Anti-Malware Security and Brute-Force Firewall

• Prevented infinite looping on recursive sub-directories.
• Changed some default values.
• Checked code for compatibility with WordPress 6.1.1 and ClassicPress 1.4.4.

• Removed the no_error_reporting option used for debugging when server errors are breaking the site.
• Checked code for compatibility with WordPress 6.0.2 and ClassicPress 1.4.2.

• Fixed XSS vulnerability on debug URLs introduced in the last release, thanks Erwan Le Rousseau.
• Updated code with other various minor improvements bug fixed.
• Checked code for compatibility with WordPress 6.0.1 and ClassicPress 1.4.2.

• Updated code with various minor improvements to efficiency and compatibility.
• Checked code for compatibility with WordPress 6.0.

• Fixed XSS vulnerability by removing unsanitized QUERY_STRING.
• Cleaned up Quarantine code, removing legacy functions and adding more detailed info.
• Fixed undefined variable notice and checked code for compatibility with WordPress 5.9.2.

• Added more sanitization and validation to all user data entered for better security.
• checked code for compatibility with WordPress 5.9.

• Fixed an XSS vulnerability and checked code for compatibility with WordPress 5.8.3.

• Fixed undefined variable warning.
• Updated code for compatibility with PHP version 8.0.

• Added German translation thanks to Micha Cassola.
• Improved the Apache software version checker for better firewall compatibility.
• Fixed session compatibility that was conflicting with the REST API check in Site Health.
• Checked code for compatibility with WordPress 5.8.1 and ClassicPress 1.3.1.

• Updated registration form to be more compatible with newer iframe restrictions.
• Fixed session check on the Brute-Force patch to no longer need mod_rewrite.
• Removed older code from WordPress Repository.

• Various minor bug fixes.
• Added Core Files Definitions for ClassicPress.
• Tweaked code for better compatibility with WordPress 5.7.2 and ClassicPress 1.2.0.

• Fixed a JavaScript error caused by a new French translation.
• Checked code for compatibility with WordPress 5.4.1.

• Updated some external links.
• Tweaked code for better compatibility with PHP 7.4 and WordPress 5.4.

• Added even more error handling to the DB Scan for servers with the PHP memory_limit set too low.
• Modified the Directory Scan Depth to accept 0 as a value to indicate skipping the Directory Scan (use this to focus on the DB Scan).
• Added some Help tips to some of the options on the Settings page.

• Updated links to use HTTPS by default and fixed some old URLs.
• Various performance improvements.
• Added more error handling to the DB Scan.
• Fixed a few minor bugs causing PHP Notices.
• Fixed a path search to work on Windows servers.
• Tweaked code for compatibility with WP 5.3 (latest release).

• Cleaned up the Nonce Token creation and storage functions.
• Cleaned up View Quarantine page and fixed recovery link.
• Added debugging for login errors WP head and footer Hooks.

• Fixed a bug in the Nonce Token Errors that was created by changes in the last release.

• Added wp_options table to the db_scan.
• Fixed a few minor bugs in the db scan quarantine view.
• Changed some wording and other minor fomatting issues.
• Checked code for compatibility with WP 5.2.1 (latest release).

• Added a Warning message about the vulnerability in the yuzo-related-post plugin.
• Updated the Quarantine interface and added a re-scan / re-clean feature.
• Fixed a bug in the scan depth array that would produce PHP Notices in the error_log files under certain conditions.
• Changed some wording and other minor fomatting issues.
• Removed some outdated JavaScript that is no longer needed.
• Checked code for compatibility with WP 5.2 (latest release).

Fixed a major bug in the Firewall updates that could cause a False Positive lockout.

• Fixed a bug in the Firewall that prevented some iPad devices from logging in.
• Fixed an encoding bug that prevented the Examine File window from dispaying some file formats.
• Restored the File Details window in the Examine File window.
• Updated code for compatibility with WP 5.1.1 (latest release).

• Added a whole new DB Scan category that looks for links and scripts injected directly into the database content and removes them.
• Updated Firewall landing page for HTTPS compatibility.
• Removed some old code that was no longer needed.
• Added a feature to clear cache files before running the Complete Scan, this will speed up the scan and prevent malware from being saved on your cached paged.
• Updated code for compatibility with WP 5.0.2 (latest release).

• Updated code for compatibility with WP 4.9.8 (latest release).
• Fixed PHP Notice for the unknown offset of SERVER_parts.
• Escaped single-quotes in translated strings for use within JavaScript.

• Updated code for compatibility with WP 4.9.7 (latest release).
• Removed wrong size dashicon from Settings link in plugin list.
• Removed the broken link to vote WORKS on wordpress.org.
• Reordered priorety on fixing Known Threats to be more efficient.

• Updated code for compatibility with WP 4.9.4 (latest release).
• Fixed dashicons sizing in css.
• Add ability to update registration email from within the plugin settings.
• Cleaned up expired nonce tokens left behind from an older version.

• Added SSL support for definition updates and registration form.
• Upgraded the Whitelist feature so the it could not contain duplicates.

• Updated code for compatibility with WP 4.9.3 (latest release).
• Fixed registration form and alternate domain for definition updates to work on HTTPS.
• Fixed the wording on the Title check error message.

• Improved security on the Quarantine directory to fix the 500 error on some servers.

• Added Title check to make sure it does say you were hacked.
• Updated code for compatibility with WP 4.8.3 (latest release).
• Fixed Undefined variable error in Quarantine.
• Fixed XSS vulnerability in nonce error output.

• Changed the definition update URL to only use SSL when required.
• Updated PayPal form for better domestic IPN compatibility.

• Added the Turkish translation thanks to Umut Can Alparslan.
• Improved the auto update so that old definitions could be phased out and new threat types would be selected by default.
• Fixed the admin username change feature on multisite installs.

• Fixed the details window so that it scrolls to the highlighted code.
• Set defaults to disable the Potential Threat scan if other threats definitions are enabled.
• Encoded definitions array for DB storage.

• Fixed syntax error in the XMLRPC patch for newer versions of Apache.

• Added fall-back to manual updates if the Automatic update feature fails.
• Fixed PHP Notices about undefined variable added in last Version release.
• Improved Apache version detection.

• Changed Automatic update feature to automatically download all definitions and firewall updates.
• Added PHP and Apache version detections and changed the XMLRPC patch to work with Apache 2.4 directives.
• Removed the onbeforeunload function because Norton detected it as a False Positive.
• Removed code that was deprecated in PHP Version 7.

• First BETA versions available for WordPress.

=

Fixed PHP Notice about an array to string conversion with some rare global variable conditions.

• Added more firewall options.
• Moved Scan Log from the Quarantine page to the main Setings page.
• Fixed PHP Warning about an invalid argument in foreach and some other bugs too.

• Fixed "What to look for" Options so that changes are saved.
• Changed get_currentuserinfo to wp_get_current_user because the get_currentuserinfo function was deprecated in WP 4.5

• Removed Menu Item Placement Options because the add_object_page function was deprecated in WP 4.5.
• Added firewall options for better compatibility with WP Firewall 2.
• Fixed an XSS vulnerability in the debug output of the nonce token.

• Moved the Firewall Options to it's own page linked to from the admin menu.
• Moved the Quick Scan from the admin menu to the top of the Scan Settings page.

• Fixed PHP Warning about in_array function expecting parameter 2 to be an array, found by Georgey B.
• Made a few minor cosmetic changes and fixed a few other small bugs in the interface.

• Fixed the Nonce Token error caused by W3 Total Cache breaking the set_transient function in WordPress.
• Added the Brazilian Portuguese language files, thanks to Marcelo Guernieri for the translation.

• Fixed the admin menu and also some links that did not work on Windows server.

• Added Core Files to the Quick Scan list on the admin menu.
• Added a nonce token to prevent Cross-Site Request Forgery by admins who are logged-in from another site.
• Hardened against XSS vulnerability triggered by the file names being scanned (thanks to Mahadev Subedi).
• Improved brute-force patch compatibility with alternate wp-config.php location.

• Had to remove the encoding of the Default Definitions to meet the WordPress Plugin Guidelines.

• Improved the JavaScript in the new Brute-Force login patch so that it works with caching enabled on the login page.

• Improved the Brute-Force login patch with custom fields and JavaScript.
• Added a Save button to that Scan Settings page.
• Fixed a bug in the XMLRPC Patch "Unblock" feature.

• Added a link to purge the deleted Quarantine items from the database.
• Added firewall option to Block all XMLRPC calls.
• Fixed a few cosmetic bugs in the quarantine and firewall options.

• Fixed a bugs in the Quarantine that was memory_limit errors if there number of files in the was too high.
• Added the highlight malicious code feature back to the Quarantine file viewer.
• Added the ability to change the admin username if the current username is "admin".
• Improved the code in the Brute-Force Protection patch.

• Fixed a few bugs in the Core Files Check that was preventing it from fixing some unusual file modifications.

• Fixed a major bug that made multisite scan extremely slow and sometimes error out.
• Moved all ajax call out of the init function and into their own functions for better handling time.

• Moved the quarantine files into the database and deleted the old directory in uploads.
• Fixed some minor formatting issues in the HTML output on the settings page.
• Added a warning message if base64_decode has been disabled.

• Moved the quarantine files into the database and deleted the old directory in uploads.
• Fixed some minor formatting issues in the HTML output on the settings page.
• Added a warning message if base64_decode has been disabled.

• Hardened against injected HTML content by encoding the tags with variables.
• Fixed debug option to exclude individual definitions.

• Hardened admin_init with current_user_can and realpath on the quarantine file deletion (thanks to J.D. Grimes).
• Fixed another XSS vulnerabilities in the admin (thanks to James H.)

• Hardened admin_init with current_user_can and realpath on the quarantine file deletion (thanks to J.D. Grimes).

• Hardened admin_init with current_user_can and realpath on the quarantine file deletion (thanks to J.D. Grimes).

• Hardened against XSS vulnerabilities in the admin (thanks to Tim Coen).
• Added feature to restore default settings for Exclude Extensions.
• Changed the encoding on the index.php file in the Quarantine to make it more human-readable.
• Fixed a few small bugs that were throwing PHP Notices in some configurations and added more info to some error messages.

• Created an automatic update feature that downloads any new definition updates before starting the scan.
• Added WordPress Core files to the new definitions update process and included a scan option to check the integrity of the Core files.
• Automatically whitelisted the unmodified WordPress Core files.
• Made more improvements to the Brute-Force protection patch and other minor cosmetic changes to the interface.
• Protected the HTML in my plugin from filter injections and fixed a few other minor bugs.

• Fixed a problem with deleting files from the Quarantine folder.
• Added a descriptive reason to the error displayed if the fix was unsuccessful.
• Added link to restore the default location of the Examine Results window.

• Improved the encoding of definition updates so that they would not be blocked by poorly written firewall rules.
• Suppressed the "Please make a donation" nag if the fix was unsuccessful, to avoid confusion over premium services.

• Removed debug alert from initial session check.

• Improved rewrite compatibility of session check for the Brute-Force Protection Installation.

• Improved session check for the option to Install Brute-Force Protection and added an error message on failure.
• Improved support for Multisite by only allowing Network Admins access to the Anti-Malware menu.

• Added link to view a simple scan history on the Quarantine page.
• Updated firewall to better protect agains new variations of the RevSlider Exploit.
• Improved check for session support before giving the option to Install Brute-Force patch.

• Added option to skip scanning the Quarantined files.
• Updated Brute-Force patch to fix the problem of being included more that once.
• Fixed a few minor bugs (better window positioning and css, cleaner results page, updated new help tab, etc.). Made sure that the plugin does not check my servers for updates unless you have registered (this opt-in requirement is part of the WordPress Repository Guidelines).

• Added option to skip scanning the Quaratined files.
• Updated Brute-Force patch to fix the problem of being included more that once.
• Fixed a few minor bugs (better window positioning and css, cleaner results page, updated new help tab, etc.).

• Added exception for the social.png files to the skip files by extension list.
• Fixed removal of Known Threats from files in the Quarantine directory.

• Block SoakSoak and other malware from exploiting the Slider Revolution Vulnerability (THIS IS A WIDESPREAD THREAT RIGHT NOW).

• Enabled the Brute-Force protection option directly from the Settings page.
• Fixed window position to auto-adjust on small screens.

• Major upgrade to the protection for wp-login.php Brute-Force attempts.
• Fixes a bug in setting the permissions for read-only files so that they could still be cleaned.