=== WP Deep Scan ===
Contributors: codecircleio
Tags: security, malware, scanner, redirect, wordpress security
Requires at least: 6.0
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stealth malware hunter for WordPress. Finds ghost plugins, database snippets, and conditional redirects that file scanners miss.

== Description ==

WP Deep Scan is a defensive WordPress security plugin built for infections that hide from Wordfence, Sucuri SiteCheck, and other file-integrity tools.

Modern redirect malware often:

1. Installs a real plugin from WordPress.org (WPCode, Code Snippets, decoy header/footer plugins)
2. Stores the payload in the database as a snippet or autoloaded option
3. Hides the plugin with the `all_plugins` filter
4. Redirects only first-time, mobile, or Google visitors

File checksums pass. Remote scanners request the site once as a bot and report clean.

WP Deep Scan is designed around that gap.

= Unique modules =

* **Ghost Inventory** — compares plugin folders on disk, the dashboard list, and the `active_plugins` option
* **Hidden & Extra Files** — Cursor-style disk listing: hidden folders, headerless plugins, extra PHP inside official plugins, disguised images, stray wp-content files
* **Early Witness** — optional MU-plugin that snapshots folders before other plugins can lie
* **Hook Trap** — inspects live callbacks on hide/redirect hooks
* **Snippet Intelligence** — WPCode, Code Snippets, Woody, HFCM, header/footer options
* **Database Ghost** — entropy and obfuscation scoring on autoloaded options
* **Persona Redirect Lab** — eight visitor personas (mobile, Google, first visit, bot)
* **Hidden Users** — administrators missing from the Users screen
* **MU-plugins & drop-ins**
* **Cron / reinfection watch**
* **Official checksums** for core and wp.org plugins
* **Hardening tests**
* **One-click playbooks** with quarantine restore points
* **File Manager** that reads the disk directly
* **SSH inspector** (PHP ssh2) to look at the server outside WordPress hooks
* **Ask AI** — bring your own key (OpenAI-compatible or Anthropic). Point it at a file or folder; it reads text and suggests next steps. Nothing is executed.
* **Firewall** — early MU-plugin WAF with tripwires on scanner findings, cookie-backdoor shield, upload PHP block, login lockout
* **Emergency lockout** — freeze wp-admin, login, and registration while the public site stays up, or put the whole site under maintenance
* **Automatic scans** — schedule a full scan daily, weekly, monthly, or on a chosen date

= What this plugin does not do =

It does not hide malware. It does not attack other sites. It does not execute scanned files. AI and SSH are optional and only run when an administrator asks.

== Installation ==

1. Upload the `wp-deep-scan` folder to `/wp-content/plugins/`
2. Activate **WP Deep Scan**
3. Open **WP Deep Scan** in the admin menu
4. Enable Early Witness in Settings
5. Run a deep scan
6. Apply playbooks on Findings

== Frequently Asked Questions ==

= Does this replace Wordfence? =

No. Use it when file scanners report clean but visitors are still redirected, or when you need a disk-vs-dashboard inventory.

= Is my AI key sent anywhere automatically? =

No. The key is encrypted with the site salt and only sent when you click Analyze.

= Will playbooks break my site? =

Playbooks that delete or move items create a quarantine restore point when possible. Confirm the finding first.

== Changelog ==

= 1.1.2 =
* Intel Sync reads the form, accepts a pasted API path, and explains a missing key.

= 1.1.1 =
* Beta logs (local + Intel), theme checksum skip, scan time budget, live Intel URL.

= 1.1.0 =
* Intel signatures, allowlist, playbooks, Persona Lab evidence, scanner UI.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.0 =
First public version.
