v2.2.2 — Plugin Check compliance + security hardening

Prepares WebDecoy for the WordPress.org plugin directory and ships the compliance fixes to self-hosted users.

Highlights

• Passes WordPress Plugin Check with 0 errors (verified with the real tool).
• Fixed a PHP 7.4 fatal in good-bot verification (str_ends_with is PHP 8.0+).
• Security hardening — all input reads unslash+sanitized; SQL values prepared; read-only reads carry justified nonce annotations.
• Zero external connections by default (all cloud calls gated behind an opt-in API key); Chart.js bundled locally; self-updater excluded from the WordPress.org build.
• Requires WordPress 6.1+, tested up to 7.0.

Downloads

• webdecoy-2.2.2.zip — CDN / self-hosted build (self-hosted updater + cloud clearance client).
• webdecoy-2.2.2-wporg.zip — WordPress.org submission build (both excluded for directory-guideline compliance).

v2.2.1 — Chart.js bundled locally + WordPress.org build

Patch release preparing WebDecoy for the WordPress.org plugin directory.

Changes

• Chart.js is now bundled with the plugin (admin Statistics charts) instead of loaded from jsDelivr — the plugin makes zero external requests until you connect a WebDecoy Cloud account.
• Refactored the self-hosted updater into its own module.
• Clarified the External Services disclosure in the readme.

Two builds

• webdecoy-2.2.1.zip — CDN / self-hosted build (includes the self-hosted updater + cloud clearance client).
• webdecoy-2.2.1-wporg.zip — WordPress.org submission build (self-updater and clearance client removed for directory-guideline compliance).

All v2.2.0 features are included — see the v2.2.0 release notes for the full parity + deception feature list.

v2.2.0 — Node SDK parity & deception enforcement

Brings the WordPress plugin to capability parity with the @webdecoy/node SDK, plus PHP-native deception the Node SDK can't do. Tripwires and honeytoken ship on by default.

Parity with @webdecoy/node

• Rule engine — deterministic rules (ALLOW/DENY/THROTTLE) evaluated before scoring, with dry-run
• Tripwires — zero-false-positive blocking of hidden honeypot paths
• Honeytoken — auto-injected invisible decoy link armed as a tripwire
• Filter rules — expression DSL (ip.* / req.*) with an admin rule builder; byte-compatible with the Node SDK
• IP enrichment — VPN/proxy/Tor, geo, ASN, abuse score powering ip.* fields
• wd_clearance enforcement loop — silent cookie minting + tripwire forwarding for rotation-proof device lockouts
• Stealth (F1) detection — catches automation that patches native browser functions
• Rate limiting — now a rule: 429 + Retry-After + X-RateLimit-* headers, sliding window, per-IP/route/user keying
• Resilient violation reporting — DB spool + cron retry, no page latency

Beyond parity (PHP/WordPress-native)

• Deceptive tripwire responses — fake .env/wp-config/SQL/phpinfo with per-site canary credentials; a later login with a canary is flagged critical
• WordPress-native traps — fake vulnerable-plugin paths (guarded), optional XML-RPC trap, author-enumeration canary
• WooCommerce honeytoken coupons — a hidden decoy coupon; applying it is a deterministic bot signal

Other

• IP allowlist (Settings → Blocking)
• Consolidated onto a single detector path; removed legacy dead code

Cloud features (violation reporting, IP enrichment, clearance lockouts) require a WebDecoy Cloud key; without one the plugin still enforces locally. Everything fails open.

SHA-256 of webdecoy-2.2.0.zip: c0779bf07844106113409d692d782fe3e95e8ab6c1434e43fe702ecdccbc4cfe

v2.0.0 — Freemium Release

WebDecoy Bot Detection v2.0.0

Highlights

• Zero-config freemium model — all protection works immediately on activation, no API key required
• SHA-256 proof-of-work challenges — invisible bot verification with no external CAPTCHA service
• Behavioral scoring — 4-factor weighted model (behavioral, environmental, temporal, form signals)
• WooCommerce carding protection — rate limiting, device fingerprinting, and checkout fraud detection
• Statistics dashboard — 30-day trends, threat distribution, top IPs, source analysis

Installation

1. Download webdecoy-2.0.0.zip below
2. WordPress Admin → Plugins → Add New → Upload Plugin
3. Activate — protection starts immediately

Optional: WebDecoy Cloud

Enter an API key in Settings → WebDecoy → Cloud to enable threat intelligence, VPN detection, and cloud sync.

Full Changelog

See changelog.txt