chore(release): 2.2.0

changelog.txt

@@ -1,6 +1,6 @@
 *** WebDecoy Bot Detection Changelog ***
 
-= 2.2.0 - Unreleased =
+= 2.2.0 - 2026-07-19 =
 * Added: IP allowlist — IPs or CIDR ranges that bypass all detection and blocking (Settings → Blocking). Previously the check existed internally but had no way to configure it.
 * Changed: Consolidated onto a single detector path (SDK detector + WordPress-signal wrapper) across front-end, forms, and WooCommerce; removed the unused legacy forms class and a dead scheduled task. No behavior change to detection.
 * Added: Filter rules — write expression-based rules (e.g. `ip.tor or ip.abuse_score > 50`, `ip.country in ["CN","RU"] and req.path matches "^/wp-login"`) evaluated before scoring; block or throttle, with dry-run. New Settings → Rules tab with a rule builder and parse-on-save validation. Expression language is byte-for-byte compatible with @webdecoy/node.

readme.txt

@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: security, bot detection, spam protection, woocommerce, firewall
 Requires at least: 5.6
 Tested up to: 6.8
-Stable tag: 2.1.0
+Stable tag: 2.2.0
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -185,6 +185,21 @@ Privacy Policy: [https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net](htt
 
 == Changelog ==
 
+= 2.2.0 =
+* Added: Tripwires — deterministic, zero-false-positive blocking of hidden honeypot paths (on by default)
+* Added: Honeytoken — auto-injected invisible decoy link armed as a tripwire (on by default)
+* Added: Filter rules — expression-based rules with an admin rule builder (ip.* / req.* fields)
+* Added: IP enrichment (VPN/proxy/Tor, geo, ASN, abuse score) powering ip.* filter fields
+* Added: wd_clearance enforcement loop — silent cookie minting + tripwire forwarding for rotation-proof device lockouts
+* Added: Stealth-browser (F1) detection — catches automation that patches native browser functions
+* Added: Deceptive tripwire responses — fake .env/wp-config/SQL/phpinfo with per-site canary credentials; canary logins flagged as critical
+* Added: WordPress-native traps — fake vulnerable-plugin paths, optional XML-RPC trap, author-enumeration canary
+* Added: WooCommerce honeytoken coupons — a hidden decoy coupon; applying it is a deterministic bot signal
+* Added: IP allowlist (Settings → Blocking)
+* Improved: Rate limiting runs as a rule — proper 429 + Retry-After + X-RateLimit-* headers, sliding-window algorithm, per-IP/route/user keying
+* Improved: Resilient violation reporting (DB spool + cron retry, no page latency)
+* Changed: Consolidated onto a single detector path; removed legacy dead code
+
 = 2.1.0 =
 * Added: JS execution verification — detects non-JS HTTP scrapers
 * Added: Challenge token meta tag for premium page serve tracking

webdecoy.php

@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.1.0
+ * Version: 2.2.0
  * Requires at least: 5.6
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.1.0');
+define('WEBDECOY_VERSION', '2.2.0');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));
@@ -1113,7 +1113,7 @@
         // latter, plus the raw cookie.
         $headers = $this->collect_request_headers();
         if (isset($_SERVER['HTTP_COOKIE'])) {
             $headers['cookie'] = (string) wp_unslash($_SERVER['HTTP_COOKIE']);
         }
 
         // Fetch IP enrichment only when a filter rule needs it (premium only).
@@ -1235,7 +1235,7 @@
             ],
         ];
 
         $wpdb->insert($wpdb->prefix . 'webdecoy_detections', [
             'ip_address' => $ip,
             'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '',
             'score' => 100,
@@ -1276,7 +1276,7 @@
                 ),
             ];
 
             $wpdb->insert($wpdb->prefix . 'webdecoy_detections', [
                 'ip_address' => $violation->ip,
                 'user_agent' => $violation->userAgent ?? '',
                 'score' => $confidence,
@@ -1340,7 +1340,7 @@
      */
     private function is_challenge_verified(string $ip): bool
     {
         $cookie = isset($_COOKIE['webdecoy_verified']) ? sanitize_text_field($_COOKIE['webdecoy_verified']) : '';
         if (empty($cookie)) {
             return false;
         }
@@ -1414,9 +1414,9 @@
             'metadata' => $result->getMetadata(),
         ];
 
         $wpdb->insert($table, [
             'ip_address' => $ip,
             'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field($_SERVER['HTTP_USER_AGENT']) : '',
             'score' => $result->getScore(),
             'threat_level' => $result->getThreatLevel(),
             'source' => 'wordpress_plugin',
@@ -1516,7 +1516,7 @@
             $ip = $this->get_client_ip();
 
             global $wpdb;
             $wpdb->insert($wpdb->prefix . 'webdecoy_detections', [
                 'ip_address' => $ip,
                 'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '',
                 'score' => 100,
@@ -1646,7 +1646,7 @@
     {
         $honeypot_name = 'webdecoy_hp_' . $context;
 
         if (isset($_POST[$honeypot_name]) && !empty($_POST[$honeypot_name])) {
             // Honeypot triggered - definitely a bot
             $ip = $this->get_client_ip();
             $blocker = new WebDecoy_Blocker();
@@ -2110,7 +2110,7 @@
         }
 
         // Get detection data
         $detection_json = isset($_POST['detection']) ? wp_unslash($_POST['detection']) : '';
         $detection = json_decode($detection_json, true);
 
         if (!$detection || !is_array($detection)) {
@@ -2205,7 +2205,7 @@
             $threat_level = 'LOW';
         }
 
         $wpdb->insert($table, [
             'ip_address' => $ip,
             'user_agent' => $user_agent,
             'score' => $score,
@@ -2282,7 +2282,7 @@
             return;
         }
 
         $api_key = sanitize_text_field($_POST['api_key'] ?? '');
 
         // Decrypt if encrypted
         if (!empty($api_key) && $this->is_encrypted($api_key)) {
@@ -2357,8 +2357,8 @@
             return;
         }
 
         $ip = sanitize_text_field($_POST['ip'] ?? '');
         $reason = sanitize_text_field($_POST['reason'] ?? '');
         $duration = intval($_POST['duration'] ?? 24);
 
         if (empty($ip) || !filter_var($ip, FILTER_VALIDATE_IP)) {
@@ -2384,7 +2384,7 @@
             return;
         }
 
         $ip = sanitize_text_field($_POST['ip'] ?? '');
 
         if (empty($ip)) {
             wp_send_json_error(['message' => __('Invalid IP address.', 'webdecoy')]);
@@ -2784,7 +2784,7 @@
                 return $transient;
             }
 
             $transient->response[WEBDECOY_PLUGIN_BASENAME] = (object) [
                 'slug' => 'webdecoy',
                 'plugin' => WEBDECOY_PLUGIN_BASENAME,
                 'new_version' => $update_info['version'],