Fix: Blocked Requests page was always empty — now reads directly from the xZeroProtect library’s log file, so both blocked and suspicious (Learning Mode) requests are shown.
Fix: Static assets (favicon.ico, CSS, JS, fonts, images) were inflating the rate-limit counter, causing premature bans. A single page view now counts as one request.
New: Hint added above the rate-limit fields in Settings explaining what counts as a request.
1.1.3
Renamed plugin slug from xzeroprotect-wp to xzeroprotect (resolves trademarked-term warning for the “wp” suffix)
Fixed Text Domain to match the new slug (“xzeroprotect”) across all strings
Renamed main plugin file to xzeroprotect.php
Removed the unused “Domain Path” header (no languages folder bundled)
Moved firewall storage directory from uploads/xzeroprotect-wp to uploads/xzeroprotect
Sanitized $_POST[‘days’] in AJAX handlers before casting
Added phpcs ignore annotations for safe, already-prepared direct DB queries
Renamed internal constants from XZPWP_* to XZP_*
1.1.2
Updated bundled Chart.js to v4.5.1
Moved firewall storage to the WordPress uploads directory (wp_upload_dir())
Replaced inline dashboard with wp_add_inline_script
Removed unnecessary load_plugin_textdomain() call (handled by WordPress.org since 4.6)
Removed directory asset files from the plugin package
1.1.1
Added real visitor tracking with device and browser detection
