Scudo Security

Changelog

1.1.2

• Important fix — the firewall no longer blocks people who are allowed to write. With the firewall active, an ordinary edit containing an embedded video, a custom HTML block or a code sample could be answered with “403 Forbidden”, because the request was inspected without checking who sent it. Anyone who can author content is now exempt, exactly as the Pro traffic controls have always been. Visitors and low-privilege accounts are still filtered.
• Removed the last references to a curated vulnerability feed as a Pro service. The advisory feed URL is a free feature and accepts any JSON feed you choose.

1.1.1

• Corrected three strings in the admin interface that described capabilities the plugin does not have: the upgrade prompts offered “real-time signatures” (the rule set is the same in both tiers — what Pro really adds is custom rules), and the alerts recommendation promised instant notification of threats when what it sends is an administrator-login notice and a weekly digest.

1.1.0

• First public release on WordPress.org. Earlier version numbers were pre-release builds distributed only to Pro customers; the notes below record what changed in them.
• Important fix — the firewall now actually blocks. The Web Application Firewall read an internal setting that nothing ever wrote, so it stayed dormant even though the dashboard reported it as active. It now follows the switch on the Firewall screen, which is on by default, and blocks SQL-injection, cross-site-scripting, path-traversal and command-injection patterns. It still stands down completely in Safe Mode. If you had deliberately disabled the firewall, that choice is respected.
• The “SQL injection & XSS protection” switch is now a real control: turning it off stops those two rule families while path-traversal and command-injection protection keep running.
• Documentation accuracy: the feature lists in the readme and inside the plugin now describe only what the plugin actually does. A few capabilities that were listed but never implemented have been removed from the descriptions — no working feature was taken away.

1.0.9

• Fixed a serious bug in the “block user enumeration” hardening module: while it was enabled, every unauthenticated REST API request failed with a server error on PHP 8 — not only the users endpoint, but the whole API. The module now leaves WordPress’s own route metadata untouched and only protects the users routes, as intended.
• The same module now runs before WordPress’s canonical redirect, so ?author=N no longer bounces to the author archive and reveals the username it is meant to hide.
• Fixed a notice under WP_DEBUG: opening the Activity Log with no filters prepared a database query that had nothing to bind.

1.0.8

• Updated the bundled Freemius SDK to 2.13.4 (the current upstream release). The bundled copy is now byte-for-byte identical to the official one, so it can be verified against the upstream repository.
• The integrity scan now documents its use of downloads.wordpress.org in “External services”, and fetches WordPress.org core files through wp_safe_remote_get() with a response-size limit.
• Fixed a recurring database error from the scheduled maintenance clean-up: finished background jobs were aged on a column the jobs table does not have, so the purge failed (and logged an error under WP_DEBUG) on every run. Old finished jobs are now removed correctly.
• Uninstall no longer queries the quarantine table without checking that it exists, so no database error is emitted when the table was never created.
• Packaging: the SPA’s tsconfig.json is now shipped alongside the TypeScript source, so the compiled bundle can actually be rebuilt from the included source.

1.0.7

• The uploads directory is now always resolved via wp_upload_dir() — including the Safe-Mode recovery marker — with no constant-based fallback, fully supporting custom and multisite upload locations.

1.0.6

• Improved how the plugin references file and directory locations: files the plugin creates are written under wp_upload_dir(), the root .htaccess is located with get_home_path() (as WordPress core does), and every remaining reference to WordPress’s own core/plugin/content directories — which the integrity and malware scanner must read — is centralized in a single, documented helper class.

1.0.5

• Packaging: the Composer manifest (composer.json/composer.lock) is again included in the plugin, so the dependency list is available for review — as the WordPress.org guidelines request, even though it is only used for development.
• Two-factor authentication: the self-service 2FA endpoints (status, enrolment, confirm, disable, backup codes) are now available to any signed-in user for their own account, instead of requiring the site-administrator capability.

1.0.4

• Free build: the two remaining premium controls that still appeared as disabled buttons — the custom firewall-rule builder and the activity-log CSV export — now show a plain “available in Pro” pointer instead, so the free version has no locked or disabled interactive controls.
• Packaging: the plugin now ships the admin app’s TypeScript/SCSS source alongside the compiled bundle, and no longer bundles composer.json/composer.lock.

1.0.3

• Fixed a PHP warning that could appear under WP_DEBUG: the bundled Composer autoloader now resolves classes via PSR-4 instead of a hard-coded classmap, so optional Pro-only classes that are not part of this free build resolve cleanly to “not present” without attempting to include a missing file. Also added a defensive file-presence check before loading those optional classes.

1.0.2

• Fixed loading of the bundled translations (corrected the .mo filename so the shipped locales load).

1.0.1

• WordPress.org compliance: removed the code-level required-payment trial. The free version is updated by WordPress.org; Freemius is used only for optional Pro licence activation and opt-in diagnostics (readme “External services” clarified).
• The admin-menu sub-item styling now uses wp_add_inline_style() instead of printing an inline tag.

1.0.0

• First public release.
• Free: environment-aware hardening, base WAF (SQLi/XSS), self-optimising malware & integrity scan, brute-force protection with anti-lockout, TOTP two-factor, login CAPTCHA, comment/form spam protection, one-click security headers, security score with prioritised recommendations, activity log, and Safe Mode with three DB-less recovery routes.
• Adaptive scan: classify each finding (false positive / warning / dangerous); confirmed false positives are suppressed safely (content-bound) on future scans, and detection tunes itself to your site.
• Real, responsive security score that reflects every feature you enable; a one-click “Plans & features” comparison.
• Multisite-aware: network activation provisions every site, and new sites are provisioned automatically.
• Seamless updates: database migrations apply themselves on update (no reactivation), including on headless / WP-CLI deployments.
• Pro: custom firewall rules, GeoIP & advanced rate limiting, hide-login, role-based 2FA enforcement, compromised-password blocking, email alerts & weekly report, plug-and-play Content-Security-Policy builder, activity-log CSV export, config export/import, and the optional AI security advisor (Anthropic Claude, bring your own API key — proposals only, nothing applied automatically).

0.1.0

• Environment detection + capability matrix, Safe Mode with three DB-less recovery routes, secure baseline on activation.
• Hardening modules, security headers, core integrity scan and heuristic malware scan with reversible quarantine.
• Self-optimising scans: chunk size auto-tunes to the host’s memory and execution-time limits (no timeouts on small hosts, faster on big ones).
• Tested against the latest WordPress release; core updates are recorded in the activity log.
• Brute-force protection, TOTP two-factor, password policy, activity log, security score and a React dashboard with real metrics and charts.
• Premium layer (Pro): custom firewall rules, GeoIP, advanced rate limiting, hide-login, 2FA enforcement by role, compromised-password, email alerts, config export/import, and the optional AI security advisor.