ScrapeLock 3.3.0

ScrapeLock 3.3.0 – Content & AI Bot Protection for WordPress.

Install: download scrapelock.zip below, then in WordPress go to Plugins → Add New → Upload Plugin.

Changes
New: Lockdown seal. The lock state and the file fingerprint are signed (HMAC-SHA256) with a key derived from the keys in wp-config.php, which are not in the database. A must-use plugin, scrapelock-lockdown-guard.php, holds a signed copy of the lock while the site is locked and keeps ScrapeLock active if it is removed from the active plugins in the database. Deleting or changing the lock in the database, or putting back an older copy, leaves the site locked, and the unlock page refuses to work with forged data. The guard is removed when you unlock fully or deactivate ScrapeLock.
New: when you lock, the protected settings (active plugins, theme, site address, admin email, registration, default role, user roles, uploads folder, search engine visibility, ScrapeLock's own settings) and the list of administrators are saved, signed. A protected setting changed directly in the database is put back on the next request; an account given administrator rights that way cannot sign in while the site is locked and is reported by the hourly check. Each kind of finding is logged and emailed at most once an hour.
New: a temporary unlock gives the rights back only to the administrator who unlocked. Other staff stay frozen until the site is locked again or unlocked fully.
New: protected while locked: the uploads folder and its address, and "Discourage search engines".
Integrity: a fingerprint that was changed, deleted or replaced with an older one in the database is reported as tampered (critical in Site Health) and is never silently replaced while locked.
Site Health: a recommendation when AUTH_KEY / AUTH_SALT are not set in wp-config.php (the signatures rely on them), when the guard is missing while locked, or when the hourly file check has not run for three hours.
Upgrade: data saved by earlier versions is signed on the upgrade to 3.3.0; changing the keys in wp-config.php is reported but never locks you out on its own.