=== Pixel Custodes ===
Contributors: xiphosx
Tags: security, optimization, admin control, WordPress
Requires at least: 5.0
Tested up to: 7.0.4
Stable tag: 1.5.16
License: GPL-2.0+
License URI: http://www.gnu.org/licenses/gpl-2.0.txt

Toggle hub for security headers, front-end cleanup, and admin chrome. Not a firewall or malware scanner.

== Description ==

Pixel Custodes turns WordPress features on or off from one admin screen.

- **Security** — file editor lock, headers, XML-RPC, author enumeration, REST user listing, generic login errors.
- **Optimization** — emojis, embeds, Heartbeat, revisions, trash, optional block CSS modes.
- **Command** — plugin notice cleanup, dashboard widgets, update emails, comments, block directory.

Open **Pixel Custodes** in the admin menu, or click **Dashboard** next to Deactivate on the Plugins screen.

== Installation ==

1. Download the Pixel Custodes plugin.
2. Go to **Plugins > Add New** in your WordPress dashboard.
3. Click **Upload Plugin** and select the downloaded ZIP file.
4. Click **Install Now**, then activate the plugin.
5. Open **Pixel Custodes** in the admin menu, or use the **Dashboard** link on the Plugins screen.

== Frequently Asked Questions ==

= Where are the settings? =
Pixel Custodes is a top-level admin menu. It is not under Settings.

= Will this plugin hide update nags? =
No. Informational plugin ads can be hidden. Errors, warnings, and update nags stay visible.

== Screenshots ==

1. **Settings Overview** - A clean and intuitive control panel for managing features.
2. **Security Settings** - Options for securing your WordPress site.
3. **Optimization Options** - Enable or disable features to optimize performance.
4. **Admin Command Controls** - Additional settings for advanced admin control.

== Changelog ==

= 1.0.0 =
* Initial release of Pixel Custodes.
* Core security, optimization, and command features added.
* Clean UI for easy management of all features.

= 1.1.0 =
* Added option to conditionally load Contact Form 7 assets on specific pages.
    - Users can now specify page slugs in the plugin settings to selectively load Contact Form 7 assets.
    - If no slugs are specified, Contact Form 7 assets will load globally on all pages.
    - Improved performance by reducing unnecessary asset loading on pages that don’t contain Contact Form 7 forms.

= 1.2.0 =
* New Feature: Added the option to disable plugin-related banners and notices in the WordPress admin area.
    - Keeps the dashboard clean and focused by hiding plugin banners.  
* New Feature: Added the option to disable WordPress core, plugin, and theme update notification emails.
    - Provides fine-grained control over update email notifications.
* New Feature: Added the option to remove Gutenberg-related stylesheets.
    - Includes separate toggles for WordPress core styles, WooCommerce block styles, and Storefront block styles. 
* New Feature: Added the option to remove default WordPress inline styles and SVG filters.
    - Removes unnecessary styles rendered with `global-styles-inline-css` and SVG filters added to the `<body>` tag. 

= 1.5.16 =
* Hide informational notices now beats Wpmet Jhanda ID styles and removes banners injected after page load.

= 1.5.15 =
* Hide informational notices also covers Wpmet/ElementsKit promo banners and the Wpmet Stories dashboard widget.

= 1.5.14 =
* Dashboard live check reports if /wp-content/debug.log is publicly downloadable.
* View details no longer overwrites a newer remote version, so Check for updates can offer the update.

= 1.5.13 =
* Live generator check fails only on the WordPress generator meta tag, not other plugins’ generator tags.

= 1.5.12 =
* Live numeric author check treats host/WAF blocks (HTTP 403/404 and similar) as blocked, not a failed redirect.

= 1.5.11 =
* Security headers also send Content-Security-Policy frame-ancestors 'self' when hosts drop X-Frame-Options.
* Live headers check treats frame-ancestors as clickjacking protection.

= 1.5.10 =
* Live XML-RPC check treats host blocks (HTTP 403/422, empty body) as blocked, not an unclear warning.

= 1.5.9 =
* Agency-FB and Open Sans ship with the plugin so titles work without the studio theme.
* Removed unused public-facing boilerplate. Admin CSS/JS stay vanilla and scoped to Custodes screens.

= 1.5.8 =
* View details sidebar uses the installed version, WordPress 7.0.4 compatibility, and today’s last-updated date.
* Changelog in View details matches this release train.

= 1.5.7 =
* Plugins screen Dashboard link. View details copy and header graphic match the current theme.

= 1.5.2 =
* Dashboard content uses the mockup page padding so cards and tables are not flush with the canvas edge.

= 1.5.1 =
* Inset padding on Dashboard tables so rows are not flush with the panel outline.

= 1.5.0 =
* White cyber admin theme using the studio primary (#FF004C) and secondary (#FF5391).
* Dashboard stat tiles, module cards with fill bars, icons on tabs and section titles.
* On/off rows and live/pass chips restyled; WordPress admin outside Custodes is unchanged.

= 1.4.0 =
* Admin CSS and JS load only on Pixel Custodes screens; “Settings saved” works again; WordPress admin footer is no longer wiped site-wide.
* Hide informational plugin notices only — update nags, errors, and the admin-bar updates node stay visible.
* Author enumeration now covers /author/ slugs, uses a 302, and redirects to the homepage.
* Security headers use the WordPress headers API; HSTS is HTTPS-only; X-XSS-Protection is set to 0; Referrer-Policy and Permissions-Policy added.
* New Dashboard, grouped Security/Optimization/Command screens, honest copy, accessible toggles, and an unsaved-changes warning.

= 1.3.1 =
* Compatibility: Tested with WordPress 7.0.4.
* Disable Emojis now also unhooks `wp_enqueue_emoji_styles` used since WordPress 6.4.
* Fixed REST API authentication toggle using a mismatched option name.
* Fixed Contact Form 7 conditional loading so it runs when page slugs are set.
* Settings now sanitize on save; uninstall removes plugin options.
* Security removers hook on `init` so they actually unhook core actions.
* Gutenberg and global-styles removers now match their labels.

= 1.3.0 =
* New Feature: Updated Security UI/UX.

== Upgrade Notice ==

= 1.5.0 =
White cyber admin theme for Pixel Custodes screens. Settings and behavior are unchanged.

= 1.4.0 =
Dashboard and settings rebuild, safer headers, and admin assets scoped to plugin screens.

= 1.3.1 =
Compatibility release for WordPress 7.0.4, plus fixes for REST auth, CF7 loading, and settings sanitization.

= 1.0.0 =
First release. Activate and configure to enable security, optimization, and admin controls.

== License ==

This plugin is open source and licensed under GPLv2 or later.


== Developer Notice ==

When you develop updates, ensure that you update:
1. includes/class-pfs-pixel-custodes-security.php: Security functionalities are placed here.
2. admin/partials/pfs-pixel-custodes-admin-display.php: Add new security features here to the HTML table to be featured on the Settings Page.
3. pfs-pixel-custodes.php: Update "Version" and line 36: define( 'PFS_PIXEL_CUSTODES_VERSION', 'X.X.X' ).
4. pfs-pixel-custodes.json: Update "Version", "requires", "tested", "last_updated", "download_url" (very important), and "changelog".
5. README.txt: Update "Requires at least", "Tested up to", and add new changes to the "== Changelog ==".
6. Zip the Plugin folder and upload it to the server via SFTP.
7. Copy the pfs-pixel-custodes.json and associated asset files, and upload them to the server via SFTP.

== Blueprint ==

1. pfs-pixel-custodes.php: This is the main file that includes all of the dependencies used by the plugin.
   + Define function for the current plugin version.
   + activate_pfs_pixel_custodes function that runs code during plugin activation.
   + deactivate_pfs_pixel_custodes function that runs code during plugin deactivation.
   + Update checker function to check for the most recent plugin version. This is where you update the update link, too.
   + run_pfs_pixel_custodes function to begin execution of the plugin.

2. admin/class-pfs-pixel-custodes-admin.php: This file and the parent 'admin' folder are for the admin-facing functionality of the plugin.
   + PFS_Pixel_Custodes_Admin class defines the plugin name, version, and provides two example hooks for how to enqueue the admin-facing stylesheet and JavaScript.

3. Front-end behavior lives in includes/ (security, optimization, command). There is no public CSS/JS bundle.

4. admin/partials/pfs-pixel-custodes-admin-display.php: This file provides the admin area view for the plugin.
   + The HTML table formatted with Bootstrap for the PFS Pixel Custodes Settings Page is rendered here.

5. admin/img folder: Contains the graphics used for the plugin.
   + PFS_Pixel_Custodes_Plugin_Banner_772x250.jpg
   + PFS_Pixel_Custodes_Plugin_Icon_132x132.png

6. pfs-pixel-custodes.pot: This file is ready for languages to be added to the plugin for translations.

7. plugin-update-checker folder: Contains all of the dependencies to run the update checker files.

8. includes folder: Registers all of the actions and filters for the plugins in classes to prevent namespace collisions with the WP Theme.

9. include/class-pfs-pixel-custodes.php: Defines the core plugin class.
   + The includes/class-pfs-pixel-custodes-security.php class for security functionalities is required here.

10. include/class-pfs-pixel-custodes-security.php: Defines security-related functionalities for PFS Pixel Custodes.