=== Sityro ===
Contributors: sityro
Tags: security, malware scanner, backup, firewall, two-factor
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.51
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Malware scan, attack protection, backups, uptime and two-factor sign-in for your website – with a plan that says what to do next.

== Description ==

Sityro watches your website and tells you when it goes down, becomes vulnerable, gets attacked or changes in a way it should not. This plugin connects your site to the Sityro service ("Sityro Central"); the checks, the storage and the alerts run there. You see the result in your WordPress dashboard and in Sityro Central.

**What you get**

* **Malware scan** – WordPress core, every plugin and every theme are compared with their originals; changed, foreign and suspicious files are listed, with what Sityro recommends for each.
* **Attack protection** – a rule engine in front of WordPress blocks common attacks: brute-force sign-ins, XML-RPC abuse, user enumeration, PHP in the uploads folder, SQL injection, injected scripts and more.
* **Updates and vulnerabilities** – which components are outdated, and which have a known security hole.
* **Uptime and certificate** – your site is checked from outside around the clock; you are told when it is down or the certificate is about to expire.
* **Hardening** – switched on per site in Sityro Central: security headers, a basic Content-Security-Policy, force HTTPS, hide the WordPress version, switch off the file editor, protect sensitive files, cookies only encrypted, switch comments off.
* **Two-factor sign-in for WordPress** – administrators sign in with the code of an authenticator app or a backup code; no extra plugin needed.
* **Action plan** – everything that needs action in one list, the most urgent first, each with a step-by-step guide.
* **Alerts** – by email, and in the Sityro app.

**With a paid plan**

* **Backups and restore** – files and database, encrypted, stored in Germany; restore everything or a part with one click.
* **Repair in one go** – many files or a whole folder at once. (Single files – replace with the original, or move into quarantine – are part of the free plan; nothing is deleted, every step can be undone.)
* **AI assessment** of suspicious files, a daily overview instead of single alerts, checks every minute, a longer history.

Sityro is a service: the plugin is free and open source (GPL), the service has a free plan and paid plans. Everything the plugin does on its own – attack protection, hardening, two-factor sign-in – is part of the free plan. Paid is what the service does for you: storing backups, assessing files, checking more often, keeping history longer.

= How it works =

1. You enter your email address in the plugin. Sityro sends a mail with an activation code.
2. You confirm the code in WordPress. From that moment the site reports to your Sityro account.
3. The first scan runs within a few minutes. The dashboard in WordPress shows the result.

= External service =

This plugin relies on the Sityro service, operated by Silicon Planet GmbH, Hamburg, Germany. Without it the plugin does nothing.

* Service: [https://sityro.com](https://sityro.com) – the plugin talks to `https://central.sityro.com`.
* Terms of service: [https://sityro.com/en/terms](https://sityro.com/en/terms)
* Privacy policy: [https://sityro.com/en/privacy-policy/](https://sityro.com/en/privacy-policy/)
* Data processing agreement, with what is processed, where, and by which sub-processors: [https://central.sityro.com/en/legal/avv](https://central.sityro.com/en/legal/avv)

**Nothing is sent before you ask for a license key or enter one.** When you ask for a key, the plugin sends the email address you typed, the address of the site and the address of its admin area.

**Once the site is connected**, the plugin sends, signed with a secret only this site and Sityro know:

* every 15 minutes a heartbeat: plugin version, state of the protection, whether the site can write to its disk;
* the inventory: versions of WordPress, PHP, plugins, themes, must-use plugins and drop-ins, which have an update, a handful of security-relevant settings (for example whether the file editor is on, whether comments are open), the server's IP address, and the login names of administrators with the date they were registered and whether they use Sityro's two-factor sign-in;
* the file check: for files that differ from their original or belong to nothing installed – path, size, date, checksum and which sign of hidden code was found, and the same for `wp-config.php`;
* on request from Sityro Central, the content of a single file from that list, to assess it and to show you the difference to the original. This includes `wp-config.php`, checked for injected code and never shown or changed. **Secrets never leave the site:** before a file is sent, the plugin replaces the database credentials, WordPress's keys and salts and any other password, secret or token it defines with `***`;
* with the heartbeat, counts of requests the attack protection blocked, by rule and kind of attack; only when Sityro asks for them, up to 30 examples of blocked requests – time, address on the site, the matched part (at most 160 characters) and the network of the sender, never the full IP address;
* with backups (paid plans): all files and the database of the site, which includes personal data of your visitors, customers and users. Backups are encrypted and stored in Germany.

On paid plans, single suspicious program files may be assessed by an AI model of a sub-processor in the USA; this can be switched off in Sityro Central. Details are in the privacy policy and the data processing agreement.

**The plugin never sends** passwords, authentication cookies or two-factor secrets.

The core integrity check uses WordPress' own checksums from `api.wordpress.org`.

= What Sityro Central can ask the site to do =

The plugin registers no REST routes and no unauthenticated AJAX actions. Server-to-server calls from Sityro Central are POST requests to the site's home URL with the query parameter `sityro_agent`; they are checked on `init` (and, for restores, by a must-use plugin that runs earlier) before anything else happens. Every call is signed with a secret only this site and Sityro know (HMAC-SHA256 over method, path, time and body), must arrive within five minutes and carries a nonce that is accepted once; anything else is answered with 401. The only other request accepted from outside is the sign-in from Sityro Central (POST with the query parameter `sityro_login`), posted by the administrator's own browser with a one-time ticket valid for 60 seconds. Orders that change something (repair, restore, update, sign-in, protection rules) carry a second signature (Ed25519) checked against Sityro's public key, which the site receives over its own TLS connection to Sityro Central and which is separate from the site's secret; they are bound to this site, expire, and can only name actions from a fixed list – never code to run.

**What Sityro may change is your decision.** Reading and reporting need no permission. Changing files and signing in from Sityro Central are off until an administrator of this WordPress allows them – when connecting the site, or later on the Sityro dashboard under "Connection and settings", where you also see who allowed it and when. Without that permission the site refuses the order, however well it is signed. Taking back what Sityro did (undo a repair, roll back a failed update) always works.

* send a fresh report, read one listed file;
* take a backup, restore a backup (restoring only with your permission to change files) – leaving out the folders and files you excluded in Sityro Central, besides caches and the folders of other backup plugins;
* replace a file with its original, move a file into quarantine, put it back (only with your permission to change files);
* delete a file or a whole folder you no longer need – only with your permission to change files, after you confirmed it in Sityro Central, and never WordPress itself, its base folders, an installed plugin or theme, or Sityro. Deleting cannot be undone unless you have a backup;
* store the protection rules and the hardening measures you switched on.

= Files outside the plugin folder =

To protect a site even when WordPress or another plugin is broken, Sityro puts a few things outside its own folder. All of them are removed when you deactivate or delete the plugin – with the one exception named below.

* `wp-content/mu-plugins/sityro-protect.php` – a must-use loader, so the attack protection runs before every other plugin. It carries no logic of its own and removes itself when the plugin folder is gone.
* `wp-content/mu-plugins/sityro-rescue.php` – lets a restore get through when the site's own code breaks WordPress (with backups).
* `wp-content/uploads/sityro/rules.php` – the protection rules, verified against Sityro's signature before they are stored. Short write tests (a file written, read back and removed at once) also run in this folder.
* A block in the `.htaccess` of the site, between `# BEGIN Sityro` and `# END Sityro` – only with the hardening measures that need the web server itself (protect sensitive files, security headers). The plugin tests the site before and after and takes the block back if the server refuses it. Nothing outside the block is touched.
* An empty `index.php` in upload folders that have none – only with the measure "Hide the uploads listing"; taken away again when it is switched off.
* `wp-content/uploads/sityro/quarantine` – files a repair moved aside instead of deleting them, kept for 30 days (100 MB at most), renamed so they cannot run, and the folder is closed to the web server. **This folder stays when you delete the plugin, as long as it holds files:** they are files of your website. Delete it yourself when you no longer need them. Versions before 1.0.0 kept it in `wp-content/sityro-quarantine`; Sityro empties that one after 30 days.
* `wp-content/sityro-restore` and `wp-content/sityro-snapshots` – work files of a running restore or update; removed when it is through.

Emergency stop: a file named `.sityro-protect-off` in the WordPress root switches the attack protection off at once.

= Sign-in from Sityro Central =

Off unless an administrator of this WordPress allows it ("Allow sign-in from Sityro Central", when connecting or on the Sityro dashboard under "Connection and settings"). Then administrators of your Sityro organization can open this WordPress with one click from Sityro Central, without typing a password. The sign-in is a one-time ticket signed by Sityro, valid for one minute and bound to this site; WordPress records it as a normal sign-in.

= Two-factor sign-in =

Switched on in Sityro Central as a hardening measure. Then every administrator is asked for a six-digit code from an authenticator app (or a backup code) after the password; an administrator who has none yet sets it up in the sign-in itself. Other users can switch it on in their profile. Secrets stay on the site, encrypted. Application passwords keep working. If a phone is lost: use a backup code, let another administrator reset the account on its profile, sign in from Sityro Central, or add `define( 'SITYRO_TWO_FACTOR_OFF', true );` to `wp-config.php`.

= Trust badge =

Sityro can show a small badge in the footer of your website. **It is off unless an administrator ticks "Show the Sityro trust badge on this website" on the Sityro dashboard in WordPress.** The badge is an image loaded from Sityro and links to sityro.com.

= Updates of other plugins =

At a finding about a vulnerable component you can ask Sityro to "update when the fix is out". The plugin then switches WordPress' own automatic update on for that one component; the update itself is done by WordPress with the official package.

== Installation ==

1. Install and activate the plugin.
2. Open "Sityro" in the admin menu, enter your email address and request a license key.
3. Open the mail from Sityro and confirm the activation code in WordPress.
4. Wait a few minutes for the first scan. Then look at the dashboard and the action plan.

To add a site to an existing Sityro account, create a license key in Sityro Central under "Add a site" and paste it into the plugin.

== Frequently Asked Questions ==

= Does the plugin work without a Sityro account? =

No. The plugin is the agent of the Sityro service; the checks, the storage of backups and the alerts run there. There is a free plan.

= What is free, what is paid? =

Free: malware scan, attack protection, hardening, two-factor sign-in for WordPress, updates and vulnerabilities, uptime and certificate, action plan, alerts, repairing single files. Paid: backups and restore, repairing many files at once, AI assessment of suspicious files, a daily overview of alerts, checks every minute and a longer history.

= Where is my data stored? =

In Germany. See the privacy policy for the exception (AI assessment of single program files, which you can switch off).

= Does Sityro delete files on my site? =

Not on its own. A repair replaces a changed file with its original or moves a foreign file into quarantine, where it stays for 30 days and can be put back with one click. Files and folders are deleted only when you choose "Delete" in Sityro Central and confirm it – that cannot be undone unless you have a backup – and never WordPress itself, an installed plugin or theme, or Sityro.

= Does it slow down my site? =

The attack protection looks at each request before WordPress starts; that takes well under a millisecond. Scans and backups run in the background, in small steps.

= What happens when I deactivate or delete the plugin? =

Deactivating removes the must-use loaders, the rules, the block in the `.htaccess` and the index files Sityro added, and stops all scheduled work. Deleting also removes every setting. Only a quarantine that still holds files of your website stays (see "Files outside the plugin folder").

= I am locked out of WordPress. What now? =

If the attack protection is the cause, create a file named `.sityro-protect-off` in the WordPress root. If two-factor is the cause, see "Two-factor sign-in" above.

== Changelog ==

= 1.0.0 =
* First release in the WordPress plugin directory.
* Delete files and whole folders you no longer need from Sityro Central, with a confirmation; leave folders out of your backups.
* Backups upload several pieces at once and leave out what you excluded.

= 0.1.16 =
* Two-factor sign-in for WordPress, switched on in Sityro Central.
* Comments can be switched off completely; a check says when they are open.
* The trust badge needs an administrator's OK in WordPress.
* The Sityro screens list the open findings of their area; findings and action plan are one screen.

== Upgrade Notice ==

= 1.0.0 =
First release in the WordPress plugin directory. Updates now come from WordPress.org.

= 0.1.16 =
The trust badge is shown only after an administrator allowed it in WordPress. If you use it, tick the box on the Sityro dashboard.
