Atlant Security

Changelog

1.1.32 – Author URL Repair: Rebuild, Rollback, and a Fix for Broken Slugs

Fixes a bug in the “Hide Usernames in Author URLs” feature added in 1.1.31, and adds the repair and rollback controls it should have shipped with. Thanks to Francesco for the detailed report.
* Fixed (important): the feature could write an empty or meaningless author slug when a display name used a non-Latin script – Cyrillic, Greek, Chinese, Japanese, Arabic, Hebrew or emoji. WordPress percent-encodes those names when building a slug, then strips the encoded characters again when saving the user, so an empty value reached the database and WordPress handed out “-2”, “-3” to each following account. Latin display names, accented ones included, were never affected.
* Fixed: non-Latin display names are now transliterated to Latin first. Where the server cannot transliterate (the PHP intl extension is missing), the plugin refuses to change the slug and says so on the Hardening page, rather than writing something meaningless.
* Fixed: the feature could not repair its own damage, because it only ever acted on slugs that still matched the username. It now recognises and rebuilds unusable slugs.
* New: every slug change is verified after writing. If WordPress stored something other than what was requested (which happens when another plugin filters user_nicename), the original is put straight back and the reason is recorded in the Audit Log.
* New: “Rebuild author URLs from display names” and “Restore original author URLs” buttons on the Hardening page. The slug each user had beforehand is recorded, so the change is fully reversible.
* New: previous author URLs are redirected to the new ones, so existing links, bookmarks and search results do not break. This stays active even after the feature is switched off.
* New: enabling the setting now warns first that public URLs will change and that it can be undone.

1.1.31 – Author Enumeration: The Block Now Actually Runs

• Fixed (important): “Block Author Enumeration” did nothing on almost every site. WordPress core registers its own canonical-redirect handler on the same hook at the same priority, and because core loads before any plugin it always ran first – sending /?author=1 on to the author archive, spelling out the username, before our block was reached. It only ever worked for authors with no published posts. The block now runs ahead of core, and is renamed “Block Author ID Scans” to match its scope.
• Changed: the ?author=N bounce is a temporary (302) redirect now. A permanent one is cached by browsers and CDNs, so turning the setting off later used to leave visitors stuck on a cached redirect.
• Fixed: on plain permalinks the author archive IS ?author=N, so the block would have removed author archives altogether. It now stands down on those sites.
• New: “Hide Usernames in Author URLs” (Hardening). Author archives stay where they are, but their URL is rebuilt from each user’s display name instead of the login name. The users sitemap, oEmbed and feeds read the same fields, so this closes those routes at the same time. Each author needs a display name that differs from their username; the Hardening page lists any that do not. Off by default.
• Corrected the wording across Hardening, Settings, the Setup Wizard, the vulnerability audit and the About page. The old copy promised username enumeration was “blocked” while only covering the ?author=N probe.

1.1.30 – Hardened Against Fatal Errors From Unexpected Hook Arguments

• Fixed: a fatal error could be triggered inside Atlant when WordPress or another plugin called one of the hooks we listen to with an argument type we did not expect. Two cases were guaranteed: on multisite, network_site_url() passes a null scheme to its filter, which fataled whenever the Custom Login URL was enabled; and any theme or plugin calling site_url( null ) fataled on every page. Reported on WordPress 7.1 / PHP 8.3 as a dashboard crash.
• Every hook callback in the plugin now validates what it receives and passes anything unexpected through untouched instead of crashing.
• Fixed: 1.1.29 was published with the plugin header still reading 1.1.28, so WordPress kept offering that update to sites which already had it.

1.1.29 – Full Audit Release

A top-to-bottom review of every module. All migrations run on their own on the next page load after updating; nothing needs doing.
* Fixed (security): the Post-Breach “Emergency Database Scan” results table rendered matched content without escaping, so a site that had been injected with a malicious script could have that script run in the administrator’s browser the moment they ran the scan.
* Fixed (security): after a plugin update, the first visitor to the site had their IP removed from the block list – the “unblock the activating admin” safety net ran on every internal upgrade, not just a real activation. A blocked attacker could unblock themselves by being first to load the site after an auto-update.
* Fixed: ASWP_SAFE_MODE now really pauses every blocking feature. It previously skipped the WAF, brute-force login lockouts, REST API policies and honeypot bans, so an admin who followed the documented recovery stayed locked out. A shared office IP in a 24-hour lockout no longer locks the administrator out either.
* Fixed (2FA): “Disable 2FA” silently did nothing; an administrator can now reset another user’s 2FA; email-code delivery failures are surfaced instead of silently waiting; TOTP secrets are encrypted at rest.
* Fixed: dead buttons across the admin – REST API Add and Edit Policy, Outbound Monitor “Save Allowlist”, Malware Scanner scan settings, the whitelist remove button and “+ Block IP” – and saving the CAPTCHA panel no longer wipes the stored secret key. Re-running the Setup Wizard no longer resets customised settings.
* Fixed: false positives that blocked legitimate traffic – WooCommerce checkout rate limiting, editors saving posts that contain code samples, routine browser updates logging users out, CAPTCHA breaking every login form that is not wp-login.php, and the outbound monitor killing WP-Cron on hosts that resolve the site internally.
* New: scheduled background malware scans. Quarantine now warns before touching WordPress core, the active theme or an active plugin, and has a one-click Restore.
* Fixed: multisite network activation, deactivation and uninstall now cover every subsite.
* Performance: removed a legacy check that ran 7 database queries on every request, autoloaded around 80 small settings, batched log-retention deletes, and cached dashboard statistics.

1.1.28 – GeoIP “Download Database” Button No Longer Stuck Disabled

• Fixed: the “Download Database” button stayed greyed out even after entering a MaxMind license key, because it only came alive after clicking a separate “Save GeoIP Settings” button that the on-screen instructions never mentioned. It now activates the instant a key is typed or pasted, and clicking it saves the key and downloads the database in one step.

1.1.27 – Daily Digest Turns Itself Off on Upgrade

• Fixed: sites receiving the unwanted morning “daily digest” email now stop automatically on update – no wp-config edit, no visiting each subsite. The digest cron is only scheduled while the digest is enabled, so a disabled digest can never fire. Re-enable it in Notifications with one toggle if you want it.

1.1.26 – Notifications Are Now Opt-In

• Changed (default): all notification channels are OFF until you enable them, including the Daily Digest and email alerts, which previously defaulted to ON and mailed the site admin every morning. New installs only; sites that already had them enabled keep their setting.
• New (multisite): define( ‘ASWP_DISABLE_NOTIFICATIONS’, true ); in wp-config.php, or the aswp_disable_notifications network option, mutes email, Slack and webhook notifications network-wide. Safe Mode now also mutes notifications.

1.1.25 – REST API Policy Fixes + Friendlier Session Defaults

• Fixed: the REST API Policies editor was unreliable – new rules did not stick, deleting one reset the whole list back to the defaults, and saving could quietly blank out the built-in rules. The editor now works from the real rule data end to end; adding or deleting a rule saves immediately, and every field is preserved.
• Improved: you can type a plain route path (e.g. /sibs/v1/callback) instead of a regular expression, which makes it straightforward to allow a payment-gateway or other third-party webhook that the default rules were blocking.
• Changed (defaults, new installs only): session idle timeout now defaults to 0 (off) and “Exempt Administrators” to ON, so a fresh install no longer logs admins out of wp-admin on a timer.

1.1.24 – Session IP Binding Off By Default

• Changed (default, new installs only): “Bind to IP Address” under Session Security is now OFF. It invalidates the session whenever the visitor’s IP changes – which happens constantly on mobile networks, CGNAT, VPNs and rotating IPv6 addresses – so admins were being logged out every few minutes. User-Agent binding stays on and protects against most cookie theft. If you are already affected, turn it off in Session Security.

1.1.23 – Fixed: Brute Force Settings Would Not Save

• Fixed: on the Login Security page, changing “Max attempts before lockout” or the lockout durations and saving did nothing. The page has two save buttons that shared the same HTML id, so only the first one had a click handler. Save buttons are now wired by class, so every save button on every settings page works. Existing values are unaffected.

1.1.22 – Hide WP Version No Longer Breaks Asset Caching

• Fixed: “Hide WP Version” stripped the version query string from every enqueued script and style site-wide, including wp-admin. That breaks browser cache-busting, so a browser could serve a stale copy of a core file indefinitely, and admin screens built with @wordpress/data (such as My Jetpack) rendered blank. The version is now masked with a stable token instead of stripped: wp-admin assets are never touched, cache-busting keeps working, and the literal version stays hidden.

1.1.21 – Accurate WAF Description

• Fixed (accuracy): corrected the WAF description in the readme, the About page and the WAF settings page. Earlier copy described a “Pre-WordPress WAF” filtering requests before WordPress loads; no such mechanism ships in the plugin. The WAF inspects every request at init priority 0 – early in the request, but after WordPress core and plugin files have loaded. No functional change.

1.1.20 – Emergency Lockdown Now Works With Page Caches

• Fixed: Emergency Site Lockdown appeared to do nothing on sites running a page cache or CDN, because cached HTML is served without running PHP. Activating lockdown now flushes the object cache and every supported page-cache plugin (WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed, SiteGround and more) and sets the standard no-cache constants; lifting it flushes again.
• Note: HTML behind an external CDN edge cache (for example a Cloudflare “Cache Everything” rule) must be purged there too.

1.1.19 – Two-Factor Enrollment & Recovery Fixes

• Fixed (lockout): turning on “require 2FA” for a role locked out every user in that role who had not yet set it up – they were sent to a code-entry screen they could never pass. Enrollment-pending users now keep a session confined to their profile page so they can complete setup; the REST API and XML-RPC stay blocked for them until they do.
• Fixed: a code entered immediately after finishing 2FA setup could be rejected as a replay for up to 30 seconds.
• Fixed: after the Post-Breach “Deactivate All Non-Essential Plugins” action, a dismissable notice now links to one-click restore.

1.1.18 – Login & Incident-Response Hardening

• Fixed (security): two-factor authentication could be bypassed during an active “Force Password Reset for All Users” window, because the force-reset redirect ran before 2FA enforcement and exited without destroying the session.
• Fixed: “Force Password Reset” could get permanently stuck with no off-switch – the flag only cleared when the very last flagged account reset its password, so one abandoned account pinned every admin to the profile page. Added an always-visible “Cancel Forced Reset” button, and the flag now clears on (re)activation.
• Fixed: brute-force lockout escalated permanently, because the per-IP failed-attempt counter was never reset on a successful login and never aged out – common on office or shared NAT addresses. It now resets on success and decays after 24 hours.
• Fixed: the firewall could block legitimate logins whose password happened to contain attack-like characters. Password fields are no longer pattern-inspected.

1.1.17 – Lockdown Off-Switch Fix

• Fixed: when Emergency Site Lockdown was active the “Lift Lockdown” button could disappear, leaving no way to turn lockdown off from inside the plugin. An always-visible “Lift Lockdown Now” button now sits in the lockdown status bar, and activating the plugin always lifts a stuck lockdown.

1.1.16 – Custom Login URL Fix

• Fixed (critical): with a Custom Login URL enabled, valid credentials bounced back to the login form and never reached the dashboard. The custom slug redirected the login POST to wp-login.php, and a 302 redirect turns a POST into a GET, silently discarding the username and password. The slug now serves wp-login.php in place, preserving the POST body, nonces and the login test cookie. All standard login hooks still fire, so 2FA and other login add-ons work on the custom URL.
• Fixed: /wp-admin was still reachable on subdirectory installs, because the guard only matched paths starting with “wp-admin”.
• Fixed: clearing the slug field appeared to do nothing. To remove the custom login URL entirely, turn the feature OFF, which clears the stored slug.

1.1.15 – Reinstall WordPress Core Fix

• Fixed: Post-Breach > “Reinstall WordPress Core” did nothing and always reported “already installed”, because Core_Upgrader was called with a version string instead of the update object it requires. It now forces a fresh update check against WordPress.org, installs a newer version if there is one, and otherwise performs a true re-install of the current version. wp-content/ is never touched.

1.1.14 – Login 429 Fix

• Fixed: legitimate users could get HTTP 429 “Too Many Requests” on /wp-login.php even without submitting wrong credentials. The login rate limiter counted every hit to the page (GETs, the lostpassword and resetpass flows, the logout link) toward a 10-per-5-min budget. It now counts only credential POST submissions, and skips already-authenticated users. Brute-force defense (the real one – 5 failed attempts locks out) is unchanged.

1.1.13 – Timezone Fix

• Fixed: admin times displayed several hours off on non-UTC sites – the display layer double-converted stored timestamps. New FortressWP\Time helper; the admin JavaScript now shows times in the site timezone, not the visitor’s browser.
• Fixed: GeoIP “last updated”, the brute-force lockout countdown, and the 08:00 daily digest schedule now all use the correct timezone.

1.1.12 – Quarantine Review Ritual

• New: quarantine now opens a review modal – file details, a forensic download button, VirusTotal / Hybrid-Analysis links, and three required acknowledgment checkboxes (also enforced server-side).
• Improved: CSV export includes confidence and matched-signature columns.

1.1.11 – Conservative Quarantine

• New: per-signature fidelity ratings and per-finding confidence; quarantine is gated to HIGH confidence and single ambiguous hits are review-only.
• New: regex matches inside string literals or comments are treated as data, not malware – eliminates self-match false positives.

1.1.10 – Critical: Self-Quarantine Lockout Fix

• Fixed (critical): the scanner could quarantine its own files and take the whole site offline; it now hard-excludes known security plugin directories.
• Fixed (critical): the plugin bootstrap survives a missing module file instead of fataling the site.

1.1.8 – Default-Allow Policy for Vendor Bots

• Fixed: AI crawler defaults flipped to “allow” – legitimate vendor bots (Google, OpenAI, Anthropic, Bing) are never blocked unless the operator opts in.
• Fixed: the Honeypot reverse-DNS check now fails open, so a transient DNS error can’t ban a real Googlebot.

1.1.7 – Critical Audit Hardening

Fixes for 14 critical and 12 high-severity issues found during a full external audit. Recommended upgrade for everyone.
* Fixed (critical): fatal-at-login bug in concurrent-session enforcement; IPv4-mapped-IPv6 IP-block bypass; outbound SSRF DNS-rebinding race; CIDR trusted-proxy parsing; over-broad Cloudflare auto-whitelist; web-accessible quarantine directory and wp-config key backups; a WAF-rule ReDoS; plaintext Custom Login URL recovery token; unvalidated plugin-restore input.
* Fixed (high): 2FA enrollment-session bypass and cross-user nonce reuse; 2FA disable without re-authentication; racy IP blocking; Googlebot user-agent-spoof honeypot exemption; notification webhook SSRF; scan symlink escape; WAF encoded-escape and capability bypasses; and more.

1.1.6 – Scanner Accuracy

• Fixed: malware scanner false-positive flood on fresh installs – WordPress core checksum verification, a known-safe path allowlist, and tightened signatures.
• New: “Mark as False Positive” and Undo on file findings, recorded to the audit log.

1.1.5

• New: CAPTCHA on the login, registration, and lost-password forms – reCAPTCHA v2, reCAPTCHA v3, and Cloudflare Turnstile, with per-form toggles and a theme picker.

1.1.4

• New: CSV export of full, untruncated scan findings; white-label filters for the Enterprise add-on. Tested up to WordPress 7.0.

1.1.3 – Security Hardening

• Security: HMAC-signed Custom Login URL grace cookie; enforced 2FA for required roles; webhook-secret redaction in the outbound log; always-on SSRF blocking of private ranges; IPv6 DNS checks.
• New: trusted proxy IP setting and a weekly cron schedule.

1.1.2

• New: About page with defense architecture and feature overview.
• Fixed: setup wizard no longer auto-redirects on activation.

1.1.1

• Improved: visitor log layout and filter bar spacing.

1.1.0

• Improved: denser, more compact admin layout.
• Fixed: session timeout now respects the “Exempt Administrators” setting.

1.0.9

• Improved: compact sidebar, shorter table headers, and denser global spacing.

1.0.8

• Fixed: visitor log and dashboard table column widths.

1.0.7

• New: inner sidebar navigation – all plugin pages in one persistent panel with a single WordPress menu entry.

1.0.6

• Improved: no-cache headers on admin pages; Top IPs / Top Pages widget fixes.

1.0.5

• Fixed: HTML entity rendering bug in the admin JavaScript.

1.0.4

• New: GeoIP country resolution, Custom Login URL, Password Policy, Force SSL Admin, and auto-update toggles.
• Internal: codebase prefix migration to aswp_ with automatic database migration on upgrade.

1.0.3

• New: Honeypot, Security Headers, Two-Factor Authentication, and Notifications modules.

1.0.2

• New: AI Crawlers, REST API Policies, Session Security, Outbound Monitor, and Cron Guard modules.

1.0.1

• New: Setup Wizard and IP Detail Modal.

1.0.0

• Initial release: 17 security modules – WAF, brute-force protection, malware scanner, post-breach recovery, IP blocking, visitor log, audit log, hardening, rate limiter, and real-time dashboard.