Black Friday: 30% OFF on all plans, applied automatically at checkout View plans
1,218 sites with automatic updates See plans
Log in Cart

Hide My WP Ghost Pro Changelog

Every recorded version, newest first, with what changed in each one.

Latest 9.0.13 · Jul 27, 202615 versionsSince Mar 2026

2026 · 15 versions

  1. 9.0.13

    Latest
    6 new8 fixes
    New
    • Vulnerability scan: flags installed plugins and themes with published security issues
    • Ghost Doctor: finds what is breaking your paths and repairs it in one click
    • Ghost Doctor can switch to protection that needs no server rules when your server will not serve them
    • Security Check now opens with one prioritized list of what to fix first
    • AI explanations written for your own website, server and configuration
    • Undo restores your settings if a repair does not help
    Fixed
    • Security Check no longer reports wp-content, the login path or the admin path as visible on sites that are hiding them correctly
    • Ghost Doctor no longer reports a failure when Disable REST API Access is on
    • Open on a failing path check no longer leads to a 404 while the new paths are not working yet
    • Fix it now works for Security Keys, Table Prefix, wp-config constants and plugin updates
    • Security Check runs on its own the first time you open it
    • Last check now shows how long ago the scan ran, not a clock time
    • Change Paths shows one card after a path change instead of two
    • Security Tasks no longer shows an empty table when every task passed

  2. 9.0.12

    5 security
    Security
    • Two-Factor Authentication settings are now bound to the account they belong to, so the 2FA method, authenticator, email codes, backup codes and passkeys can only be managed by the account owner or by an administrator allowed to edit that user
    • Passkey enrollment is now always self-service, matching the device the passkey is created on
    • Temporary Login updates and deletions now apply only to temporary accounts, so regular accounts are never affected from this screen
    • The role assigned to a temporary login is now validated and can never grant more capabilities than the user creating it already has
    • Magic Login links now require the same permissions as the screen they are offered from

  3. 9.0.11

    2 fixes
    Fixed
    • Editing a custom post type that uses the built-in Categories/Tags taxonomy no longer crashes the Block Editor with "Cannot read properties of undefined"
    • Block Editor no longer crashes with "Cannot read properties of undefined" when Hide User Enumeration is on; the users REST endpoint is now hidden from anonymous visitors only, so logged-in Editors and Authors can still edit posts and custom post types

  4. 9.0.10

    3 fixes
    Fixed
    • Cloud Activity Log entries are now sent in the background, so a slow logging server can no longer delay backend requests, including the Block Editor and other REST calls
    • Force 2FA Setup no longer redirects custom user roles that can't access their profile to a setup screen they are unable to open
    • Settings page navigation menu no longer loses its layout on sites where another plugin or theme restricts the allowed HTML tags; the menu now keeps its own classes and attributes regardless of the site's wp_kses filters

  5. 9.0.09

    1 new1 fix
    New
    • Force 2FA Setup: require selected user roles to set up Two-Factor Authentication before they can access the dashboard, with a guided setup screen shown right after login
    Fixed
    • WP-CLI commands no longer emit a PHP 8.5 Undefined array key hostname warning

  6. 9.0.08

    2 fixes
    Fixed
    • Temporary Login page no longer triggers a fatal error when opened for a user that was deleted or expired
    • Two-Factor email setup and Magic Login no longer emit PHP warnings when the requested user no longer exists

  7. 9.0.07

    2 new1 improvement
    New
    • Frontend Check now also verifies the theme's CSS and JS files load, catching a broken layout on pages that still return 200
    • Detects when CSS/JS/font files load through WordPress instead of the server config, falls back to safe paths and warns you on the settings page
    Improved
    • Redesigned the Frontend Check results into clear, uniform rows that stay readable with long URLs

  8. 9.0.06

    2 fixes1 security
    Fixed
    • Some sites could show a blank page when source code optimization was enabled; the header/tag find & replace is now fail-safe and never blanks the output on a regex error
    • Prefetch/speculation rules cleanup now removes the wp-admin and wp-*.php entries without leaving the rules JSON invalid
    Security
    • Fixed unauthenticated Open Redirect via the `redirect_to` parameter on the custom logout URL.

  9. 9.0.05

    4 fixes2 security
    Fixed
    • WPML/Polylang with a custom or renamed REST API path: WPML Advanced Translation Editor and other REST API calls no longer fail with a network error in the admin
    • REST API requests made through the ?rest_route= form are no longer mistakenly treated as normal page requests and blocked
    • Renamed REST API path: legacy, cached and external clients still calling the default wp-json path are now recognized correctly instead of being 404'd
    • Compatibility module for WPML: the Advanced Translation Editor sync routes and WPML/ICL admin-ajax requests are no longer rewritten with the active language prefix
    Security
    • Hardened REST API detection: the firewall can no longer be bypassed by appending /wp-json/ (or ?rest_route=) to the query string of another request
    • Brute force protection also covers REST API Application Password authentication

  10. 9.0.04

    4 fixes
    Fixed
    • Compatibility with WPML and Polylang: static asset URLs (wp-content, wp-includes) no longer get the language prefix prepended (e.g. /en/wp-content/...) when "Change Relative URLs to Absolute URLs" is enabled
    • Password-protected pages (built-in WordPress post password) now submit correctly on Nginx and other servers without server-level rewrites when the login URL is customized
    • Refreshed knowledge base links across admin notices to point to the new documentation
    • Minor bugs and typos

  11. 9.0.03

    4 fixes
    Fixed
    • Dark Mode popup remained white, and some settings fields were too dark
    • Login Page Design now works in Disable mode
    • Firewall whitelist IPs and paths now work in disabled mode when the Firewall is activated
    • Minor bugs and typos

  12. 9.0.02

    2 new1 improvement2 fixes
    New
    • Translation in Indonesian (id_ID) language
    • Translation in Turkish (tr_TR) language
    Improved
    • Translations updated in all 16 supported languages: Arabic, Brazilian Portuguese, Chinese (Simplified), Dutch, Finnish, French, German, Italian, Japanese, Portuguese, Romanian, Russian, Spanish, and English (default).
    Fixed
    • Friendly time display (e.g. "3 hours ago") now renders correctly in all translated languages
    • Dropdown and Help icon in the RTL languages

  13. 9.0.01

    2 new5 improvements5 fixes
    New
    • Country filter in Security Threats Log and User Events Log
    • Click on a country circle in the GeoMap to open Security Threats Log filtered by that country for the last 7 days
    Improved
    • Compatibility with WordPress 7.0 and PHP 8.5
    • Moved Export CSV button to below the table in Security Threats Log and User Events Log to avoid accidental clicks
    • Added proper color handling for dark mode (browser-based)
    • Enhanced security progress indicator and introduced Security Optimization Score
    • Add a loading process on login submit
    Fixed
    • GeoMap country circle counts now match Security Threats Log counts for the same 7-day window
    • Security Threats counting for the last 7 days on widget now matches the log totals (timezone-aligned day buckets)
    • Passkey login spinner not showing due to missing classList calls
    • Country codes missing from threats log rows now resolved on-the-fly from GeoIP when cron is not running
    • Resolved robots.txt warning when user agents are blocked

  14. 9.0.00

    6 new2 improvements
    New
    • Customize the login page with custom logo (with live preview), logo link URL, and color scheme (page, form, button, text, link colors) with one-click presets
    • Block AI Crawler Bots at firewall level with automatic robots.txt Disallow rules (GPTBot, ClaudeBot, PerplexityBot, Bytespider, and 30+ others)
    • GEO Map with top 5 threat countries visualization on the Overview dashboard
    • Export Security Threats Log and User Events Log to CSV
    • Security Check task to verify IP block automation is configured correctly
    • Threats count in the Overview widget now shows the full 7-day period totals
    Improved
    • Store country code in the threats log table for faster country stats
    • Missing country codes resolved in background via cron without slowing down threat logging

  15. 8.3.07

    6 fixes
    Fixed
    • Sorting and filtering in the Events Log & Security Threats Log
    • Rules and Threats filters to work with WP Multisite subpaths structure
    • Temporary login user edit link on WP Multisite
    • Compatibility with Woocommerce 10.6
    • Compatiibility with the Blocksy theme
    • Optimize the plugin speed

Changelog published by the developer, in their original language.