, brute force, limit login attempts
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.10
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protects your login against brute-force attacks: rate limiting, login history and generic error messages, with a safety net against admin lockout.

== Description ==

Login Guard addresses the most common WordPress attack of all: automated password guessing against /wp-login.php.

* Rate limiting: locks an IP address out after too many failed attempts, for a configurable duration.
* Login history (7 days): every attempt with a pseudonymous fingerprint instead of the raw IP address, success or failure, and the user name tried.
* Generic error messages: never reveals whether a user name exists.
* Safe allowlist behaviour: an IP address from which someone with administrator rights recently signed in successfully is never locked out automatically.
* Disable XML-RPC: closes the known bypass of rate limiting via system.multicall.
* Protection against user name enumeration (?author= parameter and the public REST user list).
* Export and import of all settings as JSON, to set up several sites the same way.
* WP-CLI: inspect the status and unlock IP addresses even when wp-admin itself is unreachable.

= Free version vs. Pro =

The free version is complete on its own: rate limiting, login history, generic error messages, XML-RPC and enumeration protection, and settings export/import.

**Login Guard Pro** adds:

* Two-factor authentication (TOTP) for individual accounts or entire roles, compatible with common authenticator apps.
* A custom login URL instead of /wp-login.php, with a 404 for the real address.
* Notification when an account signs in from an unknown device.
* A fixed allow/block list for IP addresses.
* Automatic update notifications directly in the WordPress admin.

Login Guard Pro is a separate plugin available from the author; it is not required to use the free version.

== Installation ==

1. Upload the plugin ZIP under *Plugins → Add New → Upload Plugin*, or install it from the plugin directory.
2. Activate the plugin.
3. Open the **Login Guard** menu and review the defaults under "Settings" (they already suit most sites).

== Frequently Asked Questions ==

= Can I lock myself out? =

This is exactly the scenario the safety net protects against: an IP address from which a person with administrator rights recently signed in successfully is never locked out automatically. In addition, every lockout can be lifted with one click under "Status & Lockouts", and if wp-admin is unreachable, via WP-CLI (`wp 360-orbit-login-guard unlock <ip>`).

= Are raw IP addresses stored? =

No. The login history only stores a pseudonymous fingerprint (a hash of the IP address and a secret random value generated by the plugin). The plugin does not send any data to external services.

= What happens on deactivation? =

Rate limiting and all other protections stop immediately and the daily clean-up cron job is unscheduled. The existing login history and all settings are kept and are back immediately after reactivation. Only "Delete" in the plugin list removes them permanently.

= Which languages does the admin interface support? =

The admin interface follows the language configured in WordPress. Translations are delivered as WordPress.org language packs (translate.wordpress.org, text domain `360-orbit-login-guard`); German is maintained by the author. You are welcome to contribute further languages there.

== Screenshots ==

1. Status overview with currently locked IP addresses and the most recent login attempts.
2. Settings: rate limiting, generic error messages, proxy header handling and lockout notification.

== Changelog ==

= 1.0.10 =
* Fix: the one-time data migration from older versions no longer removes old settings if copying them failed, and it retries hourly until every step succeeded. A missing data table is created again. Uninstalling now also removes data left from older versions.

= 1.0.9 =
* Internal: code cleanup for the WordPress.org Plugin Check. No functional changes.

= 1.0.8 =
* Changed: all options, classes, constants and hooks now use the unique prefix wp360_ instead of we_. Existing settings and data are migrated automatically on the first page load after the update. Custom code using this plugin's filters or actions must switch to the new wp360_ names.
* Changed: the free version no longer contains any code for Pro features.
* Changed: the deactivation confirmation is now loaded through the WordPress script API instead of an inline script.

== Upgrade Notice ==