chore(release): 2.4.0

Author: cport1

cdn-files/plugin-info.json

@@ -1,13 +1,13 @@
 {
     "name": "WebDecoy Bot Detection",
     "slug": "webdecoy",
-    "version": "2.3.4",
+    "version": "2.4.0",
     "author": "<a href=\"https://webdecoy.com\">WebDecoy</a>",
     "author_profile": "https://webdecoy.com",
     "requires": "6.1",
     "tested": "7.0",
     "requires_php": "7.4",
-    "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.3.4.zip",
+    "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.4.0.zip",
     "sections": {
         "description": "<p>WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles — including deterministic tripwires that catch scanners with zero false positives.</p><h4>Key Features</h4><ul><li>Deterministic tripwires (hidden honeypot paths) — zero-false-positive bot blocking</li><li>Server-side and client-side bot detection</li><li>Invisible proof-of-work challenge (no external CAPTCHA service)</li><li>Comment, login, and registration spam protection</li><li>WooCommerce carding attack prevention</li><li>60+ good bots automatically allowed</li><li>AI crawler detection and blocking</li><li>Optional WebDecoy Cloud: centralized dashboard, rotation-proof device lockouts, and WAF integrations (push confirmed attackers to Cloudflare or AWS WAF — blocked before they reach WordPress)</li></ul>",
         "installation": "<ol><li>Upload the plugin files to <code>/wp-content/plugins/webdecoy</code></li><li>Activate the plugin through the Plugins menu</li><li>Tripwires and local protection are active out of the box — no API key required</li><li>Optionally go to WebDecoy &gt; Settings &gt; WebDecoy Cloud to connect for centralized monitoring and enforcement</li></ol>",

changelog.txt

@@ -1,5 +1,8 @@
 *** WebDecoy Bot Detection Changelog ***
 
+= 2.4.0 - 2026-07-30 =
+* Added: filter rules can read the WebDecoy edge validator's verdict through new edge.* fields — edge.class, edge.clearance, edge.present, plus the shorthands edge.verified / edge.crawler / edge.script / edge.browser. edge.class is one of: verified (an identity Cloudflare attested, such as Googlebot — never degrade these), crawler (says it is a crawler, unproven), script (an HTTP client library, not a browser), or browser (nothing non-human fired). Matching this was already possible as req.header("x-wd-class") because the plugin forwards every request header into the rule context, but nothing told you the header existed or what its values meant, so nobody used it. The Rules screen now lists the fields and explains them. Absence is deliberately not a class: if the validator is not in front of a request, edge.present is false and every edge.* condition is false, which means "no information" rather than "human" — a rule using these decides whether to serve someone less, so guessing would be the wrong default. A value we do not recognise is ignored rather than passed through. Safe to use for blocking, throttling, logging and metering; not safe for serving different page content on a cacheable URL, because Cloudflare's cache key ignores this header outside Enterprise plans, so the first cached version would be served to everyone including Googlebot — the Rules screen says so too.
+
 = 2.3.4 - 2026-07-30 =
 * Added: tripwires can now Challenge or Log instead of only blocking or serving deception. Challenge asks the visitor to solve a small proof-of-work in the browser; Log records the hit and changes nothing about the response, which is the safest way to watch a tripwire you have just armed. The scoring path has always had these two options and the tripwire path — the one backed by proof rather than a guess — had neither, which was backwards. Note that Challenge needs JavaScript and a click, so nothing automated can complete it; on a tripwire that is the intent, since those paths exist nowhere on your site and no honest crawler requests them.
 * Fixed: timestamps are now stored consistently in UTC and converted for display. They were written in your site's local time and compared against UTC, so on any site not set to UTC the Today / 7 days / 30 days filters covered the wrong span, and the WooCommerce checkout window was the wrong width — narrower west of UTC, wider east of it. Rows written by earlier versions are left as they are rather than shifted, because shifting them would be wrong for any site that has ever changed timezone; the discrepancy ages out of the reporting windows on its own.

readme.txt

@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: security, bot detection, spam protection, woocommerce, firewall
 Requires at least: 6.1
 Tested up to: 7.0
-Stable tag: 2.3.4
+Stable tag: 2.4.0
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -195,6 +195,9 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f
 
 == Changelog ==
 
+= 2.4.0 =
+* Added: filter rules can read what the WebDecoy edge validator concluded about a request, using new edge.* fields — edge.class, edge.clearance, edge.present, and the shorthands edge.verified / edge.crawler / edge.script / edge.browser. edge.class is one of: verified (an identity Cloudflare attested, such as Googlebot — never degrade these), crawler (says it is a crawler, unproven), script (an HTTP client library, not a browser), or browser (nothing non-human fired). This was always matchable as req.header("x-wd-class"), but nothing said so; the Rules screen now documents the fields and what each value means. If the validator is not in front of a request, edge.present is false and every edge.* condition is false — that means "no information", not "human". Safe for blocking, throttling, logging and metering; the Rules screen also explains why you should not use it to serve different page content on a cacheable URL.
+
 = 2.3.4 =
 * Added: tripwires can Challenge (browser proof-of-work) or Log only, not just block or serve deception. Log is the safest way to watch a tripwire you have just armed. Challenge needs JavaScript and a click, so nothing automated completes it — on a tripwire that is the point.
 * Fixed: timestamps are stored in UTC and converted for display. They were written in site-local time and compared against UTC, so on any non-UTC site the Today / 7d / 30d filters covered the wrong span and the WooCommerce checkout window was the wrong width. Older rows are left alone rather than shifted, since shifting is wrong for any site that has changed timezone; the discrepancy ages out.

webdecoy.php

@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.3.4
+ * Version: 2.4.0
  * Requires at least: 6.1
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.3.4');
+define('WEBDECOY_VERSION', '2.4.0');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));