Fixed: brute-force counter updates now use portable SQL (CASE WHEN) so SQLite-backed WordPress installs (Playground, Studio) count attempts correctly.
Fixed: PHP warnings from wp-login.php globals when rendering the hidden login page.
Fixed: blank page after 2FA verification when no redirect destination was set; now lands on the dashboard.
1.2.0
Added: site activity logging in the Activity Log – content publishes, edits and deletions, media uploads, plugin and theme changes, user management, and core, plugin and theme updates. On by default with 30-day retention, so no separate audit-log plugin is needed.
Added: TOTP replay protection – each two-factor code is accepted once.
Security: 2FA secrets are now encrypted at rest, and secrets are no longer stored for users who never complete enrolment.
Security: a successful login now only clears the lockout counter for the account that was failing; logins to other accounts just decrement it.
Added: the emergency bypass code can be entered in a login-form field instead of the URL query string.
Fixed: blocked-request handling now runs later in the load order, so theme 404 templates and login-form plugins registered on init work correctly.
Fixed: failed-attempt counting is atomic and stale rows are cleaned up daily.
Fixed: REST API detection anchors to the REST prefix instead of matching any URL containing wp-json.
Fixed: “new IP” alerts no longer re-fire after log retention prunes old entries.
Fixed: scan alert emails name the actual blocked endpoint.
1.1.1
Fixed: saving a user profile failed with “The link you followed has expired”. The 2FA enrollment box rendered its nonce with the default field name, which overwrote the core user-edit nonce.
Fixed: the same nonce collision from the “Clear all lockouts” button broke saving the Security tab while a lockout was active.
Fixed: fatal TypeError when saving a settings tab with every checkbox unchecked, for example when disabling two-factor authentication.
Fixed: saving one settings tab no longer resets the other tabs to their defaults, and unchecking a checkbox whose default is on now persists.
1.1.0
Added: two-factor enforcement for the REST API and XML-RPC.
Added: opt-in API hiding to reduce the attack surface.
Added: “Clear lockouts” control in the admin UI.
Fixed: authentication filters now run at priority 95 and 96 so a WP_Error survives the full filter chain.
Fixed: login URL interception now hooks on setup_theme instead of plugins_loaded for more reliable behaviour.
