Security Ninja Premium Changelog

Sin fecha · 4 versiones

1. 5.308

   Última

   2 mejoras4 correcciones1 cambio

   Ocultar

   Mejora

   • Two-Factor Authentication - Login Protection can let a browser skip 2FA for a set number of days after a successful code. It stays off until you set the days (up to 90). The person still ticks "Remember this browser" on the code screen. A password change from the profile screen or the reset email, or resetting 2FA, asks for a code again. Lowering the days cuts short a browser that was remembered for longer. The number is included in Tools import/export. An older export that does not have it leaves the number already on the site. Thank you Torsten.
   • Two-Factor Authentication - Backup codes are shown when 2FA setup finishes. The person confirms they have saved them before continuing. Each code is shown once and works once. A password change, or resetting 2FA, deletes the codes. A new set can be created later from the profile.

   Corregido

   • Vulnerability Scanner - The "plugins checked" and "themes checked" numbers now match what is installed. A plugin with many known issues was counted once for each database row, and a theme with no known issues was reported as 0. The scan was already checking the installed list. Run the scan again after updating so the event log shows the new numbers. Thank you Werner.
   • Two-Factor Authentication - The login session created by the password is destroyed before the code screen. The code is checked for the account that passed the password step. A user id sent with the code is ignored. Wrong codes, including backup codes, still count toward lockout, and a blocked IP is not checked for a code.
   • Two-Factor Authentication - "Remember this browser" on the code screen can be ticked. The verify button no longer sits on top of it.
   • Scheduled Scanner - The email names the security test that changed, including the previous result when the message changed. Core files are listed only when they are new or no longer listed. A file that was already reported does not send another change email by itself.

   Cambios

   • 2026-11-03

2. 5.307

   7 mejoras6 correcciones2 cambios

   Ocultar

   Mejora

   • Two-Factor Authentication - Repeated wrong codes now use the same limit as failed logins (default 5 tries in 5 minutes). The wait stays in place until that window ends. With the firewall on, those tries count the same way a wrong password does.
   • Events Logger - An incorrect 2FA code is saved in the events log with the account name. With the firewall on, the same try is also listed as a failed login.
   • Two-Factor Authentication - Authenticator app secrets now follow your WordPress salts. The update re-encrypts existing secrets the next time you open wp-admin. Email codes are unchanged. If you later change AUTH_KEY or SECURE_AUTH_KEY, those users set up the app again.
   • Core Scanner ignores HTML challenge pages when it downloads official file content for a diff or restore.
   • Firewall IP Management shows Unblock for temporary local bans and 404 Guard bans.
   • Visitor Log stays on the current page after you ban an IP from the log.
   • MainWP - The child connection is available whenever MainWP Child is active on the site.

   Corregido

   • Firewall - Filter Suspicious Queries no longer treats ordinary text as an attack. A MapPress title such as "Scharfenstein (Rangerstation)" is not a function call, and neither is "Charlotte (Charlie)" or "Functions (overview)". The function name has to stand on its own and be followed by a parenthesis. char, eval, and benchmark are still blocked. Words such as "evaluation" or "medieval" are not eval. A phrase such as "please select one" is no longer treated as SQL. select, insert, update, and delete are still blocked when SQL follows, such as FROM, INTO, or SET. A parameter that only ends in _request, such as download_request, is no longer treated as access to the request array. Thank you Torsten and Kevin.
   • Core Scanner - WordPress 7 files under wp-includes/php-ai-client/ that were saved with a shortened name are no longer listed as critical unknown files. When the file matches the official checksum, the scan explains the shortened name and can rename it back. Those files are left out of "Delete critical & warning unknowns".
   • Firewall - A saved coupon limit of 3 (the minimum is now 5) no longer blocks saving the other firewall tabs. The field sits on the Store tab in the same form, and the browser was refusing to submit it. Thank you Chris.
   • Early Firewall - Block events waiting to be logged are stored as data files. An event that had not been written to the log yet may be missing once after this update.
   • Login Protection - The hidden wp-admin check now confirms the login cookie is valid. A normal login is unchanged.
   • Core Scanner - "Delete critical and warning unknowns" leaves files in the site root alone, including wp-config.php. You can still remove one of those files from its own row.

   Cambios

   • 2026-11-01
   • Login, firewall, and scan updates. Your saved settings stay as they are.

3. 5.306

   1 nuevo2 mejoras5 correcciones1 cambio

   Ocultar

   Nuevo

   • Login Protection - Optional "Redirect /wp-admin to homepage" when Change login URL is on. Logged-out visitors who open /wp-admin or /wp-login.php go to the homepage instead of Access Denied. Off by default. Does not reveal the new login URL. Included in Tools import/export and MainWP settings sync. Thank you Torsten for the suggestion.

   Mejora

   • Firewall - Referrer and blocked-host matches stay on the site.
   • Firewall - IP Management. IP and status columns stay narrow so notes and last visit have the room. Last visit shows the relative time and the date. Long lists stay at 25 per page.

   Corregido

   • Firewall - Filter Suspicious Queries no longer treats bare "..." in query values as path traversal (masked card numbers, truncated text). Real traversal such as ../, ..\\, and encoded variants still match. Thank you Kevin.
   • Early Firewall - After a plugin update, the compiled WAF config is rebuilt automatically so rule changes apply. If rebuild fails, Extended Protection shows an error instead of silently keeping old rules. Early Firewall is still in beta but proving very stable so far from the feedback we get.
   • Early Firewall - Pre-install recovery snapshots are stored as .wfbkp JSON (not .php), so the Malware Scanner no longer flags our own recovery files as Critical. Thank you 学而図書.
   • Firewall / WooCommerce - Coupon protection counts one failed apply per request (Woo can fire the error filter twice), logs the real coupon code instead of the numeric error id, returns a normal coupon error instead of killing the request, and no longer blocks placing an order when only coupons are temporarily limited. Default failed-attempt limit is 10 (minimum 5). Thank you Manfred.
   • Fixes - Security header names stay in English in every language. No more translated titles.

   Cambios

   • 2026-10-21

4. 5.305

   1 nuevo15 mejoras4 correcciones1 cambio

   Mostrar

   Nuevo

   • Agent skill - SKILL.md in the plugin folder tells Cursor and Claude-style agents how to configure Security Ninja, read scan results, and work through a harden checklist. This is separate from the WordPress Abilities API. Thank you Gabe.

   Mejora

   • German - The bundled translation now uses Du, the same terms throughout (Schwachstelle, Core-Scanner, Malware-Scanner, Korrekturen, Anmeldung), and the strings that were still English are translated.
   • Updated Freemius SDK to the latest version.
   • Vulnerability Scanner - When vulnerabilities are found, the warning is the only headline. "Vulnerability Scanner" stays when the scan is clean or still running. Collapsed Details no longer leaves an empty white bar.
   • Tests - Permissions-Policy example now uses current header syntax and a shorter default that leaves fullscreen, autoplay, and encrypted media alone so embedded video keeps working. Thank you Lee.
   • Tests - Permissions-Policy default no longer disables payment, so Apple Pay and Google Pay checkouts keep working. Thank you Robert.
   • Tests - Content-Security-Policy help and Fixes examples use a WordPress-safe enforcing policy. Script limits stay an advanced step and will not pass the test while they are Report-Only. Thank you Robert.
   • Tests - MySQL permissions warns when the account has ALL PRIVILEGES on this site's database, and fails on global grants or GRANT OPTION. The help text lists the privileges WordPress, updates, and backups need. Thank you Robert.
   • Tests - Security header help cleanup: removed obsolete X-Frame-Options ALLOW-FROM, fixed CSP Apache Header set syntax, and aligned X-Content-Type-Options, X-Frame-Options, HSTS, and Referrer-Policy PHP examples with the wp_headers filter.
   • Fixes - Hide WP Version now also clears the generator on RSS/Atom feeds and strips matching WordPress core ?ver= from CSS/JS asset URLs. Plugin and theme cache-busting versions are left alone.
   • Firewall - Block IP Network now uses api.wpsecurityninja.com. User-agent matches stay local and are no longer sent to the shared list. Sites with the feature on download the shared list once a day.
   • Firewall - Block IP Network reports are queued locally and flushed in batches (every 15 minutes or at 25 unique IPs), with a local hit count per IP.
   • Firewall - Early Firewall 8G blocks are reported to the Block IP Network when WordPress imports them. User-agent matches stay local.
   • Events Logger - Selected firewall and block events, including Early Firewall blocks and lost-password bans, are kept for 90 days. Other events still follow the retention you set.
   • Firewall - Country block selection stays as you set it when you press Enter in another field on the Firewall settings page.
   • Firewall - Request URI checks use the path only. Query parameters are checked separately, so long tokens in URLs (for example WooCommerce download links) are not mistaken for exploit paths.

   Corregido

   • Tests - A wp-config.php moved one level above the WordPress root now scores as a pass. A file still in the root stays a warning. Thank you Robert.
   • Auto Fixer - File backups are stored as .wfbkp data files again (not .php), so the Malware Scanner no longer flags our own backups. Existing .wfbkp.php backups are migrated automatically. Thank you Tom and Masahiro.
   • Scheduled Scanner - Scans started through Action Scheduler's async admin-ajax runner no longer die on a Security Ninja test nonce check (403). Internal runners skip that AJAX nonce; UI AJAX still verifies it. Thank you Kevin.
   • Firewall - Repeated failed logins are reported to the Block IP Network as repeat_failed_login, which is the type the shared list accepts.

   Cambios

   • 2026-10-11