Added: CSV export on the Malware Scanner page — one-click downloads of full, untruncated File Findings and Database Findings (Reddit community suggestion). Paths, matched snippets, and details are no longer truncated — perfect for researching a hit in Excel/Numbers or sending to a security consultant before committing to Quarantine.
Added: Tested up to bumped to WordPress 7.0
Added: Scanner CSV exports are written to the audit log, so fleet admins can see when and by whom the full-detail extracts were downloaded
Added: aswp_brand_name, aswp_brand_logo_url, aswp_brand_support_url filters so the Enterprise add-on can white-label the UI for agencies reselling the service
Improved: CSV downloads include a UTF-8 BOM so Excel on Windows opens non-ASCII paths correctly
1.1.3 — Security Hardening
Security: Custom Login URL grace cookie is now HMAC-signed (bound to user ID + wp_salt); the old “aswp_admin_grace=active” value can no longer bypass the hidden login URL
Security: Two-Factor Authentication is now actually enforced for roles listed in “Required Roles” — users who have not enrolled are confined to profile.php on login until they set up TOTP or Email OTP
Security: Outbound request log strips query strings and redacts Slack/Discord/Telegram webhook paths before storage — MaxMind license keys, API tokens, signed-URL signatures, and webhook secrets are no longer written to the database
Security: SSRF protection always blocks outbound requests to private/internal IP ranges, regardless of the monitor’s log/enforce mode
Security: SSRF DNS resolution now checks both IPv4 (A) and IPv6 (AAAA) records — previously only A records were inspected, letting a hostname with a public A record but a private AAAA record bypass the check on IPv6-preferring hosts
Security: Concurrent session limiting now keys fingerprint/activity maps by the same verifier hash WordPress uses internally — previously the limiter could never actually destroy old sessions because it mixed raw tokens with verifier hashes
Security: Loopback addresses (127.0.0.1, ::1) are no longer auto-whitelisted when the site is configured behind a reverse proxy or Cloudflare — on proxied hosts every visitor would otherwise appear as trusted
Security: REST API write-block default policy now allows authenticated users with the edit_posts capability (editors, authors) so Gutenberg and the block editor keep working; only unauthenticated writes are refused
Security: Post-Breach “Rotate Secret Keys” now rewrites wp-config.php directly (with a timestamped backup) instead of storing the new keys in wp_options where WordPress never reads them; falls back to a copy-paste snippet if the file is not writable
Security: 2FA recovery codes are now generated and stored lowercased so user-entered codes verify correctly — previously the mixed-case display and lowercased verification hashed different strings, causing valid codes to fail
Added: Trusted proxy IP setting in Settings › Reverse-Proxy / Load-Balancer — required for correct visitor IP detection behind Nginx, HAProxy, AWS ALB, and other reverse proxies
Added: weekly cron schedule registration — required by the weekly Cloudflare / Google / Microsoft / GeoIP refresh jobs which WordPress core does not ship as a default interval
Improved: Cloudflare / Google / Microsoft IP-range refresh cron callbacks now skip the outbound fetch when the matching integration toggle is disabled
Improved: Multi-line settings (currently: trusted proxy IPs) preserve newlines on save instead of being collapsed by sanitize_text_field()
1.1.2
Added: About page with 5-Layer Defense Architecture, competitive features list, attack vector coverage, and plugin information
Improved: Dashboard decluttered — informational panels moved to About page for a cleaner operational view
Improved: About page lists 15 unique competitive features with descriptions
Fixed: Setup wizard no longer auto-redirects on plugin activation or reactivation
Fixed: Setup wizard accessible from sidebar navigation at any time
1.1.1
Improved: Visitor log table uses percentage-based column widths for fluid layout across screen sizes
Improved: Filter bar and results info bar spacing tightened
Improved: Stat cards compacted — smaller icons, tighter padding, reduced font sizes
Improved: Page header, grid column, and IP list padding reduced for denser layout
Fixed: Session timeout now correctly respects “Exempt Administrators” setting for idle timeout and session fingerprint binding (was only checked for concurrent session limits)
Fixed: Session security settings description updated to reflect full admin bypass scope
1.0.9
Improved: Inner sidebar width reduced from 240px to 200px with tighter item padding
Improved: Table headers shortened (IP Address > IP, Country > flag only, etc.)
Improved: Top IPs widget uses compact 24x24px icon buttons instead of full-width buttons
Improved: Dashboard grid right column uses responsive minmax sizing
Improved: Page content padding and table cell padding reduced globally
Fixed: Added CSS column width classes to all table headers (visitor log + dashboard live visitors)
Fixed: Dashboard live visitors table shows flag only (removed redundant country code text)
1.0.7
Added: Inner sidebar navigation (Nexus SEO style) — all plugin pages accessible from a persistent left panel
Added: WordPress sidebar shows single “Atlant Security” entry instead of 23 submenu items
Added: Sidebar brand header with logo, active page highlighting, version footer
Added: Responsive sidebar — collapses to horizontal nav on screens below 1024px
Fixed: Plugin footer now renders inside page layout instead of WP’s admin footer area
Fixed: “Sorry, you are not allowed to access this page” error caused by removing WordPress $submenu entries — now uses CSS-based hiding to preserve permission checks
1.0.6
Improved: All plugin admin pages now send no-cache headers to prevent stale data from caching plugins
Fixed: Top Pages widget CSS class mismatch causing broken styling
Fixed: Top IPs widget now excludes whitelisted IPs from the list
1.0.5
Fixed: decodeEntities function scoping bug in admin.js causing HTML entity rendering issues
1.0.4
Added: GeoIP country resolution — MaxMind GeoLite2-Country integration with pure-PHP MMDB reader, auto-download, weekly auto-update, and dedicated admin page with test lookup
Added: Custom Login URL module — move wp-login.php to a custom slug with automatic redirect of the default login page
Added: Password Policy module — configurable minimum length, character requirements, common password blocking, and passphrase generator
Added: Force SSL Admin as a plugin-managed setting (defines FORCE_SSL_ADMIN constant at runtime)
Added: Auto-Update Plugins and Auto-Update Themes toggles in Settings and Hardening checklist
Improved: Admin sidebar pages reordered alphabetically for easier navigation
Improved: Post-Breach Command Center layout — lockdown status widget moved into Critical Actions grid
Improved: Hardening checklist — Force SSL Admin now toggleable from the checklist (was “Manual fix required”)
