=== TINXDK Login Limit Pro ===
Contributors: tinxdk
Tags: login, security, brute force, xmlrpc, limit login attempts
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 8.2.35
Requires Plugins: tinxdk-login-limit
Stable tag: 2.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Pro extension of TINXDK Login Limit Lite: XML-RPC, REST and WooCommerce counting, lists, trusted proxies, log, e-mail alerts and WP-CLI.

== Description ==

TINXDK Login Limit Pro extends the free plugin TINXDK Login Limit Lite (required). It is distributed from https://tinxdkcloud.dk/wordpress-plugins/tinxdk-login-limit/ and needs a licence key.

* Counts failed logins from XML-RPC (every failed call of system.multicall), REST application passwords and WooCommerce my-account logins.
* Allowlist and blocklist of IP addresses (IPv4/IPv6, CIDR) and usernames.
* Real client IP behind a reverse proxy: X-Forwarded-For, X-Real-IP or CF-Connecting-IP are honoured only when the request comes from a trusted proxy.
* Lockout log and statistics, GDPR option to anonymise IP addresses, configurable log retention.
* One email to the administrator per lockout (optionally only every N-th lockout).
* WP-CLI: `wp login-limit list`, `wp login-limit unlock <ip>|--all`, `wp login-limit log`.
* Automatic plugin updates through the TINXDK licence server.

The free plugin keeps working when Pro is deactivated or the licence is not valid: counting on wp-login.php, enforcement of lockouts everywhere, unlock and ALTCHA are never part of the licence. Pro settings stay visible but disabled without a licence; the stored values are kept and apply again when a licence is activated.

Licence activation: Settings > Login Limit > License, enter the key (TINX-XXXX-XXXX-XXXX-XXXX) and click Activate. Without contact to the licence server the licence keeps working for 7 days.

== Installation ==

1. Install and activate the free plugin TINXDK Login Limit Lite.
2. Upload this plugin to `/wp-content/plugins/` (or install the zip) and activate it.
3. Enter the licence key under Settings > Login Limit > License.

== Frequently Asked Questions ==

= What happens without the free plugin? =

Pro shows an admin notice and does nothing until TINXDK Login Limit Lite 2.0.0 or newer is active.

= I used the combined plugin 1.x. Is my data kept? =

Yes. Settings, the lockout log, the licence key and the database tables use the same names as before. Install the free plugin TINXDK Login Limit Lite (replaces "TINXDK WP - Login Limit"), then this plugin, and the licence is picked up again.

= What happens on uninstall? =

Deleting Pro removes the lockout log table, the licence data and its options. The settings, the failure counters and the ALTCHA secret belong to the free plugin and are removed only when the free plugin is not installed either.

== External services ==

This plugin contacts the TINXDK licence server at https://licens.tinxdkcloud.dk (operated by TINXDK ApS) to verify the licence and to offer automatic updates.

* When: when you activate or deactivate the licence, twice a day (WP-Cron) to validate it, when WordPress checks for plugin updates (cached 12 hours), when you open "View details" of the plugin in the plugin list and when the plugin is uninstalled (frees the site slot).
* What is sent: the licence key, the site URL, the plugin slug and version, the WordPress and PHP version. Nothing else.
* Terms and privacy policy: https://tinxdkcloud.dk/handelsbetingelser/ (terms) and https://tinxdkcloud.dk/privatliv/ (privacy policy)

== Changelog ==

= 2.0.1 =
* Changed: The free plugin is now called TINXDK Login Limit Lite; this add-on's texts follow. No functional change.

= 2.0.0 =
* Changed: The combined plugin "TINXDK WP - Login Limit" (tinxdk-wp-login-limit) is split in two: the free plugin TINXDK Login Limit Lite and this Pro plugin. All licensed features, the licence client, the licence settings and the updater now live here: XML-RPC / REST application password / WooCommerce counting, allowlist/blocklist, trusted proxies, lockout log with anonymisation and retention, e-mail alerts and WP-CLI.
* Changed: Needs TINXDK Login Limit Lite 2.0.0 or newer; starts when the free plugin has loaded. Option names, database tables and the licence key are unchanged.
* Changed: The lockout log table is now created by this plugin.

== Upgrade Notice ==

= 2.0.1 =
The free plugin is now called TINXDK Login Limit Lite (no functional change).

= 2.0.0 =
Install TINXDK Login Limit Lite 2.0.0 (free) first: it replaces the old combined plugin. Settings, log and licence are kept.
