=== Content Guardian ===
Contributors: gexirosecurity
Tags: content protection, copy protection, disable right click, image protection, anti scraping
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 3.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight, zero-dependency WordPress content protection plugin blocking right-click, unauthorized text selection, clipboard copying, and image dragging.

== Description ==

**Content Guardian** by Gexiro Security protects your WordPress articles, guides, and media against casual copying with zero external JavaScript dependencies and full compatibility with Windows, macOS (`Cmd` key), iOS, and Android.

= Core Features (Free Edition) =

* **Right-Click Shield:** Disables the browser context menu across frontend posts and pages.
* **Smart Text Selection Shield:** Prevents text highlighting while keeping `<input>`, `<textarea>`, and comment/checkout forms 100% usable.
* **Cross-Platform Copy & Cut Blocker:** Blocks `Ctrl+C`, `Cmd+C`, `Ctrl+X`, `Cmd+X`, `Ctrl+A`, `Cmd+A`, and native DOM `copy`/`cut` clipboard events.
* **Image Drag & Save Shield:** Prevents dragging images out of the browser window.
* **PHP2Shell Hardened AJAX Telemetry:** Uses `application/x-www-form-urlencoded` (`URLSearchParams`) and rejects `multipart/form-data` and NUL-byte payloads.
* **Clean Opt-In Uninstall:** Preserves settings across PRO upgrades by default, with an optional GDPR/hygiene clean-uninstall toggle.
* **Administrator Bypass:** Logged-in administrators can inspect and copy content normally.

= Content Guardian Pro (21-Layer Autonomous & Black October Hardened Edition) =

Upgrade to **Content Guardian Pro** for enterprise anti-scraping, headless API protection, EU AI Act TDM compliance, forensic DRM, asymmetric Ed25519 update security, and Edge-WAF capabilities:

* **Headless REST API, RSS/Atom, oEmbed & XML-RPC Shield (Module 20):** Stops scrapers from bypassing frontend protections via `/wp-json/wp/v2/posts`, `/feed/`, and `xmlrpc.php` while preserving full Gutenberg editor access.
* **EU AI Act W3C TDM-Reservation & `/llms.txt` Policy (Module 21):** Serves machine-readable `TDM-Reservation: 1`, `X-Robots-Tag: noai, noimageai`, `/.well-known/tdmrep.json`, and `/llms.txt` legal reservations.
* **Black October & PHP2Shell Shield (Module 19):** Live PHP patch auditor (`CVE-2026-109618` / `CVE-2026-109619`), SHA-256 file integrity verifier, runtime exploit blocker, and 1-Click Cloudflare Edge Virtual Patch.
* **Asymmetric Ed25519 Signed Updates:** Neutralizes compromised update server / CDN supply-chain attacks (`CVE-2026-111862`) before archive extraction.
* **Forensic Zero-Width Canary DRM & Decoder:** Invisibly embeds the Post ID, User ID, exact IPv4 address, and UTC timestamp into copied text with a built-in Forensic Decoder in WP Admin.
* **Closed Shadow-DOM Encrypted Vault (`[guardian_vault]`):** Encrypts sensitive text in the raw HTML source (`Ctrl+U` / `cURL`) and renders it inside a closed Shadow DOM root.
* **Edge-WAF Auto-Ban & Sodium-Encrypted Cloudflare Sync:** Automatically blocks aggressive scraper IPs locally and at the Cloudflare Edge while encrypting API tokens at rest via `sodium_crypto_secretbox`.

== Installation ==

1. Upload the `content-guardian` folder to `/wp-content/plugins/` or install the ZIP archive via **Plugins -> Add New -> Upload Plugin**.
2. Activate **Content Guardian** through the **Plugins** menu in WordPress.
3. Configure your protection preferences under **Settings -> Content Guardian**.

== Changelog ==

= 3.3.0 =
* Added opt-in Clean Uninstall (`uninstall.php`) and directory-listing `index.php` guards across all plugin folders.
* Updated PRO module overview to 21 layers (including Headless REST/RSS Shield and EU AI Act W3C TDM-Reservation & `/llms.txt`).
* Removed debug console output from admin JavaScript and updated all 8 commercial localization packs.

= 3.2.0 =
* Black October (October 2026) hardening: raised minimum PHP requirement to `8.2+` (EOL PHP 7.x/8.0/8.1 dropped).
* Replaced frontend `FormData` (`multipart/form-data`) telemetry requests with `URLSearchParams` (`application/x-www-form-urlencoded`) and enforced server-side `HTTP 415` multipart & `HTTP 400` NUL-byte rejection (`CVE-2026-109619` / `CVE-2026-105482` defense).

= 3.1.0 =
* Rebranded under Gexiro Security (`v3.1.0`).
* Added full macOS `Cmd` (`metaKey`) shortcut support and native DOM `copy`/`cut` event interception.
