All In One WP Security & Firewall

• 14/December/2022 =

• FEATURE: Add option to disable RSS and ATOM feeds.

• FIX: The IP address blacklist manager wasn't working.

• 09/December/2022 =

• SECURITY: No longer save settings import files in a publicly accessible folder where they can be potentially indexed by search engines if the administrator does not actually import the settings (which deletes the import file)

• TWEAK: Improve the UX for uploading import files

• TWEAK: Add a default CAPTCHA option making way for new CAPTCHAs in the future

• 07/December/2022 =

• FEATURE: User Agent - Blacklist manager functionality should be based on PHP instead .htaccess rules.

• FIX: Sorting by 'status' on the comment spam table

• FIX: Copy protection feature not working on iPhone

• FIX: Cookie based brute force prevention locks out if plugin deactivated and activated again.

• FIX: The notice to reapply .htaccess rules after reactivating the plugin is displayed on subsites.

• FIX: Various WordPress command line notices about undefined $_SERVER indexes

• FIX: Deativate and reactivate plugin firewall settings file sync issue solved.

• TWEAK: 2FA setting page to show premium options for AIOS premium.

• TWEAK: Remove characters that should not have been on the scanner page

• TWEAK: Organise firewall rules into subdirectories

• TWEAK: Added GDPR question answer to the AIOS WP org plugin's FAQ section.

• TWEAK: Allow AIOS management permission to be filtered via aios_management_permission filter

• TWEAK: Make use of is_main_site() function.

• TWEAK: Copy IP to clipboard when clicking on it at WP Security -> Brute Force -> Login whitelist.

• 16/November/2022 =

• SECURITY: Fixed a failure to check bulk action nonces, leading to a CSRF vulnerability. Exploitation would require an attacker to craft a link specifically for your site, and persuade you to click it whilst logged in; if you did so, this could result in bulk actions being carried out on AIOS list tables (e.g. delete entries from blocked IP address lists), with the attacker being restricted to deleting entries by database ID numbers that he cannot know directly (e.g. 15, 16, 17) and not IP address (e.g. 100.101.102.103).

• FEATURE: Cookie-based brute force prevention implemented with the new PHP based firewall system.

• FIX: AIOWPSecurity_WP_Loaded_Tasks::site_lockout_tasks() method visibility

• FIX: Prevent the dismiss notice button removing all notices from page including notices that contained important information

• FIX: Brute Force > Login Whitelist issue access password protected pages by user solved.

• FIX: Force logout link not working in the currently logged-in users list.

• FIX: Google reCAPTCHA site key and secret key are not verified immediately.

• TWEAK: Code style changes for scanner related pages and future item manager class.

• TWEAK: Capitalisation style reapply for firewall menu tabs.

• TWEAK: Instead login lockdown used login lockout word in UI and mail content. Changed constant AIOWPS_DISABLE_LOGIN_LOCKDOWN to AIOWPS_DISABLE_LOGIN_LOCKOUT.

• TWEAK: Update tabs, links to match capitalisation style of other UpdraftPlus plugins.

• TWEAK: Added the filter aios_server_type to override the AIOWPSecurity_Utility::get_server_type() method's return value.

• TWEAK: Notice - Account activity logs, 404 event logs older than 90 days cleared automatically to show.

• TWEAK: Premium upgrade page FAQs linked to correct URL.

• TWEAK: IP address lookup called only once in same page request. Visitor blocking called when user is not logged in. User online information updated on login only.

• TWEAK: User login lockout - minimum lockout time length should be less than maximum lockout time length validated.

• TWEAK: Take a backup of wp-config before inserting firewall contents.

• TWEAK: Ability to downgrade the firewall's protection which allows users to reverse the changes from setting up the firewall.

• TWEAK: Set a global context for $wp_file_descriptions context so that it gets assigned to correctly, preventing a subtle visual change in the theme editor

• TWEAK: Black Friday notice

• TWEAK: Update readme.txt file

• 12/October/2022 =

• FIX: The login loader is visible infinitely on the login screen and administrators can't log in if the user has enabled maintenance mode and 2FA authentication simultaneously.

• FIX: Pressing the "Disable Firewall" button didn't clear new 6G firewall rules.

• FIX: The application password was disabled by default on the activation of the AIOS plugin.

• FIX: The error occurred with the error message: Uncaught TypeError: fclose(): Argument #1 ($stream) must be of type resource, bool given in all-in-one-wp-security-and-firewall/classes/wp-security-utility-htaccess.php:164 in the server where the root folder is not writable.

• TWEAK: IP address lookup service whatismyipaddress removed, API for bot.whatismyipaddress.com is no longer available.

• TWEAK: The simple math captcha box was shown when the user was filling in the 2FA code at login time.

• TWEAK: Firewall max upload limit default value increased instead 10MB to 100MB.

• TWEAK: Google reCaptcha multilingual implemented to show in local language messages instead of English only.

• TWEAK: Update headings, labels and buttons to match capitalisation style of other plugins.

• TWEAK: Add premium upgrade tab.

• 06/October/2022 =

• FIX: PHP Notice: Only variables should be passed by reference in /wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-notices.php on line 202.

• TWEAK: Auto disable the login whitelisting on upgrade for all server types and shown related notice.

• TWEAK : 2FA - Warning: Deprecated: Call get_controller('totp'), not get_totp_controller() in /includes/simba-tfa/simba-tfa.php on line 713.

• 29/September/2022 =

• SECURITY/FEATURE: Fix IP address detection, and give IP address detection settings in the Admin Dashboard > WP Security > Settings > Advanced Settings, provide user guidance on how to use them, and notify the user if there any problem is apparent. Versions from 5.0.0 to 5.0.7 had a defect allowing an attacker to spoof their IP address, aiding them to avoid detection or locking out legitimate users. Thanks to Calvin Alkan for the responsible disclosure.

• FIX: The 403 forbidden error was shown on the wp login screen if the login url contains the redirect_to parameter and the deny bad query strings firewall feature is enabled on localhost.

• FIX: The PUT request method was blocked when the user enabled the 6G firewall.

• FIX: The login whitelisting didn't work on servers not supporting .htaccess files, without this information being dislayed in the user interface. The feature is now ported to PHP so that it works on all servers. Thanks to Calvin Alkan for identifying this issue.

• TWEAK: Add index keys to the login lockdown, failed_logins and the permanent block tables to prevent poor database reading performance in the event of vast numbers of rows being stored in these tables (see the "SECURITY" item above, since the defect described there can allow this). Thanks to Calvin Alkan for identifying this issue.

• TWEAK: Resolve a PHP-firewall 'Unable to locate workspace' log message.

• TWEAK: Added a constant AIOS_DISABLE_GET_EXTERNAL_IP. Define this in your wp-config.php to disable getting the IP address via an external API when the IP retrieval method fail to get a valid IP address.

• TWEAK: Replace deprecated jQuery(document).ready() calls.

• TWEAK: Disable cookie access via JS and HTTP for cookie-based brute force prevention.

• TWEAK: Enhanced cookie storage mechanism for cookie-based brute force prevention. Thanks to Calvin Alkan for identifying this improvement.

• TWEAK: Display notice alerting the user that the block spam comment doesn't work on non-apache servers in the block spam comment section. Thanks to Calvin Alkan for identifying this omission.

• TWEAK: Added a constant AIOS_DISABLE_LOGIN_WHITELIST. Define this in your wp-config.php to disable login IP whitelist.

• 08/September/2022 =

• FIX: The Login URL was prefixed with the site URL instead of the home URL when the home URL is different than the site URL.

• FIX: Rename login and cookie-based brute force protection couldn't work simultaneously when the permalink was set to plain.

• FIX: Disabling the 5G Firewall Protection didn't remove the 5G rules from the .htaccess file.

• TWEAK: Add a 'Dismiss' button to the firewall setup notice.

• 07/September/2022 =

• FIX: Stopped host cron job working in a specific situation.

• FIX: A few setting options like enabling the honeypot feature for registration page, disabling the application password, enabling move spam comments to trash after specified days, moving spam comments to trash after days, enabling remove database tables upon uninstalling, and enabling remove all plugin settings upon uninstalling the plugin were overridden on upgrading the plugin.

• 05/September/2022 =

• FIX: Cookie based brute force etc rules to be removed from .htaccess if set in older version 4.4.12.

• FIX: The IP lock notification mail was sent out for the 404 lockdown event.

• TWEAK: Resolve a PHP-firewall 'Unable to locate workspace' log message.

• 03/September/2022 =

• FIX: PHP coding warning in latest PHP version when handling email address parameter.

• TWEAK: Added a constant, AIOS_DISABLE_COOKIE_BRUTE_FORCE_PREVENTION. Define this in your wp-config.php to disable cookie based brute force login prevention.

• 02/September/2022 =

• FIX: An empty IP lock notification mail could be sent out after upgrading to the 5.0.0 version.

• FIX: The PHP file couldn't be loaded via commandline if the rename login page is enabled.

• FIX: When running WordPress from the command line, the warning Undefined index: REQUEST_METHOD was logged.

• TWEAK: Import latest TFA module, loading JS less aggressively to avoid potential for conflicts

• 02/September/2022 =

• FIX: The user can't login if the user set forced logout and the site's timezone is different than UTC.

• FIX: Avoid an incompatibility with Wordfence Login Security by not loading our TFA module if that plugin is active

• 02/September/2022 =

• FIX: The user can't login if the user set forced logout and the site's timezone is different than UTC.

• 24/August/2022 =

• FEATURE: Two-Factor Authentication (2FA) functionality & related settings.

• FEATURE: Set up a mechanism to load the firewall PHP file early.

• FEATURE: PHP firewall rule engine.

• FEATURE: Add WHOIS lookup functionality.

• FEATURE: Implement 6G firewall rules in the new PHP-based firewall.

• FEATURE: Disable WordPress application passwords.

• FEATURE: Remove the plugin's tables and options when uninstalling the plugin according to configuration settings.

• FEATURE: Trash spam comments after n number of days as per configuration set in Admin Dashboard > WP Security > SPAM Prevention > the "Comment SPAM" tab > the "Comment Processing" section > the "Trash Comments After" settings.

• FEATURE: Brute force Cookie-based Firewall Protection based on the PHP code instead of htaccess rules so that it also works with Nginx, IIS etc servers.

• FEATURE: Allow multiple email addresses for the User Login > Notify By Email setting.

• FEATURE: IPv6 range support in CIDR Format enabled.

• FIX: The WooCommerce customer was redirected to the wp-login page after payment with an external payment gateway if forced logout configured after a specific number of minutes.

• FIX: If the WordPress language was set to something other than English, then auto-update core, plugin, and theme emails sent in English instead of the configured language.

• FIX: Database error for multisite when creating a new site solved.

• FIX: Captcha options should not be autoloaded.

• FIX: Database error for multisite cronjob column name.

• FIX: The plugin clogs up the database with lots of rows. Delete old data after 90 days.

• FIX: Rename Login issue with wp plugin list command solved.

• FIX: Rename Login breaks logout functionality if WP_HOME is set to a different URL than the WordPress core files URL.

• FIX: PHP Fatal error: Uncaught Error: Class 'AIOWPSecurity_Admin_Init' not found in html/wp-content/plugins/all-in-one-wp-security-and-firewall/wp-security-core.php:366.

• FIX: The Spam comment blocked IP address remains blocked even after spammed comments are approved.

• FIX: Admin Dashboard > WP Security > Security Points Breakdown Section piechart tooltips flickering.

• FIX: The "Time Length of 404 Lockout" option doesn't do anything.

• FIX: Search did not work for the 404 Event Logs list table.

• FIX: Search did not work for Failed Logins list table.

• FIX: Search did not work for the Account Activity list table.

• FIX: Bulk deletions did not work for the Account Activity list table.

• FIX: Warning when bots make malformed requests.

• FIX: When the user had pressed the bottom bulk action button of the list table, the bulk action was confirmed by two confirm alerts.

• FIX: Unblock link in 404 Event Logs list table redirected to wrong tab.

• FIX: Temp Block, Blacklist IP and Delete links in 404 Event Logs list table didn't work.

• FIX: Rename login page and Cookie based brute force login prevention configurations didn't work simultaneously.

• FIX: Fatal error when activating using older PHP versions

• FIX: If auto_prepend_file is already pointed to the firewall bootstrap file from php.ini manually, the bootstrap file try to include itself.

• FIX: The custom logo wasn't displayed on the login lockdown unlock request form.

• TWEAK: Allow taking database backups via the UpdraftPlus backup plugin.

• TWEAK: Make lockout reasons more specific.

• TWEAK: Update notice class.

• TWEAK: If the user has not performed the cookie test, the brute force attack prevention configuration fields remain disabled in the Admin Dashboard > WP Security > Brute Force > Cookie Based Brute Force Prevention.

• TWEAK: Display locked IP addresses lockout date and release date in WordPress settings format.

• TWEAK: Improve success or messages when performing bulk actions on the table list.

• TWEAK: 404 events date is displayed in WordPress settings format.

• TWEAK: Account activity login date and logout date are displayed in WordPress settings format.

• TWEAK: Add a label for each setting field.

• TWEAK: JQMIGRATE: jQuery.fn.click() event shorthand is deprecated.

• TWEAK: Fix typos at Admin Dashboard > WP Security > Firewall > Basic Firewall Rules > Block Access to Debug Log File.

• 22/April/2022 =

• FEATURE: Disable login lockdown feature when the AIOWPS_DISABLE_LOGIN_LOCKDOWN constant with true value.

• FIX: For multisite giving fatal error on settings and dashboard page Call to a member function on null.

• FIX: Scores not updating correctly if a feature activated and "Remove wp generator meta info" activated shows 5/5 for all.

• FIX: Change hard-coded references of wp-content to WP_CONTENT_DIR constant.

• TWEAK: Get user IP Address using an external service in local server setup.

• TWEAK: Filter name changed to "aiowps_pre_add_to_permanent_block" from "pre_add_to_permanent_block".

• TWEAK: Filter name changed to "aiowps_filter_event_logger_data" from "filter_event_logger_data".

• TWEAK: Disables the "Secret Word" and "Re-direct URL" input fields when the "Enable Brute Force Attack Prevention" option is unchecked.

• TWEAK: Show nice error on activation if site php version is lower than 5.6.

• 29/March/2022 =

• FEATURE: Reset all settings by clicking on the "Reset Settings" button on the Settings Page.

• FEATURE: Verify the Google reCaptcha Site key before rendering and disable it if the Google reCaptcha site key is invalid.

• FIX: PHP Fatal error: Cannot redeclare wp_install_maybe_enable_pretty_permalinks() in specific server.

• FIX: throwing database error for creating debug log table in specific MySQL server.

• FIX: Compatibility issue with WPML plugin for login and logout functionality.

• FIX: Update email sent in English instead of setting language.

• FIX: The Simple Math Captcha can't be validated when a third-party plugin clears transients more frequently.

• FIX: The login lockdown unlock request was not working in a few specific server environments.

• FIX: The warning headers already sent was displayed in a few specific server environments.

• FIX: Handle invalid tabs appropriately in setting pages.

• TWEAK: Add review notice.

• TWEAK: Improve functionality of fake google bot prevents to access the site.

• TWEAK: Remove IP address retrieval setting and detect IP address automatically.

• TWEAK: Verify Google reCaptcha site key before rendering the reCaptcha.

• TWEAK: Remove force logout checking from REST API Call.

• TWEAK: Made Admin Dashboard > WP Security > Settings tabs extensible.

• TWEAK: Add G2 review message in the admin footer.

• TWEAK: Format failed login date time according to WordPress general settings.

• TWEAK: Remove unused codes from AIOWPSecurity_Config.

• TWEAK: Add more specific instructions to change the Display name compared to the username in Admin Dashboard > WP Security > User Accounts > "Display Name" tab > "Modify Accounts With Identical Login Name & Display Name" section.

• TWEAK: Remove Admin Dashboard > WP Security > Site Info tab (now redundant because of WP's "Site Health" tool)

• TWEAK: The "Allow Login Lockout Request" checkbox is ticked by default.

• FIX: Fix login lockout issue with different timezone.

• 21/Jan/2022 =

• FEATURE: Auto-purge failed login records after 90 days.

• FEATURE: Change the debug log so it's stored in the database and not a file

• FIX: Missing Plugin header fields are added.

• FIX: PHP Warning Notice for finding IP Address appears when a dual proxy used.

• FIX: Logout date-time shows 1000-10-10 10:00:00 for non-logged out user.

• FIX: The notification for re-inserting the security rules in your .htaccess file appears after deactivating and activating the plugin to non-admin users.

• TWEAK: Replace obsolete variable reference style

• TWEAK: View debug logs from within the UI

• Added Polish language translation file to the plugin. Thanks to Dariusz for submitting the language files.
• Fixed a typo in the help text.
• Allow the "redirect_to" parameter to be used on renamed login page when logged in. Thanks to @tvartom.
• Fixed a Typo in the help text located in the "Custom Rules tab".
• Added a new filter hook (aiowps_execute_backup_set_memory_limit) to allow overriding of the PHP memory limit setting when executing a backup.
• WordPress 5.8

• Fixed an issue with the rename login page feature on WordPress v5.7.

• Fixed bugs and improved functionality related to "logged in users" functionality.
• Google recaptha checks for WooCommerce product reviews
• Replaced use of deprecated hook "wpmu_new_blog" with "wp_insert_site"
• Fixed a potential XSS issue in the settings menu of the plugin for IE11 or older browsers.

• Fixed vulnerability related to open redirect and exposure of hidden login page for specific case. (Thanks to Erwan (wpscanteam) for letting us know)

• Added robustness to login lockdown feature by replacing the strtotime function with DateTime/DateInterval. This should prevent 32-bit systems from being constrained to the max date of 19 Jan 2038.
• Fixed bugs related to captcha features.
• Fixed and improved "Logged In Users" functionality for multisite.
• Always set valid dates, to avoid errors when strict mode is enabled on mysql. Thanks to Davide.

• Removed whois feature because it adds relatively little value and the third-party library used is not being maintained regularly.
• Fixed "headers already sent" error when bulk action performed using aiowps list table.

• Fixed another captcha bug related to comment form.

• Fixed various captcha bugs: woocommerce lost password page, custom login form page, etc

• Fixed rename login page feature bug introduced after WP core change in version 5.2.

• Trying again - Fixed login captcha authentication bug.

• Fixed login captcha authentication bug.

• Minor bug fix - added missing check to enqueue recaptcha script only if that feature is enabled.

• Improved white list directives to cater for Apache 2.4 and earlier versions.
• Added 3 filters for the manual account registration approval email: aiowps_register_approval_email_subject, aiowps_register_approval_email_msg, aiowps_register_approval_email_from_name
• Added configuration option to allow custom firewall rules to be applied at beginning of all rules applied by aiowps.
• Changed record insertions to DB table aiowps_failed_logins to store the full IP address instead of IP range.

• Changed the parameter in current_user_can function to use an administrator capability instead of the "administrator" role name.
• Added some new hooks to the AIOWPSecurity_WP_Loaded_Tasks called aiowps_wp_loaded_tasks_start and aiowps_wp_loaded_tasks_end.
• Improved get_locked_ips() function and added $wpdb->prepare statement.
• Added more missing translation domain parameters for translatable strings in the rename login page.
• Deleted local copy of the Persian and Italian language files. These translations are available on translate.wordpress.org.
• Domain path and text domain added to plugin header.
• Changed the get_user_ip_address functions so that $_SERVER['REMOTE_ADDR'] is the primary method used to obtain IP address.
• Added enumeration block via REST API (wp >

• Improved "User Registration" feature to bypass the pending approval status for new users created in admin side.
• Fixed bug in whois library.
• Added translation domain parameter for translatable strings in the rename login page.
• Updated the chinese language file.

• Debug logger class improvements.
• Added a message in the debug settings area to state that the log files are reset on every plugin update.
• Always return an array from scan_dir_sort_date() to prevent PHP notices.
• Improvements for Automated DB backups filling up space - old backup file will be deleted first.
• Thanks to RIPS Analyzer for sending us the vulnerability report.

• Added sanitisation for log file data in textarea.
• Disabled autocomplete for Captcha field.

• Improved and tweaked the login captcha feature to avoid some issues people had with the last modification.
• Deleted reference to ini_get('safe_mode') to avoid fatal errors for newer versions of PHP where that setting has been totally removed.

• Fixed bug in Maintenance menu page when trying to attach a media file to the message text box.
• Added a new filter (called "aiowps_ip_blocked_error_msg") which allows the modification of the error message displayed on the login page when an IP address has been blocked by the login lockdown feature.
• Updated French language translation. Thanks to Claude Ribaux for providing the translation files.
• Thanks to @chesio for making the following two changes.
• Replaced deprecated call to get_currentuserinfo() function.
• Minor code fixes in the backup class file.
• Fix: display correct (error) message when write_to_htaccess() fails.
• Tweak: database backup filename is more human-readable. Before: 24x7eg8l6i-database-backup-1463042767.zip After: database-backup-20160512-104607-24x7eg8l6i.zip

• Made file change scanner code more robust for cases when open_basedir restriction is in effect. (Thanks to Manuel Jeanne for pointing this out).
• Added code which will remove WordPress version info during CSS and JS script loading if you have the "Remove WP Generator Meta Info" option checked. (Thanks to aldemarcalazans for pointing this out).
• Fixed some potential SQL injection vulnerabilities. (Thanks to Julio Potier for pointing these out).
• Changed the feature category of blacklist manger from "Intermediate" to "Advanced".
• Tweak: Remove "@" from list of characters blocked by advanced character string filter. (Because it is often used in retina-ready images).
• Fix: Use home URL instead of site URL in lock notification email subject. Thanks to @chesio for fixing this.

• Added ability to identify IP addresses during user registration and option to block selected IPs.
• Added login form captcha functionality for sub-sites in a multi-site installation. (see the Brute Force menu)
• Fixed multi-site bug related to manual user-chosen DB prefix change.
• Added extra XSS protection inside admin menu pages for the "tab" query parameter.
• Added a note to the features that has the potential to lock you out if it doesn't work correctly on your site.
• Updated Brazil-Portuguese language file.
• Fixed issue with firewall custom rules being corrupted by magic quotes. Thanks to @chesio for fixing this.

• Added a new action hook "aiopws_before_set_404" which triggers just before the AIOWPS sets a 404. (handy for cases when rename login page is used which affects some themes when accessing "wp-admin" directly)
• Fixed some potential SQL injection vulnerabilities.
• Thanks to @chesio for submitting the following changes and applying the fixes.
• Sub-directory install fixes.
• Improve behavior of WP File Access tab.
• Fix invalid nesting of HTML elements.
• Do not block HTTP requests that contain "tag=" in query string.
• Option to enable the 6G firewall.

• Added urlencode to query strings in URLs to prevent unexpected behaviour. Thanks to @chesio for spotting the issue.
• Added new feature to stop users enumeration. Thanks to @davidegiunchidiennea for adding this.
• Added a more robust code for check_user_exists function. Thanks to Christian Carey.
• Added cron cleanup of the global meta table.
• Added a title in each of the admin interface menu.

• Renamed the language files to match the new textdomain slug to fix the language translation bug.
• Fixed bug related to the rename login feature and force logout or logout expiry events.

• Fixed an issue with the rename login page feature for WordPress 4.3
• Added esc_attr() sanitization to some of the relevant parameters
• Added the necessary changes to allow activation via wp-cli

• Added Rename Login page feature from the "Brute Force" menu to multisite sub-sites.
• Removed invalid "length" attribute from input element in captcha code.
• Fixed reset password feature whereby the URL which is sent out in the email for cases when rename login feature is enabled was not decoded properly.
• Corrected the check for boolean false if returned from wpdb query result.
• Added media button for wp editor in maintenance settings page.

• Fixed minor bug - IP addresses blocked due to '404' were not being listed in the display table.
• Updated the Russian language translation file.
• The automatic database table prefix generation value will use a-z characters only.
• Added esc_url sanitization to the add_query_arg/remove_query_arg function instances to prevent possible XSS.

• Added an improvement for login lockdown feature - locked IP addresses will no longer be allowed to register.
• Added a "view" link for each account in the pending registration approval table list.
• Fixed 404 logging/lockout bug.
• Added ability to permanently block IP addresses from the 404 event list for both bulk and single cases.
• Added ability to do bulk temp blocking for IP addresses in 404 list.
• Fixed a minor bug with validate_ip_list function.

• Improved DB prefix change code to make it more robust.
• Fixed a minor bug for the Rename Login page feature.
• Added check when processing rename login page to see if maintenance (lockout) mode enabled. Plugin will now display lockout message instead of 404 page if site lockout enabled.
• Made the Cookie Based Brute Force Prevention feature more secure by introducing a 10 digit random suffix to the test cookie name.

• Added ability to insert captcha in WordPress Multi Site registration form.
• Added a condition around the management permission constant. This will allow users to define a custom capability for this plugin's admin side via the wp-config file. This was submitted by Samuel Aguilera.
• Fixed a bug with the hidden login page feature.
• Fixed a small settings bug with the "block fake google bot" feature.

• Added a new DB scan feature. Go to the "Scanner" menu to use this new feature.
• Added new settings import/export feature.
• Modified user accounts feature to alert administrator if one or both "admin" or "Admin" usernames are being used.
• Added Persian language translation. The translation was submitted by Amir Mousavi Pour (me@ameer.ir).
• Small change to get_mysql_tables function to prevent fatal error when mysqli query is unsuccessful.
• Added Italian language translation. The translation was submitted by Marco Guglielmetti.

• Added Brazilian language translation. The translation was submitted by Sergio Siqueira.
• Added two new action hooks for plugin activation and deactivation time.
• Improved the get_user_ip_address() function so it handles cases when multiple addresses are returned due to proxy.
• Fixed the mis-alignment of login page which was broken by WP3.9 when rename login feature is used.
• WordPress 3.9 compatibility

• Fixed a minor bug: dashboard link was pointing to the wrong tab for the "Logged In Users" tab.
• Fix a bug with the login page captcha. The captcha wansn't shown if the rename login page feature was enabled at the same time.

• Added a new feature to prevent image hot-linking. (See the "Prevent Hotlinks" tab in the firewall menu)
• Added a check in the Rename Login Page feature to prevent people from setting the slug to "wp-admin"
• Fixed a small bug with Login Lockdown feature.

• Fixed a bug where the cookie-based brute force directives were not being deleted from the .htaccess file when the Rename Login Page feature was being activated.

• Consolidated "Brute Force" features by moving all such features to the "Brute Force" menu.
• Improved the file change detection scan feature: Introduced a button allowing admin to view the file change results from the last scan and fixed small bug whereby the change detected flag was not being cleared for applicable cases.
• Fixed a small bug with "rename login page" feature.
• Made wp-config.php and .htaccess file backups more secure. Thanks to @wzp for the tip.
• Made the login code more robust by catering for cases where the "wp_login" action was not passing 2 parameters.

• Added a brand new brute force prevention feature - Rename Login Page. This feature can be found in the new menu item called "Brute Force".
• Modified the new unlock request feature so that the locked out user will only have to enter email address when they submit an unlock request.
• Replaced the deprecated PHP function "mysql_list_tables" with alternative code.
• Added warning message regarding WordPress iOS app when pingback protection feature in the firewall settings is active.
• Added Malware scan tab and information.
• Some minor html form and CSS corrections.

• Added new feature which allows users to generate an automated unlock request link via email when they get locked out because of the login lockdown feature.
• Added a check to ensure that user cannot enter 0 minutes in the Force Logout feature.
• Fixed translations so that various previously omitted strings can now be translated.
• Added a new filter before locking down a user's IP address - aiowps_before_lockdown.
• Generated a new translation (POT) file.

• Added a new feature that will allow you to add a captcha to the lost password form (useful if you are allowing user registration on your site).
• Added ability to specify a system log file in the "Host System Logs" tab of the "File System Security" menu
• Fixed a tab link bug. One link was going to the wrong menu tab.
• Updated the POT file of the plugin.

• Added a new feature which allows you to add captcha to the Wordpress user registration page.
• Added some more helpful comments and link to video tutorial in the brute force and white list features settings pages.

• Added new feature which automatically sets the status of newly registered wordpress user accounts to "pending" and allows manual approval by an administrator.
• Improved robustness of file change detection iteration code.
• WordPress 3.7 compatibility

• Improved the login captcha implementation
• Changed the management permission to manage_options

• Added a feature to insert a simple math captcha to the WordPress comment form (to reduce comment spam). Check the spam prevention menu for this new feature.
• Fixed a minor bug with bulk unlock/delete in user login menu
• Fixed a minor bug with math captcha logic.

• Added a simple math captcha functionality for the WP login page. This is another easy yet effective way to combat Brute Force Login Attacks. You can enable this new feature from the user login security menu.

• Added a new Login Whitelist feature. This feature enables you to specify one or more IP addresses in a special whitelist which will have access to your WP login page. All other IP addresses trying to access your WP login page which are not in the whitelist will be automatically blocked.
• The IP address will also be included in the email that gets sent to the admin for the ip address lockout notification.
• Language file loading fix for Chinese language.
• Tweaked the code which creates a .htaccess file in the backup directory to ensure it gets run even if the directory already existed.
• Made DB backups more secure.
• Added more useful debug logs for .htaccess file manipulation failure scenarios.

• Added a new feature which will list the currently logged in users who have been active within the last 15 minutes.
• Added a new feature in settings menu which will disable all firewall rules and clear all applicable directives in the .htaccess file.
• Improved the way the wp-config.php file is handled when it contains an ending PHP tag "?>" (older sites that were using PHP4 earlier).

• Added new feature/checkbox which will instantly lockout IP address ranges which attempt to login with an invalid username.
• Fixed a bug in the Comment SPAM IP Monitoring page where trying to block one or more IPs was failing.
• Removed the word "config" from the list of bad query strings check (to add compatibility with a few more plugins)
• Added a notice in the dashboard menu to show you if there are any recent file changes that the plugin detected.
• Fixed bug with php File Editing feature. Code now also handles older style wp-config.php files which have the php end tag "?>"
• Fixed bug with "Disable All Security Features" button functionality. When clicked, this will now also make the appropriate changes to the .htacces and wp-config.php files if necessary.
• Changed the storage of backup files from the plugin's directory to the uploads directory. Also added a .htaccess file for security.
• Fixed the way user-agent strings were written to the .htacess file from the Blacklist feature. The code now will correctly identify and represent spaces and escaped chars.
• Fixed a bug related to sending backup to correct email address.

• Added new menu called Scanner with a new feature called File Change Detection. This feature will alert you if any files have changed, added or removed from your system.
• Fixed "Deny Bad Query Strings" rules to not break the ability to drag components in the WordPress "Appearance->Menus" page
• Fixed an activation time warning (on sites with WP_DEBUG option enabled)
• Re-implemented the wp-config.php file content backup feature. It now directly downloads the contents of the file to your computer.
• Multi-site enhancements: Suppressed access to configuration settings for features which are not allowed to be configured from subsites of multi-site installations.
• Fixed a bug with login lockdown feature.

• Added a new feature which will block some spambots from submitting comments.
• Moved Comment SPAM IP monitoring interface to the new "SPAM Prevention" menu.
• Fixed a bug with login lockdown feature for both multi and single site.
• Improved firewall feature for multi-site by making the "Firewall" menu available only for the main site and not the sub-sites.
• Added random prefix to backup file names.
• Fixed a bug for WP multi-site install where DB tables do not get created when new blog are created in the network.

• Fixed a version tagging issue.

• Fixed a bug for general DB backup functionality.
• Fixed multi-site DB backup - the plugin will now backup only the tables relevant for the sub-site in question.
• Added blank index.html files in various folders inside the plugin.
• Disabled the wp-config.php file backup feature until we find a more secure method of doing the backup.

• Added new WordPress PingBack Vulnerability Protection feature. This allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality.
• Added a configuration item in the brute force login prevention feature to allow ajax functionality to work properly when this feature is enabled.
• Added a POT file for language translations.
• Made the DB Prefix feature more robust by adding a check to ensure that plugin can write to the wp-config.php file. This will prevent user from losing access to their site in cases where the system changed the prefix but not the entry in the wp-config.php file.
• Tightened the data validation for the cookie based brute force login feature to ensure that the user must enter a secret word which consists of alphanumeric characters.
• Added edit links to the user account list in the "User Acounts" menu.

• Moved the front end site lockout feature to a new menu called "Maintenance".
• Added a feature in the front-end lockout feature to allow people to specify their own message which will be displayed on the front-end to visitors who try to access the site when it is in lock out state.
• Fixed a bug in the front-end lockout feature by adding some checks which ensure that the admin will not get locked if the feature is still active and their login session expires or they log out.
• Added a widget in the dashboard menu to show the status of the "maintenance mode" feature.

• Added a new feature which is a password strength tool which calculates how easy it is for your chosen password to be cracked using a desktop PC and the appropriate SW. This tool should help you create strong passwords.
• Added a front-end general visitor lockout feature. This feature allows you to temporarily lock down the front end of your site while you do security investigation, site upgrades, tweaks etc.

• Added a new option in the cookie-based Brute Force Login Attack prevention feature to allow users to use this feature together with the WordPress's post/page password protection feature.
• Fixed a bug in the 5G firewall rules to so that the printed rules include the correct number of '\' characters.
• Fixed a minor bug in the "restore from backed up htaccess file" feature.
• Enhanced the "Save current wp-config.php file" feature so it will continue to work with all of the firewall rules active on the site.
• Added extra checks to account for some error scenarios caused on some servers when recursive file search is done.

• Added new feature - Cookie-based Brute Force Login Attack Prevention. Check under the "Firewall" menu for this new feature. This feature will stop hackers in their tracks when they try to access your wp-admin or login pages. This feature will secure your WordPress backend by enforcing the requirement that anybody trying to access these pages will require a special cookie.

• Fixed bug related to setting of default configuration for first-time plugin activation.

• Tweaked the "Deny Bad Query Strings" firewall rules so that plugin deletion and update operations from the WordPress plugins menu are not affected.
• Fixed a minor bug related to scheduled database backups.
• Added some extra default settings to be applied to the plugin's configuration pages upon activation for the first time.
• Plugin will now display a recommendation message if user sets scheduled backup frequency to less than 24 hours.

• Added a new feature to remove the WordPress Generator Meta information from the HTML source of your site.
• Tweaked the "Advanced Character String Filter" to fix issue which was affecting plugins such as "Admin Management Xtended" and also pages with keywords such as "password" in the URL.
• Updated one rule in the "Advanced Character String Filter" feature to make it compatible with W3 Total Cache Plugin's minify feature.
• Added a "Delete All Failed Login Records" option in the "Failed Login Records" tab. This will delete all entries in the failed logins table and will make it less tedious for users who get a lot of brute force attacks on their site.

• Moved the rules which disable index views from the "basic firewall" rules to the "additional rules" section. This will prevent any site breakage for those who want to enable the basic firewall but do not have "AllowOverride" option enabled in their httpd.conf

• Added the following new feature:
• Prevent people from accessing the readme.html, license.txt and wp-config-sample.php files.

None