ddosNull Shield — DDoS & Bot Protection

1.1.30

• Fix fatal error “Cannot redeclare function ddosnull_shield_next_9am()” when activating ddosNull Shield Pro while the free plugin is still active.

1.1.29

• Warn in the plugin dashboard when WP-Cron is disabled (DISABLE_WP_CRON), since the plugin relies on it to send load stats and scan results to the backend server.

1.1.27

• Increase timeout for the periodic load-stats backend request from 10 to 60 seconds to reduce false “backend unreachable” failures on slower connections.

1.1.26

• Block IPs reported in the fake_ua_ips list with a 403, even when their request presents a whitelisted user-agent string (this list is for IPs caught by the backend spoofing a whitelisted UA to evade blocking).

1.1.25

• Fix challenge redirect dropping query-string parameters when the destination URL contains unencoded ampersands (e.g. filter parameters). The full URL is now preserved through the challenge form using a hidden field populated from the raw query string.

1.1.24

• Remove WordPress.org directory assets (banners, icons, screenshots) from plugin zip; these are uploaded separately via SVN.
• Remove branding footer from 403 block page to comply with WordPress.org guidelines.
• Fix Early Loading (MU Plugin) state detection in Pro plugin reading wrong MU file name.

1.1.23

• WordPress.org submission: add icon, banner, and screenshot assets.
• Add == Pricing == section and money-back guarantee info to readme.
• Internationalize all user-facing strings in challenge and block pages with load_plugin_textdomain and generate .pot file.
• Add source reference comment to admin.js.
• Redirect to plugin dashboard on first activation.
• Expand External Services section: document data transmitted to each service and add Terms of Use / Privacy Policy links for all three external endpoints (ddosNull, Google reCAPTCHA, ipify).
• Split plugin into free (Layer-7 DDoS/bot protection) and Pro (adds WooCommerce checkout protection) tiers to comply with WordPress.org remote-feature-gating guidelines.

1.1.22

• Fix early loading toggle always showing as off: detect MU plugin state from file existence rather than the stored setting, which could be missing if the file was installed via a different code path.

1.1.21

• Add protected_urls support: URL patterns (nginx-style regex or plain prefix) that force visitors through the verification challenge unless their IP or user-agent is whitelisted.

1.1.20

• Fix fatal error on sites using early loading: new option-key constants were not defined in the MU plugin loader before intercept.php ran.
• Rebuild admin JS.

1.1.19

• Store ip_list, block_with_403, and whitelisted_ips in separate wp_options entries with a 24-hour object-cache layer; cache is invalidated on each update.
• Store ip_list as a PHP array instead of a newline-delimited string, removing per-request parsing overhead.
• Clear the dynamic block list and disable DDoS mode when the ddosNull backend is unreachable, preventing the ALTCHA challenge from looping indefinitely.

1.1.18

• Improved checkout fraud detection.

1.1.17

• WordPress coding standards: replace parse_url with wp_parse_url, fopen/fclose with WP_Filesystem, unlink with wp_delete_file, rmdir with WP_Filesystem.
• Sanitize and unslash all superglobal reads ($_SERVER, $_COOKIE, $_POST).
• Add nonce verification to altcha and reCAPTCHA challenge form submissions.
• Prefix global variables in uninstall.php and remove unprefixed helper variable in main plugin file.
• Update tested-up-to to WordPress 7.0; align plugin name across header and readme.

1.1.16

• Serve 403 block page from a bundled local template with no external CDN dependencies.
• Fix cron schedule recovery for existing installs affected by the identifier rename in 1.1.15.

1.1.15

• Vendor ALTCHA JS locally, removing cdn.jsdelivr.net dependency.
• Use local plugin icon in admin menu and challenge page instead of remote URL.
• Add GPL-2.0+ license header to plugin file.
• Prefix all identifiers (cookie, transient, cron schedule) to avoid conflicts with other plugins.
• Use WP Filesystem API for must-use plugin file installation.
• Add uninstall.php to clean up settings, transients, and log files on deletion.
• Add opt-in early loading via must-use plugin dropper (toggle in Settings).
• Add readme.txt for WordPress.org submission.

1.1.14

• Add hard block (403) support for blacklisted user agents.

1.1.13

• Revert block_with_403 ordering change from 1.1.12.

1.1.12

• Fix: hard-blocked IPs could bypass the block via whitelisted URLs.

1.1.11

• Checkout protection now gated on a server-signed flag to prevent client-side tampering.

1.1.10

• Add regex support for whitelisted URLs (prefix with ~ for case-sensitive, ~* for case-insensitive).

1.1.9

• Challenge and block pages now set no-cache headers to prevent caching plugins from storing them.

1.1.8

• Add optional early loading via must-use plugin (opt-in from settings).

1.1.7

• Admin: protection suspended banner with link to dashboard; stats hidden when account limit is reached.

1.1.6

• Full IPv4 and IPv6 CIDR range support for blocked and whitelisted IP lists.

1.1.4

• Add CIDR range support for IP lists.

1.1.3

• Log challenge page hits with HTTP 429 status for accurate scan analysis.

1.1.2

• Fix IP detection to read X-Real-IP header for nginx reverse proxy setups.

1.1.0

• Enable Shield protection by default on fresh installs.