v5.262

minor

Basic protection firewall based on the excellent 8G Firewall by Jeff Star. · Events logger now part of free version,…

New

  • Basic protection firewall based on the excellent 8G Firewall by Jeff Star.
  • Events logger now part of free version, basic event monitoring and logging for your site.
  • Core Scanner - Added ability to ignore specific files and patterns from scan results using the securityninja_core_scanner_ignore_files filter. Ignored files are displayed in a separate section for transparency. https://wpsecurityninja.com/docs/core-scanner/how-to-ignore-files/ - Thank you Gary.
  • Free users now benefit from the firewall based on the excellent 8G Firewall by Jeff Star.
  • Events logger now part of free version, basic event monitoring and logging for your site. More advanced tracking in premium version available.
  • Quick firewall stats in the sidebar.

Improved

  • Events Logger - All modules are now included in email reports by default. Users can deselect specific modules in settings.
  • Added 'php_errorlog' to the list of allowed files to view by the file viewer.
  • Added firewall events to the overview page for free users.
  • File viewer - Added 'php_errorlog' to the list of allowed files to view.
  • Overview - Added firewall events to the overview page for free users.
  • Tested up to WP 6.9.

Fixed

  • Fixed CIDR notation matching in IP whitelist - CIDR ranges like 94.247.216.0/21 now correctly match IPs within the range (e.g., 94.247.221.129). Thank you Dirk.
  • 2FA generation now uses your site's URL—rather than the site name—for labeling in authenticator apps, ensuring greater clarity and consistency.
  • Refactor local request check in Wf_Sn_Tests class by introducing a dedicated method. Thank you Jean.
  • Events Logger - Prevented excessive memory usage by skipping translation hooks and reducing repeated license checks during audit logging.
  • Fixed CIDR notation matching in IP whitelist - CIDR ranges now correctly match IPs within the range - Thank you Dirk.
  • 2FA generation now uses your site's URL-rather than the site name-for labeling in authenticator apps, ensuring greater clarity and consistency.

Notes

  • 2025-11-xx
  • Tested up to WP 6.9
  • Updated development dependencies for code quality tools (PHP_CodeSniffer, PHPCompatibility, WPCS).
  • 2025-12-xx
  • 2026-01-xx

v5.261

minor

2025-11-

Improved

  • Database prefix changer now works with any prefix, not just the default "wp_". Can now rename tables when changing from one custom prefix to another. All plugin tables are automatically included in the renaming process.

Fixed

  • Compatibility warning with WordPress 6.7 regarding translation loading timing
  • Server security restriction warning when checking wp-config.php file location
  • 2FA - Changed key name format from "site_url (username):email" to "site_url:username" - Thank you Davina.
  • Fixed critical bug where database prefix changer added an extra underscore when updating wp-config.php, causing WordPress to look for non-existent tables with double underscores (e.g., wp_12345__posts instead of wp_12345_posts). Thank you Tchai.
  • Database prefix changer to properly update option names and meta keys when changing from custom prefixes (not just "wp_").
  • 2FA - Changed key name format from "site_url (username):email" to "site_url:username" - Thank you Davina.
  • Compatibility warning with WordPress 6.7 regarding translation loading timing.
  • Server security restriction warning when checking wp-config.php file location.
  • Fixed critical bug where database prefix changer added an extra underscore when updating wp-config.php, causing WordPress to look for non-existent tables with double underscores (e.g., wp_12345__posts instead of wp_12345_posts). Thank you Tchai.
  • Database prefix changer to properly update option names and meta keys when changing from custom prefixes (not just "wp_").

Notes

  • 2025-11-

v5.260

minor

Failed login email warnings - administrators receive email notifications when someone attempts to log in with their u…

New

  • Failed login email warnings - administrators receive email notifications when someone attempts to log in with their username and fails. Can be enabled in Login Form Protection settings.
  • Admin IPs are automatically whitelisted on plugin activation and successful admin login to prevent administrators from being blocked. Thank you Val.

Improved

  • Secret access URL processing moved earlier in request cycle to ensure IP whitelisting occurs before ban checks, blocked visitors can regain site access more reliably.
  • wp-config.php backups are stored in encrypted format (AES-256-CBC) to ensure data security. Each backup uses a unique encryption key and initialization vector. This was fixed in a previous release, but changelog not updated.
  • Secret access URL processing has been moved up in the request cycle to make sure IP whitelisting happens before any ban checks, so blocked visitors should be able to get back on the site more reliably.
  • wp-config.php backups are stored in encrypted format (AES-256-CBC) to ensure data security. Each backup uses a unique encryption key and initialization vector. This was introduced in a previous release, but was not added to the changelog.
  • Updated bundled dependencies - Freemius SDK 2.13.0 among others.

Fixed

  • Fixed country blocking to respect "only block backend" setting when enabled. Thank you Guru for the tip.

Notes

  • Update 3rd party libraries - Freemius SDK 2.13.0 among others.

v5.259

minor

Made the dashboard widget visible when white label mode is enabled. Previously the widget was hid…

Improved

  • Made the dashboard widget visible when white label mode is enabled. Previously the widget was hidden instead. Thank you for the suggestion, Dmitry.
  • Added count-based limit (5000 entries) to visitor log pruning to prevent database bloat on high-traffic sites.
  • Removed deprecated X-XSS-Protection header from REST API - modern browsers ignore this header and Content-Security-Policy is the recommended replacement. Thank you Dmitry for the suggestions.
  • More information on CSP in our knowledgebase.
  • Preparing for plugin rewrite - improving the free version and streamlining the premium and free feature set.

Fixed

  • Fixed typo in Permissions-Policy description (explitly → explicitly).
  • Updated Permissions-Policy documentation link from Feature-Policy to Permissions-Policy URL.
  • Corrected Nginx example in Content-Security-Policy test descriptions (was showing X-Frame-Options instead of CSP).

Notes

  • Preparing for plugin rewrite -> improving the free version and streamlining the premium and free feature set.

v5.258

minor

Enhanced username enumeration protection - Now prevents username discovery via REST API /wp-json/wp/v2/users endpoint…

New

  • Enhanced username enumeration protection - Now prevents username discovery via REST API /wp-json/wp/v2/users endpoint and oEmbed API, in addition to existing ?author=N scan protection. Thanks Allen.

v5.257

minor

2025-10-xx

Fixed

  • Removed duplicate 2FA login requests to prevent error flashes. Thanks to Eric for spotting this.
  • Added try-catch to prevent problems with corrupted IP location database, thank you Wan.

Notes

  • 2025-10-xx
  • Removed duplicate 2FA login requests to prevent error flashes. Thanks to Eric for spotting this.
  • Added try-catch to prevent problems with corrupted IP location database, thank you Wan.

v5.256

minor

Fix for recommendation engine "wp-config.php not found in the wordpress root directory" - now pro…

Improved

  • 2FA setup page stability and performance across different WordPress configurations.
  • 2FA - naming of the accounts are now a little more intuitive. Thank you Davina.

Fixed

  • Recommendation engine - "wp-config.php not found in the wordpress root directory" now properly checks for when the config file has been moved up one level. Thank you Eric.
  • 2FA email - user reported emails were sent twice with two different codes. Thank you Eric.

Notes

  • Fix for recommendation engine "wp-config.php not found in the wordpress root directory" - now properly checks for when the config file has been moved up on level. Thank you Eric.
  • Fix - 2FA email, user reported emails were sent twice with two different codes. Thank you Eric.
  • Improvements to the 2FA email sending and user feedback when requesting a code.
  • Improved 2FA setup page stability and performance across different WordPress configurations.
  • 2FA - naming of the accounts are now a little more intuitive. Thank you Davina.

v5.255

minor

Added XML-RPC protection feature. This update enhances your site's security by allowing you to easily enable or disab…

New

  • Added XML-RPC protection feature. This update enhances your site's security by allowing you to easily enable or disable XML-RPC access.

Improved

  • Malware signatures tweaked and improved, thank you users for suggestions.
  • Malware Scanner - signatures tweaked and improved, thank you users for suggestions.

v5.254

minor

Add secret key display and copy functionality to 2FA module in frontend and backend. Allowing users to easier add the…

New

  • Add secret key display and copy functionality to 2FA module in frontend and backend. Allowing users to easier add the key to their system.

Improved

  • Enhanced 2FA JavaScript with robust error handling and DOM ready protection
  • Added inline JavaScript handlers as fallback to ensure 2FA works even when external scripts fail
  • Better error messages and user feedback during 2FA setup process

Fixed

  • Resolved JavaScript conflicts that prevented 2FA functionality from working with ARMember and other plugins
  • 2FA QR code/key generation now works reliably across all site configurations, even if other scripts have errors. "Skip for now" link, "Generate new QR code" button, code input validation, and temporary secret usage during setup all function correctly.
  • 2FA setup UI and logic are now robust—QR code generation.
  • Installation issues that pop up occasionally has been fixed.
  • Timezone on Overview page was incorrect, thank you for spotting Ivar.
  • 2FA setup UI and logic are now robust-QR code generation.

Notes

  • Add secret key display and copy functionality to 2FA module
  • Add secret key display and copy functionality to 2FA module in frontend and backend. Allowing users to easier add the key to their system.

v5.253

minor

Setting up 2FA for users in admin pages · Setting up 2FA for users in admin pages.

New

  • Setting up 2FA for users in admin pages
  • Setting up 2FA for users in admin pages.

Fixed

  • WooCommerce - Coupon protection in modern block cart and checkout page. Thank you Priit.

Notes

  • Fix for coupon protection in WooCommerce modern block cart and checkout page - Thank you Priit.

v5.252

minor

Fixes for REST API warnings.

Improved

  • Updated internal libraries (PHP enums, WordPress SDK, and PHP_CodeSniffer tooling) to latest patch versions for improved stability, coding standards checks, and compatibility. No breaking changes.

Fixed

  • REST API warnings.

Notes

  • Fixes for REST API warnings.
  • Updated internal libraries (PHP enums, WordPress SDK, and PHP_CodeSniffer tooling) to latest patch versions for improved stability, coding standards checks, and compatibility. No breaking changes.

v5.251

minor

Removed extra whitespace in "import/export".

Fixed

  • Removed extra whitespace in "import/export".
  • Improved "Fixes" features proper loading when doing import/export.

v5.250

minor

Remove translated messages for errors logging in, creating a loop trying to present translated me…

Improved

  • Custom login URL security with proper access control and error handling.

Fixed

  • Fixed database prefix renaming to properly handle option names containing embedded prefixes. Thank you Chris!
  • Removed translated messages for errors logging in, creating a loop trying to present translated messages using WP's translation engine.

Notes

  • Remove translated messages for errors logging in, creating a loop trying to present translated messages using WP's translation engine.
  • Enhanced: Improved custom login URL security with proper access control and error handling

v5.249

minor

Added "Reset Secret Access URL" button to the Tools page. This allows administrators to quickly reset the secret acce…

New

  • Added "Reset Secret Access URL" button to the Tools page. This allows administrators to quickly reset the secret access URL used for firewall whitelisting.

Fixed

  • Prevent firewall from blocking REST API endpoints for plugins like Webba Booking
  • Visitor log issue with White Label enabled.

Notes

  • Improved - Better instructions for setting up 2FA.

v5.248

minor

Events Logger – REST API diagnostics. Added hooks to log REST authentication failures, pre-dispatch errors, final RES…

New

  • Events Logger – REST API diagnostics. Added hooks to log REST authentication failures, pre-dispatch errors, final REST error responses, and successful REST post creations. View details in Events → filter by actions like "rest_auth_error", "rest_pre_dispatch_error", "rest_error_response", and "rest_post_created" to troubleshoot API clients.
  • Filter by event type in the Events tab overview.
  • Events Logger – REST API diagnostics. Added hooks to log REST authentication failures, pre-dispatch errors, final REST error responses, and successful REST post creations. View details in Events.
  • Filter by event type in the Events tab overview. Faster overview.

Fixed

  • Core Scanner - Resolved false positive alerts when users delete default themes (like Twenty Twenty-Three and Twenty Twenty-Four). The scanner now properly distinguishes between missing essential core files and intentionally removed theme/plugin files. Theme and plugin modifications are still detected as security issues, but deletions are no longer flagged as problems.
  • User ID 1 Change - Fixed issue where users would lose administrator privileges when changing user ID 1 to a new ID. The fix now properly transfers user capabilities and ensures administrator role is maintained. Also improved security by using prepared statements for all database queries.
  • User ID 1 Change - Fixed issue where users would lose administrator privileges when changing user ID 1 to a new ID. The fix now properly transfers user capabilities and ensures administrator role is maintained.
  • Issues with logging in with custom login URL for some users.
  • Some settings not saving for some users (block admin function)
  • Added specific whitelist rules for WPVivid Backup Pro and Free version files containing legitimate php_uname() usage and nested function calls.
  • Properly imports Whitelabel settings, thank you Davina.
  • Remove references to the plugin name in the email sent with Secret Access URL details - if White label feature enabled.

Notes

  • Remove references to the plugin name in the email sent with Secret Access URL details - if White label feature enabled.
  • Updated French translation file.
  • CHANGE: Core Scanner – Focus on critical core files only. Modifications under wp-content/ (themes, plugins, language packs) are excluded from Core Scanner "modified core files" results and from the tab counter. Deletions of default themes/plugins remain treated as non-issues.

v5.247

minor

Multisite activation issues - Database tables are now properly created for all sites in multisite…

Improved

  • Code refactoring - Eliminated duplicate table creation methods, reducing code size by ~100 lines
  • New site creation in multisite now automatically creates required database tables
  • Better error handling and logging for database table creation processes
  • Enhanced multisite integration with Freemius SDK for proper license management
  • Code refactoring - Eliminated duplicate table creation methods, reducing code size by ~1000 lines
  • Enhanced multisite compatibility for all security tests
  • Multisite-aware test methods
  • Database operations for multisite
  • Test execution system
  • Code refactoring - Moved utility functions to dedicated classes
  • Test execution system, in particular to multisite testing.
  • Vulnerability scanner - Fixed time difference calculation for "Last Updated" display
  • Vulnerability file download - Simplified to single "Download All Files" button
  • Freemius integration - Added license validation hooks to ensure premium tables are created
  • Added license validation hooks to ensure premium tables are properly created.

Fixed

  • Multisite activation issues - Database tables are now properly created for all sites in multisite networks
  • PHP 8.1+ compatibility - Added safe string functions to prevent deprecation warnings for strip_tags() and ltrim()
  • Multisite activation issues - Database tables now properly created for all sites in multisite networks
  • PHP 8.1+ compatibility - Added safe string functions to prevent deprecation warnings

Notes

  • TESTS:

v5.246

minor

Languages!

Notes

  • Languages!
  • Languages! Lots of language changes.

v5.245

minor

2FA - Use E-mail based codes or app - Several users wanted to be able to choose email instead of app-based authentica…

New

  • 2FA - Use E-mail based codes or app - Several users wanted to be able to choose email instead of app-based authentication.
  • Enhanced test interface with smooth animations - Tests now show spinner animations during execution and completion highlights for better visual feedback.

Fixed

  • Removed minimum of 5 days in 2FA grace period.
  • Some users reported settings reset - we tracked it to a race-condition where an update could overwrite the settings if not loaded yet.
  • Error with importing latest settings that included malware scanner results. Trimmed down the export settings.

v5.244

minor

Minor adjustment to file-viewer class, function to check where file is located.

Fixed

  • Minor adjustment to file-viewer class, function to check where file is located.

v5.243

minor

Fix problem with 404 Guard not displaying statistics properly in admin page.

Improved

  • Malware scanner now only shows "View File" buttons for viewable file types * IMPROVED: FileViewer interface now properly hides WordPress admin elements when viewing files
  • Malware Scanner improved to be faster and use more detailed whitelisting system.
  • Implemented centralized security system with dual validation (hash + nonce) for all file access
  • Added time-limited file access tokens
  • Enhanced file path validation to prevent directory traversal attacks

Fixed

  • Corrected an issue where the firewall would block frontend access for banned IPs even when the setting to only block login pages was enabled.
  • Problem with 404 Guard not displaying statistics properly in admin page.
  • Removed posibility for administrators to view any file on server by generating hash manually. Limited core scanner to only view files in core WordPress folders.
  • "View File" buttons no longer appear for non-viewable file types, preventing user confusion
  • File access tokens now properly expire.
  • WPVivid Backup Pro - No more false positives.
  • Malware scanner improved results with more detailed whitelisting.
  • WPVivid Backup Pro - No more false positives in malware scanner.

Notes

  • Fix problem with 404 Guard not displaying statistics properly in admin page.
  • SECURITY: Implemented centralized security system with dual validation (hash + nonce) for all file access
  • SECURITY: Added time-limited file access tokens (5-minute expiry) to prevent persistent unauthorized access
  • SECURITY: Enhanced file path validation to prevent directory traversal attacks

v5.242

minor

Added WooCommerce protection to the Wizard for new installations.

New

  • Added WooCommerce protection to the Wizard for new installations.

Improved

  • Firewall module loads more efficiently, moved non-essential code to sub structure to improve load time in and out of admin.
  • Firewall settings module loads more efficiently, moved non-essential code to sub structure to improve load time in and out of admin.
  • Dashboard Widget visually improved and contains more practical information.

Fixed

  • Enhanced REST API protection to prevent blocking legitimate API calls. Thank you Alex.
  • Firewall settings randomly deactivates in rare cases.
  • Change login URL feature did not properly save its state.

Notes

  • *CURSORPOINT*

v5.241

minor

REST API endpoint integration for something new and exciting. · 404 Guard. Monitor excessive 404 errors and block abu…

New

  • REST API endpoint integration for something new and exciting.
  • 404 Guard. Monitor excessive 404 errors and block abusive visitors automatically. Finetune settings as needed in our new settings page - "Firewall" -> "404 Guard"
  • WooCommerce Protection tab in Firewall – dedicated security settings for WooCommerce stores!
  • WooCommerce-specific 404 Guard – detects and blocks suspicious activity targeting shop, product, cart, and checkout URLs.
  • Rate limiting for WooCommerce actions – limit excessive checkout, add-to-cart, and order attempts to prevent abuse and bots.
  • Coupon Code Brute Force Protection – automatically blocks IPs that attempt too many invalid coupon codes with temporary bans.
  • 404 Guard. Monitor excessive 404 errors and block abusive visitors automatically. Finetune settings as needed in our new settings page - "Firewall" -> "404 Guard"!
  • Rate limiting for WooCommerce actions – limit excessive checkout, add-to-cart.

Improved

  • Brute force protection for the lost password feature!
  • Vulnerability Scanner - Fixed details display and theme update links
  • Manual vulnerability button.
  • Loading time - Improved business logic for loading faster.
  • Added a button to allow manual vulnerability scans.
  • Loading time - Improved internal logic for loading faster.
  • Enhanced test interface with visual feedback - Tests now show color-coded highlights to indicate status changes, making it easier to see which tests have improved (green), declined (red), or changed (yellow). Thanks to user feedback for this improvement!
  • Enhanced test interface with visual feedback - Tests now show color-coded highlights to indicate status changes, making it easier to see which tests have improved, declined, or changed. Thanks to user feedback for this improvement!
  • Icons on tests are now easier to see with a quick glance, thank you for the user feedback.

Fixed

  • "Update Database" button - Thank you Wan.
  • Bug with deleting individual detected files in core scanner (Delete All worked fine). Thank you Wan.
  • Child theme vulnerability detection bug - Fixed incorrect logic that was causing child themes to be flagged as vulnerable when comparing child theme version against parent theme vulnerability threshold. Thank you Ivan.
  • Prevent Banned IPs from Accessing the Site setting now works correctly - when set to OFF, banned IPs can visit the site but are blocked from login pages. Thank you Sascha.
  • "Update Database" button was not working correctly - Thank you Wan.

v5.240

minor

Firewall rules improved, now much easier to pinpoint any particular

Improved

  • Firewall rules improved, now much easier to pinpoint any particular
  • Better handling of firewall rules.
  • File viewer now breaks long lines - Easier to view content.

Notes

  • *Enhanced Vulnerability Scanner Performance*: Implemented memory-efficient scanning to prevent memory exhaustion on large vulnerability databases. The scanner now processes vulnerability data line-by-line and includes automatic memory monitoring to ensure stable operation.
  • *New Ignore Feature*: Added ability to ignore specific plugins and themes from vulnerability scanning. Users can now exclude trusted plugins/themes from security alerts via the settings page.
  • *Child Theme Vulnerability Detection*: Enhanced theme vulnerability scanning to properly detect when child themes inherit vulnerabilities from their parent themes.
  • *Better Error Handling*: Enhanced error handling and recovery for vulnerability scanning operations.
  • Added: ModularDS ips' are now always whitelisted.
  • Added: ModularDS IPs are now always whitelisted.

v5.239

minor

"Details" button in events log would sometimes expand details and also reload the entire page.

Fixed

  • "Details" button in events log would sometimes expand details and also reload the entire page.

Notes

  • Improved visuals on the overview page for the firewall events.
  • Continued improving the visual layout of the plugin.
  • Improvements to visitor logging - better filtering of unecessary requests.

v5.238

minor

Added method to activate license in the main sidebar if license has not been activated yet. · Improved WooCommerce pr…

New

  • Added method to activate license in the main sidebar if license has not been activated yet.
  • Improved WooCommerce protection - Block countries from logging in or registering via WooCommerce.

Improved

  • Updated the "Fixes" page with the new interface.
  • Visitor Log page fixed minor issues and implemented the new interface.

Notes

  • 2025-06-

v5.237

minor

The emails from the Scheduled Scanner now contain details if any changes have been detected in the scheduled scans. N…

New

  • The emails from the Scheduled Scanner now contain details if any changes have been detected in the scheduled scans. No need to log in to see details.

Improved

  • Further improving the visual interface we introduced recently.

Notes

  • Further improving the visual interface.
  • Improving the code, making the plugin load faster in the admin interface.
  • Removed HelpScout beacon - we are transferring to a new support ticket system.

v5.236

minor

2025-05

Notes

  • 2025-05
  • Improvement to the interface. More changes to come, but already a much nicer interface with more features and polish.
  • Major improvements to the interface. More changes to come, but already a much nicer interface with more features and polish.
  • Many minor improvements under the hood -
  • Many minor improvements under the hood. Reworking the interface cleaned up underlying code.

v5.235

minor

"Overview" tab - Does exactly as it says, gives you a nice overview. · Introducing the "Overview" Tab - A comprehensi…

New

  • "Overview" tab - Does exactly as it says, gives you a nice overview.
  • Introducing the "Overview" Tab - A comprehensive dashboard providing a clear and concise summary of your website's security status.

Improved

  • Much improved interface, we have moved on from the traditional WordPress style and add a bit more color and flair. This is a work in progress but already the interface is much nicer to look at.
  • Revamped User Interface - Experience a modern and visually appealing interface, departing from the traditional WordPress aesthetic with enhanced color and design elements. This is an ongoing effort that will introduce more changes over the next releases.

Notes

  • 2025-05-
  • Added Fastpixel IPs to default whitelist.
  • UPDATED: Added Fastpixel IPs to the default whitelist for enhanced compatibility and reduced false positives.

v5.234

minor

Fixing warnings for translation related notices. We changed the code that loads the language file…

Notes

  • Fixing warnings for translation related notices. We changed the code that loads the language files to follow WordPress new standard.
  • Added "Whats New" for pro users that show a changelog for users right in the plugin.
  • Enhanced WordPress Multisite compatibility and integration - thank you for reporting issues.
  • Resolved translation-related PHP warnings by updating language file loading to follow WordPress standards.
  • Introduced "What's New" feature for Pro users to view changelog directly within the plugin.
  • Added welcome message for new plugin installations to improve user onboarding.

v5.233

minor

Fixed problem with custom login for some users, sorry for the hassle.

Notes

  • Fixed problem with custom login for some users, sorry for the hassle.

v5.232

minor

Rewrote activation code, removed race conditions that created issues for some users.

Notes

  • Rewrote activation code, removed race conditions that created issues for some users.
  • Improved visitor logging interface.
  • Rewritten activation code, removed race conditions that created issues for some users.

v5.230

minor

Enhanced compatibility with Trafft Booking System - A workaround has been implemented to ensure s…

Notes

  • Enhanced compatibility with Trafft Booking System - A workaround has been implemented to ensure seamless integration with our plugin, even when the Trafft Booking System is active.

v5.229

minor

Added checks for the unecessary themes to include theme from 2025, thank you Troy.

Fixed

  • Scheduled Scanner now correctly respects the "Send an email only when test results change" setting, preventing daily emails when no changes are detected. Thank you Jean.
  • Added a database update routine to fix missing URL column in visitor log table that was causing errors. Thank you Jean for reporting this issue.
  • WordPress version detection issue, thanks to Tom for pointing it out.

Notes

  • Added checks for the unecessary themes to include theme from 2025, thank you Troy.
  • Added fix for incorrect header values in the auto-fixer. Saving a header value containing a URL could lead to incorrect values being saved. Thank you Maxime.
  • Added fix for incorrect CSP header values in the auto-fixer. Saving a header value containing a URL could lead to incorrect values being saved. Thank you Maxime.
  • Cleaning up temporary files - Thank you Heath.
  • Change: Renamed the license file from license.txt to license_key.txt for better clarity and consistency, this prevents overlap with tests trying to remove the file.

v5.228

minor

Resolved PHP warnings in Events Logger related to undefined 'notify_new_admin' array key

Fixed

  • Resolved PHP warnings in Events Logger related to undefined 'notify_new_admin' array key

v5.227

minor

Security: Improved backup file encryption to prevent unauthorized access to sensitive configurati…

Fixed

  • Resolved PHP warnings in Events Logger related to undefined 'notify_new_admin' array key

Notes

  • Security: Improved backup file encryption to prevent unauthorized access to sensitive configuration files
  • Security: Added file integrity verification to backup/restore functionality
  • Enhancement: Improved visitor log interface:
  • Enhancement: Added default settings for Events Logger notifications to prevent PHP notices

v5.226

minor

Added notification system for new administrator user creation, including direct database insertions - https://securit…

New

  • Added notification system for new administrator user creation, including direct database insertions - https://securityninja.productlift.dev/p/notify-when-a-new-admin-user-has-been-created-uLRYcA
  • Added periodic checks for unauthorized admin user creation through database manipulation

v5.225

minor

Updated: Freemius SDK to 2.11.0

Notes

  • Updated: Freemius SDK to 2.11.0
  • Updated language files.

v5.224

minor

Added "Skip" button when activating the firewall. · Added "Skip" button when activating the firewall for smoother onb…

New

  • Added "Skip" button when activating the firewall.
  • Added "Skip" button when activating the firewall for smoother onboarding

Improved

  • Enhanced UI with better color contrast in the test interface
  • Vulnerability scanner now shows how many vulnerabilities are in the list.

Fixed

  • Resolved compatibility issues with Nextend Social Login in 2FA module

Notes

  • Improved 2FA compatibility with Nextend Social Login.
  • Improved colors in the test interface.
  • Enhanced: Completely revamped 2FA setup flow:
  • Security: Strengthened session management in 2FA authentication process
  • UX: Added automatic focus on 2FA code input field
  • Dev: Code refactoring for better maintainability and WordPress coding standards compliance.
  • Enhanced: Improved Import/Export functionality:
  • Dev: Code refactoring for better maintainability and WordPress coding standards compliance
  • Code refactoring for better maintainability and WordPress coding standards compliance

v5.223

minor

Added missing URL column to visitor log database table to properly track request URLs.

Fixed

  • Added missing URL column to visitor log database table to properly track request URLs.
  • Cleaning up the code for the 2FA module console log messages only showing for error events.
  • Create missing database tables when installing the plugin.

Notes

  • Updated: Freemius SDK to 2.10.1 and phpseclib to 2.0.48.
  • Added UptimeRobot IPs to the whitelist.

Install the free plugin on WordPress.org, or go Pro for cloud firewall, malware scanning, and agency tools.