2026 · 15 versions
9.8.4
Latest2 fixes4 security
Fixed- A fatal error with a custom login URL when a specific page was set as the failure page.
- The file permissions check now skips deleted files and detects all incorrect permissions.
Security- Passkeys could be skipped by logging in with an email address instead of a username.
- Users with an authenticator app (TOTP) or passkey could be offered the weaker email code instead.
- Passkey setup now only starts after all other login checks, such as captcha, have passed.
- The Mixed Content Scan fixer now only changes files found by the scan and blocks unsafe downloads.
Improved- Removed SimplyBook.me from onboarding and Other Plugins.
- Standardized punctuation in task and notice messages.
Fixed- A possible error when processing plugins that were no longer available in Other Plugins.
Security- Fixed a remaining 2FA bypass in XML-RPC authentication.
- Fixed an issue where unauthenticated visitors could bloat the database via the 404 interceptor. Thanks to Naoki Kawahigashi via WPScan for reporting.
9.8.2
2 improvements7 fixes
Improved- Updated the default Content Security Policy for WordPress 7.1 compatibility.
- Improved database table checks.
Fixed- A JavaScript error on user profile pages when passkeys were disabled.
- Users required to use 2FA could extend their own grace period.
- A fatal error caused by an invalid author query parameter.
- 2FA onboarding after logging in through WooCommerce.
- Horizontal scrolling in Content Security Policy and region blocking tables.
- The firewall could reference `advanced-headers.php` when the file did not exist.
- Possible fatal errors caused by invalid data in public CSP and 2FA requests.
9.8.1
3 security
Security- Prevented unexpected deletion of the login nonce.
- Prevented a bug that incorrectly changed the 2FA status from active to open.
- Prevent XML-RPC logins without 2FA for users with 2FA configured.
9.8.0
3 improvements3 fixes
Improved- Improved CAPTCHA handling after failed login attempts.
- REST API checks are faster and run only when needed.
- Tested up to WordPress 7.1.
Fixed- Other plugin installation now retrieves the download link correctly.
- PHP 8.5 compatibility issues.
- The 2FA grace period was not always handled correctly.
9.7.0
3 improvements2 fixes
Improved- Removed unused code.
- Removed an empty directory from the plugin ZIP file.
- Updated the color used for Metricool in the Other Plugins section.
Fixed- The firewall event log now shows the correct region and country names.
- The dashboard now shows the correct number of hardening tasks that still need attention.
9.6.1
4 improvements4 fixes
Improved- Updated translations to use the l10n PHP format.
- User agent blocking now supports wildcard matching.
- Removed an unused passkey log message.
- Updated the Other Plugins section in onboarding and settings.
Fixed- Password expiration now works correctly with 2FA and passkeys.
- Button styling in Content Security Policy and Permissions Policy tables.
- Alignment of the e-mail validation status icon.
- Vulnerability data is included in uninstall cleanup.
9.6.0
10 improvements4 fixes
Improved- Vulnerability details now load only for the plugin or theme being activated.
- Improved rule writing with file locking to avoid race conditions.
- Uninstall cleanup now removes plugin options and transients more reliably.
- Added a login page notice for invalid login sessions.
- Improved 2FA user lookup performance on multisite.
- Improved DirectAdmin Let's Encrypt certificate generation.
- Improved several interface texts.
- Event logs now support larger log tables.
- Added RSSSL_INFO_LOG for extra debugging details.
- Added more prerequisite checks before features can be enabled.
Fixed- 2FA grace period reminder emails could be sent unexpectedly.
- Content Security Policy now follows the setting toggle correctly.
- PHP 8.4 deprecation warning.
- DNS verification issue in the Let's Encrypt wizard.
9.5.11
2 fixes
Fixed- fatal error that could occur when a plugin uses admin_enqueue_scripts incorrectly.
- a bug where the wrong settings value could be saved.
9.5.10.1
1 improvement1 fix
Improved- Updated 2FA login flow to address inconsistent verification behavior.
Fixed- Undefined variable during cron.
9.5.10
2 improvements2 fixes
Improved- Removed an unused AJAX callback.
- Tested up to WordPress 7.0.
Fixed- An issue that could cause a crash when activating alongside the Perfmatters plugin.
- Some styling (CSS) issues to improve compatibility with WordPress 7.0.
9.5.9
2 improvements3 fixes
Improved- Updated the event log cleanup cron hook.
- Reworked vulnerability detection and measures logic.
Fixed- A fatal error that could occur when activating Pro in a multisite environment.
- An issue where logging in with a username and password on multisite did not trigger a passkey prompt when using a standalone passkey.
- Improved and future-proofed the plugin updater.
9.5.8.1
1 improvement2 fixes
Improved- Various improvements to authentication flow.
Fixed- An issue where TOTP codes starting with a 0 were not properly recognized.
- Prevent using "Do Not Ask Again" for user roles where 2FA is required.
9.5.8
2 fixes
Fixed- Resolved an issue where “Prevent login feedback” could show a ghost username on the login retry screen.
- Prevented “Failed to send buffer of zlib output compression” notices when using the Mixed Content Fixer with zlib.output_compression enabled.
9.5.7
3 improvements3 fixes
Improved- event logging by generating messages dynamically instead of storing translated text.
- Email 2FA user experience by making Enter submit the verification code instead of resending it.
- Simplified service bootstrapping by removing the Provider layer and registering all services directly in the App container.
Fixed- scenario where users were stuck after an expired 2FA grace period due to missing authentication methods.
- Support for `wss://` URLs in CSP `connect-src`.
- MemberPress login compatibility with Limit Login Attempts.
Changelog published by the developer, in their original language.
