=== WP Clinic ===
Contributors: famelhaut
Tags: security, malware, scanner, backup, updates
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 0.6.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scans for malware, keeps core/plugins/themes updated, and backs up your site — connected to your free or paid WP Clinic account.

== Description ==

WP Clinic is the on-site agent for the WP Clinic service (wpclinic.ai). It connects your
WordPress installation to a WP Clinic account and, depending on your plan, scans for
malicious code, keeps WordPress core/plugins/themes updated, backs up your files, and
applies AI-assisted cleanup when a threat is found.

The **free scan works standalone** with just a connection token — no payment required.
Paid plans add faster/scheduled autoscan, automatic updates, off-site backups, AI-assisted
repair of infected files, and monitoring across more sites.

= Features =

* **Malware scan**: walks `wp-content` (uploads first) looking for PHP dropped in the
  uploads folder, double file extensions, known webshell/backdoor signatures, obfuscated
  `eval()` calls, and cryptomining scripts. Also checks the database for recently created
  administrator accounts and posts/options containing injected/obfuscated code.
* **Security hardening**: one-click, reversible fixes for common misconfigurations
  (missing security headers, XML-RPC exposure, user enumeration, exposed readme/info
  files, file editor access, directory listing) plus a built-in login-URL cloak.
* **Automatic updates** (paid plans): keeps plugins, themes and WordPress core current,
  each update guarded by an automatic backup, a post-update health check, and a rollback
  if anything breaks. A manual scan/update can also be triggered from the dashboard.
* **Autoscan**: periodic scanning (daily or weekly depending on plan) via WordPress cron.
* **Backups** (paid plans): a small "repair set" backup before any automated fix, an
  on-demand full-site backup, and an opt-in weekly full backup — all stored off-site on
  WP Clinic's backup storage, not on your own hosting.
* **PHP compatibility report**: analyzes the plugins and themes actually in use to
  recommend the highest PHP version your site can safely run.
* **AI-assisted cleanup** (paid plans): when malware is found, a proposed fix is generated
  off-site and applied through the plugin's own audited code — never as a remote shell —
  always preceded by a backup and followed by a health check with automatic rollback if
  anything breaks.

This WordPress.org edition receives its own updates exclusively through the WordPress.org
plugin directory, like any other listed plugin — it does not use a custom update
mechanism for itself.

== External services ==

This plugin is a thin client: on its own, without a connection, it does nothing. To do
anything useful it must be connected — via a one-time connection token generated in your
WP Clinic account — to the WP Clinic service, using an API key issued to your site. No
data described below is sent anywhere until you complete that connection step, which
itself shows this same disclosure and links to the Terms and Privacy Policy before you
submit a token.

Once connected, this plugin communicates with the WP Clinic backend for the following,
each described with what is sent and when:

* **Connecting/licensing.** When you paste a connection token, the plugin sends your
  site's home URL and the plugin version to exchange that token for a per-site API key
  and your plan's entitlements. This happens once at connection time, and again if you
  move the site to a different WP Clinic account.
* **Periodic sync.** Roughly twice daily (WordPress cron) and right after connecting, the
  plugin sends your site URL, WordPress version, PHP version, plugin version, the current
  login URL, and a full inventory of installed plugins/themes (name, version,
  active/inactive, available updates) so the service can tell you what needs attention
  and, on plans that include it, apply updates.
* **Scan reports.** After every scan (free tier included), the plugin sends the list of
  findings — file paths/locations, finding type, and severity/detail text, not full file
  contents — so they show up in your WP Clinic dashboard and can trigger email alerts.
* **Malware-signature confirmation.** During any scan (free tier included), if a small,
  bounded set of files (at most 25 files, 1 MB each) already matches a local
  suspicious-pattern check, the plugin sends the **full contents of just those flagged
  files** to the WP Clinic service for a second, server-side confirmation pass. Files that
  don't match a local pattern first are never sent this way.
* **Off-site backups (paid plans).** Manual and scheduled full-site backups, and the
  small "repair set" backup taken automatically before any destructive action (delete,
  repair, update), are uploaded as a zip to WP Clinic's backup storage, kept for a limited
  retention window so a site can be restored.
* **AI-assisted repair (paid plans).** When you request a fix for detected malware, the
  **full contents of the specific flagged file(s)** (never your whole site) are sent to
  the WP Clinic service, which returns a proposed cleaned version. That content is used
  only to produce the fix and is not retained afterwards. The plugin applies the returned
  patch itself, using its own code — the fix is never executed as a remote script — and
  always backs up first and rolls back automatically if a post-fix health check fails.
* **Admin email breach check.** On a connected site, the plugin sends your WordPress
  admin email address to the WP Clinic service, which checks it against known public data
  breaches and returns whether/how many breaches matched (not the breach data itself).
* **Plugin/theme alternative & compatibility suggestions.** The plugin sends the slugs and
  versions of installed plugins/themes so the service can suggest actively-maintained
  alternatives or flag PHP/WordPress compatibility issues — no file contents are sent for
  this.

Separately, and independent of the WP Clinic connection above:

* **Cloudflare Turnstile (opt-in, your own keys).** If you choose to turn on the optional
  captcha/bot-protection feature on the Security tab, you paste your own free Cloudflare
  Turnstile sitekey and secret key (obtained directly from Cloudflare, not from WP Clinic).
  From then on, the login/comment/registration pages you enabled it for load Cloudflare's
  Turnstile script (challenges.cloudflare.com), and each submission's response token is sent
  to Cloudflare's siteverify endpoint for validation. No data goes to WP Clinic for this
  feature — only to Cloudflare, using your own account. See Cloudflare's Privacy Policy
  (https://www.cloudflare.com/privacypolicy/) for their handling of this data. If left off
  (the default), no data is ever sent to Cloudflare.

All of the above only happens after you connect the plugin with a valid API key; a
disconnected/inactive install sends nothing. See the WP Clinic Terms of Service
(https://wpclinic.ai/legal/terminos) and Privacy Policy
(https://wpclinic.ai/legal/privacidad) for the full data-handling and retention terms.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/wp-clinic`, or install it through the
   WordPress plugin screen directly.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. Go to the new "WP Clinic" menu item in your WordPress admin.
4. Create (or sign in to) a WP Clinic account at wpclinic.ai, go to your account's Plugin
   page, and copy the connection token.
5. Paste the token into the "Connect your site" form and submit.

== Frequently Asked Questions ==

= Is this plugin free? =

The plugin itself is free and licensed under the GPL. What it can do on your site
depends on your WP Clinic account plan: some features (autoscan cadence, auto-update,
off-site backups, AI-assisted cleanup) are limited to paid plans; a scan is available on
the free tier.

= Do I need an account? =

Yes. The plugin requires a WP Clinic account and a connection token to do anything —
without a valid connection, it stays inert and sends no data anywhere.

= What data does it send, and where? =

See "External services" above for the itemized list. In short: once connected, site
identity/version/inventory and scan-finding metadata are always sent to the WP Clinic
service; full file contents are only sent for a bounded, already-flagged set of
suspicious files (signature confirmation, on any tier) or for paid backup/AI-cleanup
features, and are not retained beyond producing that backup or fix.

= What runs on WP Clinic's server versus on my site? =

Scanning for malware, running WordPress/plugin/theme updates, and building backups all
run locally on your own site (this plugin does the work). The WP Clinic server keeps
track of your entitlements/plan, stores scan history and off-site backups, confirms
suspicious files against its own signature database, and — for AI-assisted cleanup —
analyzes a flagged file and returns a proposed patch, which this plugin then applies
locally using its own audited code (never a remote shell).

= How does this plugin update itself? =

This WordPress.org edition updates exactly like any other plugin listed on
WordPress.org — through the WordPress.org plugin directory, using WordPress's normal
update mechanism. It does not check any other server for its own updates.

== Screenshots ==

1. Dashboard overview: plan, auto-update status, autoscan cadence, site health, and last scan result.
2. Cleanup: finds files, folders and database junk that nothing on your site references anymore, and moves them to a reversible quarantine (nothing is ever deleted outright).
3. Alerts / findings list with severity and file/location detail.
4. Harden: one-click, reversible WordPress security hardening (headers, XML-RPC, user enumeration, and more).

== Changelog ==

= 0.4.72 =
* Fixed: the "PHP still executes in uploads" fix instructions now detect your actual web
  server (Apache, nginx, LiteSpeed, or OpenLiteSpeed) and control panel instead of assuming
  nginx and Plesk — OpenLiteSpeed (common with CyberPanel) does not read .htaccess at all and
  needs a different fix, which is now shown.
* Added: the Dashboard now always shows your detected web server (with version, when your
  server discloses it) and control panel, even when there is no problem to report.

= 0.4.70 =
* Cleanup: fixed a memory exhaustion that could stall restoring a large quarantined database
  item — restore now streams the snapshot row-by-row instead of loading it all at once.

= 0.4.64 =
* Cleanup: fixed the quarantine list not refreshing after an action, and failures now show
  as failures instead of a false "Done".
* Cleanup: database cleanup no longer requires a paid off-site backup — it works on all
  plans using a local, reversible snapshot.
* Cleanup: warns if the quarantine folder is reachable from the internet on Nginx.

= 0.4.63 =
* Auto-updates, cleanup, and local backups are now free on all plans.
* Consistent plugin naming throughout the admin UI.
* Assets/scripts are now properly enqueued, and plugin writes moved to the uploads directory.

= 0.4.62 =
* Fixed the Cleanup tab not opening when clicked (it fell back to the Dashboard).

= 0.4.61 =
* WordPress.org submission build: the self-hosted update mechanism (used only by the
  direct-download edition of this plugin) is fully disabled in this edition; updates for
  this edition come only from the WordPress.org plugin directory.
* Added an in-plugin external-services disclosure notice on the Dashboard tab, and this
  readme's "External services" section.

== Upgrade Notice ==

= 0.4.64 =
Cleanup fixes: quarantine list refresh, failures shown correctly, DB cleanup free on all
plans, Nginx quarantine-exposure warning.

= 0.4.63 =
Auto-updates, cleanup, and local backups are now free on all plans; minor compliance fixes.

= 0.4.61 =
First WordPress.org submission build.
