* Improvement: Introduced the Wordfence Audit Log, a new premium feature to monitor all changes and actions in security-sensitive areas of the site with remote tamper-proof data storage via Wordfence Central
* Change: Increased the minimum supported WordPress version to 4.7
* Change: Increased the minimum supported PHP version to 7.0
* Improvement: Optimized scan performance by reducing database queries by approximately 38% along with CPU usage
* Fix: Added translation support for "Page not found" string when viewing recent traffic
* Improvement: Revised the strong password requirements notice to be more readable
* Improvement: Removed unnecessary calls for the plugin and theme vulnerability checks
* Improvement: Reduced the frequency of calls to Wordfence Central during some operations where the values do not need to be synced
* Improvement: Refactored some queries to avoid the automatic SHOW FULL COLUMNS queries that WordPress performs to verify database encodings
* Improvement: Infrequently-used config values are no longer automatically loaded into memory and instead loaded only on demand
* Fix: Fixed an issue where multisite installations using the WAF mysqli storage engine could repeatedly attempt to update WAF rules when not in optimized mode
* Improvement: Updated the bundled GeoIP database
* Change: Revised the formatting of TOTP app URLs to prioritize the site's own URL for better sorting and display
* Fix: Fixed the last captcha column in the users page so it no longer displays "(not required)" on 2FA users since that no longer applies
* Fix: Added a check in wflogs/rules.php to only run when within the WAF's bootstrap stage when hosted behind nginx
* Fix: Revised the behavior of the reCAPTCHA verification to use the documented expiration period of the token and response to avoid sending verification requests too frequently, which could artificially lower scores in some circumstances
* Fix: Addressed PHP 8 deprecation notices in the file differ used by file changed scan results
* Fix: Reduced the frequency of Wordfence Central status update callbacks in sections of the scan that occur quickly in sequence
* Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)
* Fix: Addressed a potential PHP 8 notice in the human/bot detection AJAX call
* Fix: Addressed a potential PHP 8 notice when requesting a lockout unlock verification email
* Fix: Fixed the emailed diagnostics view not showing the missing table information when applicable
* Fix: Improved quick scan logic to base timing on regular scans so they're more evenly distributed
* Fix: Fixed an issue with sites containing invalid Wordfence Central site data where they could throw an error when viewing Wordfence pages
* Improvement: Enhanced the vulnerability scan to check and alert for WordPress core vulnerabilities and to adjust the severity of the scan result based on findings or available updates
* Improvement: Updated the bundled GeoIP database
* Improvement: Increased compatibility of brute force protection with plugins that override the normal login flow and omit traditional hooks
* Change: Adjusted the behavior of automatic quick scans to schedule themselves further away from full scans
* Fix: Added detection for a site being linked to a non-matching Wordfence Central record (e.g., when cloning the database to a staging site)
* Fix: Streamlined the license and terms of use installation flow to avoid unnecessary prompting
* Fix: Fixed an issue where user profiles with a selected locale different from the site itself could end up loading the site's locale instead
* Improvement: Added ".env" to the files checked for "Scan for publicly accessible configuration, backup, or log files"
* Improvement: Provided better descriptive text for the option "Block IPs who send POST requests with blank User-Agent and Referer"
* Improvement: The diagnostics page now displays the contents of any `auto_prepend_file` .htaccess/.user.ini block for troubleshooting
* Fix: Fixed an issue where a login lockout on a WooCommerce login form could fail silently
* Fix: The scan result for abandoned plugins no longer states it has been removed from wordpress.org if it is still listed
* Fix: Addressed an exception parsing date information in non-repo plugins that have a bad `last_updated` value
* Fix: The URL scanner no longer generates a log warning when matching a potential URL fragment that ends up not being a valid URL
* Improvement: Added new functionality for trusted proxy presets to support proxies such as Amazon CloudFront, Ezoic, and Quic.cloud
* Improvement: WAF rule and malware signature updates are now signed with SHA-256 as well for hosts that no longer build SHA1 support
* Improvement: Updated the bundled trusted CA certificates
* Change: The WAF will no longer attempt to fetch rule or blocklist updates when run via WP-CLI
* Fix: Removed uses of SQL_CALC_FOUND_ROWS, which is deprecated as of MySQL 8.0.17
* Fix: Fixed an issue where final scan summary counts in some instances were not sent to Central
* Fix: Fixed a deprecation notice for get_class in PHP 8.3.0
* Fix: Corrected an output error in the connectivity section of Diagnostics in text mode