Changelog

2.2.5.3 — 03 April 2024

03 April 2024
Fix v2.2.5.2 Blackhole nonce bloking some front requests
Update Malware Database

2.2.5.2 — 01 April 2024

Security Fix: CSRF in “Blackhole” module, criticity: very low (Thanks to Wordfence Security Team for the report)
Fix#1039: false positive on “include in wp-config” in malware scanner
Update Malware Database
Update i18n

2.2.5.1 — 21 December 2023

Security Fix: TOCTOU in Limit Login Attempts (Thanks to Konan Nagashima)
Improvement#963: Add context for secupress_die()
Improvement: Add DE translations (Thanks to Klaus Bei)
Improvement: Status “bad” into “warning” on bad plugins scanner results in free version
Fix#1036: Remove REST API calls made using query parameters (Thanks to JB Audras) + usage of rawurldecode() (Thanks to Aether Black)
Fix#1035: Malware scan file too big
Fix#1034: Matomo was blocked
Fix#1033: Bad referer default list, “cialis”
Fix#1032: Uncaught TypeError: Cannot read properties of null (reading 'querySelectorAll')
Fix#1030: Plugins&Themes settings on MS does not save correctly
Fix#1021: PHP Deprecated: filter_var() null in parameter 3
Fix#1015: Better output secupress_pro_sessions_control_users_column_content()
Fix#1010: Uncaught TypeError: strpos(): Argument 1 must be of type string, array given
Fix#1001: Move secupress_format_message()
Fix#962: Ranged IPs can prevent ip detection to block
Update Malware Database
Update global i18n

2.2.4.1 – 17 April 2023

Update: Malware Database
Fix#1001: Call to undefined function secupress_format_message() in /secupress-pro/free/admin/functions/scan-fix.php:51
Fix#1000: Passing null to parameter #1 ($string) of type string is deprecated in /secupress/free/functions/files.php on line 693
Fix#996: PHP Fatal error: Allowed memory size of 1075838976 bytes exhausted in secupress-pro/pro/modules/file-system/tools.php on line 88
Fix#993: joker in IPs ban everything
Fix#977: Time to soon for antispam
Fix#904: cannot deactivate default role lock
Fix global i18n

2.2.3 – 14 September 2022

Update: Malware Database v22.9.14
Security Fix#985: IP Spoofing (Thanks to Calvin Alkan on https://snicco.io/)
Fix#987: new passwordless UI didn’t need to validate the captcha to get the magic link
Fix#986: unban link for admins does not always work
Fix#984: fix “two factor authentication” plugin detection
Fix#981: Move Login could be activated without pretty permalinks
Fix#980: key regeneration button is hidden by the helpers style
Fix#962: Ranged IPs can prevent ip detection to be blocked
Fix global i18n

2.2.2 – 08 August 2022

Update: Malware Database v22.8.2
New#961: New UI/UX for PasswordLess Module!
Fix#976: WPML was adding a suffix to the PHP constant WP_HOME
Fix#975: Salt key mu plugin in double + auto login
Fix#974: Error message: Uncaught TypeError: explode(): Argument #2 ($string) must be of type string, array given in /pro/modules/firewall/plugins/bad-referer.php:13
Fix#972: Salt keys scanner too loose
Fix#971: Undefined array key "registration" in /free/modules/users-login/plugins/move-login.php on line 205
Fix#969: Remove user enumeration made using query parameters on REST API calls
Fix#965: NULL Coalescing Operator in pro/modules/firewall/tools.php on line 182
Fix#917: Uncaught Error: Call to undefined function secupress_status()
Fix global i18n

2.2 — 03 January 2022

New#930: Scan for @include as a malware in wp-config.php only (known for that)
New#932: Add support for .php[12345678] .phtml files in malware scanner
New#937: New option to force FTP creds when adding a theme or plugin, see “Disable .zip uploads” in “Plugins & Themes” module page
Improvement#455: Add filters to all our email subject and messages. Search for “secupress.mail.”
Improvement#954: Better filetree for both free and pro version. No more /core, /inc, no more 2 uninstall files, no more weird file inclusions.
Improvement#885: remove FaceBook share button
Improvement#931: Do not log 404 that are redirected by SEO plugins
Improvement#935: Support MemberPress to prevent login out of passwordless when activated
Improvement#958: Update zxcvbnphp lib
Fix#889: files from core still show themes as diff files
Fix#944: PHP Notice: Undefined variable: ip in/core/functions/ip.php on line 59
Fix#945: Uncaught Error: Object of class stdClass could not be converted to string in /core/modules/plugins-themes/tools.php:174
Fix#946: PHP Fatal error: Uncaught Error: Call to a member function views() on null in /core/classes/common/class-secupress-logs-list.php:165
Fix#947: set_time_limit() is forbidden on infomaniak, leads to fatal error in PHP8+
Fix#948: Whitelabel is not displaying a plugin author url in settings
Fix#949: missing subfolder in secupress_bad_file_extensions_get_regex_pattern
Fix#950: i18n files showing up in core file differences
Fix#951: “toggle all” checkbox in “file core diff” does not work
Fix#950: i18n files showing up in core file differences
Fix#955: PHP Fatal error: Uncaught TypeError: count(): Argument #1 ($value) must be of type Countable|array, null given in /core/admin/multisite/settings.php:96
Fix#957: Move Login can still disclose the login page when registration is disabled.

2.1.1 — 22 October 2021

Fix#941: Warning: explode() expects parameter 2 to be string, array given in secupress-pro/inc/modules/firewall/plugins/bad-referer.php on line 13
Fix#940: DB scan error on XMLHttpRequest
Fix#939: secupress_stop_user_enumeration_rest() does not return the $response param
Fix#929: hidden passwords in logs always add variables in global arrays

2.1 — 04 October 2021

New: Compatibility WP 5.8+
New#920: New GeoIP Database API
New#921: New Plugins and Themes vulnerability database using Patchstack.com
New#923: New Sessions Control Details
Fix#925: Fatal error: Uncaught ArgumentCountError: Too few arguments to function add_site_option(), 1 passed in secupress-pro/inc/admin/migrate.php on line 31 and exactly 2 expected
Fix#926: “Nothing found” not displayed in malware scanner
Fix#928: Fatal Error : Uncaught Error: Unknown named parameter $new PHP8
Improvement#916: Add hook in PHP 404
Fix#919: PHP Fatal error: Uncaught TypeError: array_map(): Argument #2 ($array) must be of type array, bool given in secupress_get_malwarescastatus_admin_post_cb
Fix#918: Move Login in subfolder (again and again and again!)
Fix#917: Uncaught Error: Call to undefined function secupress_status()

2.0.3 – 12 April 2021

Improvement#909: add hook in secupress_update_https_detection_errors
Improvement#910: Constant SECUPRESS_ALLOW_LOGIN_ACCESS will also work for our Captcha
Improvement#914: fr_BE & fr_CA = fr_FR
Fix#913: user_can can lead to fatal error (see https://core.trac.wordpress.org/ticket/52076)
Fix: undefined functions (free version only)
Fix: Captcha save button was not available (free version only)
Fix: role was not translated in the alerts

2.0.2 – 06 April 2021

Improvement: Add Jetpack SSO as supported 2FA
Improvement: Add a few forbidden names in “bad login IDs” module
Fix: Emails for PasswordLess were not sent or sent in spam. (WP 5.7.1 will also fix this)
Fix: Export Mode not read correctly
Fix: 3 undefined index PHP warning
Fix: 2 possible PHP fatal error (but won’t break the front site)
Fix: Move Login with WP running in a subdir was broken since 2.0

2.0.1 – 29 March 2021

New#905: Expert Mode has been added as a simple checkbox (but already available since 1.4.6 – 9 august 2018 ;p so, “new” feature)
Improvement#885: Extend allowed request methods
Improvement#893: Test if file exists be fore being tagged as PHP404 to prevent false positives
Improvement#894: Better HTTPS tests
Improvement#896: Emails from SecuPress will now come from the admin email address instead of noreply@ (the WP filter hook wp_mail_from is still usable)
Improvement#901: New way to propose deactivation on incompatible plugins + force deactivation on plugins that directly enters in conflict
Improvement#906: ?wp_lang param was not usable on moved login pages
Fix#897: A Grade was not accessible even with all the tests OK
Fix#898: WordPress Site Health page is back!
Fix#900: Undefined Index on step4
Fix#902: Update WP_Background_Process Lib
Fix#904: Locked Default Role was not deactivable
Fix#903: Database Prefix Rename feature didn’t renamed the checked tables
Fix#907: Alerts Emails contains HTML tags

2.0 aka Python (Mark XX) – 05 March 2021

New#318: Malware Scan on DataBase
New#332: WordPress Core > Change DB Prefix Manually
New#399: WordPress Core > Renew you security keys in one click
New#531,769: Revamp the Malware Scan Module: better detection, more detection (and remove the delete file button, sorry)
New#575: Addon Module Page
New#791: WordPress Wore > Lock admin_email, default_role, membership settings from WP
New#821: Your Grade can not get a “+”, and the A Grade is more accessible
New#823: Sensitive Data > Prevent 404 guessing
New#825: PHP8 Compatibility
New#828: WordPress Core > Lock home_url and site_url
New#863: Main Scanner > You can now scan a specific item
New#866: fr_BE and fr_CA will get the fr_FR translations
New#870: New php constant SECUPRESS_ALLOW_GEOIP_ACCESS to bypass geoip auto blocking
New#872: FireWall > Block Bad referers
New#873: Alerts > Slack Notifications
Improvement#184: Add the total of scanners when displayed (like 22/35)
Improvement#187,292,783: Better uninstallation of the whole plugin (wp-config & htaccess content, mu-plugins)
Improvement#194,220,395,482,579,775,789,809,812,840,842,871: Better wording, i18n, explanations, remove “Cheatin’uh?”, remove whitelist/blacklist, remove masculin terms in french to be more epicene + do not ever use WP text domain and keep our trad at home
Improvement#229: Add links to related modules in schedules page
Improvement#740: Reset button with JS confirmation (but at the same time, remove the button for now, see blog post)
Improvement#752: Better report email subject
Improvement#753: Remove the obsolete Block SQLi option
Improvement#754: Stop main scanner after 3 minutes
Improvement#778: Remove the date by month in security keys to prevent too many disconnection and prevent some bad dev based on thoses keys to mess up (please do not relay on these keys, use wp_salt()…)
Improvement#781: Better anti hotlink to prevent possible 404 urls on our fake image + allow google image
Improvement#782: Change recommandations for PHP Version to be more flexible
Improvement#786: Add “wp-config-sample.php” to old WordPress files
Improvement#796: Add the found IP in filter secupress.ip.default_ip
Improvement#800: Import settings will now import htaccess modifications (based on activated modules, not in the exported file)
Improvement#808: return HTTP response code matching the data passed to secupress_die (props @jeherve)
Improvement#815: Hide all login errors instead of a list
Improvement#822: Grade is included in the email subject
Improvement#827: Email only if grade has changed and is worst
Improvement#831: Remove license.txt, wp-config-sample.php, readme.html from being missing files in malware scanner
Improvement#834: Remove notices about wp-config.php and .htaccess not writable
Improvement#835: Remove SCRIPT_DEBUG from wp-config scanner
Improvement#837: Better secupress.plugin.passwordless_email_message replacements
Improvement#855: Empty User-Agent is not a bad one anymore
Improvement#860: On module (de)activation, rescan the test if present
Improvement#861: Do a JS check on captcha module to be sure it can be activated
Improvement#862: If a scanner gone bad, send it to alerts
Improvement#865: Remove the “ask old password” option
Improvement#876: Our mu-plugins won’t work if SP is not activated
Fix#362: SecuPress tables tagged as unknown when autofix the DB prefix switch
Fix#471: Remove unwanted columns in Logs pages
Fix#499: .htaccess path was not correct with ABSPATH
Fix#547: Remove “www.” in domain for antihotlink (for multisite subdomains)
Fix#746: Notice: “listMessage is not a constant”
Fix#762: Fix displaying wrong confirmation message when addind multiple IP to (dis)allow
Fix#767: Notice: “Undefined index: SERVER_PORT/HTTP_HOST in core/functions/common.php on line 797/800”
Fix#774: Remove the warning emoji in move login message
Fix#779: Email confirmation is present at each connection when move login is activated
Fix#784: Cannot use move login when pro is installed but not activated with the license
Fix#788: Settings link in plugins page is not correct with white label
Fix#792: Update doc links with https
Fix#793: Update Support for 2FA 3rd party
Fix#798: Google Bot was blocked due to a bad method query
Fix#801: Block double slashed users route from REST API
Fix#802,875: Remove old obsolete devs from <2.0 (recovery_email, support)
Fix#804: Double auth still displays 2 fields
Fix#814: API Keys can’t be hidden anymore
Fix#817: AntiSpam let any comment pass, sometimes…
Fix#818: If WooCommerce, do not scan login errors
Fix#819: Fatal error on GeoIP update (in background, your site was not harmed)
Fix#824: Display strange chars in Grade
Fix#830: Notice: “Undefined index: move-login_custom_page_url”
Fix#838: Move Login password page won’t work
Fix#855: Do not display SecuPress in admin footer and if hide WordPress version active, hide it in admin footer too
Fix#879: Missing items in our admin bar menu
Security Fix#844: A visitor can ban any IP

1.4.12 – 26 May 2020

Fix: Don’t ban IP, just block. This will prevent false positives on Banned IPs but still can block bad stuff.
Removed: The AntiFront BruteForce feature doesn’t exist anymore, too much false positive since now, websites can need may requests.

1.4.11.1 – 22 Fev 2020

Fix: fatal error during cron background tasks

1.4.11 – 18 November 2019

Improvement#759: GeoIP blocked IP will be logged as “critical” now.
Improvement#748: Antibrute Force on Front will be logged as “critical” now.
Improvement#749: You can now use the PHP bypass constant SECUPRESS_ALLOW_LOGIN_ACCESS for both Move Login and PasswordLess.
Fix#772: PasswordLess fields were not correct since WP 5.3
Fix#771: Move Login “logout” link was not correct since WP 5.3
Fix#768: “Prevent User Creation” was preventing users to change their passwords
Fix#763: Alerts modules was not activated on demand
Fix#757: “Site Health” will not be an empty page anymore when you didn’t scanned yet your site with SP.
Fix#755: PHP Error message with secupress_get_submodule_file_path()
Fix#747: Brute Force module activation does not requires 2 clicks on save button.
Fix#746: Message more specific when switching to pro version.
Fix#745: Purge the bruteforce table more efficiently
Fix#744: Banned IPs are now the top prio over “bad url content” module
Fix#743: Better datation for banned IPs
Fix#742: Better hooks content for secupress.plugin.passwordless_email_activation_subject and secupress.plugin.passwordless_email_activation_message
Fix#726: Uncaught Error: Call to a member function views() on null in /inc/classes/common/class-secupress-logs-list.php:165

1.4.10 – 26 August 2019

New Feature#736: Do not allow User Creation
Fix#737: Blacklist IP didn’t worked as expected, fixed now.
Fix#733: Add a try/catch on shell_exec test to prevent fatal errors (seems that functions_exists is not enough oO)
Improvement#734: Prevent the plugin to be tagged as malicious because of all the “bad words” contained in the code

1.4.9.4 – 14 August 2019

Fix the “secupress_filter_scanner” PHP error, props Loic Martin

1.4.9.3 – 24 July 2019

SF Move Login is not allowed anymore as a replacement plugin for our Move Login module
A new filter `secupress.move-login.override-plugins` is not there to add your plugin if needed.
Fix#729: Improve the detection of bad contents
Fix#731: Site Health page is on error is no scanner has been done yet (of course !)
Fix#732: Some menus links could be modified by SecuPress
Fix#536: Translations in pro were having “secupress” domain instead of “secupress-pro”…
Security Fix: Move Login will not display the new login page in an certain exploit (see secupress.me blog, related to “wps hide login” flaws)

1.4.9.2 – 21 June 2019

Improvement: Add more details on block page for better support
Fix: Remove some agressive bad content rules that triggered the block page too often
Fix: Fatal error on plugin activation if a module has to be silently activated (not so often)
Fix: Better result for some scanners that were not valid (but the protection was there!)

1.4.9.1 – 18 June 2019

Fix: Fatal Error on Pro update for some users

1.4.9 – 17 June 2019

New: New scanners to match Site Health: HTTPS, Communication with WP.org.
New#707: New Site Health page from WP 5.2 is now managed by SecuPress for all “security” points.
Improvement: Remove 2 textarea fields from firewall, too many times blocked by hosts, use a hook if you really want to customize the rules.
Improvement#717: Update firewall rules with custom 7G rules.
Improvement#701: GeoIP Module is now compatible with IPv6.
Improvement#705: Move Login can now be configured to display a custom message or redirect on a custom page.
Improvement#721: Whitelist and Blacklist in “log” module are now compatibles with IPv6, IP ranges and IP lists than can be copy/pasted.
Improvement#724: Remove all actions before get_users() for passwordless to prevent someone/a plugin to hack the list, resulting on not being possible to log-in.
Improvement#725: Function secupress_send_mail() replace blogname with url if empty, yes it exists.
Fix#705: Updates (for SecuPress of other plugin, sometimes) were not always visible.
Fix#709: “Alerts” settings were not saved correctly.
Fix#720: Uncaught Error: Call to undefined function secupress_filter_scanner()
Fix#723: Antispam forbid usage of pb and tb is removing too much.

1.4.8 – 30 april 2019

Improvement#696: add blogname in the email in secupress_retrieve_password()
Improvement#697: Update the PHP minimum values. Bye 5.x, welcome 7.x
Improvement#698: remove admin-bar.php from the bad url access scanner
Improvement: Remove the “page protect” module, we don’t need this protection finally.
Improvement: Various CSS and PHP improvements.
Fix#686: (again) The scanner for “bad user agent header” could not read the correct value, Grade A was not possible, it’s back in the game!
Fix#700: fix geoips db table name
Fix#702: Warning: "continue" targeting switch is equivalent to "break". in /secupress/inc/classes/settings/class-secupress-settings.php on line 972
Fix#703: Notice: Undefined index: confidence in /secupress/inc/modules/antispam/plugins/fightspam.php on line 732

1.4.7 – 26 september 2018

New#689: Dark Mode compatibility! Check https://wordpress.org/plugins/dark-mode/ (merge in core proposed)
Improvement#680: Add all “debug” and “.log” files to the “anti disclose readme/changelog” feature
Improvement#683: Add 2 filters on captcha messages to replace the default “Yes i‘m a human” and “Session expired”. See `secupress.plugins.login-captcha.checkbox.text` and `secupress.plugins.login-captcha.error.text`
Improvement#684: Better 64 bits check.
Improvement#685: Better “stop user enumeration” on Rest API, (JSON return instead of diying)
Improvement#679: Compatibility with PHP7 for a vendor package (PDF)
Improvement#686: Remove the HTML tags check from “bad user-agents” feature. Too many false positive since WP 4.9.8 😐
Fix#691: GeoIP was returning false since 1.4.5 because of the bad prepare format.

1.4.6 – 9 august 2018

New#668: Add support for https://fr.wordpress.org/plugins/2fas-light/ as a 2FA plugin
New#676: SecuPress Expert Mode. You can set a SECUPRESS_MODE constant on “expert” to hide descriptions and help all over the plugin to have a clear interface.
Improvement#663: GeoIP module can now bypass real seo bots! So you can block USA but still got Google on your website for example.
Improvement#665: Backups are now done using offset, this means that there is more chance to finish instead of dying.
Improvement#670: GeoIP database will update everyday automatically using a cron. You and your visitors won’t fell the update. Why everyday? Because everyday IPs are changing (in fact, every second… but I didn’t want to be so mean). This will prevent false positives and false negatives from your visitors, bots, crons.
Improvement#671: Strip URLs from UA before check bad UA to prevent false positives.
Improvement#672: Better compatibility for secupress_get_main_url compat().
Improvement#675: Add a checkbox for login errors module to allow its deactivation.
Fix#660: Fix the JARVIS encounter in a bad SecuPress settings link.
Fix#661: SECUPRESS_HIDE_API_KEY was not hiding the key anymore, ironic.
Fix#664: Fatal error: Uncaught Error: Call to undefined function secupress_global_settings_activate_pro_license() in /secupress-pro/core/core.php:227
Fix#667: WP Cron Fatal error: Uncaught Error: Call to undefined function secupress_scanit() in /secupress-pro/inc/modules/schedules/plugins/inc/php/class-secupress-background-process-schedules-scan.php:47
Fix#673: MoveLogin with nginx sais you have to “remove” rules instead of adding them. Funny or not.

1.4.5.1 — 27 june 2018

New: Hotfix a non patched vulnerability in WordPress Core, read more at https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/

1.4.5 – 18 june 2018

New#659: You can now set a scanner speed on scanner page, just below the scanner button. This is designed to resolve some server issue that does not love/allow too much (ajax) requests at the same time (30+ in 1 sec by default to 0,25sec or 1 per sec now). Improvement#649: Change the behavior of the scanner for minimum role. It’s not ‘Subscriber‘ anymore but ‘Not Administrator‘, so you can now set your default role on “Customer” or whatever without being tagged as “bad“.
Improvement#655: The new “confirmaction” links on WP 4.9.6 were showing the new moved login page. It will now show a “confirmaction” shortcut when move login is active.
Improvement#657: Remove the “Ask for support” on each scan result in step 3, nobody was using them.
Fix#626: Block Fake SEO Bots won’t block Facebook share anymore.
Fix#640: Import file was tagged as “empty”, not anymore.
Fix#641,#647: Some module were impossible to activate/check, it’s now ok.
Fix#642: Warning: count(): Parameter must be an array or an object that implements Countable in /secupress/inc/functions/common.php on line 1288
Fix#643: The “Add my license” and “Settings” link is now correct.
Fix#644: GeoIPs database will now work on 32 bits servers (INT MAX issue).
Fix#645: GeoIPs database has been updated to perfectly match countries, and won’t block an unknown country now.
Fix#646: Warning: shell_exec() has been disabled for security reasons in /secupress/inc/functions/ip.php on line 229
Fix#648: Fatal error: Cannot redeclare secupress_remove_comment_feature_add_packed_plugin() (previously declared in secupress-pro/core/modules/antispam/callbacks.php on line 64
Fix#650: Fatal error: Uncaught Error: Call to undefined function secupress_pro_settings_white_label_callback() in /secupress/inc/modules/welcome/callbacks.php on line 27
Fix #651: Move login and subfolder love/hate again.
Fix #654: Warning: fileperms(): stat failed for /index.php in /secupress/inc/functions/files.php on line 29
Fix #656: The scanner step 3 was not showing all the possible fixes.

1.4.4 – 23 may 2018

GDPR Compliance!
New Dashboard: The first module page is now a dashboard, you can see your licence info here now.
New: You can now reset the SecuPress settings or just module per module.
Improvement#628: GeoIP Database has been updated with new IPs
Improvement#630: Force strong password is now available on reset form too.
Fix#614: Exported settings file doesn’t contains the whitelabeled name, this will prevent the impossibility to import this file
on another website whitout the same whitelabel name.
Fix#617: Warning: shell_exec() has been disabled for security reasons in /secupress-pro/core/functions/ip.php on line 229
Fix#620: PHP Fatal error: Uncaught Error: Call to undefined function secupress_global_settings_activate_pro_license() in
/secupress-pro/core/core.php:227
Fix#622: Warning: count(): Parameter must be an array or an object that implements Countable in
/secupress/functions/common.php on line 1288
Fix#625: Remove “Wget” from bad User Agents
Fix#626: Facebook share post parser was blocked by block fake bot module
Fix#627: GooglePageSpeed too
Fix#628: GeoIP will not block anymore an unknown IP address (country not found)

1.4.3 – 9 may 2018

New#605: New feature added in Sessions Control module: Send a reset link to users
Improvement#599: UI was not full width
Improvement#600: Checkboxes in step 2 seems enabled
Improvement#602: Compat with HostPAPA.ca
Improvement#609: Remove the notices “These options are disabled…”
Improvement: Remove every check about WP being under 4.0
Fix#597: Fatal error when updating using folder overwrite (FTP for example)
Fix#598: GooglePageSpeed is blocked by Fake SEO Bots module
Fix#601: 404 on PHP should block but not ban
Fix#606: regex of fake bots’ user agents was too large
Fix#607: Alerts were always sent every 15mn, even with a higher number
Fix#608: Fix “Warning: set_time_limit() has been disabled for security reasons”

1.4.2 – 23 april 2018

Improvement#587: Remove SecuPress main logo on whitelabel (there is still some, wait!)
Improvement#589: API Key is hidden behind ••••• chars.
Improvement#592: Add a Facebook link when grade is A to share the result.
Fix#587: CSS missing when whitelabel is on.
Fix#588: Move Login died when it should not.
Fix#591: Block Fake Bots should not block real bots, right?
Fix#595: Fatal error when blocking User Enumeration on REST API
Fix#596: Security Fix: The new moved login page could be guessed because of a redirect due to a lack of “die()”, there is no more whitelist condition now. Thanks to Aymen Borgi.

1.4.1 – 18 april 2018

Improvement#583: Better PHP Version detection and warning (php 7 is now the best recommended one)
Improvement: Easy Login scan will now detect correctly 15 2FA plugins, not only our PasswordLess module.
Fix#581: You can now correctly disconnect if you’re using Move Login Page.
Fix#582: You can now correctly save the malware scan option page.
Fix#586: Possible 503 error : “The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.”

1.4 aka Hotrod – 11 avril 2018

New: PHP required version is now 5.4 (and will grow at each major version)
New: WordPress required version is now 4.0 (and will grow at each major version)
New#490: Block User Enumeration Feature
New#551: Ban 404 on .php Files Feature
New#544: API Key is hidden by default, you can also hide the full block using the new constant `SECUPRESS_HIDE_API_KEY` (will be set to true if `SECUPRESS_API_EMAIL` and `SECUPRESS_API_KEY` are set)
New#557: New constants `SECUPRESS_API_EMAIL` and `SECUPRESS_API_KEY` to overridde data from settings
New#558: New filter `secupress.pre_scan.$class` to shortcut any scanner
New#564: Block Fake SEO Bots Feature
New#562: New filter `secupress.get_email` to change the email when sending
New#567: New filter `secupress.nginx.notice` to prevent Nginx notices to pop
New#572: New filter `secupress.settings.load_plugin.$plugin` to prevent a full block of settings to be displayed
New#572: New filter `secupress.settings.field.$args[‘name’]` to hide an option from a setting block
New#576: New scan 404 on .php files
New: Pro version is now required to auto-fix issues on step 2 in the scanner
Improvement#242: When Pro is active, you’ll see a small yellow Ezio (the eagle) logo on each pro feature, so you know what is a pro feature.
Improvement#401: Remove outdated scanners and features : REST API Blocking, Non Login Time Slot, DirectoryIndex, no need that now.
Improvement#480: Change the way we display the anti sqli scanner code, more lorem, more ipsum, less random
Improvement#541: Change the way we load Move Login to prevent any “404 management” plugin to generate conflict
Improvement#550: Move Login will now let the priority to “WPS Hide Login” and “SF Move Login”
Improvement#553: Move Login will now redirect into the dashboard if the user is logged in
Improvement#563: Do not log banned IPs
Improvement#569: Let the possibility to go to step2 without launching a new scan
Improvement#570: Revamp of the “Get Pro” page (use an external link instead haha)
Improvement#571: Remove the hardcoded ads, add more help instead + you can still disable the full bar using the filter `secupress.no_sidebar` or just future ads with `secupress.no_sideads`
Improvement#573: Add a 3rdparty.php file to have a better detection of 2FA plugins installed, and better compat with hosts like WPServeur and O2Switch
Fix#470: Some messages could be in 2 different languages in the scan results
Fix#533: Move Login was not acting correctly when subfoldered
Fix#543: ManageWP couldn’t always correctly access the plugins list, now it’s ok
Fix#545: Move Login new page was disclosed by wp-signup.php page
Fix#559: Notice: Undefined index: move-login_login-access in /secupress/modules/users-login/callbacks.php on line 246
Fix#565: GEOIp was not blocking all countries correctly
Fix#566: Anti Bruteforce Front was not blocking all requests correctly
Fix#568: Remove the Captcha hidden field, too much false negatives

1.3.3 – 04 september 2017

Fix#527, #526, #525, #524, #509: Passwordless now send an email when activated (each time), not at each page save.

1.3.2 – 01 september 2017

Improvement: When PasswordLess is activated, you’ll have to valide this action by clicking on a link in an email. This will prevent you to be locked out.
Fix #502: Move login and PasswordLess are friends, again.

1.3.1 – 02 august 2017

New #510: Remove the “Avoid Double Logins” module since it’s not efficient enough
Improvement #511: You dont have to add 2 email addresses for the alerts
Improvement #478: Display a message when the malware scan found nothing
Improvement #512: Remove the recovery email notice, you won’t need to fill this anymore
Improvement #507: Lighter Move Login module with less options, no .htaccess/web.config/ngnix.conf modifications but more decisions and less bugs instead of endless bugs.
Improvement #506: Remove the scan and fix for empty user agent (not efficient enough in 2017, too much false positive)
Improvement #505: Remove the scan and fix for too long URLs (not efficient enough in 2017, too much false positive)
Improvement #488: New bad user agent (Gecko/2009032609 Firefox), thanks to Fabrice from wpformation.com
Improvement #481: Better message (less sarcastic, yes) when you lock yourself out.
Fix #504: On some servers, $_SERVER[‘SERVER_ADDR’] does not exists, well, ok.
Fix #502: Move login was not cool with PasswordLess
Fix #501: Some multisites websites could not validate their licence.
Fix #473: Captcha always returned “human verification fail” when autofill from browser is enabled.

1.3 aka Bleeding Edge – 18 july 2017

New: you don’t need the Free version to run the Pro version now: one plugin is enough.
New: migrating between the Pro plugin and the Free plugin is now easier.
Improvement #457: no more errors after editing the wp-config.php file. We added a sandbox that doesn’t keep
modifications in place if there is a problem.
Improvement #448: Better detection of user’s right for DB scan
Improvement #365: removed OrangeBot from the bad user agents list.
Improvement #337: captcha is now also available on the user registration page.
Improvement #308: Sometimes after a scan (step 1), some results are still tagged as “new”, you should encounter less cases.
Improvement #268: settings page lock: scanners page and logs page are now locked.
Improvement #247: malware scan: wp-config-sample.php is not flagged as missing from core anymore.
Improvement #180: added a warning about disabling the XML-RPC API.
Fix #469: customize.php redirects to the login page (thanks to @wpmarmite)
Fix #454: logs export: the file name was wrong. Moreover, now it includes the date.
Fix #451: Fatal error on WP <4.2.11 when sending emails
Fix #448: on some rare cases, the tables prefix couldn’t be changed because “the user doesn’t … have edition rights”.
Fix #417: malware scan: huge files are skipped (otherwise the process never ends).
Fix #416: malware scan: sometimes it couldn’t be stopped.
Fix #414: fixed some PHP 7 errors.

1.2.7 – 18th April 2017

Improvement: removed the monthly plans from the “Get Pro” page and improved a few things.

1.2.6.1 – 06th April 2017

Improvement #450: use a new API for the “Get Pro” page, to fetch prices.
Improvement #445: display the missing “Rate us” box in the settings page.
Improvements #387 and #449: changed a few things in the “Get Pro” page, mainly focused on the monthly plans.
Fix #447: prevented Move Login to change `&` characters into `&` in filtered URLs, it may cause problems when used as a redirection target.

1.2.5.1 – 19th March 2017

Fix #424: a htaccess server error appeared if you were using WP

1.2.5 – 16th March 2017

Improvement #413: improved PHP and WP version check on activation.
Improvement #408: improved Move Login settings. Now you HAVE to specify a new login URL: no default value anymore, no forgotten URL anymore. Also, your new URLs can be seen while you type in 🙂
Improvement #397: improved the theme/plugin installation/upload sub-modules: even white-listed IPs are blocked now.
Fix #402: in some cases, the scan testing the `readme.html` direct access was testing a wrong URL.
Fix #111: added the IP address `0.0.0.0` to the hardcoded white-list. It should prevent some cron processes to be blocked (because of an empty User Agent for example).
Improvement #397: improved the theme/plugin activation/deactivation/deletion sub-modules: even white-listed IPs are blocked now.
Fix #415: on some installations, the file `fpdf.php` was constantly showing in the malware scan, even being in the smart white-list.
Fix #409: the backup process couldn’t create the backup folders (D’OH!).
Fix #325: the protection against bad file extensions wasn’t working if domain sharding is used for medias.

1.2.4 – 28th February 2017

Improvement #382: if the salt keys scan still reports problems after the MU plugin is created, it will still try to fix it.
Fix #282: links in email messages should now be fine.
Fix #170: the notice saying the `.htaccess` file is not writable now is displayed only if the file exists.
Tested with php 7.1.
Various small fixes and improvements.
Fix #393: settings and profile pages were not accessible when the password protections are enabled.
Fix #374: the malware scanner doesn’t report empty files as malwares anymore.
Fix #327: in the malware scanner, white-listed files and “old WP files” are now removed from the “not from WP core” list.
Fix #209: in the malware scanner, the “scan” button wasn’t reporting the right status on first scan (only after reloading the page).
Fix #283: use the right charset collate for the “Anti Front Brute Force” and “GeoIP Management” database tables.
Fix #282: links in email messages should now be fine.
Fix #391: whenever an IP address is banned, the message was displayed to everybody.

1.2.3 – 20th February 2017

Improvement #370: in the scanner, each scan has now its own documentation ?. The “Read the documentation” links can be found at step 3, the Manual Operations.
Improvement #357: for the “Too Long URL” protection, requests made with `wp_request_***()` to self are not blocked anymore.
Fix #373: fixed a bug that allowed a specifically forged URL to cheat the “Too Long URL” protection.
Fix #367: fixed a PHP notice `Missing argument 2 for SecuPress_Action_Log::pre_process_action_wp_login()`.
Fix #363: fixed a possible failure on step 2 of the scanner (Auto-Fix).
Fix #352: revamp the whole “Auto Update” scan and protection, mainly focusing on the constant definitions.
Fix #347: the Twitter bird now can sing correctly.
Fix #343: when some scans display a message “Unable to determine…”, a link to activate manually the protection should be displaying. Some were missing.
Fix #329: the directory listing scan now reports a “Good” status if folders display an empty page with HTTP code 200.
Improvement #321: the malware scan now has a way to toggle multiple checkboxes at the same time. Yay for speed.
Improvement #273: logged in users are not considered as spam by the antispam anymore.
Fix #369: reviewed our 3 log-in protections (PasswordLess, Only One Connection, Captcha). Lots of work has been done to prevent users to be locked out.
Fix #368: fixed a `gzinflate()` error while importing settings. The down side is *old settings exports won’t work anymore: please do new settings exports after this update*.
Fix #360: in the malware scan, removed Akismet from core files. Sometimes it is not included in WordPress releases and triggers false positives.
Fix #349: alerts were still reporting whitelisted IPs.

1.2.2 – 27th January 2017

Fix #355: fixed a “recursion” that caused some scans to return a “bad” status while the corresponding protections were working
Fix #351: fixed license invalidation on multisite or multilingual sites.
Fix #346: fixed a PHP warning about `vsprintf()` in the scanner page.
Fix #345: don’t manipulate headers if they have been already sent.
Fix #313: fixed one of our easter eggs. ?
Fix #256: in the `wp-config.php` file, don’t comment a constant that is already commented or the sky will fall.
Fix #46, #154, #328, #348: fixed the whole chmod scan. Some fixes made in version 1.0.3 dramagically disappeared at some point, we bring them back: chmod values are correct again, test for the `web.config` file is back (if applicable). In the scan result, the list of files/folders were incomplete. In the scan result, folders are not called files anymore. Test for `.htaccess` and `web.config` existence instead of testing for Apache / IIS7.
Improvement #356: added back a “View details” link on the plugin row (in the plugins list), so the changelog and all the info can be viewed anytime.
Fix #269: fixed PDF export failure.

1.2.1 – 11th January 2017

Happy new year! ?
Improvement #336: prevent a rare PHP warning: array_count_values() can only count string and integer values! that could mess with the scan results.
Improvement #322: CSS animations are no more on Logs page, interacting with them is now easier.
Fix #342: in the Malware Scan module, the “Save All Changes” button under the Directory Index option was disabled.
Fix #340: solve a fatal error on deactivation.

1.2 aka Heavy Duty – 21th December 2016

New: up to 12 options for you to control. Directory Index, Directory Listing, PHP modules disclosure, PHP version disclosure, WordPress version disclosure, Bad URL Access, Protect readme files, WooCommerce and WPML version disclosure, File edition constant, Unfiltered HTML constant, Unfiltered uploads constant: all these protections can now be activated and deactivated separately as needed
New: some scans were slightly modified, so here is a new one that will test only the ShellShock vulnerability
New: if a scan displays a “Not able to access your front page” message, it brings you the possibility to activate the protection anyway.
Improvement #118: in the scanner’s manual fixes, the “Ignore this step” button is more understandable.
Improvement #147: in logs and alerts, no more “UAHE”, “BUC”, or any other obscur codes when a request is blocked, only a human readable sentence.
Improvement #199: the User Agent blacklist is now case sensitive.
Improvement #274: if you use a “Coming Soon” or “Maintenance” page, manual scans have now a small drill and can get through it and will no longer trigger a “Not able to access your front page” message for this reason.
Improvement #286: updated the “no longer in directory” and “not updated over 2 years” plugins lists.
Improvement #289: the scan message related to the constant `COOKIEHASH` is more accurate.
Improvement #290: whitelisted IPs don’t trigger alerts and logs when they are *not* blocked.
Improvement #297: the checkbox to activate the protection to deny access to malicious file extensions in the uploads folder now displays rewrite rules if the configuration file is not writable.
Improvement #324: tell cache plugins not to cache our blocking messages nor the login pages.
Improvement: prevent our icons to be overridden by other plugins or themes.
Fix #264: the scanner related to the admin user wouldn’t fix anything in a specific case. Nothing is better than a whip sometimes.
Fix #265: fixed a message displayed by the chmod scan. In some cases it was speaking nonsense about files `/` and `/`.
Fix #281: “Ask for old password” and “Strong Passwords” are now besties
Fix #285: typo in a `IfModule`
Fix #291: the fix related to the WordPress version disclosure ate the rewrite rules on Nginx. So we made it give them back (that was kind of scary).
New: the malware scanner now has a smart whitelist. You can also mark files as “not a malware”: when we receive enough notifications about the same file, it is included in the whitelist for everyone.
New: redesign the malwares scan’s page.
New: up to 12 options for you to control. Directory Index, Directory Listing, PHP modules disclosure, PHP version disclosure, WordPress version disclosure, Bad URL Access, Protect readme files, WooCommerce and WPML version disclosure, File edition constant, Unfiltered HTML constant, Unfiltered uploads constant: all these protections are now activatable and deactivatable separately when you want
Improvement #139: cleanup our crons on plugin deactivation.
Improvement #189: better plugin activation and deactivation processes.
Improvement #196: now you can also deactivate your license directly within the plugin.
Improvement #203: now you can send a support request even if the emails are not working on your server.
Improvement #290: whitelisted IPs don’t trigger alerts and logs when they are *not* blocked.
Improvement #298: now PasswordLess, Avoid Double Logins, and Captcha work better together
Fix #208: repaired layout on the “See differences”‘s page.
Fix #312: changed the PDF reports file name to prevent bad encoding.

1.1.3 – 07th November 2016

Improvement #258: Remove the blog_id and website URL in the new salf keys to avoid having to log in on each website on a multisite, was just annoying.
Improvement #259: Better hook usage to allow any cache plugin (like WP Rocket of course) to ignore login page.
Improvement #195: Better Move Login rules on Ngnix. And better rules in general for all modules.
Fix #262: Some firewall sub-modules are not working in frontend, the functions were not in the right file 😐
Fix #252: X-Powered by header was not hidden on Ngnix. Ngnix my friend …
Fix #250: WPML still appeared as a “bad plugin removed from repo”, well, the whitelist filter was not used.

1.0.2 – 07th November 2016

Fix #255: Warning: Missing argument 2 for SecuPress_Alerts::_wp_login_test() in /inc/modules/alerts/plugins/inc/php/alerts/class-secupress-alerts.php on line 299.
Fix #253: Bad File Extensions were not protected on Nginx. Ngnix my friend…
Fix #249: The Only One Connexion module didn’t worked as expected, now, it is.
Fix #248: Import settings didn’t import setting, now, it import settings.

1.1.2 — 25th October 2016

Just new prices table compatibility

1.0.1 – 22th October 2016

Improvement: typos, and missing translations.
Fix #210: The plugin could be activated without the free version, merge drama.
Fix #222: Fatal error, we’re requiring a non existant file from free instead os pro version.
Fix #225: Text encoding in PDF export was broken on accents.
Fix #233: Fatal error in class-secupress-background-process-file-monitoring.php “Can’t use function return value in write context”, now the context is right.

1.1.1 — 22th October 2016

Improvement #216: The button “Ask for support” is now always present on scanner step 3
Improvement #205: typos, and missing text domain
Fix #186: Add description and author to the COOKIEHASH MU plugin
Fix #204: When fixing the last thing in step 3, redirect to step 4
Fix #207: Table prefix fix won’t show up on step 3
Fix #219: PDF Export not exporting anything, wow.
Fix #224: In scanner JS, HTML entities were in status text.
Fix #227: Notice on affected role section Undefined index: double-auth_affected_role in /inc/admin/functions/modules.php on line 555
Fix #232: Bad request methods scan returned false negatives status.

1.1 — 19th October 2016

New: Design revamp for modules homepage

1.0 aka Mark I – 18th October 2016

Initial release

1.0.6 — 18th October 2016

Fix #158 & #179: Affected roles on modules were reset to empty. I prefer a filled field.
Fix #159: The error message from files backup talked about DB backup. Go home!
Fix #178: The PasswordLess scan will now check if its module is active, and in a near future will really check for any 2FA code.
Fix #185: A mysterious “////” title was present in the french translation, near “XML-RPC”.
Fix #190: The module link in the non login time slot scan has now its # to get a correct anchor. Happy sailor.
Fix #191: A function was missing, so the PasswordLess scan couldn’t activate its module, now, he can and he’s happy too.
Fix #193: The antibruteforce scan always said “false” because we didn’t call him by its real name.
Fix #197: When one of our muplugin was created on plugin deactivation, it triggered a fatal error, it was so fatal that we decided to remove it.

1.0.5 — 07th October 2016

Fix #167: Possibly locked at step 1 with a fake “New scan” for readme.txt files, you’re not stuck anymore.
Fix #166: Various CSS improvements.
Fix #171: Scans related to the firewall were always returning a bad status, even if the protections were running.
Fix #172: The scan and the protection related to the “Bad request methods” were not accurate.
Fix #176: A SQL warning occurred if you didn’t had logs to delete from 1.0.4, a new IF condition has been added to prevent that.

1.0.4 — 26th September 2016

TAKE CARE, ALL YOUR LOGS WILL BE DELETED! THANK YOU
Improvement #164: Logs are now lighter and can be deleted much faster
New #160: Add a filter named `secupress.remote_timeout` if you got too many “Pending” status in scanner, add more timeout since cUrl is not always gentle with us ><

1.0.3 — 14th September, 2016

Improvement: Commented salt keys (previously fixed) will now be deleted to avoid another error 500 case (in case of, you know)
Improvement: The banner button has now a better display on tiny screen
Improvement: Since SecuPress is compatible with WP 3.7 and 3.8, the icons are now compatible too
Improvement: Better bad user-agent blacklist, some were too current and blocked legit users.
Fix: User-Agent with more than 255 chars won’t be blocked anymore, too many false positive cases
Fix: The recovery email can now be set even if 2 users got the same email address (don’t ask …)
Fix: wp-config.php file permissions was sometimes set on 064 and broke some sites when autofix was done.
Fix: The PHP version warning was marked as bad for nothing, it will now mark it correctly

1.0.2 — 02nd September, 2016

Fix: The PHP Notice: wp_enqueue_script/wp_enqueue_style called incorrectly is now called correctly and won’t disturb you anymore everywhere in your admin area
Fix: The Error 500 caused by commented salt keys will not happen again
Fix: We removed the “ping” keyword from the bad user-agents since “pingdom” is not so malicious, isn’t it?
Fix: SecuPress couldn’t fix the “admin user” scan with open registration and no admin account.
Fix: The TinyMCE editor is not broken anymore, you can use it normally now \o/

1.0.1 — 31th August, 2016

Fix: The PHP Fatal Error on activation or deactivation has been killed.
Fix: The following JavaScript Error Uncaught ReferenceError: secupressResetManualFix is not defined in secupress-scanner.min.js when you visit the scanner page is on vacations, forever.
Fix: Warning in class-secupress-scan-bad-vuln-plugins.php, we won’t use $this in a static method anymore, promise.
Fix: Warning in class-secupress-scan-bad-vuln-plugins.php, ok this one is the last.
Fix: Warning in class-secupress-scan-bad-old-plugins.php, well, it was the real last one.
Fix: Warning in settings.php usage of a protected method is now allowed.
Fix: Warning in modules.php because we called secupress_insert_iis7_nodes() without the second mandatory argument.
Fix: The following PHP Parse error "syntax error, unexpected 'ai' (T_STRING) in mu-plugins/_secupress_deactivation-notice-nginx_remove_rules.php" won’t show up anymore for french users.

1.0 aka Mark I — 23th August, 2016

Initial release \o/