=== Lyntcast – Content Guard ===
Contributors: lyntx
Tags: security, approval, ai, workflow, audit log
Requires at least: 6.0
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 0.3.0
License: GPLv2 or later

Every change to your content goes through your rules first: approvals, injected-code blocking, audit trail and one-click undo for AI agents and people.

== Description ==

Lyntcast sits between your WordPress site and everything that writes to it: AI agents (Claude, ChatGPT, Cursor, n8n, Zapier), automations and people.

* **Hold for approval** – in Enforce mode, new posts and pages are held as "Pending" until a reviewer approves them in Lyntcast. That includes posts from a stolen administrator account.
* **Injected-code blocking** – new `<script>` tags, inline event handlers, `javascript:` links, hidden spam text, forms, unknown iframes and obfuscated code are blocked, even from administrators.
* **Account takeover alerts** – get told the moment an administrator account is created or promoted.
* **Reinfection alerts** – get told when a plugin is installed, activated or updated, or the theme is switched, other than by an administrator in wp-admin (with who did it and how). An hourly integrity check watches the places malware hides so it can come back after a cleanup: must-use plugins, PHP files in uploads, drop-ins (db.php, object-cache.php, advanced-cache.php), .htaccess, .user.ini and wp-config.php, PHP's auto_prepend_file, new scheduled tasks, plugins switched on without being activated, and autoloaded settings containing PHP code or scripts from other sites.
* **Full change trail** – every create, update, trash and delete is reported to Lyntcast with who did it and how (admin screen, REST, app password, XML-RPC, WP-CLI, cron).
* **Optional XML-RPC switch-off.**

AI agents connect to Lyntcast (one MCP endpoint), never to WordPress directly, so they never hold your passwords. Their changes are checked against your rules, risk-scored, approved automatically when safe, and can be undone.

= Detect and alert, never delete =

The reinfection checks only report. Lyntcast never deletes a file, deactivates a plugin or changes a setting on its own, in Monitor or Enforce mode: a wrong guess would take your site down. The first check records what's there as the baseline, silently. After that, each new or changed item is listed under Settings → Lyntcast → Integrity and reported to Lyntcast once. "Mark as expected" makes it part of the baseline. When you remove something, it leaves the baseline, so if it comes back you are told again.

The check is cheap: it runs from WP-Cron once an hour (or after an administrator's page load if cron hasn't run), stops after about a second, and caps how many files it looks at. Nothing runs on the pages your visitors see.

Lyntcast protects content. Keep WordPress, plugins and themes updated and use strong passwords: no content tool can stop an attacker who can run code on your server.

== Installation ==

1. Install and activate the plugin.
2. In Lyntcast, open **Sites → Connect WordPress**, enter your site address and approve the connection. The plugin is configured automatically.
3. Start in **Monitor** mode, then switch to **Enforce** under Settings → Lyntcast.

== Changelog ==

= 0.3.0 =
* Reinfection alerts: plugins installed, activated or updated, and themes switched, other than by an administrator in wp-admin, are reported with who did it and how.
* Hourly integrity check of must-use plugins, PHP files in uploads, drop-ins, .htaccess, .user.ini, wp-config.php, auto_prepend_file, scheduled tasks, silently activated plugins and suspicious autoloaded settings. Detect and alert only; nothing is deleted.
* New Integrity section under Settings → Lyntcast, with "Mark as expected".
* Fixed: events from 0.2.0 could be rejected by Lyntcast. The connection token is now sent under both header names.
* Uninstalling now also removes the plugin's per-post markers (held flags and price history).

= 0.2.0 =
* Renamed to Lyntcast – Content Guard. Settings and data are kept.

= 0.1.0 =
* First release.
