=== Faro Base ===
Contributors: farowp
Tags: security, performance, maintenance, two-factor-authentication, cleanup
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.9.22
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

The foundations of a WordPress site in one plugin: cleaning, performance, admin, maintenance, security and 2FA. All modules start off.

== Description ==

Faro Base does the small things every site needs and no specialist plugin should be doing: removing what WordPress prints and nobody uses, limiting revisions, keeping the admin tidy, putting the site in maintenance mode, hardening the basics and adding a second factor to the login.

Every module is a switch. A module that is off loads no code at all: its file is not even read. You can turn everything off and Faro Base becomes inert, without leaving anything behind.

= What is inside =

* **Cleanup.** Removes the emoji script and styles, the embeds script, the generator tag, shortlinks and RSD links, and stops loading Dashicons for visitors who are not logged in. It does not delete content and does not touch the database.
* **Performance.** Sets the heartbeat interval, caps post revisions, stops WordPress from creating three image sizes almost nobody uses, and removes jQuery Migrate from the public site while keeping it in the admin.
* **Admin.** Adds an ID column and a sortable last-modified column to posts and pages, plus a footer with the Faro Base, WordPress and PHP versions.
* **Maintenance.** Puts the site behind a real 503 page with your own title and message, a 12-hour bypass link for showing the result, and an optional end date. If WooCommerce is active, it can drive WooCommerce's own “Coming soon” page instead, so two pages never compete.
* **Security.** Hides the WordPress version, closes XML-RPC and pingback, disables the plugin and theme file editor, blocks user enumeration (`?author=N` and the users REST endpoint), adds four security headers and limits failed login attempts per IP and user.
* **Two-step login.** Per-user TOTP: after the password, a 6-digit code from any authenticator app, plus ten one-time backup codes. Turning it off requires a valid code. Application passwords are disabled for accounts with two-step login, because they would skip the second factor.

= What it is not =

Faro Base is not a replacement for a full SEO plugin, a firewall, a page cache or a backup plugin, and it does not pretend to be. It is the layer underneath: the defaults WordPress leaves open or does not need.

= No account, no key, no external service =

Everything runs inside your WordPress. There is no license, no sign-up and no call to any server of ours.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`.
2. Activate it through the Plugins screen.
3. Go to Settings > Faro Base and turn on the modules you need.
4. For the two-step login, each user activates it in their own profile.

== Frequently Asked Questions ==

= Does it change anything when I activate it? =

No. All modules start off. Nothing changes on your site until you switch one on.

= Can I undo a change? =

Yes. Turn the module off and it stops loading. The HTML goes back to exactly what it was before. For the security module there is also a safe mode constant for the case where a rule locks you out of the admin.

= Does two-step login work with any app? =

Yes. It is standard TOTP (6 digits, 30-second window), so Google Authenticator, Microsoft Authenticator, Authy, 1Password, Aegis or any other TOTP app works. The profile shows a QR code and the key, in case you prefer to type it.

= Do I need an account or a license? =

No. Faro Base is GPL, free and complete. There is no paid version of this plugin and no key to enter.

= Does it replace a security plugin? =

No. It closes the basics WordPress leaves open, but it is not a firewall: it does not block attacks, scan files or watch the database.

== Screenshots ==

1. The panel: what Faro Base is applying to your site right now.
2. One card per module, each with its own switch.
3. Two-step verification in the profile: setup key, QR code and the five steps.
4. The login asks for the 6-digit code after the password.

== Changelog ==

= 0.9.22 =
* Even vertical rhythm: every card in the panel now has the same gap (18px) instead of some touching.

= 0.9.21 =
* Professional button style: solid navy instead of the navy-to-orange gradient.

= 0.9.20 =
* More space around the save bar and the panel footer, so the last card and the button do not touch.

= 0.9.19 =
* More breathing room in the panel: wider padding in the cards, table rows and the save bar.

= 0.9.18 =
* Source strings in English, with the Spanish translation included in the plugin's languages folder.
* The risk level pill is gone from the module cards.

= 0.9.17 =
* Removed the risk-level label from the panel cards: it was on all six and got in the way of reading them.

= 0.9.16 =
* Removed the diagnostic trace from the second step. No behaviour change from 0.9.15.

= 0.9.15 =
* Fix for the Log in button on the code screen: the core form requires a username and password, which are hidden and empty in the second step, so the browser blocked the submit without a word. The button now carries formnovalidate and the form is marked noValidate.
* The “show password” eye icon is hidden on the code screen, where it had nothing to show.
* The code screen shows the server time in UTC and warns when the second-step session has expired.

= 0.9.12 =
* The profile shows a QR code to add the account to the authenticator app. It is drawn in the browser, so the key never leaves the server; the plain key and the otpauth link remain as a fallback.
* Bundled qrcode-generator 1.4.4 (MIT, (c) Kazuhiko Arase) in assets/js/faro-qrcode.js.

= 0.9.11 =
* The two-step block is handled while the profile screen loads (load-profile.php) and no longer through admin-post.php: the profile form sends its own action=update and WordPress rejected the request with an empty error page. That was the real cause of the failure when pressing Activate.

= 0.9.10 =
* Fix for the Activate button in the profile: the two-step block was printed inside the profile form, and nested forms are not valid HTML. The browser sent the profile form with the wrong nonce and WordPress answered “The link you have followed has expired”. Buttons now point at admin-post.php with formaction and their own nonce.
* Pressing Enter in the code field sends the plugin action instead of saving the profile.

= 0.9.9 =
* The steps to activate two-step verification now appear in the Faro Base panel and in the profile itself (five numbered steps, with the app, the key and the backup codes).
* If the profile page has gone stale and the nonce expires, you no longer get the bare core message (“The link you have followed has expired”): you go back to the profile with a note that nothing has been changed and that Activate has to be pressed again.
* When the key is created, the profile says what to do next and links straight to the authenticator app (otpauth).

= 0.9.8 =
* Two-step login: application passwords are off while 2FA is active (they skipped the second factor).
* Two-step login: only the core login form is intercepted; other sign-ins (plugins, REST, XML-RPC, WP-CLI) get a WP_Error instead of a redirect that ended the request.
* Two-step login: fires wp_login after a valid code, so sessions and plugins that hook it keep working.
* Security: the login attempts limit now actually blocks. Its error was overwritten by core, so a correct password still got in.

= 0.9.7 =
* Plugin Check clean: translators comments, sanitized input, nonce on the two-step form, languages folder.

= 0.9.3 =
* Maintenance now drives WooCommerce's own “Coming soon” visibility instead of competing with it, and restores the previous state on disable.

= 0.8.0 =
* New two-step login module: per-user TOTP, ten one-time backup codes, disable requires a valid code.

= 0.7.1 =
* New security module: hidden version, XML-RPC off, file editor off, user enumeration blocked, security headers and login attempts limit.

= 0.6.0 =
* New maintenance module: real 503 page, 12-hour bypass link, optional end date.

= 0.5.1 =
* New admin module: ID and modified columns on posts and pages, sortable, plus version footer.

= 0.4.1 =
* Help button on every module: what it does, when it shows, how to undo it.
* “Right now” panel with the rules the plugin is applying.
* Change log with who changed what and when (last 40 changes).

= 0.3.2 =
* New admin design: FaroWP brand header, counters, module cards with switches and status pills.
* Styles only load on the plugin screen.

= 0.2.0 =
* New performance module: heartbeat interval, revision limit, fewer image sizes and jQuery Migrate removal on the front end.
* Settings screen for the performance options.

= 0.1.0 =
* First version: plugin skeleton, settings screen and the cleaning module.

== Third-party resources ==

* assets/js/faro-qrcode.js: qrcode-generator 1.4.4, MIT license, (c) Kazuhiko Arase. https://github.com/kazuhikoarase/qrcode-generator
