New: The integrity scanner now monitors installed plugins and notifies you if any have been abandoned, helping you maintain site security.
New: The integrity scanner also monitors for changes in plugin ownership and alerts you, so you can assess the new developer's credibility and make informed decisions.
Improved: The plugin settings interface now dynamically adapts to your specific web server environment, displaying only relevant options to streamline the configuration process.
Improved: Translations are now loaded from WP Cerber's bundled folder, ensuring more accurate and up-to-date translations for non-English sites.
Fixed: Saving settings for one WP Cerber add-on could reset another add-on's settings to default values.
Fixed: The integrity scanner might attempt to recover files even when recovery options are disabled.
Fixed: A bug that affected the rendering of WP Cerber’s admin dashboard when WordPress encountered email-sending issues.
New: Introduced an admin tool that provides clear explanations of security events in WP Cerber logs and security settings WP Cerber applied in processing requests.
New: Implemented settings for configuring header-based exceptions for WP Cerber’s anti-spam and firewall.
Improved: A new activity log event, "Comment marked as spam", to simplify spam comment management and related plugin settings.
Improved: A new quick filter, "Spam Events" on the Activity tab. It helps admins to easily view all spam-related events and actions taken by WP Cerber’s anti-spam.
Improved: WP Cerber now logs the reasons for blocking IP addresses with better accuracy making it simpler to discern the root cause of lockouts.
Improved: To mitigate plugin conflicts, implemented a dequeuing mechanism that removes conflicting JavaScript scripts loaded by other plugins on WP Cerber admin pages.
Improved: The layout of several WP Cerber admin settings pages and translations have been improved for better admin experience.
Improved: Refined the wording of WP Cerber plugin settings, improving clarity for a better understanding of the plugin’s behavior.
Fixed: A minor PHP bug "An error of type E_ERROR was caused in line 661 of the file /wp-cerber/cerber-lab.php."
Fixed: A minor PHP bug "PHP Warning: Undefined array key net_connection_ip in /wp-cerber/cerber-lab.php on line 330"
Fixed: An issue where you could not change the mode of two-factor authentication ([2FA](https://wpcerber.com/two-factor-authentication-for-wordpress/)) for a user if 2FA was previously enabled or completely disabled on the user profile page. This only happened if the license key for the professional version of WP Cerber had expired or was removed from a website.
Fixed: A bug that triggered a PHP fatal error: Uncaught TypeError: array_merge(): Argument #1 must be of type array, bool given in …/wp-cerber/cerber-settings.php:1037
New: You can control the amount of sign-in attempt details that are shown in 2FA email messages. You can also disable this section completely.
Improved: You can have individual 2FA email configuration for each role on your WordPress and configure per-user settings as well.
Improved: A new "Login Security" section on the user edit page in the [professional version of WP Cerber](https://my.wpcerber.com/ps/).
Improved: New status for activity log entries: "Access denied by plugin settings." It indicates that a given request is denied based on settings within the WP Cerber configuration.
Breaking changes: The feature to use a separate user email address for receiving 2FA codes is available in the [professional version of WP Cerber only](https://my.wpcerber.com/ps/).
Fixed: A fatal PHP error occurs when "Data Shield" is enabled, and a plugin tries to change WordPress settings without loading pluggable PHP functions: "Uncaught Error: Call to undefined function wp_get_current_user() in /wp-cerber/cerber-common.php:1820"
New: Mitigating excessive use of the WordPress password reset form. Whenever WP Cerber detects multiple attempts to reset password for non-existing users, the IP address gets blocked.
Fixed: Erroneous events "Password reset request denied" are logged to the Activity log.
Fixed: If WP Cerber is unable to create its diagnostic log, it produces the software error "PHP Fatal error: Uncaught ValueError: Path cannot be empty in".
Fixed: When browsing plugin updates on the Dashboard / Updates page, no details about the last release of WP Cerber is shown in the pop-up window.
New: When [two-factor authentication](https://wpcerber.com/two-factor-authentication-for-wordpress/) is enabled, users can now optionally click a checkbox on the 2FA form to remember their devices for a predefined period of days. Available in the professional version of WP Cerber.
Improved: Enhanced details about generated 2FA PIN codes on the user profile page.
Improved: The tabs labeled "Role-based" and "Global" are now renamed to "Role Policies" and "Global Policies" respectively.
Fixed: The 2FA email address set on the user profile page is ignored when sending 2FA codes.
Fixed: A fatal error occurs when using [Cerber.Hub](https://wpcerber.com/manage-multiple-websites/) and switching to a managed website where automatic updates for WP Cerber were enabled.
New: WP Cerber now sends 2FA verification codes via SMTP. If an SMTP server is set up in the WP Cerber settings, it will be used to send these codes.
New: Implemented a backup method for sending emails via an SMTP server. If an attempt to send an email through the SMTP server fails, WP Cerber will resort to using the default WordPress mailer.
New: Email error reporting has been introduced. If an error occurs while WP Cerber is sending an email, the error details are captured and shown as a warning on the WP Cerber dashboard.
Improved: If your website crashes and displays the WordPress message "There has been a critical error on this website", WP Cerber captures and logs fatal PHP errors.
Improved: WP Cerber now identifies and shows the name, version and author of a plugin or a theme that produced PHP errors.
Improved: All users with prohibited usernames (logins) are marked with the red label "PROHIBITED" on the Users admin page.
Improved: The limits on the maximum length of SMTP setting fields have been increased from 28 characters to 64.
Fixed: If HTTP redirection is set to handle attempts to access protected areas, and WP Cerber blocks an intruder's IP address, no email alerts are sent even if lockout alerting is enabled.
New: WP Cerber now supports establishing outgoing network connections via a proxy server that is configured for WordPress.
Improved: File operations and error handling in the WP Cerber scanner have been enhanced. Any unsuccessful file recoveries are displayed in the scan results.
Improved: If a file recovery requires creating missing folders, the scanner create them.
Improved: To prevent altering source files, the scanner recovery folders are emptied before starting a scan.
Improved: When email notifications for new versions of installed plugins are enabled, you will receive an alert as soon as either WP Cerber or WordPress detects an update.
Improved: You can enable automatic updates for WP Cerber in the main plugin settings now.
Fixed: If a file is missing, the scanner does not recover it.
New: You can define a more secure location of the protected WP Cerber directory by using a PHP constant.
Improved: JSON payload of REST API and other requests is decoded and saved to the "Live Traffic" log.
Improved: The "Form submissions" filter, located on the Live Traffic tab, filters out conventional form submissions and no longer includes REST API requests.
Improved: The activity export file now includes a new column, "By User," which contains the user ID of the user who initiated the row event.
Improved: The names of export files are now unified and include the website URL, making it easier to identify which website the file was downloaded from.
Improved: Prevent Jetpack’s Asset CDN from destroying the layout and style of WP Cerber admin pages.
New: Get an email notification whenever a new version of a plugin is available.
New: An additional option for [granting access to users’ data via REST API](https://wpcerber.com/restrict-access-to-wordpress-rest-api/) for selected user roles.
New: An additional option for [sending activity alerts](https://wpcerber.com/wordpress-notifications-made-easy/). Email alerts can be sent to an email address you have on your WordPress account.
Improved: WP Cerber now permanently stores users’ last login data (IP address, time, user’s country) for all users. [The data can be erased by website admin](https://wpcerber.com/delete-personal-data/).
Improved: To prevent having insecure plugin configuration, WP Cerber validates required HTTP headers before enabling [the behind a proxy mode](https://wpcerber.com/wordpress-ip-address-detection/) in the WP Cerber settings.
Fixed: A specially formatted request can bypass the disabled redirection from a /wp-admin/ locations to the [custom login page](https://wpcerber.com/how-to-rename-wp-login-php/).
Fixed: The [integrity scanner](https://wpcerber.com/wordpress-security-scanner/) labels a file as "File is missing" if the folder containing the file is on the "Directories to exclude" list.
Fixed: After clicking "Apply" on the "Screen Options" on the [Cerber.Hub](https://wpcerber.com/manage-multiple-websites/) admin page, a blank page is displayed.