=== Shieldome Security Scanner ===
Contributors: shieldome
Tags: security, vulnerability scanner, owasp, malware scan, security audit
Requires at least: 5.8
Tested up to: 6.6
Stable tag: 1.0.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Scan your WordPress site for OWASP Top 10 vulnerabilities directly from the wp-admin dashboard, powered by Shieldome.

== Description ==

Shieldome Security Scanner brings automated vulnerability scanning into your WordPress dashboard. Instead of leaving wp-admin to run a security check, trigger an OWASP Top 10:2025 scan of your site and see the result - security grade, risk score, and findings - right where you already work.

= What it checks =

* Exposed configuration and backup files
* Outdated WordPress core, themes, and plugins with known vulnerabilities
* XML-RPC exposure and brute-force attack surface
* Missing or misconfigured security headers
* SSL/TLS certificate validity and configuration
* Debug information and verbose error disclosure
* User enumeration via author archives
* OWASP Top 10:2025 checks - the same engine used by the Shieldome SaaS platform

= How it works =

This plugin does not scan your site locally - it calls the Shieldome API (app.shieldome.com) to run the scan and reports the result back to your dashboard. **Using it requires a Shieldome account and an active plan** (a free trial is available at signup); the plugin itself is free, but the scanning service it connects to is a paid SaaS product beyond the trial period. See [shieldome.com](https://shieldome.com) for current plans.

= Data sent to Shieldome =

When you trigger a scan, this plugin sends your configured target URL to the Shieldome API (app.shieldome.com) for scanning, authenticated with the API key you provide in Settings. No content from your site's database, posts, or user data is transmitted - only the URL being scanned and the resulting scan metadata (status, grade, risk score) sent back. See the [Shieldome Privacy Policy](https://shieldome.com/privacy) for details on how scan data is handled.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/shieldome-scanner`, or install directly through the WordPress plugins screen.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to **Shieldome → Settings** and enter your Shieldome API key (get one at [app.shieldome.com/account](https://app.shieldome.com/account) - sign up for a free trial if you don't have an account yet).
4. Go to **Shieldome** in the admin menu and click **Scan Now**.

== Frequently Asked Questions ==

= Do I need a Shieldome account? =

Yes. The plugin is a dashboard interface to the Shieldome scanning service - it needs an API key from a Shieldome account to run scans. Create one at [app.shieldome.com](https://app.shieldome.com); new accounts include a free trial.

= Is this plugin free? =

The plugin itself is free and open source (GPLv2). Running scans through it uses your Shieldome account's plan the same way the Shieldome web dashboard does - there is no separate charge for using the plugin versus the website.

= Does this scan run on my server? =

No. Scans run on Shieldome's infrastructure against your site's public URL, the same as an external visitor would see it. This plugin only triggers the scan and displays the result - it adds no scanning load to your own server.

= What data does the plugin store on my site? =

Only your API key, target URL, and the summary of your most recent scan (grade, risk score, date) - stored as standard WordPress options. Full scan details and history live in your Shieldome account, not on your WordPress site.

= Can I scan a site other than the one the plugin is installed on? =

Yes. Set a different **Target URL** in Shieldome → Settings.

== Screenshots ==

1. Scan results in the Shieldome dashboard widget
2. Settings page - API key and target URL configuration

== Changelog ==

= 1.0.1 =
* Fixed: scan requests were rejected due to an incorrect authentication header (the plugin previously could not successfully start a scan under any configuration)
* Fixed: the target URL was not being sent correctly to the scan API
* Fixed: scan results (grade, risk score) were read from the wrong response field and never displayed after a completed scan

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 1.0.1 =
Fixes scans not starting or completing. Update required for the plugin to function.
