=== Alovio Protect ===
Contributors: alovio
Tags: security, malware, integrity, crash, rollback
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Keeps a site up when something fatals, checks its files against the official record, and can put one plugin back without rolling back the whole site.

== Description ==

Alovio Protect is built around one idea: **never claim protection that is not
there.** Every screen in it says what it actually knows, and says plainly when
it does not know.

= When something fatals, the site stays up =

WordPress has supported a fatal error handler since 5.2. This replaces it with
one that does more than apologise: it records what broke, blames the plugin or
theme responsible, and if the same component fatals again it pauses that one
component and replays the request. The visitor gets a blink instead of a white
page, and the rest of the site keeps working.

Pausing never touches the database. The plugin stays "active" in WordPress's own
list; it is filtered out at runtime, so undoing it is one click and nothing was
rewritten behind your back.

= File integrity, with two different kinds of answer =

WordPress core and plugins published on wordpress.org are compared against the
official checksums. A mismatch there is a fact, not a guess.

Premium plugins, client work and themes have no such record anywhere —
wordpress.org publishes no theme checksums at all — so the first scan takes a
record of its own and later scans compare against that. The interface never
calls the result of that comparison "verified", because it is a weaker claim:

* a checksum says *this is the file the publisher shipped*
* a record says *this is the file that was here on 3 May*

A plugin that arrived already altered has its altered files recorded as normal,
and the screen says so rather than implying cover.

= A malware scanner that reports reasons, not verdicts =

Every PHP file is read without being run and scored on what it contains: code
assembled at runtime, request data reaching a shell, executable files where
uploads belong. A finding is a reason to look, with the rule that fired, the
line and the code — not an accusation, and nothing is ever deleted behind your
back. Quarantine takes a copy first, so releasing a file is one click.

Files whose checksums already match the official release are skipped entirely,
which removes the single largest source of false positives before the first
rule runs.

= Rolling back one plugin, not the whole site =

A copy of a plugin or theme is kept before it updates. If the update breaks the
site, that one plugin goes back to its previous version — without restoring the
whole site and losing everything that happened since. The rolled-back version is
pinned, so an automatic update does not quietly reinstall it that night.

Database changes are not reversed, and the confirmation step says so.

= Login =

Failed sign-ins are rate limited, and the form stops saying which usernames
exist. The login address can be moved, and the interface is explicit that this
is concealment rather than protection: it takes the constant background of
automated attempts off wp-login.php, and the rate limiting is the part that
stops password guessing. One line in wp-config.php always brings the old address
back.

= Scheduled work =

WordPress only runs scheduled work when somebody visits, so a quiet site runs it
late or not at all. This counts what is overdue across every plugin, gives the
exact cron line for your host, and — once it can see something outside WordPress
working the queue — offers to take WP-Cron off your visitors' page loads. If
that is switched off and nothing runs for an hour, it says so, loudly.

= What leaves your site =

Nothing, except requests to wordpress.org for the official checksums it compares
against (api.wordpress.org and downloads.wordpress.org). There is no account, no
licence key, no telemetry and no server of ours in the path. The webfont the
interface uses is bundled, so no request is made to Google on your visitors' or
your own behalf.

== Installation ==

1. Install and activate the plugin.
2. Open **Alovio Protect** in the admin menu.
3. The crash guard installs its files on activation. If it reports a conflict,
   another plugin already owns WordPress's fatal error handler — the screen
   names it and leaves the choice to you.
4. Run the first file check from **File integrity**.

The plugin writes to `wp-content/alovio-protect/`, and installs
`wp-content/fatal-error-handler.php` and
`wp-content/mu-plugins/alovio-protect-guard.php`. Both are standard WordPress
extension points. If the web server cannot write to them, the screen says which
file and which user account owns it.

== Frequently Asked Questions ==

= Does pausing a plugin deactivate it? =

No. The pause is held in a file and applied while the page is being built. The
plugin is still active in WordPress's own list, nothing in the database is
rewritten, and resuming it is one click.

= The scan reported a file inside a plugin I trust. Is it malware? =

Probably not. Legitimate libraries do generate and evaluate code — phpseclib
does it for performance. That is why a finding shows you the rule, the line and
the code instead of a verdict. Marking it reviewed remembers that decision
against the file's contents, so it comes back if the file changes.

= Why does it say "recorded" instead of "verified" for my premium plugin? =

Because wordpress.org has no checksums for it, so there is nothing authoritative
to compare against. The plugin records the files itself and can tell you if they
change later — which is a genuinely useful thing, and a different thing from
verification. It will not pretend otherwise.

= Can I switch WP-Cron off? =

Once something outside WordPress is demonstrably working the queue, yes, and the
plugin will offer it. Before that it will warn you first: if the cron job is not
really in place, switching WP-Cron off stops every scheduled task on the site.
A copy of wp-config.php is stored before the line is added.

= Does it work on multisite? =

The uninstaller cleans every site in a network. The interface is per-site and
has not been through a full multisite test yet, so treat that as untested rather
than supported.

== Privacy ==

**Update checks.** This plugin is distributed from alovio.org rather than the WordPress.org plugin directory, so it asks alovio.org for its updates. About twice a day WordPress sends one request to licenses.alovio.org carrying five things: the plugin slug, the version you are running, your site's domain, and the WordPress and PHP versions it runs on. That request carries no personal data, no customer data, no content, and no licence key, because this plugin has none. The Integrity module makes requests of its own; those are described below.

We keep one record per site: the domain, the version, the WordPress and PHP versions, and when it was first and last seen. It exists so we know how many sites run the plugin and which versions are still in use, which is what tells us whether a release has reached people and which versions still need supporting — and so that raising the WordPress or PHP a release requires is a decision about real sites rather than a guess. It is never sold, never shared with anyone, and never used to contact you.

**Integrity talks to WordPress.org, because that is where the official record is.** When the Integrity module is switched on it fetches the published checksums for your WordPress version and for the plugins it checks, from api.wordpress.org and downloads.wordpress.org. Those requests identify the plugin and its version and carry your site's address, the way WordPress's own update requests do. They ask for a public list and send nothing about your files — the comparison happens on your own server. Switch the module off and the requests stop.

**Everything the plugin finds stays on your site.** The pause state, the integrity and malware findings and the login counters are written to your own WordPress installation and are never sent to us or to anyone else.

**Switching it off.** Add this to wp-config.php:

`define( 'ALOVIO_NO_UPDATE_CHECK', true );`

The update check then stops entirely. It also stops the plugin being told about new versions, so you would check alovio.org and install updates by hand. It does not affect Integrity, which is switched off in the plugin's own settings — with both off, the plugin makes no outbound request at all.

== Changelog ==

= 1.0.0 =
* First release.
* Crash guard: fatal errors caught, blamed, recorded, and the responsible
  component paused without touching the database.
* File integrity against wordpress.org checksums, and a record of its own for
  plugins and themes that have no published checksums.
* Malware scanner over the PHP token stream, with quarantine that keeps a copy.
* Restore points, and rollback of a single plugin or theme update with pinning.
* Login rate limiting, flattened login errors, optional login address.
* Scheduled scanning with email notification, and a cron setup tool that
  verifies the job is actually running.
