Changelog
Track all the latest updates, fixes, and improvements in Nexura Security.
Version 1.0.20
- Security / Critical Fix: Implemented Anti-Email-Storm Protection and Smart Rate Limiting in Alert System to prevent servers from exhausting hourly email quotas and getting blocked by hosting providers during attacks.
- Feature: Added configurable Hourly Email Rate Limit (default 5 emails/hour) with automated transient digest queue buffering.
- Enhancement: Added Brute-Force Alert Smart Policy with 15-minute cooldown, filtering out botnet scans while preserving instant alerts for attacks targeting actual administrator accounts.
- Fix: Fixed Visitor Tracker anomaly speed detection to apply 1-hour cooldown and strict severity gating, preventing rapid email loops.
- Fix: Added 24-hour source deduplication to Real-Time Scanner option hooks to prevent recurring alert emails on dynamic option updates.
- Fix: Prevented duplicate alert emails on scan completion by dispatching webhooks instead of double emailing.
- Fix: Protected Auto-Heal Drop-in crash notifications and Scheduled Scan reports with hard cooldown limits to eliminate email loops.
Version 1.0.19
- Fix: Fixed a UI glitch in the loading button icon by switching from Dashicons to the plugin's native spinner.
- Fix: Resolved a false-positive issue in the Plugin Conflict Cleaner where WooCommerce's Jetpack dependencies caused continuous false alerts.
- Fix: Fixed a bug in the File Snapshots viewer where the PRO verification logic incorrectly hid snapshots for users with an active lifetime license.
- Enhancement: Added a "Clean All Logs" button to the IP Intelligence page, complete with a custom modal.
- Security: Added 2026 modern JS malware signatures to detect obfuscated arrays (Balada Injector, Sign1) and dynamic script injections.
- Security: Expanded PHP backdoor signatures to block modern WP action hook droppers and known webshells.
- Fix: Resolved a critical bug where malware scans would crash at 96% with a 500 error if the server's mail function was disabled.
Version 1.0.18
- Security: Hardened WAF bootstrap whitelisting to use content signatures, preventing evasion techniques.
- Security: Upgraded CAPTCHA and Core Restorer cryptographic checks from MD5 to SHA-256 to prevent collision attacks.
- Security: Implemented SameSite=Strict and timing-safe hash comparisons for "Remember Device" 2FA cookies.
- Enhancement: Upgraded WAF engine with XML-RPC context detection and deep HTML entity decoding to block encoded XSS/RCE payloads.
- Enhancement: Overhauled internationalization (i18n) support across 2FA interfaces, JavaScript strings, and UI banners.
- Fix: Resolved fatal error and infinite redirect loops affecting some third-party themes during Two-Factor Authentication.
- Fix: Replaced deprecated WP_Http_Curl usages and improved object cache compatibility with Redis/Memcached.
Version 1.0.17
- New Feature: Redesigned Security Reports layout featuring an Executive Summary, visual metric blocks, and actionable remediation advice.
- New Feature: Introduced Malware Scanner File Whitelisting to safely exclude known benign files from subsequent scans.
- Enhancement: Activated Premium features by default for a streamlined deployment experience.
- Fix: Resolved a path validation error that prevented secure downloading of
.sql.gzdatabase backups. - Fix: Addressed a restriction issue preventing
wp-config.phpfrom loading in the Malware Scanner Editor during remediation. - Fix: Optimized malware cleanup routines to strip residual, empty
<script>tags after payload removal. - Fix: Refined PHP payload extraction to prevent syntax errors caused by consecutive PHP opening tags.
Version 1.0.16
- Fix: Resolved HTTP 500 error on CGI/FastCGI hosting environments (Bluehost, HostGator, SiteGround) caused by WAF auto_prepend_file in .htaccess. The directive now only applies on Apache mod_php servers.
- Fix: Fixed broken Global Threat Intelligence toggle in Settings page — the switch was non-functional due to a missing checkbox input.
- New Feature: Smart Auto-Recovery — if any security rule written to .htaccess causes a server error, the plugin automatically detects it and rolls back to the previous safe state.
- Security: Applied Apache SAPI detection safeguard to Pro Server Lock feature to prevent 500 errors on strict hosting environments.
- Enhancement: Updated comment spam URL blocklist with 8 new spambot domains (shorturl.fm, t.ly, goo.su, qrco.de and more).
Version 1.0.15
- Enhancement: Redesigned WAF loading with a fail-safe
nexura-waf-bootstrap.phpproxy file, eliminating fatal errors when plugin folder is renamed or the Pro version coexists with the free version. - Fix: Resolved fatal error (
Failed opening required 'nexura-security-pro/nexura-waf.php') affecting sites where plugin was installed under thenexura-securityfolder name. - Fix: Fixed WAF Analytics dashboard (Pro) failing to load charts due to undefined PHP variables in the REST API endpoint.
- Fix: Fixed Database Optimizer page (Pro) stuck on "Loading..." on certain hosting environments due to null-check issue in the table stats query.
- Enhancement: Plugin now automatically detects and deactivates the old standalone Nexura Security Pro plugin on activation to prevent conflicts.
Version 1.0.14
- New Feature: Enterprise WooCommerce Security Module with granular protection against checkout abuse and fake registrations.
- New Feature: Advanced Database Malware Scanner inside wp_options, postmeta, usermeta, and Custom Tables.
- New Feature: Ultra-Fast Local Geo-Blocking using native MaxMind GeoLite2 integration.
- Security: Centralized Permission Engine using Nexura_Security::can_manage_security() for bulletproof access controls.
- Security: Hardened Filesystem Operations utilizing a 3-layer security model for advanced capabilities like chattr.
- Fix: Critical 500 Internal Server Errors on Live Servers by strictly verifying php_module support.
- Fix: Server Lock and .htaccess locking issue ensuring rules can be safely toggled OFF.
Version 1.0.13
- Improvement: Completely separated Free and Pro WordPress.org builds per Freemius distribution guidelines.
- Security: Hardened Disaster Recovery script with strict cache-control, session-fixation protection, and rate limiting.
- Security: Fixed WAF initialization priority to guarantee Pre-Boot firewall runs immediately.
- Fix: Fixed database schema bug for Scan Results status column.
- Fix: Updated dynamic view logic for Pro dashboard UI files.
Version 1.0.12
- Enhancement: Streamlined the Pro license activation process for a seamless, instant upgrade experience without caching delays.
- Enhancement: Improved menu integration with the Freemius SDK for a cleaner admin dashboard experience.
- Fix: Resolved a critical initialization issue in the Pro module loader to ensure maximum stability on all hosting environments.
- Fix: Restored and optimized the 3D Geo-Location Map visualization within the WAF Analytics dashboard.
- Fix: Addressed a display issue on feature preview pages to ensure smooth navigation for Free tier users.
Version 1.0.11
- Improvement: Refactored compound conditions into nested checks for SDK AST parsing.
- Fix: Fixed dynamic variable assignments for Pro code obfuscation blocks.
- Fix: General code-cleanup and performance improvements.
Version 1.0.10
- Security: Added Base64 and Hex payload decoding to the WAF to catch obfuscated malware.
- Security: Added Wp2shell Zero-Day blocking rule (CVE-2026-60137 / CVE-2026-63030).
- Security: Fixed SSL verification in Rescue Script to prevent MITM attacks.
- Security: Prevented Open Redirect attacks in 2FA login.
- Security: Secured dynamic table names with strict sanitization in DB Backup.
- New Feature: Ghost Admin Protection — detects and automatically demotes rogue administrator accounts.
Version 1.0.9
- Added: Deep Malware Scanner using signature and heuristic analysis.
- Added: Cloudflare Worker integration for distributed WAF.
- Improved: Pre-Boot WAF performance by 12%.
- Fixed: Conflict with specific caching plugins.
Version 1.0.8
- Added: Google Authenticator 2FA support.
- Improved: Brute force protection algorithms.
- Fixed: Admin dashboard UI glitches on mobile devices.
Version 1.0.7
- Added: IP Blacklisting and Country blocking options.
- Improved: Log viewing interface.
Version 1.0.0
- Release: Nexura Security 1.0. The first major stable release bringing the complete security suite to the public.