SecuPress Pro

Versión 2.7.2

• Nuevo Critical: Warn admins so they can check the backdoor and patch it.
• Nuevo Passwordless login now uses a 6-digit code instead of a magic link.
• Nuevo Disable Application Passwords: refuse and log any Application Password authentication attempt.
• Nuevo Move Login scanner checks whether the default login page is still reachable.
• Nuevo Dashboard attacks widget lists attack types, trends and blocked IPs.
• Nuevo Reading a WordPress option known as malware is logged as an "option" attack.
• Nuevo Disallowed usernames are also refused as display names.
• Mejorado A magic-code request for an unknown identifier shows the same form as a real account.
• Mejorado Bad login attempts now count unknown identifiers the same way as real accounts.
• Mejorado Enhance login error handling and disclosures in Login Errors Disclose feature.
• Mejorado Learning Mode can review common page slugs (demo, beta, etc.) instead of treating them as critical.
• Mejorado Backup folder can be set with the SECUPRESS_BACKUPS_PATH constant or the secupress.backups.path filter.
• Mejorado Activating Bad URL Access now also enables Bad File Extensions (and the reverse on deactivation).
• Mejorado Pro update checks also run outside wp-admin, so new versions are visible everywhere.
• Mejorado Security Status shows the firewall state, blocked attacks and daily trends.
• Mejorado Application Password usage can trigger a critical alert.
• Mejorado Anti-spam obfuscates email addresses in front-end content.
• Mejorado Remove the ssl_verify false from EDD class.
• Mejorado Better detection of fake WP filename and fake WP option name.
• Mejorado Allowed IPs from different providers (meta, google, rocket)
• Eliminado Ban Non-Existent Users Feature. Unknown identifiers are no longer blocked on the first try. Use Limit Login Attempts now.
• Corregido Escape sessions values late in Sessions Control feature, even if sanitized by WP first
• Corregido A double notice when you have 3 (??) security plugins active was visible
• Corregido Invisible login form when redirected from a Move Login page
• Corregido Better feedback message to differenciate whenever out server it out or your licence key is incorrect
• Corregido PHP Fatal error from JetFpack setting set_current_screen() during a REST Call
• Corregido Better JS selector for "Show all plugins" feature to prevent some other plugins popups to show too early.
• Corregido Security rules are no longer written when a previous SecuPress marker block has no closing marker, which could leave .htaccess or wp-config incomplete.
• Corregido Async scans are not queued twice, and their delay is applied correctly.
• Corregido Stop User Enumeration feature was blocking Editors to create or edit posts and pages.
• Corregido Fatal error in the dashboard attacks widget (wrong count passed to _nx, seen with Divi).
• Corregido File monitoring no longer reports the whole WordPress core as missing when the filetree is incomplete.

Versiones anteriores

• 2.7.1 (24 septiembre 2026): 1 nuevo, 6 mejorado, 7 corregido, 1 seguridad