=== Accelvia – Content Protection === Contributors: musfiqurrahman Tags: content protection, disable right click, disable copy, image protection, watermark Requires at least: 6.0 Tested up to: 6.9 Requires PHP: 7.4 Stable tag: 1.2.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Enterprise-grade WordPress content protection with anti-copy, screenshot prevention, DevTools detection, and watermarking. == Description == Accelvia Content Protection is a powerful, zero-dependency WordPress plugin that provides multi-layered, enterprise-grade content protection to deter content theft. It goes far beyond basic right-click blocking with advanced security features including DevTools detection, cross-platform screenshot prevention, encrypted HTML delivery, and canvas-baked watermarking that survives image downloads. ### Content Protection Features * **Disable Right Click (Context Menu):** Prevent users from right-clicking to save images or view source. * **Disable Keyboard Shortcuts:** Blocks common developer and save shortcuts like F12, Ctrl+Shift+I, Ctrl+Shift+J, Ctrl+U, Ctrl+S, and Ctrl+P. * **Disable Text Selection:** Prevents highlighting and selecting text on the page. * **Disable Image Drag:** Stops users from dragging and dropping images to save them. * **Disable Copy (Ctrl+C):** Blocks the standard keyboard shortcut for copying content. * **Modern Notifications:** Display a sleek, auto-dismissing toast notification or a standard browser alert when a user attempts a blocked action. Customise the notification message to fit your brand. * **Granular Control:** Exclude specific post types, exclude specific page/post IDs, or bypass protection entirely for logged-in administrators. * **Immediate Head Guard:** Protection activates instantly in the `` before the page body loads, eliminating any race condition during hot-reload or slow page loads. * **JavaScript Required Guard:** When JavaScript is disabled in the browser, all page content is hidden and a friendly message is shown, since protections depend on JavaScript. * **Zero Dependencies:** Built with pure Vanilla JavaScript and no jQuery, ensuring zero impact on your site's load time. ### DevTools Detection * **3-Layer Detection Engine:** Monitors for Developer Tools opened from any method — keyboard shortcuts, browser menu, or undocked windows. * **Window Size Delta Detection:** Catches DevTools docked to the side or bottom of the browser. * **Console Getter Trap:** Detects when the DevTools Console tab is actively inspecting objects. * **Debugger Timing Detection:** The most reliable method — catches ALL DevTools modes including undocked and menu-opened. Uses cached Function objects for optimal performance. * **Full-Page Blur Overlay:** When DevTools is detected, the page content is blurred and a professional overlay warns the user to close DevTools. * **DOM Encryption on Detection:** When Encrypted Content is enabled, all readable HTML is removed from the DOM and replaced with base64-encoded data while DevTools is open. The Elements panel shows only encrypted gibberish. Content is fully restored when DevTools is closed. ### Encrypted Content (Source Protection) * **Base64 Body Encoding:** The HTML body content is base64-encoded on the server and decoded by JavaScript at runtime. Typing `view-source:` before the URL shows encoded gibberish instead of readable HTML. * **SEO-Safe:** Search engine crawlers (Googlebot, Bingbot, Yandex, Baidu, DuckDuckBot, etc.) and social media bots (Facebook, Twitter, LinkedIn, WhatsApp, Pinterest, Telegram) are automatically whitelisted and receive raw HTML for proper indexing and link previews. * **Layout-Safe Minification:** HTML is minified before encoding with full protection for `

`, ``, `<script>`, and `<style>` blocks — no layout or formatting is affected.
* **Security Headers:** Adds `X-Content-Type-Options: nosniff` and `X-Frame-Options: SAMEORIGIN` to prevent MIME-sniffing and clickjacking.
* **Toggle On/Off:** Enable or disable from the Advanced Settings tab without affecting other protection features.

### Cross-Platform Screenshot Protection
* **Windows:** Blocks PrintScreen key and Win+Shift+S (Snipping Tool), clears clipboard immediately.
* **macOS:** Blocks Cmd+Shift+3 (full screenshot), Cmd+Shift+4 (area selection), and Cmd+Shift+5 (screenshot/recording panel) with instant page blur.
* **Linux:** Blocks PrintScreen and Shift+PrintScreen (area screenshot).
* **Tab Switch Blur:** Automatically blurs the page and reduces opacity when the user switches tabs or the window loses focus — common when using external screenshot tools.
* **Screen Recording Interception:** Intercepts the Screen Capture API (`getDisplayMedia`) to blur content during browser-based screen recording. Content stays blurred until recording stops.
* **Print Protection:** Blocks Ctrl+P, blanks all content via CSS `@media print`, and shows a "content is protected" message when printing is attempted.
* **Periodic Clipboard Clearing:** Automatically clears the clipboard every 3 seconds to neutralize PrintScreen captures even when keydown events are bypassed.
* **CSS Capture Shield:** Applies backdrop filter compositing and disables touch callout/drag to interfere with capture tools.

### Dynamic Image Watermarking
* **Enable/Disable Control:** Turn watermarking on or off at any time with a single toggle.
* **Text Watermarks:** Full control over text content, font size (12–72px), and font color with a visual color picker. Perfect for branding, copyright notices, or messaging.
* **Image Watermarks:** Upload your own logo or image (PNG, SVG) to use as a watermark via the WordPress Media Library.
* **Flexible Positioning:** Choose from 9 precise positions (top-left, top-center, top-right, middle-left, center, middle-right, bottom-left, bottom-center, bottom-right) or use **Tiled/Repeat** mode for full-coverage protection.
* **Opacity Control:** Fine-tune transparency (0–100%) to maintain visibility without affecting image quality.
* **Resizable Watermarks:** Scale watermark size (5–100% of image width) to suit different image dimensions.
* **Tile Spacing:** Adjust spacing between repeated watermarks when using tiled mode.
* **Global or Selective Application:** Apply watermarks across all images site-wide, or target specific images using CSS selectors.
* **Image Exclusion:** Cleanly skip specific images (like logos, banners, or hero images) from receiving watermarks by providing a list of excluded CSS selectors.
* **Device-Based Visibility:** Choose whether watermarks appear on Desktop only, Mobile only, or Both.
* **Canvas-Baked Protection:** Watermarks are burned directly into image pixel data via HTML5 Canvas. The image `src` is replaced with a `blob:` URL, so "Copy Image URL", "Save Image As", and DevTools Network tab all return the watermarked version.
* **Lazy-Load Compatible:** Automatically detects and watermarks dynamically loaded images via MutationObserver.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/accelvia-content-protection` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Navigate to **Settings -> Accelvia Protection** to configure your protection features, customize notifications, set exclusions, and configure watermarks.
4. After updating from a previous version, click **Save Settings** once to persist new default values for any newly added features.

== Frequently Asked Questions ==

= Does this plugin completely prevent content theft? =
No tool can 100% prevent content theft (for example, users can still take photos of their screen with a phone or use external capture hardware). This plugin acts as a very strong, multi-layered deterrent against casual copying, right-clicking, screenshot tools, DevTools inspection, and source code viewing.

= Will this slow down my website? =
No. The plugin is extremely lightweight and uses pure Vanilla JavaScript. DevTools detection uses optimised polling (1.5s intervals with cached function objects) that consumes less than 0.04% CPU. Server-side HTML encoding adds only 2-4ms to page generation. There is no noticeable impact on performance.

= Will Encrypted Content affect my SEO? =
No. Search engine crawlers (Google, Bing, Yandex, Baidu, DuckDuckBot) and social media bots (Facebook, Twitter, LinkedIn, WhatsApp, Pinterest, Telegram) are automatically whitelisted and receive raw, unencoded HTML. Your SEO and social link previews are fully preserved.

= Will Encrypted Content break my page layout? =
No. The minification engine protects `<pre>`, `<textarea>`, `<script>`, and `<style>` blocks from whitespace collapsing. The base64 decoding happens synchronously and is virtually instantaneous. Your layout, design, and interactive elements remain unaffected.

= Can I disable protection on certain pages? =
Yes. You can exclude specific post types or enter specific page/post IDs to exclude them from protection via the plugin's Advanced Settings tab.

= Can I still edit my site and use right-click? =
Yes. You can enable the "Skip Administrators" option in the settings so that all protection is disabled for logged-in administrators.

= Does the watermark modify my original images? =
No. Your original image files in the Media Library are never touched or modified. Watermarks are rendered at runtime via Canvas and CSS overlays.

= Can I use both text and image watermarks? =
You can choose either a text watermark or an image watermark. Select your preferred type from the Watermark tab in settings.

= Will watermarks appear on small icons and favicons? =
No. The plugin automatically skips images smaller than 80×80 pixels (such as icons, spacers, and favicons) to avoid cluttering your interface.

= Can I show watermarks only on mobile devices? =
Yes. The Device Visibility setting lets you choose between Desktop Only, Mobile Only, or Both.

= What happens when JavaScript is disabled? =
All page content is hidden and a friendly message is displayed asking the visitor to enable JavaScript. This is by design, as all protection features require JavaScript to function.

= Does the screenshot protection work on all platforms? =
Yes. It blocks screenshot keyboard shortcuts on Windows, macOS, and Linux. It also blurs the page when the tab loses focus or the browser window is unfocused (common when switching to screenshot tools). It intercepts the Screen Capture API for browser-based screen recording. However, hardware capture methods (phone cameras, external capture cards) cannot be blocked by any browser-based solution.

== Screenshots ==

1. The General Settings tab where you can toggle specific protection features including DevTools Detection and Screenshot Protection.
2. The Advanced Settings tab for configuring custom notifications, access control, and Encrypted Content (source protection).
3. The Watermark tab with text/image type selector, positioning grid, and appearance controls.
4. The frontend toast notification displayed when a protected action is attempted.
5. Example of a tiled text watermark applied to a frontend image.
6. The DevTools Detection overlay shown when Developer Tools is opened.

== Changelog ==

= 1.2.0 =
* **New:** DevTools Detection Engine — 3-layer detection system using window size delta, console getter trap, and debugger timing to catch DevTools opened from any method.
* **New:** DOM Encryption on DevTools Detection — All readable HTML is replaced with base64-encoded data in the Elements panel when DevTools is detected. Content restores non-destructively when DevTools is closed.
* **New:** Encrypted Content (Source Protection) — Server-side base64 body encoding that makes `view-source:` show encoded gibberish. SEO-safe with bot whitelisting.
* **New:** Cross-Platform Screenshot Protection — Blocks screenshot shortcuts on Windows (PrintScreen, Win+Shift+S), macOS (Cmd+Shift+3/4/5), and Linux. Auto-blurs on tab switch/window blur. Intercepts Screen Capture API for recording prevention.
* **New:** Canvas-Baked Watermarking — Burns watermarks into image pixels via HTML5 Canvas. Replaces img.src with blob: URLs so copied/saved images are always watermarked.
* **New:** Immediate Head Guard — Inline script in `<head>` blocks right-click and shortcuts before the page body loads, eliminating race conditions.
* **New:** JavaScript Required Guard — `<noscript>` overlay hides content when JavaScript is disabled.
* **New:** Security Headers — Adds `X-Content-Type-Options: nosniff` and `X-Frame-Options: SAMEORIGIN`.
* **New:** Layout-safe HTML minification that preserves `<pre>`, `<textarea>`, `<script>`, and `<style>` blocks.
* **Improved:** Print protection now blanks all content via CSS `@media print` with a protection message.
* **Improved:** Periodic clipboard clearing every 3 seconds to catch PrintScreen bypasses.
* **Improved:** Performance-optimised DevTools polling with cached Function objects and 1.5s intervals.
* **New:** Dynamic Image Watermarking System.
* Text watermarks with customizable content, font size, and font color.
* Image watermarks via WordPress Media Library upload.
* 9-position grid placement (top-left through bottom-right) plus Tiled/Repeat mode.
* Opacity control (0–100%) and size control (5–100% of image width).
* Tile spacing adjustment for repeat mode.
* Scope targeting: apply to all images or specific CSS selectors.
* Device visibility: Desktop only, Mobile only, or Both.
* MutationObserver support for dynamically loaded / lazy-loaded images.
* WordPress Media Uploader integration for watermark image upload.
* WordPress Color Picker integration for font color selection.

= 1.1.0 =
* Author Update

= 1.0.0 =
* Initial release.