ZeroBot Security – Login Protection, Firewall & Bot Blocker

Istoric modificări

1.1.1

• Security: a ZeroBot account can only be created from the plugin with the email of an
  administrator of the site. ZeroBot also confirms this with the site during signup.

1.1.0

• New: free protection without an account. The Login Brute-Force Guard and the XML-RPC kill
  switch now run as soon as the plugin is active. Previously every protection waited for a
  license key, so new installs protected nothing.
• New: create a ZeroBot trial account from inside wp-admin. Enter an email, confirm it, and
  the plugin activates itself. Pasting an existing license key still works.
• New: free dashboard with 7-day counts of failed logins, lockouts and blocked XML-RPC requests.
• New: when a plan or trial ends, network protection pauses with a clear notice and the free
  layer keeps running. A daily check re-enables it automatically after renewal.
• Security: visitor IP detection no longer trusts proxy headers sent by the visitor.
  CF-Connecting-IP is only accepted from Cloudflare edges, and X-Real-IP / X-Forwarded-For
  only from local reverse proxies or when „Trust proxy headers” is enabled. Forged headers
  could previously bypass the login lockout or lock out someone else’s IP. The old default
  of trusting all proxy headers is switched off on update.
• Fix: a temporary API outage during the daily license check no longer switches network
  protection off until the next day.
• Fix: the XML-RPC kill switch stands down while Jetpack is active.
• Fix: a visitor flagged as a bot was kept blocked for 24 hours, even after being whitelisted.
  Bot verdicts are now cached for 15 minutes, and whitelisting an IP from the plugin applies
  immediately.
• Change: the Site-Wide Firewall is on by default and switches on whenever a site is connected.
• Change: without a valid license, the network layers (firewall, browser fingerprint, comment
  and REST API guards, shared blacklist) are shown off and cannot be switched on.
• Fix: the firewall now gives up after 3 seconds with no retries if the API is slow (it could
  previously hold a page for up to 24 seconds before failing open).
• Fix: when the trial checks are used up or the plan ends, the firewall pauses its API calls for
  an hour instead of calling on every page view, and the dashboard explains why.
• Fix: the master protection switch is on for new installs. On update it is turned on only
  for sites that never saved the settings page.
• Tested with WordPress 7.1.

1.0.17

• New: searchable multi-country picker on the Protection Settings page.
  Replaces the plain-text „Allowed Countries” input with a chip-based UI
  that lists all 249 ISO countries with flag emoji, alphabetical search,
  and a clear „Allow all / Only specific” mode toggle.
• Fix: visitors blocked by country policy now correctly show a yellow
  „Denied” badge on the Dashboard’s Recent Activity widget. They were
  previously stacked into the red „Bot” bucket even though the block
  reason was „Country Denied (XX)”.
• Fix: country flags now render in both the Dashboard widget and the
  Threat Logs table. The flag helper expects a 2-letter ISO code, but the
  API ships the country as a name – so flags silently failed for every
  row. A new Helpers::countryNameToCode() lookup resolves names to
  codes, and the flag image renders before the country name on every
  log row.
• Change: removed the Score column from the Dashboard Recent Activity
  widget and the Threat Logs table. The Reason already explains why a
  request was flagged, and the numeric score added visual noise without
  decision-relevant information.
• Security: tightened the firewall verdict cache to bot-only. Clean
  verdicts are no longer cached, so an IP that turns malicious mid-cache
  doesn’t keep passing through for up to 24 hours. Bot verdicts continue
  to be cached for instant re-blocking.
• Compliance: $_SERVER['REQUEST_URI'] in XmlRpcGuard::register() is
  now run through wp_unslash() and sanitize_text_field() before the
  regex match, clearing the two PHPCS warnings about that variable.

1.0.16

• Fix: critical error on every wp-admin page caused by a missing
  License::isDomainAuthorized() method that the admin_notices hook called.
  The method now exists on the License class, fails open when no
  authorization state has been recorded yet, and gets set true/false by
  activate() based on whether the auto domain-registration call to the
  ZeroBot platform succeeded (HTTP 200) or reported the domain as already
  registered (HTTP 409).

1.0.15

• WordPress.org review compliance: removed the broken flagpedia.net/privacy
  URL from the External Services section of readme.txt.
• The chart-data bootstrap on the admin dashboard now ships via
  wp_add_inline_script() attached to the existing zerobot-security-admin
  handle, instead of an inline <script> tag. No behavioural change — the
  same JS payload is delivered through the official WordPress enqueue API.

1.0.14

• WordPress.org review compliance: replaced the short „zb_” prefix everywhere
  it appeared in PHP and JS (AJAX action names, option keys, transient keys,
  nonce names, cron hooks, JS globals, custom DB table names, WP_Error codes,
  and the admin script handle) with the full „zerobot_security_” prefix so
  every plugin-defined identifier is at least the WP.org-required 4 characters
  and is uniquely namespaced.
• No functional or UI changes — the rename is purely cosmetic (CSS class
  names beginning with „zb-” are stylesheet-internal and were left
  unchanged, since they don’t conflict with WordPress core or other plugins).

1.0.12

• Second Plugin Check compliance pass: final 3 errors resolved (wrap
  countryFlagImg() output in wp_kses(); add translators comment for
  „Cleared %d cached decisions”; etc.). Input-sanitization warnings
  addressed across Helpers, Firewall, ProtectionSettings, LicensePage.
• Fingerprint script now passes the plugin version to wp_enqueue_script()
  for reliable cache-busting.
• Uninstall variables renamed to zerobot_security_* prefix.

1.0.11

• Full Plugin Check compliance pass: wrap every Helpers::icon() SVG output
  through wp_kses() with a tight SVG tag allowlist; add wp_unslash() +
  sanitize calls on every $SERVER / $_POST / $_GET read; gate error_log()
  behind WP_DEBUG; replace date() with gmdate(); rename plugin constants to
  ZEROBOT_SECURITY* prefix; drop load_plugin_textdomain (WP 4.6+ auto-loads
  translations); add translators comments for all placeholders; LoginGuard
  queries use esc_sql() for the table identifier; uninstall uses prefixed
  variables and prepared statements.
• Fingerprint script now enqueued via wp_enqueue_script() with a
  script_loader_tag filter for the data attributes, replacing the raw
  echo ”. Respects standard WordPress script filters.
• DecisionCache::flush() no longer issues a raw LIKE query — iterates the
  matching transient option names and calls delete_transient() for each,
  so the object cache and transient DB stay in sync.
• Threat Logs are now always scoped to the current WordPress site’s host (the
  „Domain” filter is removed — it’s redundant and could leak cross-domain data).
• Firewall self-heals domain-deauthorization in real time: the plugin flags the
  site immediately on the first failed API call instead of waiting for the
  daily verify cron, so the warning banner shows up right after the admin
  removes the domain from authorized_domains.
• Admin warning banner is now shown on every wp-admin page, not only the
  plugin’s own screens.
• Country flags in the Dashboard and Threat Logs render as reliable PNG
  images (via flagcdn.com) instead of Unicode emoji, which some platforms
  don’t render.

1.0.9

• Per-IP decision cache extended to 24 hours to reduce API load
• Allowed-countries enforcement moved server-side so denied requests are logged correctly
• Login verification (device 2FA) toggle added per user

1.0.8

• Browser Fingerprint layer now also injects on wp-login.php and via wp_footer fallback
• Fingerprint collector no longer skipped for logged-in users (configurable)

1.0.7

• „Country Denied” badge styled distinctly from generic bot block
• Threat Logs show the visitor path alongside IP / ISP / country

1.0.6

• /v3/openapi now receives allowed_countries from the plugin so geo-blocks are enforced
  server-side and logged with the correct reason

1.0.5

• Decision caching logic refactored so every request logs correctly
• Fingerprint injection improvements

1.0.3 – 1.0.4

• „Clear Threats for this Domain” action in Threat Logs
• „Path” column in Threat Logs showing the URL the visitor accessed

1.0.0

• Initial release
• Full Dashboard, License, Rules, Whitelist, Blacklist, Protection Settings, Threat Logs
• Six protection layers: Page, Firewall, Login, Comment, REST API, XML-RPC
• Decision caching with object cache + transient fallback
• CSV export for threat logs
• WP-admin dashboard widget
• Cloudflare / proxy IP detection