Elohim Cyber Guardian

Changelog

1.3

Security and code-quality release addressing the WordPress.org plugin review.

• Removed all PHP session usage. The math CAPTCHA answer and the rate-limit block notice were previously held in $_SESSION, which forced session_start() and made every visitor uncacheable, bypassing server-side page caches such as Nginx FastCGI cache and Varnish. Both now use short-lived transients, so the plugin is fully compatible with full-page caching and managed WordPress hosts.
• The math CAPTCHA challenge is now a single-use, 5-minute token carried in a hidden form field. A token is invalidated on every verification attempt, correct or not, so an answer can never be replayed.
• Restructured the custom login handler so the request nonce is verified before any other value is read from $_POST. Verified values are collected once and passed to the CAPTCHA and login-completion steps as arguments; those methods no longer read superglobals at all.
• Failed logins through the custom login URL now fire WordPress core’s wp_login_failed action. Previously they did not, which meant such attempts were invisible to this plugin’s own logging and email alerts, and to any third-party brute-force protection the site owner had installed.
• Replaced the $_SERVER[‘ELOGUARD_INTERNAL_LOGIN’] signalling flag with a private static class property. $_SERVER is request input, not plugin storage.
• Fixed the escaping of the reCAPTCHA site key in inline JavaScript. esc_js() is intended for quoted HTML attributes; the value is now emitted with wp_json_encode(), the correct escaper for a raw script context. The site key in the Google API URL is now passed through rawurlencode().
• eloguard_req_string() now sanitizes as it reads rather than returning a raw value for callers to sanitize separately. A clearly separated eloguard_req_raw_string() is used only for passwords, which must not be sanitized.
• Fixed several inputs that were unslashed or sanitized a line away from where they were read, including the alert email address, REMOTE_ADDR in the log viewer, and the hardening settings AJAX payload.
• Proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) are now validated with FILTER_VALIDATE_IP before being trusted, in the emergency-access path as well as the honeypot.
• Added range validation to the reCAPTCHA v3 score threshold, the email alert throttle, the maximum attempt count, and the block duration.
• Split compound nonce conditions in the CAPTCHA and rate-limit settings pages into sequential capability and nonce guards, so the checks cannot be accidentally bypassed by a later edit.
• Replaced a CAPTCHA verification routine that looped over guessed method names inside a catch-all try/catch, which could silently fail open, with a single explicit call.
• Renamed plugin variables that collided with WordPress globals ($page, $per_page, $type, $tabs, $path, $file).
• Validated the outbound email alert address with is_email() before storing it.
• Expanded the External Services disclosure to state exactly what data is sent to Google reCAPTCHA and ipapi.co and when, and removed the outdated note about PHP sessions.
• Diagnostic error_log() calls in the hardening module now only run when WP_DEBUG is enabled.
• Renamed the “free plan” wording in the logs screen to “Community edition” and documented the 3 blocked-IP limit in this readme.
• Expanded “Requires at least” to 6.2 to reflect use of the %%i identifier placeholder in $wpdb->prepare().
• Updated “Tested up to” to 7.0.2.
• Prefixed all file-scope variables in admin templates with eloguard_ (WordPress.NamingConventions.PrefixAllGlobals).
• Replaced esc_sql() table-name interpolation with $wpdb->prepare() + %%i throughout dashboard, logs, email, and the migration routine, removing PluginCheck.Security.DirectDB.UnescapedDBParameter warnings.
• Annotated core hook calls (login_form, login_head, wp_login, etc.) in class-admin-url.php to suppress false-positive NonPrefixedHooknameFound warnings.
• Annotated the hardening module’s root .htaccess write to suppress PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected.
• Added NoCaching ignore annotations on real-time security counts and one-time migration schema checks.

1.2

• Renamed the “ecs” prefix (too short per WordPress.org guidelines) to “eloguard” across all functions, classes, defines, hooks, transients, database tables, and option names
• Added automatic one-time migration so existing installs’ settings, logs, and blocked IPs carry over from the old “ecs_” names to the new “eloguard_” names
• Removed global define(‘CONCATENATE_SCRIPTS’, false) — script concatenation is now only disabled on this plugin’s own admin pages, not site-wide
• Removed global define(‘DISABLE_WP_CRON’, true) — the plugin now shows an admin notice with instructions instead of silently changing this site-wide setting for every other plugin
• Replaced define(‘FORCE_SSL_ADMIN’, true) with WordPress core’s force_ssl_admin() function, so enabling HTTPS enforcement no longer defines a raw global constant
• Fixed late-escaping issue on the admin menu icon CSS output

1.1

2026-05-08
Initial Public Release

• Removed all license-gated feature restrictions — all features are fully free
• Fixed unprepared database queries across dashboard and logs pages
• Replaced direct file operations with WP_Filesystem API
• Moved inline scripts and styles into wp_enqueue_script() / wp_enqueue_style() across all admin pages
• Added capability checks to all admin page files
• Fixed chart data arrays not being built from query results
• Improved security score calculation
• Fixed admin menu position to avoid conflicting with core WordPress menu items
• Performance optimizations — caching added to all dashboard queries