v2.5.0 — Hardening + 2FA + GDPR + UI Overhaul

🎉 Major Release v2.5.0

Comprehensive security hardening, TOTP two-factor authentication, GDPR compliance,
multisite support, real-time monitoring dashboard, and full UI redesign.

🔒 Security Hardening (v2.3.0 → v2.5.0)

• Updater: sslverify ON by default, HTTPS pinning for package URLs, sanitized popup info
• Logger/Notifications/Pulse: SSL verify enforced on all cloud calls
• Quarantine: strict path validation, md5 ID whitelist, atomic writes, symlink protection
• Scanner neutralize_file: whitelist ABSPATH/WP_CONTENT, free original content from memory
• API Client: removed server_ip/admin_email leaks
• Settings page: nonce-gated license auto-refresh (CSRF protection)
• Firewall: rate-limit public debug endpoint (anti-fingerprinting)
• Cron: plugin integrity check before any cloud calls
• Activator: md5 manifest of plugin files for tamper detection
• Login questions: no plaintext storage, length caps

🆕 New Modules

• Hardening — .htaccess protection (wp-config, wp-includes, uploads PHP-block), security headers (CSP, COOP, COEP, Permissions-Policy, HSTS)
• TOTP 2FA — RFC 6238 with QR code + backup codes, replay protection, timing-safe compare
• Session Hardening — rotation after login, IP/UA binding, concurrent limit, inactivity timeout
• Anomaly Detection — new IP, unusual hour, multi-IP per user, email alerts
• GDPR Compliance — IP anonymization (IPv4/IPv6), data export/erasure (WP privacy tools), retention policy
• Hotlink Protection — 1×1 transparent PNG for off-site embeds
• Email Notifications — admin login, brute force, malware, integrity
• Comment Antispam — honeypot + time-token (≥4 sec)
• Password Policy — min length + complexity + HIBP k-Anonymity breach check
• REST API restriction — unauth users blocked from /wp-json/wp/v2/users
• Author enumeration blocking — ?author=N 301 redirect
• HTTP method whitelist — TRACE/PROPFIND blocked
• Cache plugin compatibility — auto-detect WP Rocket, W3TC, LiteSpeed, Redis
• Multisite support — network-wide + per-site override, drop tables on site delete
• Monitoring dashboard — Chart.js timeline, top-10 IPs, country stats
• Health check + diagnostics — 10 env checks + JSON export
• First-run wizard — 4 animated steps with progress

🎨 UI/UX Overhaul

• Design tokens — 60+ CSS variables (color, shadow, spacing, radius)
• Glass morphism hero — animated gradient + backdrop blur
• Dark mode — automatic via prefers-color-scheme + manual toggle
• Status pills with pulse-dot for active states
• Mode cards — radio-cards with smooth selection + glow
• Security Score ring — animated circular 0-100 indicator
• Skeleton loaders with shimmer effect
• Toast notifications — slide-in with auto-dismiss
• Confirmation modals — Promise API (replaces native confirm)
• Animated counters — easeOutCubic for metrics
• Command palette — Ctrl/Cmd+K for quick navigation
• Drag-and-drop — reorder for IP lists and signatures
• Chart.js — custom tooltips + animations
• 3 SVG illustrations for empty states
• prefers-reduced-motion support
• Responsive mobile-first layout

🧪 Quality

• PHPUnit bootstrap + unit tests for TOTP and password policy
• i18n-ready — all strings via __() / esc_html__()
• Object cache for WAF signatures (1h TTL)

📊 Statistics

• 25 files modified, 18 new
• +10,000 / -2,500 lines of code
• All 35+ PHP files pass php -l syntax check
• All JS files pass node --check

⚠️ Breaking Changes

• Default ssl_verify_api flipped from 0 → 1 (good thing, but admins who relied on the old default must update their settings)
• Plaintext storage of legacy login questions removed (data is rehashed on next save)

🔧 Upgrade Notes

1. Backup your database before updating
2. The plugin will automatically generate a file integrity manifest on activation
3. Run Hardening → Apply rules to enable .htaccess protection
4. Enable Settings → ssl_verify_api (now default ON) for safer API calls
5. Optional: enable 2FA → Required for all admins for stronger authentication

📦 Requirements

• WordPress 5.0+ (recommended 6.0+)
• PHP 7.4+ (recommended PHP 8.x)

---

Full changelog: see README.md