chore: consolidation & cleanup (#15)#31
Merged
Merged
Conversation
…list (#15) - Single detector path: early_check now runs through the WebDecoy_Detector wrapper (SDK BotDetector + WP signals) — the same one WooCommerce uses — instead of the raw SDK detector. Score-neutral (the SDK ignores the extra WP signals; request_path was already added). - Removed the dead WebDecoy_Forms class: it was loaded but never instantiated (fully unwired), and its daily-rotation idea already lives in the honeytoken feature. The live inline honeypot remains the single honeypot implementation. - Removed the dead webdecoy_sync_blocked_ips cron (scheduled but never had a handler); existing installs get it cleared on upgrade and (de)activation. - IP allowlist: is_allowlisted() existed but nothing wrote ip_allowlist and nothing called it. Added a Blocking-tab field (IPs/CIDRs, validated on save) and wired the check into early_check so allowlisted IPs bypass all detection. - (SDK User-Agent staleness was already fixed under #1.) Verified: allowlist exact + CIDR matching, no dangling WebDecoy_Forms references, full suite green (41). Closes #15. Part of #16. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The final milestone item — clears the debt surfaced while mapping the codebase.
What changed
early_check()now runs detection through theWebDecoy_Detectorwrapper (SDKBotDetector+ WordPress signals) — the same one WooCommerce uses — instead of the raw SDK detector. Score-neutral: the SDK ignores the extra WP signals andrequest_pathwas already being added, so results are identical; the code is just unified.WebDecoy_Formsclass — it wasrequired but never instantiated (fully dead), and its daily-rotation idea already shipped in the honeytoken feature (Honeytoken hidden links — automatic sitewide injection #4). The live inline honeypot remains.webdecoy_sync_blocked_ipscron, which was scheduled but never had a handler. Existing installs get the stale schedule cleared on upgrade and on (de)activation.WebDecoy_Blocker::is_allowlisted()existed but nothing wroteip_allowlistand nothing called it. Added a Blocking → IP Allowlist field (IPs/CIDRs, validated on save) and wired the check intoearly_check()so allowlisted IPs bypass all detection and blocking.User-Agentstaleness was already fixed under Make this repo canonical — sync v2.1.0 from the app monorepo + version hygiene #1.Tests
Allowlist exact-IP and CIDR matching verified; confirmed no dangling
WebDecoy_Formsreferences remain; full SDK suite green (41). CI covers PHP 7.4 compat / PHPCS / PHPStan.Closes #15. Completes the v2.2 milestone (#16).