WPSniffer
=========

WPSniffer is a modified version of a program licensed under the GNU General
Public License version 3, and is distributed under the same license; see
LICENSE. The original program's source as received is the first commit in
this repository's history.

Modifications (2026-10-22)
--------------------------
- Renamed the package, command, configuration, cache paths, user agent,
  banner and logo to WPSniffer.
- Removed license keys, terms acceptance, the remote signature and
  vulnerability APIs, the update check, mailing-list prompts, and the
  vuln-scan, db-scan, remediate and terms subcommands that depended on them.
- Removed the PCRE and Vectorscan match engines and replaced them with a
  YARA-X engine (wpsniffer/scanning/matching/yara.py) that scans whole files
  and reports rule metadata.
- Added YARA rule sources: local rule files/directories and YARA Forge rule
  packages downloaded from GitHub (wpsniffer/intel/yara_sources.py).
- Workers no longer busy-wait on an empty queue and exit when their parent
  process is gone, instead of spinning or blocking forever.

No proprietary malware signatures are included in or used by WPSniffer.

YARA rules
----------
WPSniffer does not ship YARA rules. Rules downloaded from YARA Forge
(https://github.com/YARAHQ/yara-forge) are collected from many public
repositories and keep their original authors, references and licenses in
each rule's metadata. Several sources, including Florian Roth's
signature-base, use the Detection Rule License 1.1, which requires
attribution; keep rule metadata intact when sharing results or rule sets.
