=== Guard DL ===
Contributors: devlemon
Tags: security, hardening, xml-rpc, login, headers
Requires at least: 6.3
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight WordPress hardening with transparent, reversible protections for login, XML-RPC, version exposure, and security headers.

== Description ==

Guard DL is a lightweight WordPress hardening plugin. It does not try to replace a firewall or a full security suite. Instead, it offers a small number of well-understood, reversible protections that reduce common, low-effort attack vectors.

Each protection is listed on a single settings page with a clear name, a plain-language description, and an on/off switch. Nothing is hidden, nothing is automatic, and nothing changes on your site unless you enable it (protections that carry compatibility risk, such as disabling XML-RPC, start turned off).

**Philosophy:** simple WordPress protection without unnecessary complexity.

= What Guard DL does =

* **Disable File Editing** — Prevents theme and plugin files from being edited through the built-in WordPress file editors.
* **Block User Enumeration** — Blocks numeric `?author=N` requests used to discover usernames, without breaking legitimate author archive pages.
* **Generic Login Errors** — Shows a single generic login error message instead of revealing whether a username exists.
* **Disable XML-RPC** — Optional. Disabled by default. Turns off XML-RPC for sites that do not need it.
* **Reduce WordPress Version Exposure** — Removes the WordPress version number from the site's HTML output and feeds.
* **Limit Public User Exposure** — Optional. Disabled by default. Restricts the REST API users endpoint to logged-in requests only, without disabling the REST API itself, the block editor, or authenticated integrations.
* **Security Headers** — Adds the low-risk `X-Content-Type-Options` and `Referrer-Policy` HTTP headers.

= What Guard DL does not do =

Guard DL does not claim to stop every attack, and it does not make WordPress "unhackable." It is not an antivirus, it is not a firewall or WAF, and it does not perform malware scanning. It is one small, honest part of a broader security practice that should also include strong passwords, regular backups, and keeping WordPress, themes, and plugins updated.

= Privacy =

Guard DL does not collect any personal data. It does not use analytics, telemetry, or tracking of any kind, and it does not send any data to DevLemon or to any third party. All protections run entirely on your own server using native WordPress hooks and filters. No external services are contacted, no remote code is downloaded, and no external requests are made by this plugin.

= Data storage =

Guard DL stores its settings in a single WordPress option (`gdl_settings`). No custom database table is created. Uninstalling the plugin removes that option and nothing else; no WordPress core data or data from other plugins is touched.

== Installation ==

1. Upload the `guard-dl` folder to the `/wp-content/plugins/` directory, or install the plugin directly through the WordPress admin **Plugins → Add New** screen.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **Tools → Guard DL** to review and toggle each protection.

== Frequently Asked Questions ==

= Will Guard DL slow down my site? =

No. Guard DL is intentionally lightweight. It only registers the hooks needed for the protections you have enabled, loads its admin assets solely on its own settings page, and does not perform any external HTTP requests, scheduled tasks, or database queries beyond reading its single settings option.

= Does Guard DL replace a firewall or a full security plugin? =

No. Guard DL focuses on a small set of preventive, easily understood hardening measures. It is not a firewall, it does not scan for malware, and it does not detect brute-force attacks or maintain any kind of threat intelligence database.

= Will "Disable XML-RPC" break anything? =

It can, if you rely on an application or an external publishing service that uses XML-RPC (for example, some mobile publishing apps or certain third-party integrations). This is why the protection is turned off by default. Only enable it if you are sure you do not need XML-RPC. Disabling XML-RPC does not affect the WordPress REST API.

= Will "Limit Public User Exposure" break Gutenberg or WooCommerce? =

No. This protection only restricts the public, unauthenticated `/wp/v2/users` REST API route. Requests made while logged into wp-admin, the block editor, and authenticated integrations are unaffected. The REST API itself is never disabled.

= Does Guard DL modify wp-config.php or any WordPress core file? =

No. Guard DL never edits WordPress core, theme, or plugin files on disk. All protections are implemented at runtime using standard WordPress hooks and filters.

= Does Guard DL send any data to DevLemon? =

No. Guard DL does not collect data, does not phone home, and does not contact any external server. It runs entirely on your own site.

= What happens to my settings if I deactivate the plugin? =

Your settings are preserved. Deactivating the plugin simply stops its protections from running; reactivating it restores your previous configuration. Settings are only permanently removed if you delete the plugin through the WordPress Plugins screen.

== Screenshots ==

1. The Guard DL settings screen under Tools → Guard DL, showing the Security Status summary and the list of individual protections with their on/off switches.

== Changelog ==

= 1.0.0 =
* Initial release.
* Disable File Editing protection.
* Block User Enumeration protection.
* Generic Login Errors protection.
* Disable XML-RPC protection (disabled by default).
* Reduce WordPress Version Exposure protection.
* Limit Public User Exposure protection for the REST API users endpoint (disabled by default).
* Security Headers protection (X-Content-Type-Options and Referrer-Policy).
* Full translations for English, Brazilian Portuguese, and Spanish.
