=== Faro Auditoria ===
Contributors: farowp
Tags: security, audit, hardening, xmlrpc, headers
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A read-only audit of your WordPress: twelve checks that the core does not do, explained in plain language, with history of what changed.

== Description ==

WordPress already has Site Health, and it does twenty-five things well. This plugin does not repeat them. It looks at the twelve things Site Health does not look at, explains each one and keeps the result so you can see what changed since the last audit.

**It reads. It does not touch.** No firewall, no blocking, no renaming the login, no changing salts. Nothing in this plugin writes to your site, which is exactly why it is safe to run on a live site.

The twelve checks:

1. **Security headers** - HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, one by one.
2. **Content-Security-Policy** - and whether it is actually blocking or only reporting.
3. **Abandoned plugins and themes** - more than two years without an update, or removed from the directory.
4. **Forgotten files in the root** - `.git/config`, `.env`, `wp-config.php.bak`, `debug.log`, `backup.sql`, `backup.zip`, `readme.html`.
5. **PHP inside uploads** - with a file and time limit, so a big library does not hang the panel.
6. **XML-RPC** - whether it answers and whether anything closes it.
7. **Users and administrators** - a login called "admin", how many administrators there are, free email addresses.
8. **Built-in file editor** - on or off.
9. **Default database prefix** - `wp_`, with an honest note: it is convenience, not a hole.
10. **Cookie flags** - Secure, HttpOnly and SameSite, on the home page and the login.
11. **security.txt** - present or not, with a generator that gives you the file ready to upload.
12. **File permissions** - of `wp-config.php` and the root.

== Three states, not two ==

Every check says one of three things: **OK**, **to fix** or **to check**. The third state is the important one. Many sites answer 200 to every address (a page builder, a proxy, an access screen): in that case the plugin says "I could not check it" instead of inventing a critical finding. A false alarm in the first five minutes is the fastest way to lose a user.

== History ==

Every audit is stored and compared with the previous one: "this was fine and stopped being fine" with dates. That is the part no other free plugin does.

== Reports ==

The report can be downloaded as JSON or as a printable HTML page (print to PDF from the browser). It includes what was found, why it matters, what to do and the date of every data point.

== What it does not do ==

- It is not a firewall or a WAF, and it does not block anything.
- It does not detect malware or modified files.
- It does not scan ports or services from outside.
- It is not a certified audit and it does not replace a pentest.
- It cannot know whether a plugin is safe: only whether it is maintained.

== Privacy ==

The plugin does not send any data anywhere. The only external requests it makes are to `api.wordpress.org`, once per installed plugin and theme, to ask for the last update date: the same request WordPress already makes when it checks for updates. Nothing about you, your users or your content leaves the site.

== Installation ==

1. Upload the folder to `/wp-content/plugins/` or install the zip from Plugins > Add New > Upload Plugin.
2. Activate it.
3. Go to "Faro Auditoria" in the menu and press "Run the audit".

== Frequently Asked Questions ==

= Does it change anything on my site? =

No. Every check is read-only: HTTP requests to your own site, the database for users, and the filesystem to read permissions and walk uploads. There is one exception and it is voluntary: the security.txt file is offered as a download, not written for you.

= Why does it say "to check" instead of "to fix"? =

Because sometimes the plugin cannot be sure. If a site answers 200 to every address, a `.env` request that returns 200 does not prove anything. Saying "I do not know" is more useful than a false alarm.

= Does it work with a site behind Cloudflare? =

Yes. That is exactly the case where the "to check" state appears: the proxy answers for the origin, and the plugin says so instead of reporting twelve fake exposures.

== Changelog ==

= 0.1.0 =
* First version: twelve read-only checks, three states, history with differences, JSON and printable report, security.txt generator.
