=== NP Shield ===
Contributors: norttipaikalle
Tags: security, sql injection, firewall, logging
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.6.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Detects and (optionally) blocks SQL-injection scanning traffic as early as WordPress allows.

== Description ==

NP Shield intercepts requests matching known SQL-injection scanning patterns before WordPress resolves them into a query or renders a page — the earliest point a conventionally-installed plugin can act. Every match is logged; each signature independently controls whether a match is also blocked (403 Forbidden) or just logged for review.

**Key features**

* Runs as top-level code in the plugin's main file, ahead of `plugins_loaded` — the earliest a normal plugin can intercept a request.
* Per-signature Monitor/Block table: log-only by default for every signature, with Block a per-row checkbox away once you've reviewed the log for false positives — Block requires an active license.
* Signature list (UNION-based extraction, EXTRACTVALUE() error-based extraction, comment-terminated ORDER BY probing, SYSIBM/RDB$DATABASE/information_schema fingerprinting) stored as data, extensible without a rewrite.
* Allowlist: exempt specific IP addresses or URL path prefixes from detection entirely — free, no license required.
* Blocked IP addresses list: always block specific IPs outright, ahead of both crawl and signature detection. An allowlisted IP always wins over a blocked one. Enforcing the block requires an active license, same as signature-based blocking. Your own current IP address is automatically removed from this list on save, so it cannot lock you out.
* Optional email and/or webhook notifications on a match, rate-limited to at most one alert per 15 minutes regardless of match volume, with a "Send test email" button to confirm delivery without waiting for a real match.
* Paginated log viewer under the NP Shield admin menu, with a "Clear log now" action.
* Logged entries are pruned automatically after 90 days.
* Documentation tab covering detection, the Monitor/Block table, the allowlist, notifications, the log, and data erasure — no need to leave wp-admin for reference.
* Optional crawl detection: flags a single visitor loading an unusual number of pages in a short time, even when none of those requests contain a recognized SQLi payload. Off by default; blocking requires an active license, same as signature-based blocking.

= Privacy and data collection =

For each matched request, NP Shield logs: the visitor's IP address, the requested URL, the matched signature, the HTTP method, and the browser user-agent string. See "Privacy and GDPR" below.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/np-shield` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. Visit the "NP Shield" menu in your WordPress admin to review logged matches and set each signature to Monitor or Block.

== Frequently Asked Questions ==

= What data does this plugin collect? =

Only for requests that match a known SQL-injection scanning pattern: the visitor's IP address, the requested URL, the matched pattern name and string, the HTTP method, the user-agent string, and a timestamp. Non-matching requests are not logged.

= How long is data kept? =

Logged entries older than 90 days are deleted automatically (checked daily). You can also clear the entire log immediately at any time with "Clear log now" on the NP Shield admin page.

= Can I erase data for a specific visitor if they request it? =

Yes. NP Shield's admin page has an "Erase log entries by IP address" tool. This plugin does not use WordPress core's built-in Tools > Export/Erase Personal Data screens, because those are keyed by email address and NP Shield does not collect one — IP address is the only visitor identifier it stores.

= Is Block free? =

Detection and logging are always free, for every signature. Actually blocking a matched request (returning 403 Forbidden instead of just logging it) requires an active NP Shield license — see the License tab. If your license lapses, every signature's Block action stops enforcing automatically; logging is unaffected.

= Can I exempt my own monitoring tools or a specific visitor from NP Shield? =

Yes. The Protection tab's Allowlist section accepts IP addresses and URL path prefixes — anything matching either list is never checked against signatures at all, and never logged. This is free and unrelated to licensing.

= Can NP Shield notify me when it catches something? =

Yes, on the Notifications tab: email and/or a webhook POST. To avoid flooding you during an active scan, at most one notification is sent every 15 minutes regardless of how many requests match in that window — the Dashboard log always has the full picture.

= What happens to my data if I delete the plugin? =

Uninstalling the plugin (not just deactivating it) drops the log table and removes its settings. Deactivating alone leaves all data in place.

= Privacy and GDPR =

This plugin processes IP addresses as part of its normal operation, which under GDPR constitutes processing of personal data. Site owners are responsible for ensuring their own privacy policy discloses this processing and for identifying an appropriate legal basis. Suggested policy text is available via Settings > Privacy > "Policy Guide".

== Changelog ==

= 1.6.1 =
* Blocked IP addresses now has a self-lockout guard: your own current IP address is automatically removed from the list every time it is saved, even if you type it in yourself, so it can never block (or log a block for) your own access.

= 1.6.0 =
* Added a "Blocked IP addresses" card to the bottom of the Protection tab: always blocks the listed IPs outright, ahead of crawl and signature detection. An allowlisted IP always wins over a blocked one. Matches are logged the same as a signature match; enforcing the 403 requires an active license.

= 1.5.0 =
* Added a "Send test email" button to the Notifications tab: sends a dummy detection alert to the configured recipient (or the site admin email), clearly marked as a test, so you can confirm delivery and see what a real alert looks like without waiting for one.

= 1.4.2 =
* Crawl detection now lives in the same form as Signatures and Allowlist on the Protection tab, saved with one Save button instead of two.

= 1.4.1 =
* Renamed the Settings tab to Protection.

= 1.4.0 =
* Added optional crawl detection: flags (and, with an active license, can block) a single visitor loading an unusual number of pages within a short time window, the pattern an automated scanner leaves behind even when its requests carry no recognized attack payload. Off by default, configured on the Settings tab with an adjustable request-count/time-window threshold. Matches are logged the same way a signature match is, and respect the existing IP/path allowlist.

= 1.3.2 =
* The intro card's free/license line is no longer muted, and now links straight to the License tab.

= 1.3.1 =
* The Dashboard tab's intro card now has an "About NP Shield" heading and a closing line clarifying that monitoring is free and blocking requires a license.

= 1.3.0 =
* Added a Settings tab: the Signatures table and Allowlist (previously on the Dashboard tab) now live there instead.
* Dashboard tab reorganized: the intro card is followed by a single Log card containing the log table, pagination, and the "Clear log now" / "Erase log entries by IP address" actions, in that order.
* Log table pagination replaced with first/prev/page-label/next/last buttons (matching the button-row style used elsewhere in the Nortti paikalle plugin family) instead of WordPress core's default page-number links.

= 1.2.2 =
* Added a plain-language intro card at the top of the Dashboard tab explaining what NP Shield does and why it matters, for a non-technical reader.
* Removed em dashes from every admin-facing string in the plugin (notices, descriptions, Documentation tab copy).

= 1.2.1 =
* Adopted the shared wp-plugin-base-styles.css (used across the Nörtti paikalle plugin family) for the admin page: every section is now a proper card, the tab nav matches the sibling plugins' style, the log table sits in a bordered/shadowed card, the "Block requires a license" note is a proper banner, and "Clear log now" is now visibly styled as a destructive action.

= 1.2.0 =
* Replaced the single site-wide Monitor/Block setting with a per-signature table: each of the six signatures now has its own Monitor and Block checkboxes, so (for example) UNION SELECT can block while a noisier pattern stays log-only. Block remains license-gated per signature, enforced both at save time and at match time (a lapsed license silently drops back to Monitor for every signature, same as before).
* Added an Allowlist (Dashboard tab): exempt specific IP addresses or URL path prefixes from detection entirely — free, no license required. A match against either list is never checked against signatures and never logged.
* Added a Notifications tab: optional email and/or webhook (JSON POST) alert on a match, rate-limited to at most one notification per 15 minutes regardless of match volume, so an active scanning campaign can't turn into a flood of emails.

= 1.1.0 =
* Added a Documentation tab explaining detection, Monitor/Block mode, the log, and data erasure.
* Block mode now requires an active NP Shield license (LicMan integration, new License tab). Detection and logging remain fully free in Monitor mode; only the blocking action itself is paywalled. If a license lapses, Block mode stops enforcing automatically, even if it's still selected — logging continues either way.

= 1.0.1 =
* Full-project sweep: "Erase log entries by IP address" now validates the input is actually a well-formed IP address (filter_var()) before running the delete, instead of accepting any non-empty text — an invalid value now shows an error notice rather than silently matching nothing. Both "Clear log now" and "Erase by IP" now redirect after handling (POST/Redirect/GET) instead of re-rendering the same page, so reloading the result page can no longer resubmit the action.

= 1.0.0 =
* Initial release: SQLi request detection/logging, Monitor/Block mode toggle, paginated log viewer, 90-day automatic retention, IP-based erasure tool.
