=== DWD Security ===
Contributors: dizwebdesign
Tags: security, 2fa, firewall, hardening, login
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Site hardening, login protection including email and SMS 2FA, local firewall, integrity scans, and activity logs.

== Description ==

DWD Security adds on-site hardening, headers, login lockouts, optional hide-login, email and SMS two-factor, password policy, idle sessions, XML-RPC/REST lockdown, a local request firewall, core integrity scans, and an activity log.

Started from the DWD BasePlugin scaffold (Hub, upgrades, Tools, backup, Multisite). Hide login and 2FA stay off until you enable them.

== Installation ==

1. Upload the `dwd-security` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Open **DWD Security** (or under DWD Plugins Hub) and use the tabbed screens.

== Changelog ==

= 1.1.6 =
* Idle timeout: allow logging back in after a session expires, and show an inactivity message on the login screen.

= 1.1.5 =
* Plugin Check: set Tested up to WordPress 7.1.

= 1.1.4 =
* Plugin Check: WordPress.org readme headers, UTF-8 without BOM already shipped, sanitization/nonces, wp_delete_file, identifier-prepared audit SQL, no hidden files in the ZIP, drop manual load_plugin_textdomain.

= 1.1.3 =
* Strip UTF-8 BOM from PHP includes so REST JSON stays valid.

= 1.1.2 =
* Manual Plugin Check exception on the Firewall tab.

= 1.1.1 =
* Activity log shows the WordPress username for logged-in users.

= 1.1.0 =
* Text-message 2FA (carrier email-to-text or Twilio).

= 1.0.1 =
* Fix Tools and backup restore forms; tighten restore and ZIP packaging.

= 1.0.0 =
* First release.
