diff --git a/RELEASING.md b/RELEASING.md index d1f105f..d1b078a 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -59,3 +59,28 @@ always point at a ZIP that actually exists there with a matching SHA-256. git tag -a v -m "v — " git push origin v ``` + +## 5. WordPress.org SVN release + +The directory listing at is driven by +the SVN repo (`https://plugins.svn.wordpress.org/webdecoy`). A working copy +lives at `.svn-wporg/` (git-ignored, excluded from builds). Credentials: +username `webdecoy1`, SVN password set separately at +. + +```bash +./build.sh --org +rm -rf .svn-wporg/trunk/* && unzip -q dist/webdecoy--wporg.zip -d /tmp/wporg +cp -R /tmp/wporg/webdecoy/. .svn-wporg/trunk/ && rm -rf /tmp/wporg +cd .svn-wporg +svn add --force trunk assets +svn status # sanity-check: no unexpected deletes/adds; `svn rm` any removed files +svn ci -m "Release " --username webdecoy1 +svn cp trunk tags/ +svn ci -m "Tag " --username webdecoy1 +``` + +`readme.txt`'s `Stable tag:` must match the SVN tag name — the directory serves +whatever tag `Stable tag:` in `trunk/readme.txt` points at. Listing images +(icon/banner PNGs, regenerated from `assets/*.svg` per `assets/README.md`) and +`screenshot-N.png` files go in the SVN top-level `assets/` dir, not trunk. diff --git a/assets/README.md b/assets/README.md index 87dfd4a..82d888d 100644 --- a/assets/README.md +++ b/assets/README.md @@ -32,7 +32,12 @@ rsvg-convert -w 772 -h 250 banner.svg > banner-772x250.png ## Notes -- The icon uses a shield with a web/honeycomb pattern in dark navy and green. -- The banner uses a dark gradient background with the plugin name and tagline. +- Both assets use the WebDecoy duck mascot (white duck, pink hoodie, shades) — + the same artwork as `frontend/src/assets/duck-logo.svg` in the app monorepo, + embedded as a base64 PNG. Brand colors: hoodie pink `#F90289`, ink + `#111C26`, bill orange `#F99717`. +- The banner wordmark/tagline are live `` set in Avenir Next — render the + PNGs on macOS (or a machine with Avenir Next installed) or the type falls + back to a different face. - Upload the generated PNGs (not the SVGs) to the WordPress.org SVN `assets/` directory. SVG files are kept here as editable sources only. diff --git a/assets/banner.svg b/assets/banner.svg index 9545545..7fef5a2 100644 --- a/assets/banner.svg +++ b/assets/banner.svg @@ -1,104 +1,12 @@ - + - - - - - - - - - - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - WebDecoy - - - - - - - - Bot Detection & Protection - - - - - + + + + Web Decoy + \ No newline at end of file diff --git a/assets/icon.svg b/assets/icon.svg index 0589355..66211d2 100644 --- a/assets/icon.svg +++ b/assets/icon.svg @@ -1,44 +1,4 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + \ No newline at end of file diff --git a/cdn-files/plugin-info.json b/cdn-files/plugin-info.json index 02b69a5..9c49298 100644 --- a/cdn-files/plugin-info.json +++ b/cdn-files/plugin-info.json @@ -1,17 +1,17 @@ { "name": "WebDecoy Bot Detection", "slug": "webdecoy", - "version": "2.2.2", + "version": "2.3.0", "author": "WebDecoy", "author_profile": "https://webdecoy.com", - "requires": "5.6", - "tested": "6.7", + "requires": "6.1", + "tested": "7.0", "requires_php": "7.4", - "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.2.2.zip", + "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.3.0.zip", "sections": { - "description": "

WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles — including deterministic tripwires that catch scanners with zero false positives.

Key Features

  • Deterministic tripwires (hidden honeypot paths) — zero-false-positive bot blocking
  • Server-side and client-side bot detection
  • Invisible proof-of-work challenge (no external CAPTCHA service)
  • Comment, login, and registration spam protection
  • WooCommerce carding attack prevention
  • 60+ good bots automatically allowed
  • AI crawler detection and blocking
  • Optional WebDecoy Cloud: centralized dashboard and rotation-proof device lockouts
", - "installation": "
  1. Upload the plugin files to /wp-content/plugins/webdecoy
  2. Activate the plugin through the Plugins menu
  3. Tripwires and local protection are active out of the box — no API key required
  4. Optionally go to WebDecoy > Settings > WebDecoy Cloud to connect for centralized monitoring and enforcement
", - "changelog": "

2.1.0

  • JS execution verification to catch non-JS HTTP scrapers
  • Challenge token meta tag on page serve; automatic page-serve reporting

2.0.0

  • All detection and protection now works locally — no API key required
  • Invisible proof-of-work challenge system (SHA-256, no external service)
  • Behavioral scoring, statistics page, enhanced detections page

1.3.0

  • Bulk IP blocking/unblocking; enhanced good bot detection (60+ bots)
", + "description": "

WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles \u2014 including deterministic tripwires that catch scanners with zero false positives.

Key Features

  • Deterministic tripwires (hidden honeypot paths) \u2014 zero-false-positive bot blocking
  • Server-side and client-side bot detection
  • Invisible proof-of-work challenge (no external CAPTCHA service)
  • Comment, login, and registration spam protection
  • WooCommerce carding attack prevention
  • 60+ good bots automatically allowed
  • AI crawler detection and blocking
  • Optional WebDecoy Cloud: centralized dashboard and rotation-proof device lockouts
", + "installation": "
  1. Upload the plugin files to /wp-content/plugins/webdecoy
  2. Activate the plugin through the Plugins menu
  3. Tripwires and local protection are active out of the box \u2014 no API key required
  4. Optionally go to WebDecoy > Settings > WebDecoy Cloud to connect for centralized monitoring and enforcement
", + "changelog": "

2.3.0

  • One-click WebDecoy Cloud connect with automatic key provisioning
  • Monthly security report opt-in
  • Plan entitlements sync (fails open to free)
  • Fixed: Statistics charts growing unbounded with detection data

2.1.0

  • JS execution verification to catch non-JS HTTP scrapers
  • Challenge token meta tag on page serve; automatic page-serve reporting

2.0.0

  • All detection and protection now works locally \u2014 no API key required
  • Invisible proof-of-work challenge system (SHA-256, no external service)
  • Behavioral scoring, statistics page, enhanced detections page

1.3.0

  • Bulk IP blocking/unblocking; enhanced good bot detection (60+ bots)
", "faq": "

Does WebDecoy slow down my site?

No. WebDecoy adds negligible latency; tripwire checks are a fast path lookup and clearance minting is idle-deferred.

Will it block search engines?

No. WebDecoy automatically allows 60+ known good bots including all major search engines, and tripwires only fire on hidden paths no legitimate crawler follows.

" }, "icons": { diff --git a/changelog.txt b/changelog.txt index 83fed11..a4c293f 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,11 @@ *** WebDecoy Bot Detection Changelog *** += 2.3.0 - 2026-07-23 = +* Added: One-click WebDecoy Cloud connect (Settings → WebDecoy Cloud). Clicking Connect opens app.webdecoy.com to approve; on return the plugin exchanges a one-time token server-side and stores the provisioned API keys (encrypted at rest). Manual API key entry remains available under "Advanced: manual configuration". +* Added: "Send me a monthly security report" opt-in at connect time. +* Added: Plan entitlements sync (twice daily via cron) — a feature switchboard for upcoming plan-aware capabilities; any sync error fails open to the free tier. +* Fixed: Statistics page charts grew unbounded (thousands of pixels tall) once detection data existed — Chart.js canvases are now wrapped in fixed-height containers. + = 2.2.3 - 2026-07-21 = * Changed: All CSS and JavaScript is now loaded via the WordPress dependency APIs — the challenge/block interstitials use wp_register_style/script + wp_print_styles/scripts with static asset files (public/css/, public/js/webdecoy-challenge.js), and the Statistics page attaches chart data via wp_add_inline_script. No more raw