Changeset 3764759

cyberpulse/trunk/assets/js/cyberpulse-403.js

-              r3757045
+              r3764759
  * CyberPulse — 403 block page script.
+ *
  * Handles the human-verification form on the block page: submits the
  * math answer together with the signed token, and reacts to success,
  * server-side failure, and network failure.
+ * Handles both:
+ * 1. Static Apache page (localization only).
+ * 2. Dynamic PHP page (human-verification form).
+ *
  * @package CyberPulse
 …
     'use strict';
+    // ==================== HUMAN VERIFICATION ====================
+    // ==================== STATIC PAGE LOCALIZATION ====================
+    // This runs ONLY on the static cyberpulse-403.html page.
+    (function initStaticLocalization() {
+        var titleEl = document.getElementById("cp-403-title");
+        if (!titleEl) return; // Not on the static page, exit.
+    /**
+     * Validates the answer locally (non-empty only) and submits it to
+     * the cybersec_human_verify AJAX endpoint.
+     *
+     * The actual math check is intentionally NOT performed client-side —
+     * the server compares the submitted value against the expected
+     * answer stored in a transient. This prevents an attacker from
+     * reading the correct value out of the page source.
+     *
+     * UI states:
+     *   - success:   shows a checkmark, redirects after 1.5s
+     *   - bad answer / server error: shows the returned message and
+     *     a refresh link, re-enables the form, clears the input
+     *   - network error: shows the connection error and a refresh link,
+     *     re-enables the form
+     */
+        var lang = (navigator.language || navigator.userLanguage || 'en').slice(0, 2).toLowerCase();
+        var translations = {
+            "ru": { title: "Доступ запрещен", desc: "Ваш запрос был заблокирован системой безопасности сервера.", btn: "Обновить страницу" },
+            "de": { title: "Zugriff verweigert", desc: "Ihre Anfrage wurde vom Sicherheitssystem des Servers blockiert.", btn: "Seite neu laden" },
+            "fr": { title: "Accès refusé", desc: "Votre demande a été bloquée par le système de sécurité du serveur.", btn: "Actualiser la page" },
+            "es": { title: "Acceso denegado", desc: "Su solicitud fue bloqueada por el sistema de seguridad del servidor.", btn: "Actualizar página" },
+            "it": { title: "Accesso negato", desc: "La tua richiesta è stata bloccata dal sistema di sicurezza del server.", btn: "Aggiorna pagina" },
+            "pt": { title: "Acesso negado", desc: "Sua solicitação foi bloqueada pelo sistema de segurança do servidor.", btn: "Atualizar página" },
+            "zh": { title: "拒绝访问", desc: "您的请求已被服务器安全系统拦截。", btn: "刷新页面" },
+            "ja": { title: "アクセス拒否", desc: "リクエストはサーバーのセキュリティシステムによってブロックされました。", btn: "ページを更新" },
+            "ko": { title: "액세스 거부됨", desc: "귀하의 요청이 서버 보안 시스템에 의해 차단되었습니다.", btn: "페이지 새로고침" }
+        };
+        if (translations[lang]) {
+            var descEl = document.getElementById("cp-403-desc");
+            var btnEl = document.getElementById("cp-403-btn");
+            titleEl.innerText = "403 " + translations[lang].title;
+            if (descEl) descEl.innerText = translations[lang].desc;
+            if (btnEl) btnEl.innerText = translations[lang].btn;
+        }
+    })();
+    // ==================== DYNAMIC PAGE HUMAN VERIFICATION ====================
+    // This runs ONLY on the PHP-generated page where cybersec403Data exists.
     function verifyHuman() {
+        // Safety check: if PHP data is missing, do nothing.
+        if (typeof cybersec403Data === 'undefined') return;
         var answerInput = document.getElementById('sw-human-answer');
         var errorDiv = document.getElementById('sw-test-error');
 …
+        }
                 var answer = answerInput.value;
+        var answer = answerInput.value;
         if (!answer) {
 …
+        }
-        // Client-side math check removed — server validates the answer
-        // against the transient-stored expected value.
         errorDiv.style.display = 'none';
         verifyBtn.disabled = true;
 …
+    }
+    // ==================== INITIALIZATION ====================
+    /**
+     * Wires up the verification form once the DOM is ready:
+     * Enter-to-submit, click-to-submit, and auto-focus on the input.
+     */
+    // ==================== DYNAMIC PAGE INITIALIZATION ====================
     document.addEventListener('DOMContentLoaded', function() {
         var answerInput = document.getElementById('sw-human-answer');
         var verifyBtn = document.getElementById('sw-verify-btn');
+        if (answerInput) {
+            answerInput.addEventListener('keypress', function(e) {
+                if (e.key === 'Enter') {
+                    verifyHuman();
+                }
+            });
+        }
+        // If these elements don't exist, we are on the static page. Skip.
+        if (!answerInput || !verifyBtn) return;
+        if (verifyBtn) {
+            verifyBtn.addEventListener('click', verifyHuman);
+        }
+        answerInput.addEventListener('keypress', function(e) {
+            if (e.key === 'Enter') {
+                verifyHuman();
+            }
+        });
+        // Auto-focus the input field
+        if (answerInput) {
+            setTimeout(function() {
+                answerInput.focus();
+            }, 100);
+        }
+        verifyBtn.addEventListener('click', verifyHuman);
+        setTimeout(function() {
+            answerInput.focus();
+        }, 100);
     });

cyberpulse/trunk/cyberpulse-core.php

-              r3763154
+              r3764759
 define('CYBERSEC_PERMANENT_BLOCKED_SUBNETS', 'secwall_permanent_blocked_subnets');
 define('CYBERSEC_UA_BLOCKS_OPTION', 'secwall_blocked_user_agents');
 define('CYBERSEC_VERSION', '5.9.1.2');
+define('CYBERSEC_VERSION', '5.9.1.3');
 if (!file_exists(CYBERSEC_LOG_DIR)) {
 …
         'force_secure_cookies' => 1,
         'rate_limiting_enabled' => 1,
         'rate_limit_requests' => 60,
+        'rate_limit_requests' => 40,
         'rate_limit_window' => 60,
         'rest_api_protection' => 1,
 …
         'ai_training_block_enabled' => 1,
         'ai_search_block_enabled'   => 0,
+        'force_https' => 0,
     );
 …
+    }
+    // Chrome < 90.
+    // Exceptions: real browsers (Yandex, Opera, Edge, etc.) that also carry Chrome/<ver> token.
+    if ($chrome_ver > 0 && $chrome_ver < 90) {
+        $real_old_browsers = array('YaBrowser', 'OPR/', 'Edg/', 'SamsungBrowser', 'Brave', 'Vivaldi', 'CriOS', 'FxiOS', 'OPiOS');
+        $is_real = false;
+        foreach ($real_old_browsers as $b) {
+            if (stripos($ua, $b) !== false) { $is_real = true; break; }
+        }
+        // Do not block if it's a real browser or actual old mobile device
+        if (!$is_real && stripos($ua, 'Mobile') === false && stripos($ua, 'Android') === false) {
+            return true;
+        }
+    }
     if ($chrome_ver > 0 && stripos($ua, 'Macintosh') !== false) {
     if ($chrome_ver >= 76
         && (empty($_SERVER['HTTP_SEC_FETCH_SITE']) || empty($_SERVER['HTTP_SEC_FETCH_MODE']))) {
         return true;
+    }
     if ($chrome_ver >= 76 && !cybersec_looks_like_real_chrome()) {
         return true;
+    }
+}
+        if ($chrome_ver >= 76
+            && (empty($_SERVER['HTTP_SEC_FETCH_SITE']) || empty($_SERVER['HTTP_SEC_FETCH_MODE']))) {
+            return true;
+        }
+        if ($chrome_ver >= 76 && !cybersec_looks_like_real_chrome()) {
+            return true;
+        }
+    }
     if ($chrome_ver >= 76
 …
     && stripos($ua, 'Android') === false
     && !cybersec_looks_like_real_chrome()) {
     return true;
+}
+        return true;
+    }
     // Internal consistency
 …
             if (stripos($ua, 'Edg/') !== false) return true;
+        }
+        // Firefox < 90.
+        if ($ff_ver < 90) {
+            $real_ff = array('Waterfox', 'PaleMoon', 'SeaMonkey', 'Iceweasel');
+            $is_real_ff = false;
+            foreach ($real_ff as $r) {
+                if (stripos($ua, $r) !== false) { $is_real_ff = true; break; }
+            }
+            // Exclude actual old mobile devices
+            if (!$is_real_ff && !$is_fxios && stripos($ua, 'Mobile') === false && stripos($ua, 'Android') === false) {
+                return true;
+            }
+        }
+    }
 …
             $ver = (int)$vm[1];
             if ($ver > 100) {
+                return true;
+            }
+            // Safari Version < 14 = bot.
+            // Exclude mobile devices (old iPhones/iPads cannot update).
+            if ($ver < 14 && stripos($ua, 'Mobile') === false && stripos($ua, 'iPad') === false) {
                 return true;
+            }
 …
+    }
         // Known botnet fingerprints — exact old Chrome builds
+    // Known botnet fingerprints — exact old Chrome builds
     // (identical UA from multiple countries within minutes = scraper farm)
     $botnet_fingerprints = array(
 …
+    }
     // v5.9.0.10: Opera Presto (defunct since 2013) — any "Presto/" marker is a bot
+    // Opera Presto
     if (stripos($ua, 'Presto/') !== false) {
         return true;
+    }
     // v5.9.0.10: Windows CE — EOL since 2013, no real users exist
+    // Windows CE
     if (stripos($ua, 'Windows CE') !== false) {
         return true;
 …
     if (preg_match('/Windows NT (6\.1|6\.3)/', $ua)
     && $chrome_ver > 0
     && $chrome_ver < 110
     && !cybersec_looks_like_real_chrome()) {
     return true;
+}
+        && $chrome_ver > 0
+        && $chrome_ver < 110
+        && !cybersec_looks_like_real_chrome()) {
+        return true;
+    }
     // AI bots — block before any whitelist
 …
     // Tool & script detection
     $tool_patterns = array(
     'libwww-perl','curl/','wget/','Go-http-client','Java/',
     'Apache-HttpClient','zgrab','masscan','nmap','sqlmap','nikto','nessus',
     'HeadlessChrome','PhantomJS','Selenium','puppeteer',
     'keys-so-bot','SERankingBacklinksBot','scrapy',
     'BacklinksExtendedBot','AffsignalCrawler','SeopultContentAnalyzer','Photon/',
     'python-requests','python-urllib','python-httpx',
     'node-fetch','axios/','okhttp/',
     'Faraday/','Rest-Client','Typhoeus','Excon/',
 );
+        'libwww-perl','curl/','wget/','Go-http-client','Java/',
+        'Apache-HttpClient','zgrab','masscan','nmap','sqlmap','nikto','nessus',
+        'HeadlessChrome','PhantomJS','Selenium','puppeteer',
+        'keys-so-bot','SERankingBacklinksBot','scrapy',
+        'BacklinksExtendedBot','AffsignalCrawler','SeopultContentAnalyzer','Photon/',
+        'python-requests','python-urllib','python-httpx',
+        'node-fetch','axios/','okhttp/',
+        'Faraday/','Rest-Client','Typhoeus','Excon/',
+    );
     foreach ($tool_patterns as $tool) {
         if (stripos($ua, $tool) !== false) return true;
 …
             if (preg_match('/(Windows NT|Macintosh|X11; Linux|x86_64|Intel Mac OS X)/', $ua)) return false;
             return true;
+        }
+    }
-    // Old Firefox (except known forks)
-    if (preg_match('/Firefox\/(\d+)\./', $ua, $m)) {
-        $fv = (int)$m[1];
-        if ($fv < 60) {
-            $real_ff = array('Waterfox', 'PaleMoon', 'SeaMonkey', 'Iceweasel');
-            $is_real = false;
-            foreach ($real_ff as $r) {
-                if (stripos($ua, $r) !== false) { $is_real = true; break; }
+            }
-            if (!$is_real) return true;
+        }
+    }
 …
     if(is_admin()||wp_doing_ajax()||wp_doing_cron()) return;
     if(defined('REST_REQUEST')&&REST_REQUEST) return;
+    $early_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
+    if (preg_match('#^/(ads\.txt|app-ads\.txt|robots\.txt|favicon\.ico|sellers\.json|security\.txt)(\?|$)#i', $early_uri)) {
+        return;
+    }
+    if (strpos($early_uri, '/.well-known/') === 0) {
+        return;
+    }
     $early_ip = cybersec_get_visitor_ip();
 …
                 if (preg_match($bad_re, $ua_check)) {
                     cybersec_increment_stat('blocked');
                     cybersec_ban_and_log($ip_early, 'Static file via bot UA: ' . $bad_re, true);
+                    cybersec_ban_and_log($ip_early, cybersec_translate('Static file via bot UA') . ': ' . $bad_re, true);
                     cybersec_show_block_page($ip_early, cybersec_translate('Access denied.'));
                     exit;
 …
 add_action('init', 'cybersec_force_secure_cookies', 1);
+// ==================== FORCE HTTPS REDIRECT ====================
+/**
+ * Redirects non-HTTPS requests to HTTPS with a 301.
+ *
+ * Trusts X-Forwarded-Proto: https so the redirect does not loop when
+ * the site sits behind a TLS-terminating reverse proxy — is_ssl()
+ * returns false in that case even though the client connected over
+ * HTTPS. Fires on init priority 1, after brute-force check (0) and
+ * alongside other early security hooks.
+ *
+ * Disabled by default. Enable only after confirming the SSL cert
+ * covers the site's canonical domain (and www. alias, if used).
+ */
+function cybersec_force_https() {
+    $s = cybersec_get_settings();
+    if (empty($s['force_https'])) return;
+    if (is_ssl()) return;
+    if (wp_doing_ajax() || wp_doing_cron() || (defined('WP_CLI') && WP_CLI)) return;
+    if (defined('REST_REQUEST') && REST_REQUEST) return;
+    $fwd_proto = isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
+        ? strtolower(sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_PROTO'])))
+        : '';
+    if ($fwd_proto === 'https') return;
+    $host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '';
+    $uri  = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
+    if (empty($host)) return;
+    wp_safe_redirect('https://' . $host . $uri, 301);
+    exit;
+}
+add_action('init', 'cybersec_force_https', 1);
 /**
  * Global rate limiter. Tracks requests per IP in the configured window
 …
     if(get_option(CYBERSEC_PAGES_OPTION)===false) update_option(CYBERSEC_PAGES_OPTION,array(home_url()));
     if(get_option(CYBERSEC_BOT_OPTIONS)===false) update_option(CYBERSEC_BOT_OPTIONS,cybersec_get_default_bot_options());
     if(get_option(CYBERSEC_SETTINGS_OPTION)===false) { $default_settings = cybersec_get_settings(); $recommended = array('auto_unblock_minutes'=>30,'alert_threshold'=>20,'alert_minutes'=>5,'brute_max_attempts'=>5,'brute_window_minutes'=>15,'rate_limit_requests'=>60,'rate_limit_window'=>60,'max_revisions'=>5,'auto_clean_logs_days'=>30,'referer_history_threshold'=>1,'referer_rate_1min'=>5,'referer_rate_5min'=>10,'referer_same_page'=>3,'referer_no_proxy_rate'=>3); $default_settings = array_merge($default_settings, $recommended); update_option(CYBERSEC_SETTINGS_OPTION, $default_settings); }
+    if(get_option(CYBERSEC_SETTINGS_OPTION)===false) { $default_settings = cybersec_get_settings(); $recommended = array('auto_unblock_minutes'=>30,'alert_threshold'=>20,'alert_minutes'=>5,'brute_max_attempts'=>5,'brute_window_minutes'=>15,'rate_limit_requests'=>40,'rate_limit_window'=>60,'max_revisions'=>5,'auto_clean_logs_days'=>30,'referer_history_threshold'=>1,'referer_rate_1min'=>5,'referer_rate_5min'=>10,'referer_same_page'=>3,'referer_no_proxy_rate'=>3); $default_settings = array_merge($default_settings, $recommended); update_option(CYBERSEC_SETTINGS_OPTION, $default_settings); }
     if(get_option(CYBERSEC_WHITELIST_OPTION)===false) update_option(CYBERSEC_WHITELIST_OPTION,array());
     if(get_option(CYBERSEC_TEMP_BLOCKS_OPTION)===false) update_option(CYBERSEC_TEMP_BLOCKS_OPTION,array());

cyberpulse/trunk/cyberpulse-htaccess.php

-              r3763154
+              r3764759
 <?php
-/**
- * CyberPulse — .htaccess management for Apache / LiteSpeed.
+ *
- * Requests to existing files (.git/objects/*, wp-config.php.bak,
- * /.aws/credentials, /backup.sql) never reach PHP: Apache serves them
- * as static content because WordPress's own rewrite rule uses
- * `RewriteCond !-f` ("if file exists, don't pass to index.php").
- * Only the web server can block these requests, so the rules must
- * live in .htaccess BEFORE the WordPress block.
+ *
- * The plugin owns only its own marker-delimited section:
+ *
- *   # BEGIN CyberPulse Protection
- *   ...
- *   # END CyberPulse Protection
+ *
- * On deactivation the block is removed and the rest of .htaccess
- * (WP Fastest Cache, Wordfence, etc.) is left untouched.
+ *
- * OPT-IN: this protection is disabled by default. Rules are written
- * only when the admin explicitly enables "htaccess_protection_enabled"
- * in plugin settings. This prevents accidental breakage of SEO tools,
- * nginx setups, or custom server configs on fresh installs.
+ *
- * @package CyberPulse
- */
 if (!defined('ABSPATH')) exit;
 …
 /**
+ * Returns true if the current web server reads .htaccess files.
+ * Apache and LiteSpeed do; nginx does not.
+ *
+ * @return bool
+ * Checks whether the current web server honors .htaccess files.
+ *
+ * Apache and LiteSpeed read .htaccess natively; nginx does not.
+ * When SERVER_SOFTWARE is unavailable (CLI, some FPM setups), the
+ * function assumes .htaccess works — the caller is expected to
+ * handle any resulting error gracefully via the verification step
+ * in cybersec_htaccess_sync().
+ *
+ * @return bool True when .htaccess rules will actually take effect.
  */
 function cybersec_htaccess_server_supports() {
 …
     if ($server === '') {
-        // CLI / cron — assume Apache
         return !defined('WP_CLI') || !WP_CLI;
+    }
 …
 /**
+ * Converts a CIDR to Apache-escaped IP prefix regexes.
+ *
+ *   /32     → "x\.y\.z\.w$"         (exact IP)
+ *   /24     → "x\.y\.z\."           (octet prefix)
+ *   /16     → "x\.y\."              (two-octet prefix)
+ *   /8      → "x\."                 (one-octet prefix)
+ *   /15-/9  → multiple /16 prefixes (single-octet range expanded)
+ *
+ * Masks between /24 and /32 exclusive are skipped — expanding them
+ * would generate dozens of prefixes per subnet and blow up .htaccess.
+ *
+ * @param string $cidr
+ * @return array Apache-escaped prefix strings.
+ * Converts a CIDR block into .htaccess-compatible regex prefixes.
+ *
+ * Only IPv4 is supported. The returned strings are the LHS of
+ * mod_rewrite REMOTE_ADDR conditions (escaped dots included), so
+ * they can be used directly as `RewriteCond %{REMOTE_ADDR} ^<prefix>`.
+ *
+ * Rationale for the specific prefix lengths:
+ *   /32  → exact match with trailing `$`
+ *   /24  → first three octets + trailing dot (covers 256 IPs)
+ *   /16  → first two octets + trailing dot
+ *   /8   → single octet + trailing dot
+ *   /17–/23 and non-/8-/16/-/24 masks cannot be expressed as a
+ *   single prefix and are expanded into up to 64 host-prefixes.
+ *   Anything outside /8–/32 is refused to keep the rule set small.
+ *
+ * @param string $cidr CIDR string, e.g. "192.168.1.0/24".
+ * @return array List of regex prefixes (empty on invalid input).
  */
 function cybersec_htaccess_cidr_to_prefixes($cidr) {
 …
         return array($o[0] . '\\.');
+    }
+    // /17–/23 cannot be expressed as a single octet-aligned prefix.
     if ($mask > 16 && $mask < 24) {
         return array();
+    }
+    // /9 to /15 — expand to /16 prefixes
+    // /9–/15: expand to individual /16 prefixes (capped at 64 to keep
+    // the block size bounded).
     $range = 1 << (16 - $mask);
     $base = ((int) $o[0]) * 256 + ((int) $o[1]);
 …
 /**
+ * Builds the CyberPulse .htaccess block content.
+ *
+ * IP deny list comes from the 'secwall_permanent_blocked_subnets' option
+ * (30 most recent entries only). Path rules for .git/.env/etc. are static.
+ *
+ * Returns an empty string when:
+ *   - the server does not read .htaccess (nginx, CLI with WP_CLI);
+ *   - .htaccess is not writable;
+ *   - the feature is disabled by the admin (opt-in).
+ *
+ * @return string Empty string when the block should not be written.
+ * Builds the .htaccess protection block from current settings.
+ *
+ * Returns an empty string when the feature is disabled, the server
+ * does not support .htaccess, or the file is not writable — callers
+ * must treat an empty return as "do nothing" rather than "write empty".
+ *
+ * The block does three things:
+ *   1. Blocks the top-30 recently-banned /24+ subnets (deny list),
+ *      capped at 64 regex conditions to keep .htaccess small.
+ *   2. Blocks access to sensitive paths (.git, .env, SSH keys,
+ *      crypto wallets, DB dumps, etc.) — defence-in-depth even if
+ *      the PHP-level checks fail.
+ *   3. Blocks known AI / data-scraping bots by User-Agent. This
+ *      happens before PHP runs, saving server resources.
+ *
+ * Server's own IP is always excluded from the deny conditions so
+ * the site cannot lock itself out.
+ *
+ * @return string The complete BEGIN/END-wrapped block, or ''.
  */
 function cybersec_htaccess_build_block() {
     if (!cybersec_htaccess_server_supports()) return '';
+    // OPT-IN gate: never produce rules unless the admin explicitly
+    // enabled .htaccess protection in Settings. This keeps fresh
+    // installs and upgrades side-effect free.
+    // OPT-IN gate: never produce rules unless the admin explicitly enabled it.
     if (function_exists('cybersec_get_settings')) {
         $settings = cybersec_get_settings();
 …
     $server_ip = function_exists('cybersec_get_server_ip') ? cybersec_get_server_ip() : '';
+    // Collect CIDR prefixes from the 30 most recent permabans.
+    // Sorting by blocked_at DESC keeps the freshest threats present
+    // when the 64-condition cap is hit.
     $deny_prefixes = array();
     $permanent = get_option('secwall_permanent_blocked_subnets', array());
     if (!empty($permanent) && is_array($permanent)) {
-        // Most recent 30 subnets only — keep .htaccess compact
         uasort($permanent, function($a, $b) {
             $ta = isset($a['blocked_at']) ? strtotime($a['blocked_at']) : 0;
 …
     $block  = CYBERPULSE_HTACCESS_BEGIN . "\n";
     $block .= "# Generated: " . gmdate('Y-m-d H:i:s') . " UTC\n";
+    // Assign our custom 403 page
+    $block .= "ErrorDocument 403 /cyberpulse-403.html\n\n";
     $block .= "<IfModule mod_rewrite.c>\n";
     $block .= "RewriteEngine On\n";
+    // ============================================================
+    // PERMABAN DENY LIST
+    // Server's own IP is excluded first so a misconfigured ban of
+    // its own subnet cannot break admin access.
+    // ============================================================
     if (!empty($deny_prefixes)) {
-        // Never block the server's own IP (self-requests from cron, monitoring, etc.)
         if ($server_ip && filter_var($server_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
             $block .= "RewriteCond %{REMOTE_ADDR} !^" . str_replace('.', '\\.', $server_ip) . "$\n";
 …
+    }
+    // ============================================================
+    // SENSITIVE CONFIG & SYSTEM FILES
+    // ============================================================
     // Configuration files that must NEVER be exposed to the web.
     // Apache usually blocks .htaccess via <FilesMatch "^\.ht"> in the
 …
     $block .= "RewriteRule (^|/)(readme|license|changelog)\\.(html|txt|md)$ - [F,L,NC]\n";
     // Path rules — only files/dirs that are NEVER legitimate to expose.
     // /graphql and /userfiles are intentionally excluded — they break
     // WPGraphQL, Gatsby, Next.js, and CMS platforms with /userfiles/ dirs.
+    // VCS directories, env/secret files, SSH keys, crypto wallets,
+    // container/IDE probes, and DB dumps. Runs before PHP, so it
+    // catches scanners that would otherwise hit PHP and log.
     $block .= "RewriteRule (^|/)\\.git(/|$) - [F,L]\n";
     $block .= "RewriteRule (^|/)\\.svn(/|$) - [F,L]\n";
 …
     $block .= "RewriteRule (^|/)@fs(/|$) - [F,L]\n";
     $block .= "RewriteRule (^|/)proc/self(/|$) - [F,L]\n";
+    // wp-config backups — covers wp-config.bak, wp-config.php.bak,
+    // wp-config.php.zip, wp-config.php.tar.gz, etc.
     $block .= "RewriteRule (^|/)wp-config(\\.php)?\\.(bak|old|txt|save|orig|tmp|swp|zip|tar\\.gz)$ - [F,L]\n";
     $block .= "RewriteRule (^|/)(database|dump|db|users|backup)\\.sql$ - [F,L]\n";
+    // Build the AI-bot regex from the ACTIVE signatures only,
+    // respecting the ai_training_block_enabled / ai_search_block_enabled
+    // toggles. When both are off, this whole section is skipped.
+    // ============================================================
+    // AI / DATA-SCRAPING BOT BLOCK
+    // Fires before PHP. Signatures come from the ACTIVE list only,
+    // respecting ai_training_block_enabled / ai_search_block_enabled.
+    // When both are off, this section is skipped entirely.
+    // ============================================================
     $active_ai = function_exists('cybersec_get_active_ai_bot_signatures')
         ? cybersec_get_active_ai_bot_signatures()
         : array();
         if (!empty($active_ai)) {
+    if (!empty($active_ai)) {
         // preg_quote: protects against regex injection.
         // str_replace: replaces literal spaces (e.g. "IAS Crawler")
 …
+        }
         $bot_ua = '(' . implode('|', $escaped) . ')';
+        // Exclude the custom 403 HTML page, its CSS and JS files
+        // to prevent infinite loops and broken styling.
+        $block .= "RewriteCond %{REQUEST_URI} !/cyberpulse-403\\.html [NC]\n";
+        $block .= "RewriteCond %{REQUEST_URI} !/cyberpulse-403\\.css [NC]\n";
+        $block .= "RewriteCond %{REQUEST_URI} !/cyberpulse-403\\.js [NC]\n";
         $block .= "RewriteCond %{HTTP_USER_AGENT} " . $bot_ua . " [NC]\n";
         $block .= "RewriteRule .* - [F,L]\n\n";
 …
 /**
+ * Inserts or updates the CyberPulse block in .htaccess.
+ *
+ * The block is placed BEFORE "# BEGIN WordPress" so deny rules are
+ * evaluated before WP's "if file exists" catch-all.
+ *
+ * @param bool $verify Perform a test GET after writing and roll back on 5xx.
+ *                     Pass false during activation — WordPress is in
+ *                     maintenance mode and the verify-request would 5xx,
+ *                     causing a false rollback.
+ * @return bool
+ * Returns a data-URI SVG favicon for the static 403 page.
+ *
+ * Inlined so the favicon renders even when the visitor's IP is
+ * blocked at the .htaccess level and every external request
+ * (including /favicon.ico) returns 403. No network round-trip,
+ * no dependency on WordPress being bootstrapped.
+ *
+ * @return string `data:image/svg+xml,...` URI ready for <link rel="icon">.
+ */
+function cybersec_htaccess_favicon_data_uri() {
+    static $uri = null;
+    if ($uri !== null) return $uri;
+    $svg = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 36 36">'
+        . '<path d="M 18.0,4.5 C 10.9,4.5 6.8,6.8 6.8,10.4 C 7.0,25.8 16.0,30.9 18.0,32.3 C 20.0,30.9 29.0,25.8 29.2,10.4 C 29.2,6.8 25.1,4.5 18.0,4.5 Z"'
+        . ' fill="#1a1e18" stroke="#00e048" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>'
+        . '<path fill="none" stroke="#00e048" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"'
+        . ' d="M 9.0,18.0 L 13.2,18.0 L 15.0,14.0 L 18.0,23.6 L 21.0,10.0 L 22.8,18.0 L 27.0,18.0"/>'
+        . '</svg>';
+    $uri = 'data:image/svg+xml;charset=utf-8,' . rawurlencode($svg);
+    return $uri;
+}
+/**
+ * Writes the protection block into .htaccess and optionally verifies it.
+ *
+ * Uses WordPress's BEGIN/END markers to replace an existing block
+ * in place. New blocks are placed BEFORE the `# BEGIN WordPress`
+ * marker so they can deny access before WP rewrite rules run.
+ *
+ * Two safety measures:
+ *   - Whitespace-in-UA-regex guard: if the built block contains a
+ *     literal space inside the bot UA condition, .htaccess parsing
+ *     would fail and break the whole site. Refuses to write.
+ *   - Optional HTTP verification: sends a request to the front page.
+ *     On 5xx (500/502/504) the original .htaccess is restored, so a
+ *     bad rule cannot leave the site offline.
+ *
+ * Errors are stored in the `cybersec_htaccess_sync_error` transient
+ * for 5 minutes and surfaced via the AJAX handler / admin error panel.
+ *
+ * @param bool $verify Run the HTTP self-test after writing.
+ * @return bool True on success, false on any failure.
  */
 function cybersec_htaccess_sync($verify = true) {
 …
+    }
+    // Safety: RewriteCond patterns must not contain literal spaces.
+    // A space inside the regex group is parsed by Apache as an extra
+    // argument and causes 500 Internal Server Error on every request.
+    // Whitespace inside the UA condition would break Apache parsing.
+    // Fail closed rather than write an invalid .htaccess.
     if (strpos($block, 'RewriteCond %{HTTP_USER_AGENT}') !== false) {
         if (!preg_match('/RewriteCond\s+%\{HTTP_USER_AGENT\}\s+\S+\s+\[NC\]/', $block)) {
 …
+    }
+    // ============================================================
+    // GENERATE STATIC 403 PAGE
+    // We use a distinct filename (cyberpulse-403.html) so we never
+    // overwrite a custom 403.html that the user might already have.
+    //
+    // This file is served directly by Apache via ErrorDocument — it
+    // does NOT go through WordPress, so wp_enqueue_style() and
+    // wp_enqueue_script() are unavailable. To comply with Plugin
+    // Check (WordPress.WP.EnqueuedResources.*) and keep the page
+    // fully self-contained, the CSS and JS are embedded inline
+    // instead of being loaded via <link>/<script src>.
+    //
+    // Same pattern as cybersec_show_unified_block_page() in
+    // cyberpulse-core.php — that path is already Plugin-Check clean.
+    //
+    // The favicon is also a data URI (cybersec_htaccess_favicon_data_uri):
+    // a normal /favicon.ico request would be blocked by the same
+    // permaban / AI-bot rule that produced this page, so the icon
+    // must be embedded rather than linked.
+    // ============================================================
+    $html_403_path = ABSPATH . 'cyberpulse-403.html';
+    if (!cybersec_fs_exists($html_403_path)) {
+        $lang = substr(cybersec_get_locale(), 0, 2);
+        $css_path = plugin_dir_path(__FILE__) . 'assets/css/cyberpulse-403.css';
+        $js_path  = plugin_dir_path(__FILE__) . 'assets/js/cyberpulse-403.js';
+        $inline_css = cybersec_fs_get_contents($css_path);
+        $inline_js  = cybersec_fs_get_contents($js_path);
+        // Minify inline CSS — identical to cybersec_show_unified_block_page().
+        // Safe regex: strips comments, collapses whitespace, tightens around
+        // structural symbols. calc() operators keep their spaces because
+        // they're not in the [{};:,>] class.
+        if (!empty($inline_css)) {
+            $inline_css = preg_replace('#/\*.*?\*/#s', '', $inline_css);
+            $inline_css = preg_replace('/\s+/', ' ', $inline_css);
+            $inline_css = preg_replace('/\s*([{};:,>])\s*/', '$1', $inline_css);
+            $inline_css = trim($inline_css);
+        }
+        $favicon_uri = cybersec_htaccess_favicon_data_uri();
+        $html_403 = '<!DOCTYPE html>
+<html lang="' . esc_attr($lang) . '">
+<head>
+    <meta charset="UTF-8">
+    <meta name="robots" content="noindex,nofollow,noarchive">
+    <meta name="viewport" content="width=device-width,initial-scale=1.0">
+    <title>403 Forbidden | CyberPulse Security</title>
+    <link rel="icon" type="image/svg+xml" href="' . esc_attr($favicon_uri) . '">
+    <style>' . $inline_css . '</style>
+</head>
+<body>
+    <div class="sw-card">
+        <div class="sw-icon">
+            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#ff4040" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/>
+            </svg>
+        </div>
+        <h1 class="sw-title" id="cp-403-title">403 ' . esc_html(cybersec_translate('Access Denied')) . '</h1>
+        <p class="sw-description" id="cp-403-desc">' . esc_html(cybersec_translate('Your request was blocked by the server security system.')) . '</p>
+        <a href="javascript:location.reload();" class="sw-btn" id="cp-403-btn">' . esc_html(cybersec_translate('Refresh Page')) . '</a>
+        <div class="sw-footer">
+            <a href="https://cyberpulse-security.com" target="_blank" rel="noopener" class="sw-brand">
+                <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 36 36" fill="none">
+                    <path d="M 18.0,4.5 C 10.9,4.5 6.8,6.8 6.8,10.4 C 7.0,25.8 16.0,30.9 18.0,32.3 C 20.0,30.9 29.0,25.8 29.2,10.4 C 29.2,6.8 25.1,4.5 18.0,4.5 Z" fill="none" stroke="#00e048" stroke-width="2"/>
+                    <path fill="none" stroke="#00e048" stroke-width="1.6" d="M 9.0,18.0 L 13.2,18.0 L 15.0,14.0 L 18.0,23.6 L 21.0,10.0 L 22.8,18.0 L 27.0,18.0"/>
+                </svg>
+                Protected by CyberPulse
+            </a>
+        </div>
+    </div>
+    <script>' . $inline_js . '</script>
+</body>
+</html>';
+        cybersec_fs_put_contents($html_403_path, $html_403);
+    }
     $htaccess_path = ABSPATH . '.htaccess';
 …
+    }
+    // Strip any existing CyberPulse block first so we do not duplicate.
     $pattern = '/' . preg_quote(CYBERPULSE_HTACCESS_BEGIN, '/') . '.*?' . preg_quote(CYBERPULSE_HTACCESS_END, '/') . "\n?/s";
     $content = preg_replace($pattern, '', $original);
+    // Insert before the WordPress block so our F,L rules win.
     $wp_marker = '# BEGIN WordPress';
     $pos = strpos($content, $wp_marker);
 …
+    }
+    // ============================================================
+    // SELF-TEST
+    // Fetch the front page. A 5xx response almost certainly means
+    // our new rules broke the server — roll back to the original.
+    // 4xx is fine (auth-protected sites, 404 on non-existent query
+    // string, etc.) and does not trigger rollback.
+    // ============================================================
     $verify_resp = wp_remote_get(home_url('/?cyberpulse_verify=' . wp_rand(1000, 9999)), array(
         'timeout' => 5,
 …
     ));
         if (!is_wp_error($verify_resp)) {
+    if (!is_wp_error($verify_resp)) {
         $code = wp_remote_retrieve_response_code($verify_resp);
         if (in_array($code, array(500, 502, 504))) {
 …
 /**
  * Removes the CyberPulse block from .htaccess (used on deactivation
  * and when the admin unchecks the option in Settings).
+ *
  * Only the plugin's own markers are touched — other plugins' blocks
  * stay intact.
+ *
  * @return bool
+ * Removes the CyberPulse block from .htaccess.
+ *
+ * Uses the BEGIN/END markers so user-added rules above or below the
+ * block are preserved untouched. Safe to call when no block exists
+ * (returns true) or when .htaccess is missing (returns true).
+ *
+ * @return bool True if the file no longer contains a CyberPulse block.
  */
 function cybersec_htaccess_remove() {
+    // Clean up the static 403 page we generated
+    $html_403_path = ABSPATH . 'cyberpulse-403.html';
+    if (cybersec_fs_exists($html_403_path)) {
+        cybersec_fs_delete($html_403_path);
+    }
     $htaccess_path = ABSPATH . '.htaccess';
     if (!cybersec_fs_exists($htaccess_path)) return true;
 …
+}
 // ------------------------------------------------------------------
+// AJAX: manual sync button
 // ------------------------------------------------------------------
 /**
  * AJAX: rewrites the plugin's .htaccess block. Returns a JSON error when
  * the server does not read .htaccess (nginx), the feature is disabled,
  * or the write fails — the latter rolls back automatically inside
  * cybersec_htaccess_sync().
  */
 add_action('wp_ajax_cybersec_htaccess_sync', function() {
+// ==================== AJAX: MANUAL SYNC ====================
+/**
+ * AJAX: writes .htaccess rules on demand from the admin UI.
+ *
+ * Requires the "htaccess_protection_enabled" option to be ON —
+ * this is a safety check, not just a convenience: the admin must
+ * have explicitly opted in before we touch .htaccess. On failure
+ * the transient error reason is surfaced in the JSON response.
+ */
+add_action('wp_ajax_cyberpulse_htaccess_sync', function() {
     $nonce_action = defined('CYBERPULSE_AJAX_NONCE_ACTION') ? CYBERPULSE_AJAX_NONCE_ACTION : 'cybersec_ajax_action';
     check_ajax_referer($nonce_action, 'nonce');
 …
+    }
+    // Feature must be explicitly enabled in Settings. If the admin
+    // clicks the "Sync" button while the option is off, refuse rather
+    // than silently writing rules they didn't ask for.
+    $settings = function_exists('cybersec_get_settings') ? cybersec_get_settings() : array();
+    $settings = cybersec_get_settings();
     if (empty($settings['htaccess_protection_enabled'])) {
+        wp_send_json_error(array(
+            'message' => 'Enable .htaccess protection in Settings first.',
+        ));
+        wp_send_json_error(array('message' => 'Enable .htaccess protection in Settings first.'));
+    }
 …
 });
+/**
+ * Runs on every admin_init: performs the one-time legacy cleanup for
+ * installations upgraded from a version that wrote the block
+ * unconditionally, and re-syncs .htaccess when the plugin version
+ * changed and the feature is enabled.
+// ==================== AUTO-SYNC ON VERSION CHANGE ====================
+/**
+ * Hooked on `admin_init` priority 20.
+ *
+ * Responsibilities:
+ *   1. One-time cleanup of legacy blocks if the feature is now
+ *      disabled (migration from an older build that shipped rules
+ *      unconditionally).
+ *   2. Automatic re-sync when the plugin version changes, so the
+ *      block stays in sync with the current deny list / bot list.
+ *      Stores the sync state (or error) for admin visibility.
+ *
+ * Runs ONLY when the feature is enabled — otherwise it just cleans
+ * up and exits.
  */
 add_action('admin_init', function() {
 …
     $enabled  = !empty($settings['htaccess_protection_enabled']);
+    // One-time migration for users upgrading from a version where the
+    // block was written unconditionally. If the option is now off but a
+    // legacy block still exists in .htaccess, remove it once so nobody
+    // keeps stale rules they never asked for.
+    // One-time migration: remove legacy blocks if the feature was disabled.
     if (!$enabled && !get_option('cybersec_htaccess_legacy_purged')) {
         $htaccess_path = ABSPATH . '.htaccess';
 …
     if (!$enabled) return;
+    // Version check — rewrite only when the plugin version changed.
+    $stored  = get_option('cybersec_htaccess_version', '');
+    $current = defined('CYBERSEC_VERSION') ? CYBERSEC_VERSION : '0';
+    // Version guard — avoid touching .htaccess on every admin page load.
+    $stored = get_option('cybersec_htaccess_version', '');
+    $current = defined('CYBERPULSE_PRO_VERSION') ? CYBERPULSE_PRO_VERSION : (defined('CYBERSEC_VERSION') ? CYBERSEC_VERSION : '0');
     if ($stored === $current) return;

cyberpulse/trunk/cyberpulse-tabs.php

-              r3763154
+              r3764759
             'ai_training_block_enabled' => isset($_POST['cybersec_ai_training_block_enabled']) ? 1 : 0,
             'ai_search_block_enabled'   => isset($_POST['cybersec_ai_search_block_enabled']) ? 1 : 0,
+            'force_https' => isset($_POST['cybersec_force_https']) ? 1 : 0,
         );
 …
             $fsize = filesize($audit_log);
             if ($fsize > 0) {
-                // v5.9.1.1 — read tail via WP_Filesystem instead of
-                // fopen/fseek/fread/fclose (Plugin Check
-                // WordPress.WP.AlternativeFunctions.file_system_operations_*).
                 $full = cybersec_fs_get_contents($audit_log);
                 if ($full !== '') {
 …
     <p style="margin-top:8px;font-size:11px;color:var(--sw-success);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="11" height="11" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:1.5px;"><polyline points="20 6 9 17 4 12"/></svg><?php echo esc_html(cybersec_translate('Always active')); ?></p>
 </div>
+            <div class="sw-settings-card" style="grid-column: 1 / -1;">
+                <h4><?php echo esc_html(cybersec_translate('Force HTTPS')); ?> <span class="sw-status <?php echo !empty($st['force_https']) ? 'sw-status-active' : 'sw-status-inactive'; ?>"><?php echo !empty($st['force_https']) ? esc_html(cybersec_translate('Enabled')) : esc_html(cybersec_translate('Disabled')); ?></span></h4>
+                <p><?php echo esc_html(cybersec_translate('Automatically redirects all HTTP requests to HTTPS (301 redirect).')); ?> <strong><?php echo esc_html(cybersec_translate('Enable only if you have an SSL certificate configured')); ?></strong>, <?php echo esc_html(cybersec_translate('otherwise the site will become inaccessible.')); ?></p>
+                <label style="margin-top:8px;display:block;"><input type="checkbox" name="cybersec_force_https" value="1" <?php checked(!empty($st['force_https']), true); ?>> <?php echo esc_html(cybersec_translate('Redirect HTTP → HTTPS')); ?></label>
+            </div>
         </div>
     </div>
 …
                 <strong style="color:var(--sw-accent);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:2px;"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><polyline points="13 2 9 10 12 10 8 18"/></svg><?php echo esc_html(cybersec_translate('Flood and DDoS Protection')); ?></strong>
                 <p style="margin:6px 0 0 0;font-size:12px;color:var(--sw-text-secondary);line-height:1.5;"><?php echo esc_html(cybersec_translate('Three levels of application-layer attack protection.')); ?> <strong><?php echo esc_html(cybersec_translate('Basic')); ?></strong> — <?php echo esc_html(cybersec_translate('constant protection against scraping and flooding.')); ?> <strong><?php echo esc_html(cybersec_translate('Enhanced')); ?></strong> — <?php echo esc_html(cybersec_translate('for repelling DDoS attacks.')); ?> <strong>Anti-Slowloris</strong> — <?php echo esc_html(cybersec_translate('automatic protection against slow connections.')); ?></p>
+                <div style="background:var(--sw-success-light);border:2px solid var(--sw-success-border);border-radius:var(--sw-radius);padding:14px 16px;margin-top:12px;"><strong style="color:var(--sw-success);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:1.5px;"><polyline points="20 6 9 17 4 12"/></svg><?php echo esc_html(cybersec_translate('Basic Level (Rate Limiting)')); ?></strong><p style="margin:6px 0 0 0;font-size:12px;color:var(--sw-text-secondary);"><?php echo esc_html(cybersec_translate('Limits the number of requests from one IP to the entire site within a specified time interval. Protects against DDoS attacks and aggressive scraping. After 3 repeated violations, the subnet is automatically permanently banned.')); ?> <strong><?php echo esc_html(cybersec_translate('Recommended: enabled, 60 requests per 60 seconds.')); ?></strong></p><label style="margin-top:10px;display:block;"><input type="checkbox" name="cybersec_rate_limiting_enabled" value="1" <?php checked($st['rate_limiting_enabled'],1);?>> <?php echo esc_html(cybersec_translate('Enable basic protection')); ?></label><div style="margin-top:10px;display:flex;align-items:center;gap:6px;flex-wrap:wrap;"><span><?php echo esc_html(cybersec_translate('Maximum')); ?></span><input type="number" name="cybersec_rate_limit_requests" value="<?php echo (int)$st['rate_limit_requests'];?>" min="1" max="1000" style="width:80px;"><span><?php echo esc_html(cybersec_translate('requests per')); ?></span><input type="number" name="cybersec_rate_limit_window" value="<?php echo (int)$st['rate_limit_window'];?>" min="1" max="3600" style="width:80px;"><span><?php echo esc_html(cybersec_translate('seconds')); ?></span></div></div>
+                <div style="background:var(--sw-info-light);border:2px solid var(--sw-info-border);border-radius:var(--sw-radius);padding:14px 16px;margin-top:12px;"><strong style="color:var(--sw-info);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:1.5px;"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg><?php echo esc_html(cybersec_translate('Anti-Slowloris Protection')); ?></strong><p style="margin:6px 0 0 0;font-size:12px;color:var(--sw-text-secondary);"><?php echo esc_html(cybersec_translate('Automatically tracks and blocks slow connections (Slowloris attacks). Works automatically when enhanced DDoS protection is enabled. IP is blocked when exceeding')); ?> <strong><?php echo esc_html(cybersec_translate('20 simultaneous connections')); ?></strong>.</p></div>
+                <!-- ============ BASIC LEVEL ============ -->
+                <div style="background:var(--sw-success-light);border:2px solid var(--sw-success-border);border-radius:var(--sw-radius);padding:14px 16px;margin-top:12px;">
+                    <strong style="color:var(--sw-success);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:1.5px;"><polyline points="20 6 9 17 4 12"/></svg><?php echo esc_html(cybersec_translate('Basic Level (Rate Limiting)')); ?></strong>
+                    <p style="margin:6px 0 0 0;font-size:12px;color:var(--sw-text-secondary);"><?php echo esc_html(cybersec_translate('Limits the number of requests from one IP to the entire site within a specified time interval. Protects against DDoS attacks and aggressive scraping. After 3 repeated violations, the subnet is automatically permanently banned.')); ?> <strong><?php echo esc_html(cybersec_translate('Recommended: enabled, 40 requests per 60 seconds.')); ?></strong></p>
+                    <label style="margin-top:10px;display:block;"><input type="checkbox" name="cybersec_rate_limiting_enabled" value="1" <?php checked($st['rate_limiting_enabled'],1);?>> <?php echo esc_html(cybersec_translate('Enable basic protection')); ?></label>
+                    <div style="margin-top:10px;display:flex;align-items:center;gap:6px;flex-wrap:wrap;"><span><?php echo esc_html(cybersec_translate('Maximum')); ?></span><input type="number" name="cybersec_rate_limit_requests" value="<?php echo (int)$st['rate_limit_requests'];?>" min="1" max="1000" style="width:80px;"><span><?php echo esc_html(cybersec_translate('requests per')); ?></span><input type="number" name="cybersec_rate_limit_window" value="<?php echo (int)$st['rate_limit_window'];?>" min="1" max="3600" style="width:80px;"><span><?php echo esc_html(cybersec_translate('seconds')); ?></span></div>
+                    <!-- Collapsible help: how to choose the right value -->
+                    <details style="margin-top:12px;padding:10px 12px;background:var(--sw-card-bg-alt);border:1px solid var(--sw-border);border-radius:var(--sw-radius);font-size:12px;color:var(--sw-text-secondary);line-height:1.6;">
+                        <summary style="cursor:pointer;font-weight:700;color:var(--sw-text);outline:none;">
+                            <?php echo esc_html(cybersec_translate('How to choose the right value')); ?>
+                        </summary>
+                        <ul style="margin:10px 0 0 16px;padding:0;">
+                            <li style="margin-bottom:6px;"><strong>30–35</strong> — <?php echo esc_html(cybersec_translate('homogeneous audience, mostly desktop users, without mobile carriers.')); ?></li>
+                            <li style="margin-bottom:6px;"><strong>40</strong> — <?php echo esc_html(cybersec_translate('universal default, suitable for most news and information sites.')); ?></li>
+                            <li style="margin-bottom:6px;"><strong>50–80</strong> — <?php echo esc_html(cybersec_translate('large share of mobile-carrier traffic (CGNAT) or corporate networks.')); ?></li>
+                        </ul>
+                        <p style="margin:10px 0 0 0;">
+                            <strong><?php echo esc_html(cybersec_translate('Important:')); ?></strong>
+                            <?php echo esc_html(cybersec_translate('the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.')); ?>
+                        </p>
+                        <p style="margin:8px 0 0 0;padding:8px 10px;background:var(--sw-info-light);border-left:3px solid var(--sw-info);border-radius:4px;">
+                            <strong><?php echo esc_html(cybersec_translate('CGNAT (Carrier-Grade NAT):')); ?></strong>
+                            <?php echo esc_html(cybersec_translate('mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.')); ?>
+                        </p>
+                    </details>
+                </div>
+                <!-- ============ ANTI-SLOWLORIS ============ -->
+                <div style="background:var(--sw-info-light);border:2px solid var(--sw-info-border);border-radius:var(--sw-radius);padding:14px 16px;margin-top:12px;">
+                    <strong style="color:var(--sw-info);"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:baseline;margin-right:3px;position:relative;top:1.5px;"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg><?php echo esc_html(cybersec_translate('Anti-Slowloris Protection')); ?></strong>
+                    <p style="margin:6px 0 0 0;font-size:12px;color:var(--sw-text-secondary);"><?php echo esc_html(cybersec_translate('Automatically tracks and blocks slow connections (Slowloris attacks). Works automatically when enhanced DDoS protection is enabled. IP is blocked when exceeding')); ?> <strong><?php echo esc_html(cybersec_translate('20 simultaneous connections')); ?></strong>.</p>
+                </div>
             </div>
         </div>

cyberpulse/trunk/cyberpulse.php

r3763154	r3764759
4	4	* Plugin URI: https://wordpress.org/plugins/cyberpulse
5	5	* Description: Real-time security heartbeat for your WordPress. Monitors every request, blocks bots instantly, protects against brute force and AI scraping. Feel the pulse of protection. Free version with PRO upgrade available.
6		* Version: 5.9.1.2
	6	* Version: 5.9.1.3
7	7	* Author: CyberPulse Security
8	8	* Author URI: https://cyberpulse-security.com

cyberpulse/trunk/languages/cyberpulse-de_DE.php

-              r3763154
+              r3764759
     'Automatically added administrator IP' => 'Automatisch hinzugefügte Administrator-IP',
     'No manual entries yet.' => 'Noch keine manuellen Einträge.',
+    'Static file via bot UA' => 'Statische Datei über Bot User-Agent',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => 'Wird beim Speichern automatisch angewendet. Regeln werden entfernt, wenn das Häkchen entfernt wird. Andere .htaccess-Inhalte (WordPress, Caching-Plugins usw.) bleiben erhalten. Ein fehlgeschlagenes Schreiben wird überprüft und automatisch zurückgesetzt.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'Fügt Blockierungsregeln direkt zu .htaccess hinzu (nur Apache / LiteSpeed). Blockiert KI-Bots und sensible Dateien (.git, .env, .sql, Schlüssel, Backups), bevor PHP geladen wird, um Serverressourcen zu sparen. Die KI-Bot-Regeln folgen den beiden Schaltern oben – das Deaktivieren einer Kategorie entfernt sie auch aus .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'HTTPS erzwingen',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Leitet alle HTTP-Anfragen automatisch auf HTTPS um (301-Weiterleitung).',
+    'Enable only if you have an SSL certificate configured' => 'Nur aktivieren, wenn ein SSL-Zertifikat konfiguriert ist',
+    'otherwise the site will become inaccessible.' => 'andernfalls wird die Website unzugänglich.',
+    'Redirect HTTP → HTTPS' => 'HTTP → HTTPS-Weiterleitung',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Empfohlen: aktiviert, 40 Anfragen pro 60 Sekunden.',
+    'How to choose the right value' => 'So wählen Sie den richtigen Wert',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'homogene Zielgruppe, überwiegend Desktop-Nutzer, ohne Mobilfunkanbieter.',
+    'universal default, suitable for most news and information sites.' => 'universeller Standardwert, geeignet für die meisten Nachrichten- und Informationsseiten.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'großer Anteil an Mobilfunkverkehr (CGNAT) oder Firmennetzwerken.',
+    'Important:' => 'Wichtig:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'der obige Wert gilt für normale Browser mit einem modernen User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Für leere oder defekte User-Agents, Rechenzentrums-IPs, alte Browser und bekannte Bots wird das Limit automatisch 3–6× strenger angewendet.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'Mobilfunkanbieter (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) und Firmennetzwerke weisen eine öffentliche IP Hunderten von Teilnehmern zu. Ein zu niedriges Limit blockiert echte Leser, nicht Angreifer.',
 );

cyberpulse/trunk/languages/cyberpulse-en_US.php

-              r3763154
+              r3764759
     'Enable ONLY if' => 'Enable ONLY if',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'you use Cloudflare (orange cloud enabled in DNS).',
+    'Static file via bot UA' => 'Static file via bot UA',
     // ------------------------------------------------------------------
 …
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.'
         => 'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Force HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Automatically redirects all HTTP requests to HTTPS (301 redirect).',
+    'Enable only if you have an SSL certificate configured' => 'Enable only if you have an SSL certificate configured',
+    'otherwise the site will become inaccessible.' => 'otherwise the site will become inaccessible.',
+    'Redirect HTTP → HTTPS' => 'Redirect HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Recommended: enabled, 40 requests per 60 seconds.',
+    'How to choose the right value' => 'How to choose the right value',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'homogeneous audience, mostly desktop users, without mobile carriers.',
+    'universal default, suitable for most news and information sites.' => 'universal default, suitable for most news and information sites.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'large share of mobile-carrier traffic (CGNAT) or corporate networks.',
+    'Important:' => 'Important:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.',
 );

cyberpulse/trunk/languages/cyberpulse-es_ES.php

-              r3763154
+              r3764759
     'Enable ONLY if' => 'Activar SOLO si',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'usas Cloudflare (nube naranja activada en DNS).',
+    'Static file via bot UA' => 'Archivo estático vía User-Agent de bot',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => 'Se aplica automáticamente al guardar. Las reglas se eliminan cuando se desmarca. Se conserva el resto del contenido de .htaccess (WordPress, complementos de caché, etc.). Una escritura fallida se verifica y se revierte automáticamente.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'Agrega reglas de bloqueo directamente a .htaccess (solo Apache / LiteSpeed). Bloquea bots de IA y archivos confidenciales (.git, .env, .sql, claves, copias de seguridad) antes de que se cargue PHP, ahorrando recursos del servidor. Las reglas de los bots de IA siguen los dos interruptores anteriores: deshabilitar una categoría también la elimina de .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Forzar HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Redirige automáticamente todas las solicitudes HTTP a HTTPS (redirección 301).',
+    'Enable only if you have an SSL certificate configured' => 'Habilitar solo si tiene un certificado SSL configurado',
+    'otherwise the site will become inaccessible.' => 'de lo contrario, el sitio quedará inaccesible.',
+    'Redirect HTTP → HTTPS' => 'Redirigir HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Recomendado: activado, 40 solicitudes por 60 segundos.',
+    'How to choose the right value' => 'Cómo elegir el valor correcto',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'audiencia homogénea, mayoritariamente usuarios de escritorio, sin operadores móviles.',
+    'universal default, suitable for most news and information sites.' => 'valor predeterminado universal, adecuado para la mayoría de sitios de noticias e información.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'gran proporción de tráfico de operadores móviles (CGNAT) o redes corporativas.',
+    'Important:' => 'Importante:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'el valor anterior se aplica a navegadores normales con un User-Agent moderno (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Para User-Agents vacíos o rotos, IP de centros de datos, navegadores antiguos y bots conocidos, el límite se aplica automáticamente 3–6× más estricto.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'los operadores móviles (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) y las redes corporativas asignan una IP pública a cientos de suscriptores. Un límite demasiado bajo bloqueará lectores reales, no atacantes.',
 );

cyberpulse/trunk/languages/cyberpulse-fr_FR.php

-              r3763154
+              r3764759
     'Enable ONLY if' => 'Activez UNIQUEMENT si',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'vous utilisez Cloudflare (nuage orange activé dans DNS).',
+    'Static file via bot UA' => 'Fichier statique via User-Agent de bot',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => 'Appliqué automatiquement lors de l\'enregistrement. Les règles sont supprimées lorsque la case est décochée. Le reste du contenu de .htaccess (WordPress, plugins de cache, etc.) est préservé. Un échec d\'écriture est vérifié et annulé automatiquement.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'Ajoute des règles de blocage directement dans .htaccess (Apache / LiteSpeed uniquement). Bloque les bots IA et les fichiers sensibles (.git, .env, .sql, clés, sauvegardes) avant même le chargement de PHP, économisant les ressources du serveur. Les règles des bots IA suivent les deux interrupteurs ci-dessus — la désactivation d\'une catégorie la supprime également de .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Forcer HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Redirige automatiquement toutes les requêtes HTTP vers HTTPS (redirection 301).',
+    'Enable only if you have an SSL certificate configured' => 'Activer uniquement si un certificat SSL est configuré',
+    'otherwise the site will become inaccessible.' => 'sinon le site deviendra inaccessible.',
+    'Redirect HTTP → HTTPS' => 'Rediriger HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Recommandé : activé, 40 requêtes par 60 secondes.',
+    'How to choose the right value' => 'Comment choisir la bonne valeur',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'audience homogène, principalement des utilisateurs de bureau, sans opérateurs mobiles.',
+    'universal default, suitable for most news and information sites.' => 'valeur par défaut universelle, adaptée à la plupart des sites d\'actualités et d\'information.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'part importante du trafic d\'opérateurs mobiles (CGNAT) ou de réseaux d\'entreprise.',
+    'Important:' => 'Important :',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'la valeur ci-dessus s\'applique aux navigateurs normaux avec un User-Agent moderne (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Pour les User-Agents vides ou cassés, les IP de centres de données, les anciens navigateurs et les bots connus, la limite est appliquée automatiquement 3–6× plus strictement.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT) :',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'les opérateurs mobiles (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) et les réseaux d\'entreprise attribuent une IP publique à des centaines d\'abonnés. Une limite trop basse bloquera de vrais lecteurs, pas les attaquants.',
 );

cyberpulse/trunk/languages/cyberpulse-it_IT.php

-              r3763154
+              r3764759
     'Enable ONLY if' => 'Abilita SOLO se',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'usi Cloudflare (cloud arancione abilitato nel DNS).',
+    'Static file via bot UA' => 'File statico tramite User-Agent bot',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => 'Applicato automaticamente al salvataggio. Le regole vengono rimosse quando la casella viene deselezionata. Il resto del contenuto di .htaccess (WordPress, plugin di caching, ecc.) viene preservato. Una scrittura fallita viene verificata e ripristinata automaticamente.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'Aggiunge regole di blocco direttamente in .htaccess (solo Apache / LiteSpeed). Blocca bot IA e file sensibili (.git, .env, .sql, chiavi, backup) prima ancora che PHP venga caricato, risparmiando risorse del server. Le regole dei bot IA seguono i due interruttori sopra — la disabilitazione di una categoria la rimuove anche da .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Forza HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Reindirizza automaticamente tutte le richieste HTTP a HTTPS (reindirizzamento 301).',
+    'Enable only if you have an SSL certificate configured' => 'Abilita solo se hai configurato un certificato SSL',
+    'otherwise the site will become inaccessible.' => 'altrimenti il sito diventerà inaccessibile.',
+    'Redirect HTTP → HTTPS' => 'Reindirizza HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Consigliato: attivo, 40 richieste per 60 secondi.',
+    'How to choose the right value' => 'Come scegliere il valore giusto',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'pubblico omogeneo, prevalentemente utenti desktop, senza operatori mobili.',
+    'universal default, suitable for most news and information sites.' => 'valore predefinito universale, adatto alla maggior parte dei siti di notizie e informazione.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'grande quota di traffico da operatori mobili (CGNAT) o reti aziendali.',
+    'Important:' => 'Importante:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'il valore sopra si applica ai browser normali con User-Agent moderno (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Per User-Agent vuoti o corrotti, IP di datacenter, browser obsoleti e bot noti, il limite viene applicato automaticamente 3–6× più severo.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'gli operatori mobili (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) e le reti aziendali assegnano un IP pubblico a centinaia di abbonati. Un limite troppo basso bloccherà lettori reali, non gli aggressori.',
 );

cyberpulse/trunk/languages/cyberpulse-ja.php

-              r3763154
+              r3764759
     'Enable ONLY if' => '次の場合のみ有効にする',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'Cloudflareを使用している（DNSでオレンジ色の雲が有効）。',
+    'Static file via bot UA' => 'ボットのUser-Agentによる静的ファイルアクセス',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => '保存時に自動的に適用されます。チェックを外すとルールが削除されます。他の.htaccessの内容（WordPress、キャッシュプラグインなど）は保持されます。書き込みに失敗した場合は検証され、自動的にロールバックされます。',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'ブロックルールを.htaccessに直接追加します（Apache / LiteSpeedのみ）。PHPが読み込まれる前にAIボットと機密ファイル（.git、.env、.sql、キー、バックアップ）をブロックし、サーバーリソースを節約します。AIボットのルールは上記の2つのトグルに従います — カテゴリを無効にすると.htaccessからも削除されます。',
+    // Force HTTPS
+    'Force HTTPS' => 'HTTPSを強制する',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'すべてのHTTPリクエストをHTTPSに自動リダイレクトします（301リダイレクト）。',
+    'Enable only if you have an SSL certificate configured' => 'SSL証明書が設定されている場合のみ有効にしてください',
+    'otherwise the site will become inaccessible.' => 'そうでない場合、サイトにアクセスできなくなります。',
+    'Redirect HTTP → HTTPS' => 'HTTP → HTTPS リダイレクト',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => '推奨：有効、60 秒あたり 40 リクエスト。',
+    'How to choose the right value' => '適切な値の選び方',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => '均質なオーディエンス、主にデスクトップユーザー、モバイルキャリアなし。',
+    'universal default, suitable for most news and information sites.' => '汎用的なデフォルト値、ほとんどのニュース・情報サイトに適しています。',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'モバイルキャリア（CGNAT）または企業ネットワークのトラフィックが多い場合。',
+    'Important:' => '重要：',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => '上記の値は、最新の User-Agent（Chrome 90+、Firefox 90+、Safari 14+、Edge 90+）を使用する通常のブラウザに適用されます。空または壊れた User-Agent、データセンター IP、古いブラウザ、既知のボットには、制限が自動的に 3〜6 倍厳しく適用されます。',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT（キャリアグレード NAT）：',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'モバイルキャリア（MTS、MegaFon、Beeline、Airtel、Claro、Jio、Vivo）と企業ネットワークは、1 つのパブリック IP を数百の加入者に割り当てます。制限が低すぎると、攻撃者ではなく実際の読者をブロックします。',
 );

cyberpulse/trunk/languages/cyberpulse-ko_KR.php

-              r3763154
+              r3764759
     'Enable ONLY if' => '다음 경우에만 활성화',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'Cloudflare를 사용 중인 경우 (DNS에서 주황색 구름 활성화).',
+    'Static file via bot UA' => '봇 User-Agent를 통한 정적 파일 접근',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => '저장 시 자동으로 적용됩니다. 선택을 취소하면 규칙이 제거됩니다. 기타 .htaccess 콘텐츠(WordPress, 캐싱 플러그인 등)는 보존됩니다. 쓰기 실패는 확인 후 자동으로 롤백됩니다.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => '차단 규칙을 .htaccess에 직접 추가합니다(Apache / LiteSpeed 전용). PHP가 로드되기 전에 AI 봇 및 민감한 파일(.git, .env, .sql, 키, 백업)을 차단하여 서버 리소스를 절약합니다. AI 봇 규칙은 위의 두 토글을 따릅니다 — 범주를 비활성화하면 .htaccess에서도 제거됩니다.',
+    // Force HTTPS
+    'Force HTTPS' => 'HTTPS 강제',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => '모든 HTTP 요청을 HTTPS로 자동 리디렉션합니다 (301 리디렉션).',
+    'Enable only if you have an SSL certificate configured' => 'SSL 인증서가 구성된 경우에만 활성화하세요',
+    'otherwise the site will become inaccessible.' => '그렇지 않으면 사이트에 액세스할 수 없게 됩니다.',
+    'Redirect HTTP → HTTPS' => 'HTTP → HTTPS 리디렉션',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => '권장: 활성화됨, 60초당 40회 요청.',
+    'How to choose the right value' => '올바른 값을 선택하는 방법',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => '동질적인 사용자층, 주로 데스크톱 사용자, 모바일 통신사 없음.',
+    'universal default, suitable for most news and information sites.' => '범용 기본값, 대부분의 뉴스 및 정보 사이트에 적합합니다.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => '모바일 통신사(CGNAT) 또는 기업 네트워크 트래픽이 많은 경우.',
+    'Important:' => '중요:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => '위 값은 최신 User-Agent(Chrome 90+, Firefox 90+, Safari 14+, Edge 90+)를 사용하는 일반 브라우저에 적용됩니다. 비어 있거나 손상된 User-Agent, 데이터센터 IP, 구형 브라우저 및 알려진 봇에는 제한이 자동으로 3–6배 더 엄격하게 적용됩니다.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => '모바일 통신사(MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo)와 기업 네트워크는 하나의 공인 IP를 수백 명의 가입자에게 할당합니다. 제한이 너무 낮으면 공격자가 아닌 실제 독자를 차단합니다.',
 );

cyberpulse/trunk/languages/cyberpulse-pt_BR.php

-              r3763154
+              r3764759
     'Enable ONLY if' => 'Ative SOMENTE se',
     'you use Cloudflare (orange cloud enabled in DNS).' => 'você usa Cloudflare (nuvem laranja ativada no DNS).',
+    'Static file via bot UA' => 'Arquivo estático via User-Agent de bot',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => 'Aplicado automaticamente ao salvar. As regras são removidas quando desmarcadas. O restante do conteúdo do .htaccess (WordPress, plugins de cache, etc.) é preservado. Uma gravação com falha é verificada e revertida automaticamente.',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => 'Adiciona regras de bloqueio diretamente ao .htaccess (apenas Apache / LiteSpeed). Bloqueia bots de IA e arquivos confidenciais (.git, .env, .sql, chaves, backups) antes mesmo de o PHP carregar, economizando recursos do servidor. As regras de bots de IA seguem os dois botões acima — desativar uma categoria também a remove do .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Forçar HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Redireciona automaticamente todas as solicitações HTTP para HTTPS (redirecionamento 301).',
+    'Enable only if you have an SSL certificate configured' => 'Ative apenas se você tiver um certificado SSL configurado',
+    'otherwise the site will become inaccessible.' => 'caso contrário, o site ficará inacessível.',
+    'Redirect HTTP → HTTPS' => 'Redirecionar HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Recomendado: ativado, 40 requisições por 60 segundos.',
+    'How to choose the right value' => 'Como escolher o valor correto',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'público homogêneo, majoritariamente usuários de desktop, sem operadoras móveis.',
+    'universal default, suitable for most news and information sites.' => 'valor padrão universal, adequado para a maioria dos sites de notícias e informação.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'grande parcela de tráfego de operadoras móveis (CGNAT) ou redes corporativas.',
+    'Important:' => 'Importante:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'o valor acima se aplica a navegadores normais com User-Agent moderno (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Para User-Agents vazios ou quebrados, IPs de datacenter, navegadores antigos e bots conhecidos, o limite é aplicado automaticamente 3–6× mais rigoroso.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'operadoras móveis (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) e redes corporativas atribuem um IP público a centenas de assinantes. Um limite muito baixo bloqueará leitores reais, não atacantes.',
 );

cyberpulse/trunk/languages/cyberpulse-ru_RU.php

-              r3763154
+              r3764759
     'Automatically added administrator IP' => 'Автоматически добавлен IP администратора',
     'No manual entries yet.' => 'Ручных записей пока нет.',
+    'Static file via bot UA' => 'Статический файл запрошен ботом (по User-Agent)',
     // ------------------------------------------------------------------
 …
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.'
         => 'Добавляет правила блокировки прямо в .htaccess (только Apache / LiteSpeed). Блокирует ИИ-ботов и чувствительные файлы (.git, .env, .sql, ключи, бэкапы) ещё до загрузки PHP, экономя ресурсы сервера. Правила для ИИ-ботов подчиняются двум переключателям выше — отключение категории убирает её и из .htaccess.',
+    // Force HTTPS
+    'Force HTTPS' => 'Принудительный HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => 'Автоматически перенаправляет все HTTP-запросы на HTTPS (301 редирект).',
+    'Enable only if you have an SSL certificate configured' => 'Включайте только при наличии настроенного SSL-сертификата',
+    'otherwise the site will become inaccessible.' => 'иначе сайт станет недоступен.',
+    'Redirect HTTP → HTTPS' => 'Редирект HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => 'Рекомендуется: включено, 40 запросов за 60 секунд.',
+    'How to choose the right value' => 'Как выбрать правильное значение',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => 'однородная аудитория, преимущественно десктопные пользователи, без мобильных операторов.',
+    'universal default, suitable for most news and information sites.' => 'универсальное значение по умолчанию, подходит для большинства новостных и информационных сайтов.',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => 'большая доля трафика с мобильных операторов (CGNAT) или из корпоративных сетей.',
+    'Important:' => 'Важно:',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => 'значение из поля выше применяется к обычным браузерам с современным User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). Для пустых или битых User-Agent, IP из дата-центров, старых браузеров и известных ботов лимит автоматически снижается в 3–6 раз.',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT (Carrier-Grade NAT):',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => 'мобильные операторы (МТС, МегаФон, Билайн, Airtel, Claro, Jio, Vivo) и корпоративные сети выдают один публичный IP сотням абонентов. Слишком низкий лимит заблокирует реальных читателей, а не атакующих.',
 );

cyberpulse/trunk/languages/cyberpulse-zh_CN.php

-              r3763154
+              r3764759
     'Enable ONLY if' => '仅在以下情况下启用',
     'you use Cloudflare (orange cloud enabled in DNS).' => '您使用Cloudflare（DNS中启用橙色云）。',
+    'Static file via bot UA' => '通过机器人 User-Agent 访问静态文件',
     // ------------------------------------------------------------------
 …
     'Applied automatically on save. Rules removed when unchecked. Other .htaccess content (WordPress, caching plugins, etc.) is preserved. A failed write is verified and rolled back automatically.' => '保存时自动应用。取消勾选时删除规则。保留 .htaccess 的其他内容（如 WordPress、缓存插件等）。写入失败时会自动验证并回滚。',
     'Adds blocking rules directly to .htaccess (Apache / LiteSpeed only). Blocks AI bots and sensitive files (.git, .env, .sql, keys, backups) before PHP even loads, saving server resources. The AI-bot rules follow the two toggles above — disabling a category also removes it from .htaccess.' => '直接将拦截规则添加到 .htaccess（仅限 Apache / LiteSpeed）。在加载 PHP 之前拦截 AI 机器人和敏感文件（.git、.env、.sql、密钥、备份），节省服务器资源。AI 机器人规则遵循上方的两个开关——禁用某个类别也会将其从 .htaccess 中移除。',
+    // Force HTTPS
+    'Force HTTPS' => '强制 HTTPS',
+    'Automatically redirects all HTTP requests to HTTPS (301 redirect).' => '自动将所有 HTTP 请求重定向到 HTTPS（301 重定向）。',
+    'Enable only if you have an SSL certificate configured' => '仅当您已配置 SSL 证书时才启用',
+    'otherwise the site will become inaccessible.' => '否则网站将无法访问。',
+    'Redirect HTTP → HTTPS' => '重定向 HTTP → HTTPS',
+    // Flood and DDoS Protection — Help Block
+    'Recommended: enabled, 40 requests per 60 seconds.' => '推荐：开启，每 60 秒 40 次请求。',
+    'How to choose the right value' => '如何选择正确的值',
+    'homogeneous audience, mostly desktop users, without mobile carriers.' => '受众单一，以桌面用户为主，无移动运营商。',
+    'universal default, suitable for most news and information sites.' => '通用默认值，适合大多数新闻和信息网站。',
+    'large share of mobile-carrier traffic (CGNAT) or corporate networks.' => '移动运营商（CGNAT）或企业网络流量占比较大。',
+    'Important:' => '重要提示：',
+    'the value above applies to normal browsers with a modern User-Agent (Chrome 90+, Firefox 90+, Safari 14+, Edge 90+). For empty or broken User-Agents, datacenter IPs, old browsers, and known bots the limit is applied 3–6× stricter automatically.' => '上述值适用于使用现代 User-Agent（Chrome 90+、Firefox 90+、Safari 14+、Edge 90+）的正常浏览器。对于空或损坏的 User-Agent、数据中心 IP、旧浏览器和已知机器人，限制会自动收紧 3–6 倍。',
+    'CGNAT (Carrier-Grade NAT):' => 'CGNAT（运营商级 NAT）：',
+    'mobile carriers (MTS, MegaFon, Beeline, Airtel, Claro, Jio, Vivo) and corporate networks assign one public IP to hundreds of subscribers. A too-low limit will block real readers, not attackers.' => '移动运营商（MTS、MegaFon、Beeline、Airtel、Claro、Jio、Vivo）和企业网络为一个公网 IP 分配数百个用户。限制过低会阻止真实读者，而非攻击者。',
 );

cyberpulse/trunk/readme.txt

-              r3763154
+              r3764759
 Tested up to: 7.1
 Requires PHP: 7.4
 Stable tag: 5.9.1.2
+Stable tag: 5.9.1.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 * 🤖 AI Scraping Protection — blocks GPTBot, ClaudeBot, PerplexityBot, CCBot, and other AI data collectors
 * 🛡️ Server-level `.htaccess` protection — optional (opt-in) blocking of sensitive files and AI bots directly at the Apache/LiteSpeed level
 * 🔍 Multi-layer bot detection (11 independent checks: User-Agent, HTTP headers, Referer, Accept-Language, and more)
+* 🔍 Multi-layer bot detection (20+ independent checks: User-Agent, HTTP headers, Referer, Accept-Language, behavioral analysis, and more)
 * 🔐 Brute force protection — automatic permanent /24 subnet ban after exceeding attempt limit
 * 🌍 IP Management — block IPs, subnets (/24), whitelist trusted addresses, detect visitor country by IP
 …
 * ⏱️ Rate Limiting — configurable request limits to prevent DDoS and aggressive scraping
 * ✅ IP Whitelist — manual and automatic (server IP, search engines, administrator IPs)
+* 🔒 Force HTTPS redirect — automatic 301 redirect from HTTP to HTTPS with proxy-loop protection
 * 🛡️ XSS attack protection — blocks cross-site scripting in requests
 * 🔎 404 scanner detection — blocks vulnerability scanners by excessive 404 errors
 …
 = 🔍 How does bot detection work? =
 CyberPulse analyzes 11 parameters of every request: User-Agent, HTTP headers, Accept-Language, Referer, browser headers (Sec-Fetch-*), and more. Suspicious requests are blocked automatically with temporary or permanent IP bans.
+CyberPulse analyzes 20+ parameters of every request: User-Agent, HTTP headers, Accept-Language, Referer, browser headers (Sec-Fetch-*), behavioral patterns, and more. Suspicious requests are blocked automatically with temporary or permanent IP bans.
 = ⚡ Does it slow down my site? =
 …
 . 📁 Page tracking and traffic analytics
 . ✅ Whitelist management panel
 . ⚙️ Security settings with 11 bot detection options
+. ⚙️ Security settings with multiple bot detection options
 == Changelog ==
+= 5.9.1.3 =
+* ⚡ Performance: Lowered the default Rate Limiting threshold from 60 to 40 requests per minute. Added a smart collapsible guide in the UI to help users choose the right value (with CGNAT and mobile carrier warnings).
+* 🛡️ Custom Static 403 Page: When .htaccess protection blocks a bot, it now displays a beautifully styled cyberpulse-403.html page instead of the hosting provider's default error page.
+* 🔧 Better UX: Replaced the "Back to Home" button with a "Refresh Page" button on the static block page, which is more useful for temporary blocks.
+* 🔒 New Free Feature: Force HTTPS 301 redirect with proxy-loop protection, full-width UI, and translations for all 10 supported languages.
 = 5.9.1.2 =
 …
 == Source Code ==
+The original unminified developer source code is available at:
+https://github.com/gataurus/cyberpulse
+The original unminified developer source code is available inside the plugin package (in the .zip archive) or via the WordPress.org SVN repository.

Plugin Directory

Context Navigation

Legend:

cyberpulse/trunk/assets/js/cyberpulse-403.js

cyberpulse/trunk/cyberpulse-core.php

cyberpulse/trunk/cyberpulse-htaccess.php

cyberpulse/trunk/cyberpulse-tabs.php

cyberpulse/trunk/cyberpulse.php

cyberpulse/trunk/languages/cyberpulse-de_DE.php

cyberpulse/trunk/languages/cyberpulse-en_US.php

cyberpulse/trunk/languages/cyberpulse-es_ES.php

cyberpulse/trunk/languages/cyberpulse-fr_FR.php

cyberpulse/trunk/languages/cyberpulse-it_IT.php

cyberpulse/trunk/languages/cyberpulse-ja.php

cyberpulse/trunk/languages/cyberpulse-ko_KR.php

cyberpulse/trunk/languages/cyberpulse-pt_BR.php

cyberpulse/trunk/languages/cyberpulse-ru_RU.php

cyberpulse/trunk/languages/cyberpulse-zh_CN.php

cyberpulse/trunk/readme.txt

Download in other formats: