Prevented wp-config.php and .htaccess from being left empty after a server crash or a failed file update. Bug Fix: Resolved an error that broke the Firewall settings tab when IP Detection was set to "Unconfigured". Bug Fix: Two-factor authentication is now enforced for users without a display name when Passkeys are enabled. Bug Fix: Resolved an issue where modals and popovers in the admin UI rendered without their styles.
Added Nexcess Licensing through Harbor library. Bug Fix: WP CLI licensing command didn't show Nexcess licensing correctly.
Versão 9.0.3
1 melhoria1 correção
Melhoria
Nexcess
Correção
Handle WP_Error in login interstitial session creation to prevent fatal errors.
Versão 9.0.2
1 melhoria1 correção
Melhoria
Nexcess
Correção
Error if all Kadence products are managed by Nexcess licensing.
Versão 9.0.1
1 melhoria1 correção
Melhoria
Nexcess
Correção
Race condition in file write could empty wp-config.php/.htaccess files.
Versão 9.0.0
2 melhorias
Melhoria
Nexcess
Updated branding from SolidWP to Kadence. Tweak: Updated branding references from StellarWP to Nexcess. New: QR code for 2FA is generated locally by default (the GD PHP extension is required), with a Kadence Security-hosted solution as a fallback. "Local QR Code" plugin is not available for downloading.
Restrict Admin Access module under Features > Login Security to configure authorized country access to your dashboard. New: Security Headers module under Advanced to enforce essential HTTP security headers. Tweak: Ensure generated Nginx config rules are valid for customized directory structures.
The Solid Security Basic and Solid Security Pro plugins can no longer be active at the same time. Tweak: Config files now show "Solid Security" instead of "iThemes Security". Tweak: Improved Database Backups dashboard widget when the feature is disabled. Tweak: Clarify the 2FA onboarding email confirmation message. Tweak: Improve Passwordless Login styling. Tweak: All Gutenberg blocks use API version 3. Tweak: Show the plugin changelog in the plugin information pop-up. Security: Update the…
Send notification about new vulnerabilities found during manual scan. Tweak: Site Scan page: show mitigated vulnerabilities, ensure all unresolved vulnerabilities are visible.
Clarify Site Scan description to reflect the new scheduling frequency. Update: Increase minimum PHP requirement to 7.4 and update the admin notice accordingly. Bug Fix: The padding on the WP Admin Dashboard page was incorrect. Bug Fix: PHP notice about early translations loading on the settings screen. Bug Fix: Treat Central IPs as trusted to ensure Central isn’t blocked by Trusted Devices restrictions.
Volodymyr Shelmuk New: Patchstack Priority tells you how quickly you should address a vulnerability so you can focus on the most critical issues. New: The Security Digest email includes a complete list of vulnerabilities affecting your site. Enhancement: The Site Scan email now only includes newly found vulnerabilities to prevent notification fatigue. Enhancement: Site Scans now run hourly to detect new vulnerabilities. Tweak: Make frontend JS code compatible with React 18.
Versão 8.5.8
2 melhorias
Melhoria
Lisa Canini
The lib/updater library has been updated to 1.9.1
Versão 8.5.7
1 novidade1 melhoria
Novidade
Development and staging sites no longer take up a separate license. Learn more: Tweak: Reduce number of steps in the onboarding sequence. Bug Fix: Notification Center settings could not be properly saved.
Melhoria
Timothy Jacobs, John Hooks
Versão 8.5.6
1 melhoria1 correção
Melhoria
Timothy Jacobs
Correção
Fix fatal error in WP-Admin when File Change is active.
Versão 8.5.5
2 melhorias
Melhoria
Timothy Jacobs
Delete older JS files that were causing false-positives on scans. They have not been used since the UI was rewritten in React. Security: Update StellarWP Telemetry library to improve authorization checks.
Versão 8.5.4
2 melhorias
Melhoria
Timothy Jacobs, Zach Tirrell
Use block API Version 3 for the Security Profile block. Bug Fix: PHP warning when HTTP_HOST not set.
2024
10 versões
Versão 8.5.3
2 melhorias
Melhoria
Timothy Jacobs
Better surface Login Security features during onboarding.
Versão 8.5.2
1 melhoria1 correção
Melhoria
Timothy Jacobs
Correção
PHP warning about translations being loaded too early.
Versão 8.5.1
1 melhoria
Melhoria
Timothy Jacobs Tweak: Add a new solid_security_mail_site_logo filter to modify the Site Logo used in email notifications. Bug Fix: PHP fatal error on shutdown due to missing Event class on some sites. Bug Fix: PHP warning on Site Health page. Bug Fix: PHP warning in the SSL module on some server setups.
Versão 8.5.0
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Segurança
Users can register for an account using passkeys on WP Login. Enhancement: Improve highlighting settings search results. Bug Fix: Checkbox styling issue on WordPress 6.6. Bug Fix: If Login Methods is set to "Email Only" use the user's email address for the passkey's name. Bug Fix: Fire an action when a vulnerability is unresolved due to plugin activation.
Versão 8.4.2
1 melhoria1 correção
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Correção
The Security Dashboard widget would not appear on new Solid Security installs. Bug Fix: Activating a Patchstack license on sites with a www. subdomain would not show the license as active.
Versão 8.4.1
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Segurança
Fix a Google reCAPTCHA v3 bypass. Important: "Automatic (Insecure)" IP detection has been removed. Read more: Tweak: Block repeated session hijacking attacks from the same device even if the user has not specifically blocked the attacker's device. Previously, subsequent attacks after the first block would have their capabilities reduced. Tweak: Remove the "Accept-Language" and "DNT" header from the list of sources for Trusted Devices. Tweak: The Updater library has been updated to 1.8.4. The…
Versão 8.4.0
1 novidade1 melhoria
Novidade
The "Trusted Devices" user experience has been reworked to make it clearer and simpler, especially for end users. Learn more: Enhancement: Allow generating a new Two-Factor TOTP secret from the WP-Login UI. Bug Fix: The SolidWP logo appeared too large in some email clients. Bug Fix: An error would occur if we could not determine the length of database columns while saving log items.
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Versão 8.3.2
2 melhorias
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Add a notice when a user's role is demoted from the Site Scans page. Tweak: Update Privacy Policy generator text. Bug Fix: Could not proceed through onboarding when BuddyPress or BuddyBoss was active. Bug Fix: Some firewall rules could not be deactivated. Bug Fix: Allow opting in to Telemetry via the Settings Page. Bug Fix: PHP 8.2 deprecation warnings.
Versão 8.3.1
1 melhoria1 correção
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Correção
A PHP Fatal Error on PHP 8+ when logging a WP_Error to the Security Logs.
Versão 8.3.0
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Segurança
The Firewall page has a new IP Management tab to provide easy access to blocking or authorizing IP addresses. New: Usage Data Sharing (opt-in only) allows users to share non-personal and non-sensitive information with StellarWP to inform decisions about how to improve Solid Security in the future. Enhancement: The "Trusted Devices" manager has been redesigned and relocated to the Security Profile tabbed UI. Enhancement: Add a snackbar notice when making changes on the Firewall Configure page.…
2023
9 versões
Versão 8.2.0
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Segurança
Refreshed UI for manging per-user security settings like Passwordless Login, Passkeys, Two-Factor and Privilege Escalation. The previous Two-Factor UI can be enabled using the SOLID_SECURITY_LEGACY_2FA_UI constant. New: A new block "Solid Security User Security Settings" let's you display this UI on the front-end of your website. The [solid_security_user_profile_settings] shortcode can be used if you're not yet using the Block Editor. Important: Solid Security now requires WordPress 6.3 or…
Versão 8.1.0
1 novidade1 melhoria
Novidade
Add support for creating custom firewall rules. Enhancement: Add support for configuring firewall settings from the Firewall page. Bug Fix: The firewall page would appear empty when geolocation could not retrieve a country code.
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Versão 8.0.4
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini
Segurança
Harden SolidWP Updater against XSS attacks. Thanks to Robin Wood (digi.ninja) for disclosing this issue.
Versão 8.0.3
1 melhoria1 reforço de segurança
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Segurança
Don't disclose the login URL when using Hide Backend on a site with comments enabled and comment registration required. Thanks to Naveen Muthusamy for disclosing this issue. Hardening: Check for the promote_user capability when using Privilege Escalation in addition to edit_user. Tweak: Remove the iThemes Security is now Solid Security banner from admin-facing email notifications. Bug Fix: Prevent the User Security page from crashing when "Show Avatars" is disabled in the WordPress discussion…
Versão 8.0.2
2 melhorias
Melhoria
Timothy Jacobs, Lisa Canini, Jared Hill
Add pagination to the Firewall logs table. Tweak: Various UI improvements. Bug Fix: On sites with no logo, a broken image appeared in some emails. Bug Fix: In some email clients, the Solid Security logo would stretch too wide.
