Changeset 3758339

Timestamp:

10/21/2026 12:38:24 PM (41 hours ago)

Author:

genioussonu

Message:

Update to version 1.3.4 from GitHub

Location:

genioussonu-site-checkup

Files:

• tags/1.3.4 (copied) (copied from genioussonu-site-checkup/trunk )
• tags/1.3.4/admin/assets/css/design-tokens.css (modified) (1 diff)
• tags/1.3.4/genioussonu-site-checkup.php (modified) (2 diffs)
• tags/1.3.4/readme.txt (modified) (3 diffs)
• tags/1.3.4/update-info.json (modified) (2 diffs)
• trunk/admin/assets/css/design-tokens.css (modified) (1 diff)
• trunk/genioussonu-site-checkup.php (modified) (2 diffs)
• trunk/readme.txt (modified) (3 diffs)
• trunk/update-info.json (modified) (2 diffs)

genioussonu-site-checkup/tags/1.3.4/admin/assets/css/design-tokens.css

@@ -9 +9 @@
  *
  * @package GeniousSonu_Site_Checkup
- * @version 1.3.3
+ * @version 1.3.4
  */
 

genioussonu-site-checkup/tags/1.3.4/genioussonu-site-checkup.php

@@ -4 +4 @@
  * Plugin URI:        https://www.genioussonu.me/plugin/genioussonu-site-checkup/
  * Description:       Complete security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.
- * Version:           1.3.3
+ * Version:           1.3.4
  * Requires at least: 5.8
  * Requires PHP:      7.4
@@ -26 +26 @@
 
 // Plugin Constants.
-define( 'GENISICH_VERSION', '1.3.3' );
+define( 'GENISICH_VERSION', '1.3.4' );
 define( 'GENISICH_PLUGIN_FILE', __FILE__ );
 define( 'GENISICH_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

genioussonu-site-checkup/tags/1.3.4/readme.txt

@@ -4 +4 @@
 Author URI: https://www.genioussonu.me/
 Plugin URI: https://www.genioussonu.me/plugin/genioussonu-site-checkup/
-Tags: security, hardening, security audit, login security, firewall
+Tags: security, hardening, vulnerability scanner, audit, login security
 Requires at least: 5.8
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.3.3
+Stable tag: 1.3.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-Security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.
+Strengthen your WordPress security with an automated hardening checklist, vulnerability scanner, one-click safe fixes, and client audit reports.
 
 == Description ==
 
-**GeniousSonu Site Checkup** delivers professional **WordPress security** auditing and **site hardening** through an actionable, SOP-driven dashboard. Whether you need an instant **security checkup**, automated **hardening** for sensitive files and server headers, or a comprehensive **security audit** checklist across client installations, GeniousSonu Site Checkup organizes and executes your entire security workflow.
-
-Rather than competing with or replacing mature firewalls and backup tools, GeniousSonu Site Checkup audits your environment, detects vulnerabilities, and applies verified, reversible **hardening** fixes with zero bloat. Automate safe security tasks, guide complex configurations with seamless plugin bridges, track routine credential rotations, and generate print-ready executive client audit reports:
+Securing a WordPress site often means juggling complex server configurations, confusing checklist articles, and heavyweight security plugins that slow down your admin or break production sites without warning. When managing multiple client sites, knowing which hardening steps have been properly implemented—and proving it to stakeholders—is even harder.
+
+GeniousSonu Site Checkup solves this by giving you a clear, structured WordPress security hardening checklist paired with automated diagnostic scanners and safe, reversible fixes. Instead of guessing, you get an actionable SOP dashboard that audits your installation, previews every configuration change before applying it, and generates professional client-ready reports.
+
+Rather than competing with or replacing mature firewalls and backup tools, GeniousSonu Site Checkup audits your environment, detects vulnerabilities, and applies verified, reversible hardening fixes with zero bloat. Automate safe security tasks, guide complex configurations with seamless plugin bridges, track routine credential rotations, and generate print-ready executive client audit reports:
 
 * **Level A (Safe Automation & Scanners):** Disable XML-RPC, restrict unauthenticated REST user enumeration, hide PHP versions, enforce clickjacking protection (X-Frame-Options), MIME sniffing protection, HSTS, disable front-end `WP_DEBUG_DISPLAY`, audit file permissions (strict 640 baseline on `wp-config.php`), detect risky PHP `disable_functions` / `open_basedir`, check default `wp_` database prefix, external fingerprint scanner, and probe TLS protocols (`TLSv1.0` through `TLSv1.3`) and certificate chain depth.
@@ -108 +110 @@
 == Frequently Asked Questions ==
 
+= Does it replace a firewall? =
+No. GeniousSonu Site Checkup is designed to complement existing web application firewalls (like Cloudflare, Wordfence, or server-level WAFs), not replace them. While firewalls inspect live traffic and block malicious requests in real time, GeniousSonu Site Checkup focuses on site hardening, vulnerability auditing, configuration hygiene, and reducing your site's attack surface so attacks cannot succeed in the first place.
+
+= What does it change on my server? =
+The plugin only modifies configuration files if you explicitly choose to apply a safe fix. When enabled, it writes clearly marked blocks to your `.htaccess` (on Apache/LiteSpeed) or `wp-config.php` (such as disabling file editing or hiding XML-RPC). It never alters WordPress core files, and on Nginx servers, it never writes blind rewrite rules—instead, it displays copyable Nginx directives for your server block.
+
+= How do I undo a change? =
+Every automated fix can be toggled off directly from the Site Checkup dashboard with a single click. The plugin strictly uses isolated, marker-delimited blocks (e.g., `# BEGIN GeniousSonu Site Checkup`), allowing it to cleanly remove its rules without disturbing existing directives. You can also preview the exact diff before any change is written or removed.
+
 = What happens if my server runs Nginx instead of Apache? =
 GeniousSonu Site Checkup detects Nginx server software (`$_SERVER['SERVER_SOFTWARE']`). Tasks that rely on `.htaccess` are marked as "Not Applicable on this Server" and feature a "View Nginx Snippet" button with 1-click copy for your server configuration.
@@ -130 +141 @@
 
 == Changelog ==
+
+= 1.3.4 =
+* Docs: Optimize WordPress.org search visibility with natural keywords, verified search tags, and real-world FAQs.
+* Docs: Update project portfolio landing page, comprehensive SOP task reference, and live verification.
 
 = 1.3.3 =

genioussonu-site-checkup/tags/1.3.4/update-info.json

@@ -2 +2 @@
     "name": "GeniousSonu Site Checkup",
     "slug": "genioussonu-site-checkup",
-    "version": "1.3.3",
-    "download_url": "https://github.com/GeniousSonu/Site-Checkup-Pro/releases/download/v1.3.3/genioussonu-site-checkup-selfhosted.zip",
+    "version": "1.3.4",
+    "download_url": "https://github.com/GeniousSonu/Site-Checkup-Pro/releases/download/v1.3.4/genioussonu-site-checkup-selfhosted.zip",
     "homepage": "https://www.genioussonu.me/plugin/genioussonu-site-checkup/",
     "author": "<a href=\"https://www.genioussonu.me/\">SK Sahinur Islam</a>",
@@ -10 +10 @@
     "tested": "7.1",
     "requires_php": "7.4",
-    "last_updated": "2026-10-21 08:25:08",
+    "last_updated": "2026-10-21 12:34:27",
     "upgrade_notice": "Recommended update for security audit improvements and bug fixes.",
     "sections": {
         "description": "<p>Complete security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.</p>",
         "installation": "<p>Upload the ZIP file through the WordPress admin (Plugins &rarr; Add New &rarr; Upload Plugin), or extract to <code>wp-content/plugins/genioussonu-site-checkup</code>.</p>",
-        "changelog": "<h4>1.3.3</h4>\n<ul>\n\t<li>Fix: Remote WordPress.org changelog scanning for security updates with strict semantic version parsing and zero false findings on local fixtures.</li>\n\t<li>Feature: Destructive action password confirmation setting toggle (default OFF) with full capability and nonce preservation.</li>\n\t<li>Feature: Seven honest task result states (Done &amp; Verified, Applied Not Verified, Needs Action, Needs Host or Manual, Informational, Not Applicable, Failed) with actionable plugin capability guidance on every task.</li>\n\t<li>Fix: Environment sensitivity for TLS probe and SPF/DMARC checks to mark local (.local, localhost) and non-HTTPS sites as Not Applicable.</li>\n\t<li>Fix: Guarded is_plugin_active calling context and established strict Level B guided status for 2FA and Child Theme Scaffolder.</li>\n\t<li>Fix: Synchronize slug and text domain to genioussonu-site-checkup and prefix to genisich/GENISICH_ across entire codebase.</li>\n\t<li>Security: In-memory atomic wp-config.php updates with zero disk backup persistence and local cryptographic salt generation.</li>\n\t<li>Privacy: Independent per-source opt-in consent controls defaulting to off for all external API lookups.</li>\n\t<li>Compliance: Convert child theme scaffolding to Level-B guided documentation flow without executable PHP generation.</li>\n</ul>\n\n<h4>1.3.2</h4>\n<ul>\n\t<li>Fix: Synchronized plugin text domain with WordPress.org review slug to eliminate TextDomainMismatch errors.</li>\n\t<li>Fix: Consolidated database query annotations to eliminate PHPCS DirectDatabaseQuery and NoCaching warnings.</li>\n\t<li>Fix: Replaced var_export debug function call with safe string escaping during security salt rotation.</li>\n\t<li>Fix: Removed redundant auto-update setting HTML filter to comply with WordPress.org update routines.</li>\n</ul>\n\n<h4>1.3.1</h4>\n<ul>\n\t<li>Fix: Parameterized and strictly escaped database table queries across migration readiness, DB health scanner, and task status lookup.</li>\n\t<li>Fix: Excluded internal agent and development markdown files (AGENTS.md, DEVELOPMENT.md, CONTRIBUTING.md, README.md, .agents/) from release packages.</li>\n\t<li>Hardening: Strengthened SQL query preparation and table validation matching strict injection-prevention guidelines.</li>\n</ul>\n\n<h4>1.3.0</h4>\n<ul>\n\t<li>Feature: Multi-Source Vulnerability Intelligence — Unified threat feed integrating GitHub Advisory Database (GHSA), Google OSV, NIST NVD, CISA Known Exploited Vulnerabilities (KEV), and WPScan with strict Guideline 7 consent toggles and HKDF-encrypted API keys.</li>\n\t<li>Feature: Compound Version-Range Correlation — Semver boundary parser (`&lt;`, `&lt;=`, `&gt;`, `&gt;=`, `=`, `x`, compound `,` / `AND`) mapping vulnerability ranges accurately to installed plugin/theme versions.</li>\n\t<li>Feature: 3-State Fix Verification — Verifies vulnerability remediations (`done`, `applied_unverified`, `not_applied`) through live HTTP header and file checks.</li>\n\t<li>Feature: External Fingerprint &amp; Information Disclosure Audit — Non-destructive loopback scanner probing for exposed backup dumps, sensitive files, and version leaks.</li>\n\t<li>Security: End-to-End Cryptographic Masking — HKDF-derived encryption at rest for all third-party API credentials with write-only REST submissions and masked getters.</li>\n</ul>\n\n<h4>1.2.0</h4>\n<ul>\n\t<li>Feature: REST API Security Auditor — Complete discovery and permission callback inspection of all registered REST endpoints across core, active plugins, and themes with risk scoring and source reflection.</li>\n\t<li>Feature: Environment Badge Tagging — Persistent, color-coded admin bar badge (Production/Red, Staging/Amber, Development/Gray) with smart heuristics and hostname safety guards.</li>\n\t<li>Feature: Developer Diagnostic Snapshot — Sanitized Markdown system report export for GitHub issues and tickets with strict secret/salt/password redaction.</li>\n\t<li>Feature: WP-Cron Health Auditor — Inspection of scheduled background tasks with overdue stalled event detection (&gt;600s late) and duplicate hook identification.</li>\n\t<li>Feature: Database Health Scanner &amp; Bloat Cleanup — Detection of orphaned postmeta, orphaned usermeta, expired transients, and excess revisions with protected Level-B cleanup gated by administrator re-authentication and recent backup validation.</li>\n\t<li>Feature: Migration Serialization Readiness — Bounded scanning for absolute site URLs embedded inside serialized PHP objects with actionable WP-CLI search-replace guidance.</li>\n\t<li>Feature: Weekly Changelog Digest — Automated aggregation of available plugin and theme updates with upgrade notice highlighting, scheduled weekly digest alerts, and manual inspection.</li>\n</ul>\n\n<h4>1.0.2</h4>\n<ul>\n\t<li>Fix: Resolve Run-button flicker and silent reversion on audit scanner tasks (File Permissions Audit, PHP Security Restrictions, Database Table Prefix, etc.) by ensuring all task response states (completed, unverified, findings-detected, failed) render explicit, visible UI states and appropriate action buttons.</li>\n\t<li>Fix: Restrict administrator password re-authentication exclusively to destructive, state-changing tasks (file modifications, plugin deletion, login URL renames, salt rotation, application password revocation) and exclude all read-only diagnostic scanners.</li>\n\t<li>Performance: Extend re-authentication token validity to a 30-minute trusted window after successful verification, eliminating repetitive password re-entry while retaining session binding and instant invalidation on logout or password change.</li>\n\t<li>UI: Retain updated task row visibility and add visual highlight animation upon manual scan execution during filtered status views.</li>\n</ul>\n\n<h4>1.0.1</h4>\n<ul>\n\t<li>Fix: Prevent syntax corruption in wp-config.php during security salt rotation by removing unescaped quotes/backreferences and using safe callback replacement.</li>\n\t<li>Fix: Ensure full excision of empty marker blocks and directive-aware verification in GENISICH_Htaccess_Manager.</li>\n\t<li>Fix: Ensure dbDelta schema updates run automatically on plugin version upgrades, not only on initial activation.</li>\n\t<li>Fix: Replace native browser confirm dialogs with accessible, branded custom modal dialogs.</li>\n\t<li>Fix: Enforce design tokens across entire admin stylesheet, eliminating hardcoded hex values.</li>\n\t<li>Fix: Resolve header case-sensitivity in loopback self-verification checks.</li>\n</ul>\n\n<h4>1.0.0</h4>\n<ul>\n\t<li>Initial release.</li>\n\t<li>Added Task Registry with complete SOP checklist items.</li>\n\t<li>Implemented client-driven sequential batch runner.</li>\n\t<li>Added .htaccess and wp-config.php marker managers with health checks and diff preview.</li>\n\t<li>Integrated baseline drift scanner for rogue admins and wp_options.</li>\n\t<li>Added Nginx server detection and snippet exporter.</li>\n\t<li>Integrated Patchstack vulnerability database API with match-confidence scoring.</li>\n\t<li>Added multi-protocol TLS probe (`TLSv1.0` - `TLSv1.3`) and certificate chain depth verification.</li>\n\t<li>Added strict file permissions auditing (640 for `wp-config.php`, 644 files, 755 directories).</li>\n\t<li>Added RFC 9116 `/.well-known/security.txt` generator with document root containment.</li>\n\t<li>Added informational SPF/DKIM/DMARC domain authentication checker.</li>\n\t<li>Added 12-month audit log retention and 15-day / 90-day / 6-month scheduler.</li>\n</ul>"
+        "changelog": "<h4>1.3.4</h4>\n<ul>\n\t<li>Docs: Optimize WordPress.org search visibility with natural keywords, verified search tags, and real-world FAQs.</li>\n\t<li>Docs: Update project portfolio landing page, comprehensive SOP task reference, and live verification.</li>\n</ul>\n\n<h4>1.3.3</h4>\n<ul>\n\t<li>Fix: Remote WordPress.org changelog scanning for security updates with strict semantic version parsing and zero false findings on local fixtures.</li>\n\t<li>Feature: Destructive action password confirmation setting toggle (default OFF) with full capability and nonce preservation.</li>\n\t<li>Feature: Seven honest task result states (Done &amp; Verified, Applied Not Verified, Needs Action, Needs Host or Manual, Informational, Not Applicable, Failed) with actionable plugin capability guidance on every task.</li>\n\t<li>Fix: Environment sensitivity for TLS probe and SPF/DMARC checks to mark local (.local, localhost) and non-HTTPS sites as Not Applicable.</li>\n\t<li>Fix: Guarded is_plugin_active calling context and established strict Level B guided status for 2FA and Child Theme Scaffolder.</li>\n\t<li>Fix: Synchronize slug and text domain to genioussonu-site-checkup and prefix to genisich/GENISICH_ across entire codebase.</li>\n\t<li>Security: In-memory atomic wp-config.php updates with zero disk backup persistence and local cryptographic salt generation.</li>\n\t<li>Privacy: Independent per-source opt-in consent controls defaulting to off for all external API lookups.</li>\n\t<li>Compliance: Convert child theme scaffolding to Level-B guided documentation flow without executable PHP generation.</li>\n</ul>\n\n<h4>1.3.2</h4>\n<ul>\n\t<li>Fix: Synchronized plugin text domain with WordPress.org review slug to eliminate TextDomainMismatch errors.</li>\n\t<li>Fix: Consolidated database query annotations to eliminate PHPCS DirectDatabaseQuery and NoCaching warnings.</li>\n\t<li>Fix: Replaced var_export debug function call with safe string escaping during security salt rotation.</li>\n\t<li>Fix: Removed redundant auto-update setting HTML filter to comply with WordPress.org update routines.</li>\n</ul>\n\n<h4>1.3.1</h4>\n<ul>\n\t<li>Fix: Parameterized and strictly escaped database table queries across migration readiness, DB health scanner, and task status lookup.</li>\n\t<li>Fix: Excluded internal agent and development markdown files (AGENTS.md, DEVELOPMENT.md, CONTRIBUTING.md, README.md, .agents/) from release packages.</li>\n\t<li>Hardening: Strengthened SQL query preparation and table validation matching strict injection-prevention guidelines.</li>\n</ul>\n\n<h4>1.3.0</h4>\n<ul>\n\t<li>Feature: Multi-Source Vulnerability Intelligence — Unified threat feed integrating GitHub Advisory Database (GHSA), Google OSV, NIST NVD, CISA Known Exploited Vulnerabilities (KEV), and WPScan with strict Guideline 7 consent toggles and HKDF-encrypted API keys.</li>\n\t<li>Feature: Compound Version-Range Correlation — Semver boundary parser (`&lt;`, `&lt;=`, `&gt;`, `&gt;=`, `=`, `x`, compound `,` / `AND`) mapping vulnerability ranges accurately to installed plugin/theme versions.</li>\n\t<li>Feature: 3-State Fix Verification — Verifies vulnerability remediations (`done`, `applied_unverified`, `not_applied`) through live HTTP header and file checks.</li>\n\t<li>Feature: External Fingerprint &amp; Information Disclosure Audit — Non-destructive loopback scanner probing for exposed backup dumps, sensitive files, and version leaks.</li>\n\t<li>Security: End-to-End Cryptographic Masking — HKDF-derived encryption at rest for all third-party API credentials with write-only REST submissions and masked getters.</li>\n</ul>\n\n<h4>1.2.0</h4>\n<ul>\n\t<li>Feature: REST API Security Auditor — Complete discovery and permission callback inspection of all registered REST endpoints across core, active plugins, and themes with risk scoring and source reflection.</li>\n\t<li>Feature: Environment Badge Tagging — Persistent, color-coded admin bar badge (Production/Red, Staging/Amber, Development/Gray) with smart heuristics and hostname safety guards.</li>\n\t<li>Feature: Developer Diagnostic Snapshot — Sanitized Markdown system report export for GitHub issues and tickets with strict secret/salt/password redaction.</li>\n\t<li>Feature: WP-Cron Health Auditor — Inspection of scheduled background tasks with overdue stalled event detection (&gt;600s late) and duplicate hook identification.</li>\n\t<li>Feature: Database Health Scanner &amp; Bloat Cleanup — Detection of orphaned postmeta, orphaned usermeta, expired transients, and excess revisions with protected Level-B cleanup gated by administrator re-authentication and recent backup validation.</li>\n\t<li>Feature: Migration Serialization Readiness — Bounded scanning for absolute site URLs embedded inside serialized PHP objects with actionable WP-CLI search-replace guidance.</li>\n\t<li>Feature: Weekly Changelog Digest — Automated aggregation of available plugin and theme updates with upgrade notice highlighting, scheduled weekly digest alerts, and manual inspection.</li>\n</ul>\n\n<h4>1.0.2</h4>\n<ul>\n\t<li>Fix: Resolve Run-button flicker and silent reversion on audit scanner tasks (File Permissions Audit, PHP Security Restrictions, Database Table Prefix, etc.) by ensuring all task response states (completed, unverified, findings-detected, failed) render explicit, visible UI states and appropriate action buttons.</li>\n\t<li>Fix: Restrict administrator password re-authentication exclusively to destructive, state-changing tasks (file modifications, plugin deletion, login URL renames, salt rotation, application password revocation) and exclude all read-only diagnostic scanners.</li>\n\t<li>Performance: Extend re-authentication token validity to a 30-minute trusted window after successful verification, eliminating repetitive password re-entry while retaining session binding and instant invalidation on logout or password change.</li>\n\t<li>UI: Retain updated task row visibility and add visual highlight animation upon manual scan execution during filtered status views.</li>\n</ul>\n\n<h4>1.0.1</h4>\n<ul>\n\t<li>Fix: Prevent syntax corruption in wp-config.php during security salt rotation by removing unescaped quotes/backreferences and using safe callback replacement.</li>\n\t<li>Fix: Ensure full excision of empty marker blocks and directive-aware verification in GENISICH_Htaccess_Manager.</li>\n\t<li>Fix: Ensure dbDelta schema updates run automatically on plugin version upgrades, not only on initial activation.</li>\n\t<li>Fix: Replace native browser confirm dialogs with accessible, branded custom modal dialogs.</li>\n\t<li>Fix: Enforce design tokens across entire admin stylesheet, eliminating hardcoded hex values.</li>\n\t<li>Fix: Resolve header case-sensitivity in loopback self-verification checks.</li>\n</ul>\n\n<h4>1.0.0</h4>\n<ul>\n\t<li>Initial release.</li>\n\t<li>Added Task Registry with complete SOP checklist items.</li>\n\t<li>Implemented client-driven sequential batch runner.</li>\n\t<li>Added .htaccess and wp-config.php marker managers with health checks and diff preview.</li>\n\t<li>Integrated baseline drift scanner for rogue admins and wp_options.</li>\n\t<li>Added Nginx server detection and snippet exporter.</li>\n\t<li>Integrated Patchstack vulnerability database API with match-confidence scoring.</li>\n\t<li>Added multi-protocol TLS probe (`TLSv1.0` - `TLSv1.3`) and certificate chain depth verification.</li>\n\t<li>Added strict file permissions auditing (640 for `wp-config.php`, 644 files, 755 directories).</li>\n\t<li>Added RFC 9116 `/.well-known/security.txt` generator with document root containment.</li>\n\t<li>Added informational SPF/DKIM/DMARC domain authentication checker.</li>\n\t<li>Added 12-month audit log retention and 15-day / 90-day / 6-month scheduler.</li>\n</ul>"
     },
     "icons": {

genioussonu-site-checkup/trunk/admin/assets/css/design-tokens.css

@@ -9 +9 @@
  *
  * @package GeniousSonu_Site_Checkup
- * @version 1.3.3
+ * @version 1.3.4
  */
 

genioussonu-site-checkup/trunk/genioussonu-site-checkup.php

@@ -4 +4 @@
  * Plugin URI:        https://www.genioussonu.me/plugin/genioussonu-site-checkup/
  * Description:       Complete security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.
- * Version:           1.3.3
+ * Version:           1.3.4
  * Requires at least: 5.8
  * Requires PHP:      7.4
@@ -26 +26 @@
 
 // Plugin Constants.
-define( 'GENISICH_VERSION', '1.3.3' );
+define( 'GENISICH_VERSION', '1.3.4' );
 define( 'GENISICH_PLUGIN_FILE', __FILE__ );
 define( 'GENISICH_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

genioussonu-site-checkup/trunk/readme.txt

@@ -4 +4 @@
 Author URI: https://www.genioussonu.me/
 Plugin URI: https://www.genioussonu.me/plugin/genioussonu-site-checkup/
-Tags: security, hardening, security audit, login security, firewall
+Tags: security, hardening, vulnerability scanner, audit, login security
 Requires at least: 5.8
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.3.3
+Stable tag: 1.3.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-Security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.
+Strengthen your WordPress security with an automated hardening checklist, vulnerability scanner, one-click safe fixes, and client audit reports.
 
 == Description ==
 
-**GeniousSonu Site Checkup** delivers professional **WordPress security** auditing and **site hardening** through an actionable, SOP-driven dashboard. Whether you need an instant **security checkup**, automated **hardening** for sensitive files and server headers, or a comprehensive **security audit** checklist across client installations, GeniousSonu Site Checkup organizes and executes your entire security workflow.
-
-Rather than competing with or replacing mature firewalls and backup tools, GeniousSonu Site Checkup audits your environment, detects vulnerabilities, and applies verified, reversible **hardening** fixes with zero bloat. Automate safe security tasks, guide complex configurations with seamless plugin bridges, track routine credential rotations, and generate print-ready executive client audit reports:
+Securing a WordPress site often means juggling complex server configurations, confusing checklist articles, and heavyweight security plugins that slow down your admin or break production sites without warning. When managing multiple client sites, knowing which hardening steps have been properly implemented—and proving it to stakeholders—is even harder.
+
+GeniousSonu Site Checkup solves this by giving you a clear, structured WordPress security hardening checklist paired with automated diagnostic scanners and safe, reversible fixes. Instead of guessing, you get an actionable SOP dashboard that audits your installation, previews every configuration change before applying it, and generates professional client-ready reports.
+
+Rather than competing with or replacing mature firewalls and backup tools, GeniousSonu Site Checkup audits your environment, detects vulnerabilities, and applies verified, reversible hardening fixes with zero bloat. Automate safe security tasks, guide complex configurations with seamless plugin bridges, track routine credential rotations, and generate print-ready executive client audit reports:
 
 * **Level A (Safe Automation & Scanners):** Disable XML-RPC, restrict unauthenticated REST user enumeration, hide PHP versions, enforce clickjacking protection (X-Frame-Options), MIME sniffing protection, HSTS, disable front-end `WP_DEBUG_DISPLAY`, audit file permissions (strict 640 baseline on `wp-config.php`), detect risky PHP `disable_functions` / `open_basedir`, check default `wp_` database prefix, external fingerprint scanner, and probe TLS protocols (`TLSv1.0` through `TLSv1.3`) and certificate chain depth.
@@ -108 +110 @@
 == Frequently Asked Questions ==
 
+= Does it replace a firewall? =
+No. GeniousSonu Site Checkup is designed to complement existing web application firewalls (like Cloudflare, Wordfence, or server-level WAFs), not replace them. While firewalls inspect live traffic and block malicious requests in real time, GeniousSonu Site Checkup focuses on site hardening, vulnerability auditing, configuration hygiene, and reducing your site's attack surface so attacks cannot succeed in the first place.
+
+= What does it change on my server? =
+The plugin only modifies configuration files if you explicitly choose to apply a safe fix. When enabled, it writes clearly marked blocks to your `.htaccess` (on Apache/LiteSpeed) or `wp-config.php` (such as disabling file editing or hiding XML-RPC). It never alters WordPress core files, and on Nginx servers, it never writes blind rewrite rules—instead, it displays copyable Nginx directives for your server block.
+
+= How do I undo a change? =
+Every automated fix can be toggled off directly from the Site Checkup dashboard with a single click. The plugin strictly uses isolated, marker-delimited blocks (e.g., `# BEGIN GeniousSonu Site Checkup`), allowing it to cleanly remove its rules without disturbing existing directives. You can also preview the exact diff before any change is written or removed.
+
 = What happens if my server runs Nginx instead of Apache? =
 GeniousSonu Site Checkup detects Nginx server software (`$_SERVER['SERVER_SOFTWARE']`). Tasks that rely on `.htaccess` are marked as "Not Applicable on this Server" and feature a "View Nginx Snippet" button with 1-click copy for your server configuration.
@@ -130 +141 @@
 
 == Changelog ==
+
+= 1.3.4 =
+* Docs: Optimize WordPress.org search visibility with natural keywords, verified search tags, and real-world FAQs.
+* Docs: Update project portfolio landing page, comprehensive SOP task reference, and live verification.
 
 = 1.3.3 =

genioussonu-site-checkup/trunk/update-info.json

@@ -2 +2 @@
     "name": "GeniousSonu Site Checkup",
     "slug": "genioussonu-site-checkup",
-    "version": "1.3.3",
-    "download_url": "https://github.com/GeniousSonu/Site-Checkup-Pro/releases/download/v1.3.3/genioussonu-site-checkup-selfhosted.zip",
+    "version": "1.3.4",
+    "download_url": "https://github.com/GeniousSonu/Site-Checkup-Pro/releases/download/v1.3.4/genioussonu-site-checkup-selfhosted.zip",
     "homepage": "https://www.genioussonu.me/plugin/genioussonu-site-checkup/",
     "author": "<a href=\"https://www.genioussonu.me/\">SK Sahinur Islam</a>",
@@ -10 +10 @@
     "tested": "7.1",
     "requires_php": "7.4",
-    "last_updated": "2026-10-21 08:25:08",
+    "last_updated": "2026-10-21 12:34:27",
     "upgrade_notice": "Recommended update for security audit improvements and bug fixes.",
     "sections": {
         "description": "<p>Complete security audit, site hardening checklist, and vulnerability scanner for WordPress. One-click safe hardening, login protection, and client reports.</p>",
         "installation": "<p>Upload the ZIP file through the WordPress admin (Plugins &rarr; Add New &rarr; Upload Plugin), or extract to <code>wp-content/plugins/genioussonu-site-checkup</code>.</p>",
-        "changelog": "<h4>1.3.3</h4>\n<ul>\n\t<li>Fix: Remote WordPress.org changelog scanning for security updates with strict semantic version parsing and zero false findings on local fixtures.</li>\n\t<li>Feature: Destructive action password confirmation setting toggle (default OFF) with full capability and nonce preservation.</li>\n\t<li>Feature: Seven honest task result states (Done &amp; Verified, Applied Not Verified, Needs Action, Needs Host or Manual, Informational, Not Applicable, Failed) with actionable plugin capability guidance on every task.</li>\n\t<li>Fix: Environment sensitivity for TLS probe and SPF/DMARC checks to mark local (.local, localhost) and non-HTTPS sites as Not Applicable.</li>\n\t<li>Fix: Guarded is_plugin_active calling context and established strict Level B guided status for 2FA and Child Theme Scaffolder.</li>\n\t<li>Fix: Synchronize slug and text domain to genioussonu-site-checkup and prefix to genisich/GENISICH_ across entire codebase.</li>\n\t<li>Security: In-memory atomic wp-config.php updates with zero disk backup persistence and local cryptographic salt generation.</li>\n\t<li>Privacy: Independent per-source opt-in consent controls defaulting to off for all external API lookups.</li>\n\t<li>Compliance: Convert child theme scaffolding to Level-B guided documentation flow without executable PHP generation.</li>\n</ul>\n\n<h4>1.3.2</h4>\n<ul>\n\t<li>Fix: Synchronized plugin text domain with WordPress.org review slug to eliminate TextDomainMismatch errors.</li>\n\t<li>Fix: Consolidated database query annotations to eliminate PHPCS DirectDatabaseQuery and NoCaching warnings.</li>\n\t<li>Fix: Replaced var_export debug function call with safe string escaping during security salt rotation.</li>\n\t<li>Fix: Removed redundant auto-update setting HTML filter to comply with WordPress.org update routines.</li>\n</ul>\n\n<h4>1.3.1</h4>\n<ul>\n\t<li>Fix: Parameterized and strictly escaped database table queries across migration readiness, DB health scanner, and task status lookup.</li>\n\t<li>Fix: Excluded internal agent and development markdown files (AGENTS.md, DEVELOPMENT.md, CONTRIBUTING.md, README.md, .agents/) from release packages.</li>\n\t<li>Hardening: Strengthened SQL query preparation and table validation matching strict injection-prevention guidelines.</li>\n</ul>\n\n<h4>1.3.0</h4>\n<ul>\n\t<li>Feature: Multi-Source Vulnerability Intelligence — Unified threat feed integrating GitHub Advisory Database (GHSA), Google OSV, NIST NVD, CISA Known Exploited Vulnerabilities (KEV), and WPScan with strict Guideline 7 consent toggles and HKDF-encrypted API keys.</li>\n\t<li>Feature: Compound Version-Range Correlation — Semver boundary parser (`&lt;`, `&lt;=`, `&gt;`, `&gt;=`, `=`, `x`, compound `,` / `AND`) mapping vulnerability ranges accurately to installed plugin/theme versions.</li>\n\t<li>Feature: 3-State Fix Verification — Verifies vulnerability remediations (`done`, `applied_unverified`, `not_applied`) through live HTTP header and file checks.</li>\n\t<li>Feature: External Fingerprint &amp; Information Disclosure Audit — Non-destructive loopback scanner probing for exposed backup dumps, sensitive files, and version leaks.</li>\n\t<li>Security: End-to-End Cryptographic Masking — HKDF-derived encryption at rest for all third-party API credentials with write-only REST submissions and masked getters.</li>\n</ul>\n\n<h4>1.2.0</h4>\n<ul>\n\t<li>Feature: REST API Security Auditor — Complete discovery and permission callback inspection of all registered REST endpoints across core, active plugins, and themes with risk scoring and source reflection.</li>\n\t<li>Feature: Environment Badge Tagging — Persistent, color-coded admin bar badge (Production/Red, Staging/Amber, Development/Gray) with smart heuristics and hostname safety guards.</li>\n\t<li>Feature: Developer Diagnostic Snapshot — Sanitized Markdown system report export for GitHub issues and tickets with strict secret/salt/password redaction.</li>\n\t<li>Feature: WP-Cron Health Auditor — Inspection of scheduled background tasks with overdue stalled event detection (&gt;600s late) and duplicate hook identification.</li>\n\t<li>Feature: Database Health Scanner &amp; Bloat Cleanup — Detection of orphaned postmeta, orphaned usermeta, expired transients, and excess revisions with protected Level-B cleanup gated by administrator re-authentication and recent backup validation.</li>\n\t<li>Feature: Migration Serialization Readiness — Bounded scanning for absolute site URLs embedded inside serialized PHP objects with actionable WP-CLI search-replace guidance.</li>\n\t<li>Feature: Weekly Changelog Digest — Automated aggregation of available plugin and theme updates with upgrade notice highlighting, scheduled weekly digest alerts, and manual inspection.</li>\n</ul>\n\n<h4>1.0.2</h4>\n<ul>\n\t<li>Fix: Resolve Run-button flicker and silent reversion on audit scanner tasks (File Permissions Audit, PHP Security Restrictions, Database Table Prefix, etc.) by ensuring all task response states (completed, unverified, findings-detected, failed) render explicit, visible UI states and appropriate action buttons.</li>\n\t<li>Fix: Restrict administrator password re-authentication exclusively to destructive, state-changing tasks (file modifications, plugin deletion, login URL renames, salt rotation, application password revocation) and exclude all read-only diagnostic scanners.</li>\n\t<li>Performance: Extend re-authentication token validity to a 30-minute trusted window after successful verification, eliminating repetitive password re-entry while retaining session binding and instant invalidation on logout or password change.</li>\n\t<li>UI: Retain updated task row visibility and add visual highlight animation upon manual scan execution during filtered status views.</li>\n</ul>\n\n<h4>1.0.1</h4>\n<ul>\n\t<li>Fix: Prevent syntax corruption in wp-config.php during security salt rotation by removing unescaped quotes/backreferences and using safe callback replacement.</li>\n\t<li>Fix: Ensure full excision of empty marker blocks and directive-aware verification in GENISICH_Htaccess_Manager.</li>\n\t<li>Fix: Ensure dbDelta schema updates run automatically on plugin version upgrades, not only on initial activation.</li>\n\t<li>Fix: Replace native browser confirm dialogs with accessible, branded custom modal dialogs.</li>\n\t<li>Fix: Enforce design tokens across entire admin stylesheet, eliminating hardcoded hex values.</li>\n\t<li>Fix: Resolve header case-sensitivity in loopback self-verification checks.</li>\n</ul>\n\n<h4>1.0.0</h4>\n<ul>\n\t<li>Initial release.</li>\n\t<li>Added Task Registry with complete SOP checklist items.</li>\n\t<li>Implemented client-driven sequential batch runner.</li>\n\t<li>Added .htaccess and wp-config.php marker managers with health checks and diff preview.</li>\n\t<li>Integrated baseline drift scanner for rogue admins and wp_options.</li>\n\t<li>Added Nginx server detection and snippet exporter.</li>\n\t<li>Integrated Patchstack vulnerability database API with match-confidence scoring.</li>\n\t<li>Added multi-protocol TLS probe (`TLSv1.0` - `TLSv1.3`) and certificate chain depth verification.</li>\n\t<li>Added strict file permissions auditing (640 for `wp-config.php`, 644 files, 755 directories).</li>\n\t<li>Added RFC 9116 `/.well-known/security.txt` generator with document root containment.</li>\n\t<li>Added informational SPF/DKIM/DMARC domain authentication checker.</li>\n\t<li>Added 12-month audit log retention and 15-day / 90-day / 6-month scheduler.</li>\n</ul>"
+        "changelog": "<h4>1.3.4</h4>\n<ul>\n\t<li>Docs: Optimize WordPress.org search visibility with natural keywords, verified search tags, and real-world FAQs.</li>\n\t<li>Docs: Update project portfolio landing page, comprehensive SOP task reference, and live verification.</li>\n</ul>\n\n<h4>1.3.3</h4>\n<ul>\n\t<li>Fix: Remote WordPress.org changelog scanning for security updates with strict semantic version parsing and zero false findings on local fixtures.</li>\n\t<li>Feature: Destructive action password confirmation setting toggle (default OFF) with full capability and nonce preservation.</li>\n\t<li>Feature: Seven honest task result states (Done &amp; Verified, Applied Not Verified, Needs Action, Needs Host or Manual, Informational, Not Applicable, Failed) with actionable plugin capability guidance on every task.</li>\n\t<li>Fix: Environment sensitivity for TLS probe and SPF/DMARC checks to mark local (.local, localhost) and non-HTTPS sites as Not Applicable.</li>\n\t<li>Fix: Guarded is_plugin_active calling context and established strict Level B guided status for 2FA and Child Theme Scaffolder.</li>\n\t<li>Fix: Synchronize slug and text domain to genioussonu-site-checkup and prefix to genisich/GENISICH_ across entire codebase.</li>\n\t<li>Security: In-memory atomic wp-config.php updates with zero disk backup persistence and local cryptographic salt generation.</li>\n\t<li>Privacy: Independent per-source opt-in consent controls defaulting to off for all external API lookups.</li>\n\t<li>Compliance: Convert child theme scaffolding to Level-B guided documentation flow without executable PHP generation.</li>\n</ul>\n\n<h4>1.3.2</h4>\n<ul>\n\t<li>Fix: Synchronized plugin text domain with WordPress.org review slug to eliminate TextDomainMismatch errors.</li>\n\t<li>Fix: Consolidated database query annotations to eliminate PHPCS DirectDatabaseQuery and NoCaching warnings.</li>\n\t<li>Fix: Replaced var_export debug function call with safe string escaping during security salt rotation.</li>\n\t<li>Fix: Removed redundant auto-update setting HTML filter to comply with WordPress.org update routines.</li>\n</ul>\n\n<h4>1.3.1</h4>\n<ul>\n\t<li>Fix: Parameterized and strictly escaped database table queries across migration readiness, DB health scanner, and task status lookup.</li>\n\t<li>Fix: Excluded internal agent and development markdown files (AGENTS.md, DEVELOPMENT.md, CONTRIBUTING.md, README.md, .agents/) from release packages.</li>\n\t<li>Hardening: Strengthened SQL query preparation and table validation matching strict injection-prevention guidelines.</li>\n</ul>\n\n<h4>1.3.0</h4>\n<ul>\n\t<li>Feature: Multi-Source Vulnerability Intelligence — Unified threat feed integrating GitHub Advisory Database (GHSA), Google OSV, NIST NVD, CISA Known Exploited Vulnerabilities (KEV), and WPScan with strict Guideline 7 consent toggles and HKDF-encrypted API keys.</li>\n\t<li>Feature: Compound Version-Range Correlation — Semver boundary parser (`&lt;`, `&lt;=`, `&gt;`, `&gt;=`, `=`, `x`, compound `,` / `AND`) mapping vulnerability ranges accurately to installed plugin/theme versions.</li>\n\t<li>Feature: 3-State Fix Verification — Verifies vulnerability remediations (`done`, `applied_unverified`, `not_applied`) through live HTTP header and file checks.</li>\n\t<li>Feature: External Fingerprint &amp; Information Disclosure Audit — Non-destructive loopback scanner probing for exposed backup dumps, sensitive files, and version leaks.</li>\n\t<li>Security: End-to-End Cryptographic Masking — HKDF-derived encryption at rest for all third-party API credentials with write-only REST submissions and masked getters.</li>\n</ul>\n\n<h4>1.2.0</h4>\n<ul>\n\t<li>Feature: REST API Security Auditor — Complete discovery and permission callback inspection of all registered REST endpoints across core, active plugins, and themes with risk scoring and source reflection.</li>\n\t<li>Feature: Environment Badge Tagging — Persistent, color-coded admin bar badge (Production/Red, Staging/Amber, Development/Gray) with smart heuristics and hostname safety guards.</li>\n\t<li>Feature: Developer Diagnostic Snapshot — Sanitized Markdown system report export for GitHub issues and tickets with strict secret/salt/password redaction.</li>\n\t<li>Feature: WP-Cron Health Auditor — Inspection of scheduled background tasks with overdue stalled event detection (&gt;600s late) and duplicate hook identification.</li>\n\t<li>Feature: Database Health Scanner &amp; Bloat Cleanup — Detection of orphaned postmeta, orphaned usermeta, expired transients, and excess revisions with protected Level-B cleanup gated by administrator re-authentication and recent backup validation.</li>\n\t<li>Feature: Migration Serialization Readiness — Bounded scanning for absolute site URLs embedded inside serialized PHP objects with actionable WP-CLI search-replace guidance.</li>\n\t<li>Feature: Weekly Changelog Digest — Automated aggregation of available plugin and theme updates with upgrade notice highlighting, scheduled weekly digest alerts, and manual inspection.</li>\n</ul>\n\n<h4>1.0.2</h4>\n<ul>\n\t<li>Fix: Resolve Run-button flicker and silent reversion on audit scanner tasks (File Permissions Audit, PHP Security Restrictions, Database Table Prefix, etc.) by ensuring all task response states (completed, unverified, findings-detected, failed) render explicit, visible UI states and appropriate action buttons.</li>\n\t<li>Fix: Restrict administrator password re-authentication exclusively to destructive, state-changing tasks (file modifications, plugin deletion, login URL renames, salt rotation, application password revocation) and exclude all read-only diagnostic scanners.</li>\n\t<li>Performance: Extend re-authentication token validity to a 30-minute trusted window after successful verification, eliminating repetitive password re-entry while retaining session binding and instant invalidation on logout or password change.</li>\n\t<li>UI: Retain updated task row visibility and add visual highlight animation upon manual scan execution during filtered status views.</li>\n</ul>\n\n<h4>1.0.1</h4>\n<ul>\n\t<li>Fix: Prevent syntax corruption in wp-config.php during security salt rotation by removing unescaped quotes/backreferences and using safe callback replacement.</li>\n\t<li>Fix: Ensure full excision of empty marker blocks and directive-aware verification in GENISICH_Htaccess_Manager.</li>\n\t<li>Fix: Ensure dbDelta schema updates run automatically on plugin version upgrades, not only on initial activation.</li>\n\t<li>Fix: Replace native browser confirm dialogs with accessible, branded custom modal dialogs.</li>\n\t<li>Fix: Enforce design tokens across entire admin stylesheet, eliminating hardcoded hex values.</li>\n\t<li>Fix: Resolve header case-sensitivity in loopback self-verification checks.</li>\n</ul>\n\n<h4>1.0.0</h4>\n<ul>\n\t<li>Initial release.</li>\n\t<li>Added Task Registry with complete SOP checklist items.</li>\n\t<li>Implemented client-driven sequential batch runner.</li>\n\t<li>Added .htaccess and wp-config.php marker managers with health checks and diff preview.</li>\n\t<li>Integrated baseline drift scanner for rogue admins and wp_options.</li>\n\t<li>Added Nginx server detection and snippet exporter.</li>\n\t<li>Integrated Patchstack vulnerability database API with match-confidence scoring.</li>\n\t<li>Added multi-protocol TLS probe (`TLSv1.0` - `TLSv1.3`) and certificate chain depth verification.</li>\n\t<li>Added strict file permissions auditing (640 for `wp-config.php`, 644 files, 755 directories).</li>\n\t<li>Added RFC 9116 `/.well-known/security.txt` generator with document root containment.</li>\n\t<li>Added informational SPF/DKIM/DMARC domain authentication checker.</li>\n\t<li>Added 12-month audit log retention and 15-day / 90-day / 6-month scheduler.</li>\n</ul>"
     },
     "icons": {