=== LocalGuard Scanner ===
Contributors: localguard-scanner-contributors
Tags: security, malware, scanner, integrity, privacy
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Local, explainable malware scanning for WordPress files and database content. Report-only, with no telemetry.

== Description ==

LocalGuard Scanner inspects a WordPress installation without sending files, database values, or scan results to an external service.

It provides:

* Manual and daily resumable scans.
* Bundled, signed detection rules and WordPress core SHA-256 catalogs.
* Exact core-file trust that suppresses malware heuristics only after a signed hash match.
* Bounded PHP data-flow checks that distinguish real dangerous flows from nearby legitimate code.
* Token-verified informational handling for inert PHP files in uploads, regardless of filename.
* A signed offline advisory snapshot for selected unpatched plugins.
* Contextual file and database checks.
* Explainable risk scores and deduplicated findings.
* Guided, color-coded finding explanations with safe next steps.
* Separate source tabs for file, database, and plugin findings, with filtered counts and pagination.
* Human-readable database locations and copyable read-only SQL queries for supported content, option, and user records.
* Redacted email summaries for new high or critical findings.
* Explicit complete or partial coverage status.
* English and Spanish interfaces.
* Multisite support restricted to super administrators.

Version 1.2 only reports. It does not delete, edit, repair, or quarantine anything.

No malware scanner can guarantee that a site is clean. New or heavily obfuscated malware may not be detected, and legitimate code can cause false positives. Always investigate findings and keep tested off-site backups.

== Installation ==

1. Upload the plugin ZIP through Plugins > Add New > Upload Plugin.
2. Activate LocalGuard Scanner. On Multisite, use network activation.
3. Open LocalGuard > Scan and review Local diagnostics.
4. Select Scan now.
5. On a constrained shared VPS, use a batch size of 25–50.

== Frequently Asked Questions ==

= Does LocalGuard upload my site data? =

No. The runtime scanner contains no outbound HTTP or socket calls. Rules and integrity catalogs are packaged with the plugin.

= Does it remove malware? =

No. Version 1.2 is report-only. This prevents an uncertain detection from modifying a live site.

= What does partial coverage mean? =

At least one area could not be inspected fully, for example because of permissions, an exclusion, a size limit, a symbolic link, or an unavailable exact core manifest. A partial result must not be treated as clean.

= Will automatic scans work when WP-Cron is disabled? =

Not by themselves. Configure a system cron to invoke WordPress cron. The plugin reports the condition locally.

= How are rules updated? =

By installing a newer signed plugin release. The scanner does not download rules during a scan.

== Privacy ==

Scan processing and persistence remain on the WordPress server. Alert emails contain counts and an authenticated dashboard link, not paths or inspected content. The plugin adds no telemetry.

== Changelog ==

= 1.2.6 =

* Prevents consecutive scan batches from reporting `LGS-LOCK-LOST` when WordPress already stores the requested lock renewal.
* Continues to stop safely when the lock is missing, belongs to another scan, or cannot be renewed to the required expiry.

= 1.2.5 =

* Separates file, database, and plugin findings into source-aware tabs.
* Shows database records as table, ID or option name, and site instead of path-like internal identifiers.
* Provides copyable `SELECT` queries and structured investigation, conditional correction, and verification guidance without executing changes.
* Adds an accessible Garaje Imagina attribution to Overview with a direct, tracking-free product link.

= 1.2.4 =

* Confirms individually when a previously reported file no longer exists and moves that finding to History.
* Reconciles deleted files in resumable batches even when an unrelated file makes global coverage incomplete.
* Preserves existing, excluded, symbolic-link, hostile, or unverifiable paths in Active findings.
* Shows aggregate previous-findings progress without exposing the paths being checked.

= 1.2.3 =

* Separates active findings from resolved audit history.
* Resolves stale findings by verified scan area, so a database limitation no longer keeps deleted-file warnings active.
* Shows coverage by area and reconciles totals when the site changes during a scan.

= 1.2.2 =

* Adds a resumable inventory phase and exact item progress for active scans.
* Shows persisted scan stages, activity, provisional finding counts, and safe failure diagnostics.
* Validates required database columns and upgrades existing installations without losing scanner data.

= 1.2.1 =

* Fixed a false negative: files whose only opening tag was `<?=` or a bare short tag were never analyzed.
* Fixed a lifecycle defect where a single excluded directory stopped every finding from ever being resolved.
* Separated deliberately excluded areas from areas the scan could not read, and reported both.
* Findings inside an excluded directory are no longer resolved automatically, because they were not re-inspected.
* Aligned the suppression model across schema, repository, service and lifecycle, with site scope and revocation.
* Stored the evaluated file trust and the inode change time instead of discarding them.

= 1.2.0 =

* Replaced the dense findings table with an accessible expandable list.
* Added guided explanations, context, confidence and safe review steps for every detector.
* Improved Overview, Scan, diagnostics and Settings with clearer states and practical guidance.
* Added severity colors that are always accompanied by labels and symbols.
* Preserved authenticated-only, report-only, local, Multisite and shared-VPS behavior.

= 1.1.0 =

* Reduced false positives using exact core trust and bounded PHP data-flow analysis.
* Classified token-verified inert index files in uploads as Information.
* Added a signed offline plugin advisory catalog, initially covering User Meta through 3.1.2.
* Kept suspicious executable uploads and proven request-to-file flows visible.
* Preserved local-only, report-only, Multisite, and shared-VPS operation.

= 1.0.0 =

* Initial report-only release.
* Local file and WordPress database scanning.
* Signed rules and bundled core integrity catalogs.
* Manual and daily resumable operation.
* English and Spanish administration interface.
