=== OpenShield Malware Scanner ===
Tags: malware, security, scanner, integrity, hacked
Requires at least: 6.4
Tested up to: 7.0.2
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A free, read-only WordPress malware and integrity scanner with evidence and remediation guidance.

== Description ==

OpenShield scans the WordPress installation from inside the site. It checks:

* WordPress core checksums.
* PHP, JavaScript, HTML, .htaccess, and .user.ini files.
* PHP files inside uploads.
* Common obfuscation and backdoor indicators.
* Fake CAPTCHA / ClickFix indicators.
* Selected database injection signatures in options, posts, and post meta.
* The public homepage output.
* Recent administrator accounts and basic hardening settings.

The plugin produces a risk score from 0 to 100. This score is an indicator, not a mathematical probability that the site is hacked.

The scanner is read-only. It does not automatically delete, repair, quarantine, or change files.

== Installation ==

1. Upload the plugin ZIP through Plugins > Add New > Upload Plugin.
2. Activate OpenShield Malware Scanner.
3. Go to Tools > OpenShield Scanner.
4. Run a Quick Scan first. Use Deep Scan when the server has enough resources.

== Frequently Asked Questions ==

= Does a score of 0 guarantee my site is clean? =

No. Signature scanners can miss new, encrypted, conditional, or server-level malware. Use the report together with hosting logs, file integrity checks, backups, and a server-side security scanner.

= Why does the plugin call the WordPress checksum API? =

Official checksums are used to verify WordPress core files. If the server cannot make outbound HTTPS requests, this check is reported as unavailable.

= Does the plugin scan arbitrary remote websites? =

No. This first release scans the WordPress installation where it is installed. A public URL-scanning service requires separate hosted infrastructure, queue workers, crawler controls, and abuse prevention.

= Does it remove malware? =

No. Automatic deletion can break a site and destroy evidence. OpenShield reports the location, evidence, severity, and a recommended next action.

== Changelog ==

= 0.1.0 =
* Initial MVP release.
* AJAX-based incremental scanning.
* Core checksum verification.
* File, database, configuration, and homepage checks.
* JSON report export.
