=== iDownAlert ===
Contributors: fareeddaar
Tags: downtime, uptime monitor, security alerts, malware scanner, brute force
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Instant email and Telegram alerts when your site breaks: fatal errors, database outages, malware, file changes, brute-force bots and risky changes.

== Description ==

iDownAlert tells you the moment something goes wrong on your WordPress site, so you hear about it before your visitors or customers do.

= Errors & downtime =

* **White screen / fatal errors.** Get the error message, the file and line, and which plugin or theme caused it.
* **Database down.** When WordPress shows "Error establishing a database connection", you get an email, and visitors see a clean "We'll be right back" page instead. You are told again when the database comes back, with the total downtime.
* **Works when WordPress can't.** Two small files in wp-content (`db-error.php` and `fatal-error-handler.php`) send alerts even when the database is down or a plugin crashes before the others load.
* **Whole server down?** No plugin can send an email from a server that is switched off, so iDownAlert gives you a private heartbeat URL to add to a free uptime monitor such as UptimeRobot. The dashboard shows step-by-step instructions and confirms when the monitor is connected.

= Malware & file changes =

* Compares WordPress core files with the official checksums from wordpress.org.
* Flags unknown PHP files in wp-admin, wp-includes and the site root.
* Flags any PHP file in the uploads folder, a common sign of a hack.
* Reports PHP files added or modified in plugins, themes and wp-content, except changes made by normal updates.
* Checks new and changed files for backdoors, web shells and obfuscated code.

= Bots & brute force =

* Alerts on repeated failed logins, 404 floods and scanners probing for files like `.env`, `.git` or wp-config backups.
* Optionally blocks the offending IP for a time you choose.
* Works behind Cloudflare and other proxies, with an allowlist for your own IPs.

= Site changes & health =

* New administrator accounts.
* Site URL, admin email, registration or default role changes.
* Plugins and themes installed, updated, activated, deactivated or deleted.
* Failed automatic updates.
* SSL certificate about to expire, and low disk space.
* Emails your site fails to send.

= No inbox floods =

Repeats of the same problem are grouped: you get one email, and the next one tells you how many times it happened in between. A global hourly cap protects you during an attack. Every event is also kept in a searchable log on the dashboard.

= Delivery you can trust =

Alerts use `wp_mail()` by default. Because a broken mail setup is one of the things you want to hear about, iDownAlert can also send through its own SMTP connection (Gmail, Outlook, Zoho or your host) that works independently of other mail plugins, and through a Telegram bot as a backup.

== Installation ==

1. Upload the plugin through Plugins → Add New → Upload Plugin, or install it from the plugin directory, then activate it.
2. Go to iDownAlert → Settings and check the email address that should receive alerts.
3. Optional: under Delivery, set up SMTP and/or Telegram, then click "Send test alert".
4. On the iDownAlert dashboard, copy the heartbeat URL into a free uptime monitor to be alerted when the whole server is down.

If an IP block ever locks you out, add `define( 'IDOWNALERT_DISABLE_FIREWALL', true );` to wp-config.php.

To keep the SMTP password out of the database, add `define( 'IDOWNALERT_SMTP_PASSWORD', 'your-password' );` to wp-config.php.

== Frequently Asked Questions ==

= Can the plugin email me if my server goes down completely? =

Not by itself: when the server is off, no code on it can run. iDownAlert covers this with a heartbeat URL for an external uptime monitor (UptimeRobot's free plan checks every 5 minutes). Everything else, including database outages and fatal errors, is reported by the plugin directly.

= What files does iDownAlert add outside its own folder? =

`wp-content/db-error.php`, `wp-content/fatal-error-handler.php` and a `wp-content/idownalert/` folder holding the alert settings (protected from web access). If another plugin already uses one of those drop-ins, iDownAlert leaves it alone. All of them are removed when you deactivate the plugin. You can turn the drop-ins off under Settings → Alerts.

= Will scans slow down my site? =

Scans run in the background with WP-Cron, once a day by default. Only new and changed files are checked for malicious code after the first scan.

= I keep getting an alert about a file I trust. =

Click "Mark as safe" next to it on the dashboard. If the file changes later, it is checked again.

== External services ==

iDownAlert connects to these services:

* **WordPress.org checksums API** (`api.wordpress.org/core/checksums/`), during malware scans when "WordPress core" scanning is on, to fetch the official checksums for your WordPress version. Only your WordPress version and locale are sent. [Terms](https://wordpress.org/about/privacy/)
* **Telegram Bot API** (`api.telegram.org`), only if you turn on Telegram alerts. Each alert's text is sent to the chat you choose. [Terms](https://telegram.org/tos) · [Privacy](https://telegram.org/privacy)
* **Your SMTP server**, only if you turn on SMTP. Alerts are sent through the server you enter.

The dashboard links to UptimeRobot as an example uptime monitor; the plugin sends nothing to it. The monitor you choose calls your heartbeat URL, which returns only "ok/problem" status.

== Changelog ==

= 1.0.0 =
* First release.
