=== All In One WP Security & Firewall ===

Contributors: Tips and Tricks HQ, wpsolutions, Peter Petreski, Ruhul Amin,
mbrsolution, chesio
Donate link: https://www.tipsandtricks-hq.com
Tags: security, secure, Anti Virus, antivirus, ban, ban hacker, virus, firewall,
firewall security, login, lockdown, htaccess, hack, malware, vulnerability,
protect, protection, phishing, database, backup, plugin, sql injection, ssl,
restrict, login captcha, bot, hotlink, 404 detection, admin, rename, all in one,
scan, scanner, iframe,
Requires at least: 3.5
Tested up to: 4.9
Stable tag: 4.3.1
License: GPLv3

A comprehensive, user-friendly, all in one WordPress security and firewall plugin

for your site.

== Description ==
= A COMPREHENSIVE, EASY TO USE, STABLE AND WELL SUPPORTED WORDPRESS SECURITY PLUGIN
=

WordPress itself is a very secure platform. However, it helps to add some extra
security and firewall to your site by using a security plugin that enforces a lot
of good security practices.

The All In One WordPress Security plugin will take your website security to a whole
new level.

This plugin is designed and written by experts and is easy to use and understand.

It reduces security risk by checking for vulnerabilities, and by implementing and

enforcing the latest recommended WordPress security practices and techniques.

https://www.youtube.com/watch?v=CJvCTlVtazA

All In One WP Security also uses an unprecedented security points grading system to
measure how well you are protecting your site based on the security features you
have activated.

Our security and firewall rules are categorized into "basic", "intermediate" and
"advanced". This way you can apply the firewall rules progressively without
breaking your site's functionality.

The All In One WordPress Security plugin doesn't slow down your site and it is 100%
free.

Visit the [WordPress Security Plugin](https://www.tipsandtricks-hq.com/wordpress-

security-and-firewall-plugin) page for more details.

Below is a list of the security and firewall features offered in this plugin:

= User Accounts Security =

* Detect if there is a user account which has the default "admin" username and
easily change the username to a value of your choice.
* The plugin will also detect if you have any WordPress user accounts which have
identical login and display names. Having account's where display name is identical
to login name is bad security practice because
you are making it 50% easier for hackers because they already know the login name.
* Password strength tool to allow you to create very strong passwords.
* Stop user enumeration. So users/bots cannot discover user info via author
permalink.

= User Login Security =

* Protect against "Brute Force Login Attack" with the Login Lockdown feature. Users
with a certain IP address or range will be locked out of the system for a
predetermined amount of time based on the configuration settings and you can also
choose to be notified
via email whenever somebody gets locked out due to too many login attempts.

* As the administrator you can view a list of all locked out users which are
displayed in an easily readable and navigable table which also allows you to unlock
individual or bulk IP addresses at the click of a button.
* Force logout of all users after a configurable time period
* Monitor/View failed login attempts which show the user's IP address, User
ID/Username and Date/Time of the failed login attempt

* Monitor/View the account activity of all user accounts on your system by keeping
track of the username, IP address, login date/time, and logout date/time.
* Ability to automatically lockout IP address ranges which attempt to login with an
invalid username.
* Ability to see a list of all the users who are currently logged into your site.
* Allows you to specify one or more IP addresses in a special whitelist. The
whitelisted IP addresses will have access to your WP login page.
* Add captcha to WordPress Login form.
* Add captcha to the forgot password form of your WP Login system.

= User Registration Security =

* Enable manual approval of WordPress user accounts. If your site allows people to
create their own accounts via the WordPress registration form, then you can
minimize SPAM or bogus registrations by manually approving each registration.
* Ability to add captcha to the WordPress's user registration page to protect you
from spam user registration.
* Ability to add Honeypot to the WordPress's user registration form to reduce
registration attempts by robots.

= Database Security =
* Easily set the default WP prefix to a value of your choice with the click of a
button.
* Schedule automatic backups and email notifications or make an instant DB backup
whenever you want with one click.

= File System Security =

* Identify files or folders which have permission settings which are not secure and
set the permissions to the recommend secure values with click of a button.
* Protect your PHP code by disabling file editing from the WordPress administration
area.
* Easily view and monitor all host system logs from a single menu page and stay
informed of any issues or problems occurring on your server so you can address them
quickly.
* Prevent people from accessing the readme.html, license.txt and wp-config-
sample.php files of your WordPress site.

= htaccess and wp-config.php File Backup and Restore =

* Easily backup your original .htaccess and wp-config.php files in case you will
need to use them to restore broken functionality.
* Modify the contents of the currently active .htaccess or wp-config.php files from
the admin dashboard with only a few clicks
= Blacklist Functionality =
* Ban users by specifying IP addresses or use a wild card to specify IP ranges.
* Ban users by specifying user agents.

= Firewall Functionality =

This plugin allows you to easily add a lot of firewall protection to your site via
htaccess file. An htaccess file is processed by your web server before any other
code on your site.
So these firewall rules will stop malicious script(s) before it gets a chance to
reach the WordPress code on your site.

* Access control facility.

* Instantly activate a selection of firewall settings ranging from basic,
intermediate and advanced.
* Enable the famous "5G Blacklist" Firewall rules courtesy of [Perishable Press]
(http://perishablepress.com/)
* Forbid proxy comment posting.
* Block access to debug log file.
* Disable trace and track.
* Deny bad or malicious query strings.
* Protect against Cross Site Scripting (XSS) by activating the comprehensive
advanced character string filter.
or malicious bots who do not have a special cookie in their browser. You (the site
admin) will know how to set this special cookie and be able to log into your site.
* WordPress PingBack Vulnerability Protection feature. This firewall feature allows
the user to prohibit access to the xmlrpc.php file in order to protect against
certain vulnerabilities in the pingback functionality. This is also helpful to
block bots from constantly accessing the xmlrpc.php file and wasting your server
resource.
* Ability to block fake Googlebots from crawling your site.
* Ability to prevent image hotlinking. Use this to prevent others from hotlinking
your images.
* Ability to log all 404 events on your site. You can also choose to automatically
block IP addresses that are hitting too many 404s.
* Ability to add custom rules to block access to various resources of your site.

= Brute force login attack prevention =

* Instantly block Brute Force Login Attacks via our special Cookie-Based Brute
Force Login Prevention feature. This firewall functionality will block all login
attempts from people and bots.
* Ability to add a simple math captcha to the WordPress login form to fight against
brute force login attacks.
* Ability to hide admin login page. Rename your WordPress login page URL so that
bots and hackers cannot access your real WordPress login URL. This feature allows
you to change the default login page (wp-login.php) to something you configure.
* Ability to use Login Honeypot which will helps reduce brute force login attempts
by robots.

= WhoIs Lookup =
* Perform a WhoIs lookup of a suspicious host or IP address and get full details.

= Security Scanner =
* The file change detection scanner can alert you if any files have changed in your
WordPress system. You can then investigate and see if that was a legitimate change
or some bad code was injected.
* Database scanner feature can be used to scan your database tables. It will look
for any common suspicious-looking strings, javascript and html code in some of the
WordPress core tables.
= Comment SPAM Security =
* Monitor the most active IP addresses which persistently produce the most SPAM
comments and instantly block them with the click of a button.
* Prevent comments from being submitted if it doesn't originate from your domain
(this should reduce some SPAM bot comment posting on your site).
* Add a captcha to your wordpress comment form to add security against comment
spam.
* Automatically and permanently block IP addresses which have exceeded a certain
number of comments labeled as SPAM.

= Front-end Text Copy Protection =

* Ability to disable the right click, text selection and copy option for your
front-end.

= Regular updates and additions of new security features =

* WordPress Security is something that evolves over time. We will be updating the
All In One WP Security plugin with new security features (and fixes if required) on
a regular basis so you can rest assured that your site will be on the cutting edge
of security protection techniques.

= Works with Most Popular WordPress Plugins =

* It should work smoothly with most popular WordPress plugins.

= Additional Features =
* Ability to remove the WordPress Generator Meta information from the HTML source
of your site.
* Ability to remove the WordPress Version information from the JS and CSS file
includes of your site.
* Ability to prevent people from accessing the readme.html, license.txt and wp-
config-sample.php files
* Ability to temporarily lock down the front end of your site from general visitors
while you do various backend tasks (investigate security attacks, perform site
upgrades, do maintenance work etc.)
* Ability to export/import the security settings.
* Prevent other sites from displaying your content via a frame or iframe.

= Plugin Support =
* If you have a question or problem with the All In One Security plugin, post it on
the support forum and we will help you.

= Developers =
* If you are a developer and you need some extra hooks or filters for this plugin
then let us know.
* Github repository - https://github.com/Arsenal21/all-in-one-wordpress-security

= Translations =
* All In One WP Security plugin can be translated to any language.

Currently available translations:

- English
- German
- Spanish
- French
- Hungarian
- Italian
- Swedish
- Russian
- Chinese
- Portuguese (Brazil)
- Persian

Visit the [WordPress Security Plugin](https://www.tipsandtricks-hq.com/wordpress-

security-and-firewall-plugin) page for more details.

== Installation ==

To begin making your WordPress site more secure:

1. Upload the 'all-in-one-wp-security.zip' file from the Plugins->Add New page in

the WordPress administration panel.
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to Settings menu under 'WP Security' and start activating the security
features of the plugin.

== Usage ==

Go to the settings menu after you activate the plugin and follow the instructions.

== Screenshots ==
Check the following page for screenshots:
https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin

== Frequently Asked Questions ==

Check the following page for F.A.Q (see the faq section):
https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin

== Upgrade Notice ==
None

== Changelog ==

= 4.3.1 =
- Improved white list directives to cater for Apache 2.4 and earlier versions.
- Added 3 filters for the manual account registration approval email:
aiowps_register_approval_email_subject, aiowps_register_approval_email_msg,
aiowps_register_approval_email_from_name
- Added configuration option to allow custom firewall rules to be applied at
beginning of all rules applied by aiowps.
- Changed record insertions to DB table aiowps_failed_logins to store the full IP
address instead of IP range.

= 4.3.0 =
- Updated wp-security-rename-login-feature.php to include latest WordPress core
changes.
- Added captcha for woocommerce login and registration forms.
- Fixed "mixed line endings" warnings for whois library.
- Moved DB cleanup task cron job from daily to hourly.
- Updated the reapply htaccess function so it doesn't create the header already
sent error.

= 4.2.9 =
- Changed the parameter in current_user_can function to use an administrator
capability instead of the "administrator" role name.
- Added some new hooks to the AIOWPSecurity_WP_Loaded_Tasks called
aiowps_wp_loaded_tasks_start and aiowps_wp_loaded_tasks_end.
- Improved get_locked_ips() function and added $wpdb->prepare statement.
- Added more missing translation domain parameters for translatable strings in the
rename login page.
- Deleted local copy of the Persian and Italian language files. These translations
are available on translate.wordpress.org.
- Domain path and text domain added to plugin header.
- Changed the get_user_ip_address functions so that $_SERVER['REMOTE_ADDR'] is the
primary method used to obtain IP address.
- Added enumeration block via REST API (wp >= 4.7)

= 4.2.8 =
- Improved "User Registration" feature to bypass the pending approval status for
new users created in admin side.
- Fixed bug in whois library.
- Added translation domain parameter for translatable strings in the rename login
page.
- Updated the chinese language file.

= 4.2.7 =
- The PHPWhois library updated to their latest version to include a security patch.

= 4.2.6 =
- Added new Login Lockdown whitelist feature which allows immunity for IP address
or ranges from being locked by the lockdown feature.
- Fixed bug - Replaced date_i18n with current_time to prevent cases where some
localizations produce foreign characters in date stamp output.
- Added a new feature to add Honeypot to the WordPress's user registration form
(this can help reduce registration attempts by robots).
- Added "Export to CSV" buttons for 404 Event Logs, Account Activity Logs and
Failed Login Records.
- Minor update to 6G rules.
- Minor spelling and wording fixes and changes.

= 4.2.5 =
- Fixed bug - added code which caters for mysql view definitions when DB prefix is
changed.
- Fixed a typo in the user login security menu.
- Fixed storage of time stamp in lockdown table to match the local Wordpress server
time and be consistent with the timestamp stored in the failed logins table.
- Prevent direct access to wp-security-core.php
- Updated the POT file.

= 4.2.4 =
- Fix error on block_ip_if_locked(), doesn't exit with a wp_user. This is needed
for other plugins that create the $user (aka ldap auth plugins).
- Fix login error message for users with pending account approval.
- Wordpress 4.7 compatibility.

= 4.2.3 =
- Fixed bug when math captcha was displayed on Woocommerce registration page.
- Fixed login page bug for cases where email address and captcha are used to submit
login form (thanks to @chesio for fix).
- Logs directory now contains a .htaccess file with proper deny directives.
- Small UX improvement: add for attribute to captcha label.
- Added check for IIS server in get_server_type function.

= 4.2.2 =
- Debug logger class improvements.
- Added a message in the debug settings area to state that the log files are reset
on every plugin update.
- Always return an array from scan_dir_sort_date() to prevent PHP notices.
- Improvements for Automated DB backups filling up space - old backup file will be
deleted first.
- Thanks to RIPS Analyzer for sending us the vulnerability report.

= 4.2.1 =
- Improve output of .htaccess to include <IfModule mod_rewrite.c> checks and
RewriteEngine On directives.
- Fall back to default DB backup interval in case of invalid value.
- The aiowps_delete_backup_files() function will produce a debug log message on
every call (to help with troubleshooting when needed).

= 4.2.0 =
- WPML plugin compatibility fix for the renamed admin login page feature.
- Fixed a few potential XSS vulnerabilities.

= 4.1.9 =
- Small improvement to the new "immediate blocking of specific usernames" feature.

= 4.1.8 =
- New feature to allow immediate blocking of specific usernames.
- Only activate copy (right-click) protection for non-admin users.
- Fixed bug where logout link in admin bar does not get updated on after the $_POST
submit to reflect the new rename login setting.
- Fixed small bug in return_regularized_url function.
- Improvement/bug fix: When currently logged in user attempts to access renamed
login page, redirect them to dashboard.
- Removed Spanish language files so they can be automatically pulled from
WordPress.org.
- Drop unnecessary WHERE clause in some backend listings.
- Improvement: do not schedule a cronjob, if it is already scheduled.

= 4.1.7 =
- Added sanitisation for log file data in textarea.
- Disabled autocomplete for Captcha field.

= 4.1.6 =
- Added cleanup code for captcha string info transients.
- Minor change to the username label in the renamed login page to keep it inline
with the standard WordPress login page.
- Fixed a potential vulnerability when viewing AIOWPS log files in the Dashboard
menu. Thanks to Manuel LLOP for pointing this out.

= 4.1.5 =
- Fixed bug where username is an email and captcha was being ignored.
- Reduce memory footprint of database backup.
- Improvements: Make hard-coded strings localizable.
- Partial Apache 2.3 compatibility.
- Improved: Hide WP version number by replacing it with a hash. This way, WordPress
version number is not exposed, but browser caching is not obscured by missing
version numbers.

= 4.1.4 =
- Improved and tweaked the login captcha feature to avoid some issues people had
with the last modification.
- Deleted reference to ini_get('safe_mode') to avoid fatal errors for newer
versions of PHP where that setting has been totally removed.

= 4.1.3 =
- Added new checkbox for XMLRPC to disable only pingback methods but leave other
XMLRPC functionality accessible. This will be useful for people who use Jetpack or
Wordpress iOS or other apps.
- Updated the French language file.
- Fix: decbin doesn't add leading zero. Comparing empty strings return bad results.
- Fix: bugfix in the login captcha. Thanks to Sipke Mellema for pointing it out.

= 4.1.2 =
- Fixed bug introduced by last file change scanner code changes.
- Fixed bug in SPAM comment blocking functionality.
- Fixed fatal error case when Divi theme and front end lockout is enabled.

= 4.1.1 =
- Fixed Fatal error conflict between Rename Login feature and Yoast SEO and some
themes when attempting to access wp-admin page directly.
- Added "Pending Approval" message when manual registration approval feature is
enabled and a user registers.
- Fix (minor): No need to use strcmp to compare integer values.
- Updated and simplified wp-security-stop-users-enumeration.php for bug (thanks to
@davidegiunchidiennea)
- Minor code cleanup (Thanks to @chesio for the following changes).
- File scanner codebase cleanup.
- Fix: properly report invalid email addresses in file scanner configuration.
- Code clean-up in AIOWPSecurity_Scan::do_file_change_scan() method.
- Tweak: Compare file scan data faster.

= 4.1.0 =
- Fixed bug in Maintenance menu page when trying to attach a media file to the
message text box.
- Added a new filter (called "aiowps_ip_blocked_error_msg") which allows the
modification of the error message displayed on the login page when an IP address
has been blocked by the login lockdown feature.
- Updated French language translation. Thanks to Claude Ribaux for providing the
translation files.
- Thanks to @chesio for making the following two changes.
- Replaced deprecated call to get_currentuserinfo() function.
- Minor code fixes in the backup class file.
- Fix: display correct (error) message when write_to_htaccess() fails.
- Tweak: database backup filename is more human-readable.
Before: 24x7eg8l6i-database-backup-1463042767.zip
After: database-backup-20160512-104607-24x7eg8l6i.zip

= 4.0.9 =
- Made file change scanner code more robust for cases when open_basedir restriction
is in effect. (Thanks to Manuel Jeanne for pointing this out).
- Added code which will remove WordPress version info during CSS and JS script
loading if you have the "Remove WP Generator Meta Info" option checked. (Thanks to
aldemarcalazans for pointing this out).
- Fixed some potential SQL injection vulnerabilities. (Thanks to Julio Potier for
pointing these out).
- Changed the feature category of blacklist manger from "Intermediate" to
"Advanced".
- Tweak: Remove "@" from list of characters blocked by advanced character string
filter. (Because it is often used in retina-ready images).
- Fix: Use home URL instead of site URL in lock notification email subject. Thanks
to @chesio for fixing this.

= 4.0.8 =
- Added ability to identify IP addresses during user registration and option to
block selected IPs.
- Added login form captcha functionality for sub-sites in a multi-site
installation. (see the Brute Force menu)
- Fixed multi-site bug related to manual user-chosen DB prefix change.
- Added extra XSS protection inside admin menu pages for the "tab" query parameter.
- Added a note to the features that has the potential to lock you out if it doesn't
work correctly on your site.
- Updated Brazil-Portuguese language file.
- Fixed issue with firewall custom rules being corrupted by magic quotes. Thanks to
@chesio for fixing this.

= 4.0.7 =
- Added a new action hook "aiopws_before_set_404" which triggers just before the
AIOWPS sets a 404. (handy for cases when rename login page is used which affects
some themes when accessing "wp-admin" directly)
- Fixed some potential SQL injection vulnerabilities.
- Thanks to @chesio for submitting the following changes and applying the fixes.
- Sub-directory install fixes.
- Improve behavior of WP File Access tab.
- Fix invalid nesting of HTML elements.
- Do not block HTTP requests that contain "tag=" in query string.
- Option to enable the 6G firewall.

= 4.0.6 =
- Removed the viewing of contents of wp-config.php and .htaccess files in order to
protect sensitive info.
- Fixed more potential XSS vulnerabilities in some other settings pages. (Once
again many thanks to Erin Germ for pointing these out)

= 4.0.5 =
- Fixed some potential XSS vulnerability in the blacklist, file system and file
change detection settings pages. (Many thanks to Erin Germ for pointing these out)

= 4.0.4 =
- Added new feature: Auto Block Spammer IPs. This feature will automatically and
permanently block IP addresses which are linked to comment SPAM. (see SPAM
Prevention -> Comment SPAM IP Monitoring tab)
- Added compatibility fix for the qTranslate-X plugin in the rename login page
feature.
- Added ability to send to more than one email address for file change detection
feature notification.
- Fixed bug in whois library when searching ARIN registry.
- Fixed the handling of display of longer IPV6 strings in dashboard summary table.
- Added hook for WooCommerce login form to display unlock button.
- Added Dutch language translation. Thanks to Jeroen van der Linde for providing
the translation files.
- Typo fix in the "stop users enumeration" feature.

= 4.0.3 =
- Added urlencode to query strings in URLs to prevent unexpected behaviour. Thanks
to @chesio for spotting the issue.
- Added new feature to stop users enumeration. Thanks to Davide Giunchi
@davidegiunchidiennea for adding this.
- Added a more robust code for check_user_exists function. Thanks to Christian
Carey.
- Added cron cleanup of the global meta table.
- Added a title in each of the admin interface menu.

= 4.0.2 =
- Added ability to enable/disable debug from the settings menu.
- Fixed bug related to using IP ranges in the whitelist settings.
- Added IPv6 support for the whitelist feature.
- Added check in file permissions feature for cases where wp-config.php may be
located outside of root.
- Added wp cron DB cleanup events for various tables which may grow large over
time.
- Changed firewall rule for proxy comment prevention to reflect suggestion made by
Thomas O. in forum (https://wordpress.org/support/topic/high-server-cpu-with-proxy-
login)
- Fixed CSS styling issue in admin pages for WordPrss 4.4

= 4.0.1 =
- Renamed the language files to match the new textdomain slug to fix the language
translation bug.
- Fixed bug related to the rename login feature and force logout or logout expiry
events.
- Applied fix for log being generated by events table DB insert.
- Corrected a function call to static version of display error msg.

= 4.0.0 =
- Updated text domain to match expected value for translate.wordpress.org
translation system.
- Fixed bug related to multi-site user_roles not being updated for child sites.
- Fixed minor bug in rename login feature.
- Updated the Italian language file.

= 3.9.9 =
- Fixed an issue with the rename login page feature for WordPress 4.3
- Added esc_attr() sanitization to some of the relevant parameters
- Added the necessary changes to allow activation via wp-cli

= 3.9.8 =
- Added guard against possible XSS in the unlock request feature.

= 3.9.7 =
- Added new feature which allows custom .htaccess rules. (See "Custom Rules" tab in
Firewall menu). You can now use this to add custom rules to block access to various
resources on your site.
- Added a new feature to block access to the wp-content/debug.log file (WordPress
creates this file if you enabled debug loggin option in the config file).
- Removed the "v" from version number of the plugin.
- Completed testing with WordPress 4.3.

= 3.9.6 =
- Added Rename Login page feature from the "Brute Force" menu to multisite sub-
sites.
- Removed invalid "length" attribute from input element in captcha code.
- Fixed reset password feature whereby the URL which is sent out in the email for
cases when rename login feature is enabled was not decoded properly.
- Corrected the check for boolean false if returned from wpdb query result.
- Added media button for wp editor in maintenance settings page.

= 3.9.5 =
- Fixed minor bug - IP addresses blocked due to '404' were not being listed in the
display table.
- Updated the Russian language translation file.
- The automatic database table prefix generation value will use a-z characters
only.
- Added esc_url sanitization to the add_query_arg/remove_query_arg function
instances to prevent possible XSS.

= 3.9.4 =
- The sort order and orderby parameters now use a whitelisting approach for
sanitization.

= 3.9.3 =
- Fixed the sort order not working in the 404 error logging and account activity
page.

= 3.9.2 =
- Added a check for registration captcha feature to prevent errors when using
another captcha plugin.
- Improved a few SQL statements.

= 3.9.1 =
- Added new "Force Logout" feature which will instantly force a certain user to be
logged out of their session. (See the "Logged In Users" tab in User Login menu)
- Added more security protection for aiowps log files by creating .htaccess file
and rules. AIOWPS log files can now only be viewed via dashboard menu, in new tab
called "AIOWPS Logs". (NOTE:This security currently applies only for apache or
similar servers)
- Added backticks to SQL statement for DB prefix change to help prevent errors.
- Added protection against possible SQL injection attacks.

= 3.9.0 =
- Added some robustness to the file-scan code.
- Added extra security to all relevant list table instances to prevent unlikely
malicious deletion commands.
- Fixed the user agent part of the blacklist settings code to allow user-agents to
be cleared upon saving.

= 3.8.9 =
- Fixed bug in the new feature which allows permanent blocking of IP addresses that
create 404 events.
- Fixed minor bug for all instances where wpdb "prepare" was being used with
order/orderby parameters.
- Fixed a possible open redirect vulnerability. Thanks to Sucuri for pointing it
out.

= 3.8.8 =
- Added extra robustness and security for wp list table db commands by using wpdb
"prepare" command.
- Fixed minor bug with undeclared variable in rename login feature page.

= 3.8.7 =
- Added an improvement for login lockdown feature - locked IP addresses will no
longer be allowed to register.
- Added a "view" link for each account in the pending registration approval table
list.
- Fixed 404 logging/lockout bug.
- Added ability to permanently block IP addresses from the 404 event list for both
bulk and single cases.
- Added ability to do bulk temp blocking for IP addresses in 404 list.
- Fixed a minor bug with validate_ip_list function.

= 3.8.6 =
- DB cleanup cron event bug fixed.
- Added Swedish language translation. The translation was submitted by Tor-Björn
Fjellner.
- Updated the Russian language translation file. Update submitted by Tor-Björn
Fjellner.
- The events table will automatically be cleaned up so it only keeps the last 5000
entries. You can override it using a filter (if you wanted to).

= 3.8.5 =
- Added functionality to prevent the aiowps_events table from getting too large.
- Added file change scan summary inside the alert email.
- Fixed the unlock feature so that it works correctly when the Rename Login Page
feature is active.
- Added a check in the list logged in users file to prevent error when
get_transient returns false.

= 3.8.4 =
- Updated POT language file.
- Tweaked the function which retrieves the IP address to handle cases where traffic
is coming from cloudflare
- The MySQL database will not be forced anymore at the time of creating the table.
It also reads the characters set value from the system first.
- Applied fixes to prevent remotely exploitable vulnerabilities.

= 3.8.3 =
- Modified "Pingback Protection" .htaccess rules to prevent xmlrpc login attacks
and to be compatible with more servers.
- Made improvements to ensure that the rename login and white list features can be
used together.
- Added a check to force user to enter alphanumeric string for renamed login slug.
- Improved the turn_off_all_firewall_rules() and turn_off_all_security_features()
functions so that they also handle the updating of the htaccess file.
- Added an alternative way to import settings via a text box (Thanks to Dave
McHale). This is for people who might have issues using the config settings file
uploader.
- Added fix to properly update options tables when changing DB prefix in multisite
system.
- Greatly improved the Renamed Login Page feature by removing various potential
vulnerabilities.
- Added an if statement check to fix bug with rename login page feature - special
case where user had non permalink structure was not working correctly in some rare
scenarios.
- Updated the Italian language file.
- Fixed bug regarding wp_mail malformed header when "From" string was empty due to
"site title" not being set.
- Fixed bug in IP list validation function for blacklist feature.
- Removed strict filtering of IP addresses so as to allow internal IP address
ranges.
- Added stripping of orderby and order query parameters in the plugin.
- Added search capability by IP address, URL or referer for the 404 events list
table.

= 3.8.2 =
- Fixed a CSS issue with the honeypot feature.
- Fixed a call to the login action handler static function.

= 3.8.1 =
- Minor bug fix for the honeypot feature - loading of css style sheet was not
occurring when main login page rendered.
= 3.8.0 =
- Improved deactivation and re-activation tasks - AIOWPS will now gracefully clean
up the .htaccess rules when the plugin is deactivated.
- Tweaked code so that all login pages including custom ones will correctly load
the CSS style sheet file needed for honeypot feature.
- Updated the Portugese language translation.
- Fixed the copy protection feature so it doesn't interfere with iframes and
shortcodes.
- The plugin will now work fine even if your wp-config.php file is outside the
wordpress root folder.

= 3.7.9.2 =
- copy protection feature JS code improvement

= 3.7.9.1 =
- Added captcha functionality for custom login form which is produced by the WP
function: wp_login_form()
- Fixed a minor bug with the copy protection feature's JavaScript code.
- Tweaked file change scan algorithm to help prevent getMTime fatal runtime errors.
- Added a link to the github repository in the readme.txt file for developers.

= 3.7.9 =
- Fixed a small bug related to the cookie test in the Cookie Based Brute Force
feature.

= 3.7.8 =
- Added new feature called Login Honeypot which will help reduce brute force login
attempts by robots. (This can be found in the Brute Force menu)
- Added new feature to prevent other sites from displaying your content via a frame
or iframe. (This can be found in the Miscellaneous menu)
- Added captcha feature for BuddyPress registration form.
- Added a new filter for the site lockout message so it can be customized.
- Added a new filter for template include of the site lockout feature.
- Temporarily deactivated the "DB Scan" feature.

= 3.7.7 =
- Improved DB prefix change code to make it more robust.
- Fixed a minor bug for the Rename Login page feature.
- Added check when processing rename login page to see if maintenance (lockout)
mode enabled. Plugin will now display lockout message instead of 404 page if site
lockout enabled.
- Made the Cookie Based Brute Force Prevention feature more secure by introducing a
10 digit random suffix to the test cookie name.

= 3.7.6 =
- Added ability to insert captcha in WordPress Multi Site registration form.
- Added a condition around the management permission constant. This will allow
users to define a custom capability for this plugin's admin side via the wp-config
file. This was submitted by Samuel Aguilera.
- Fixed a bug with the hidden login page feature.
- Fixed a small settings bug with the "block fake google bot" feature.

= 3.7.5 =
- Added a new DB scan feature. Go to the "Scanner" menu to use this new feature.
- Added new settings import/export feature.
- Modified user accounts feature to alert administrator if one or both "admin" or
"Admin" usernames are being used.
- Added Persian language translation. The translation was submitted by Amir Mousavi
Pour (me@ameer.ir).
- Small change to get_mysql_tables function to prevent fatal error when mysqli
query is unsuccessful.
- Added Italian language translation. The translation was submitted by Marco
Guglielmetti.

= 3.7.4 =
- Added a new feature to add copy protection for your front-end. You can find this
feature under the "Miscellaneous" menu.
- Fixed comment captcha bug for multi-site. Now this feature can be
activated/deactivated for subsites of a multisite installation.
- Added Hungarian language translation. The translation was submitted by Daniel
Kocsis.
- Moved the custom login page feature's handling code to wp-loaded hook so other
plugins that modify the login page can do their task before our one is triggered.
This change was suggested by Mark Hudnall.
- Added German language translation. The translation was submitted by Manuel
Fritsch.
- Updated the Brazilian language translation file.

= 3.7.3 =
- Added Brazilian language translation. The translation was submitted by Sergio
Siqueira.
- Added two new action hooks for plugin activation and deactivation time.
- Improved the get_user_ip_address() function so it handles cases when multiple
addresses are returned due to proxy.
- Fixed the mis-alignment of login page which was broken by WP3.9 when rename login
feature is used.
- WordPress 3.9 compatibility

= 3.7.2 =
- Added a PHP Info section in the system info interface to show some important PHP
details of the server.
- Added a filter to allow the user to have a custom translation in a place (which
will be loaded instead of the default one from the plugin). This change was
submitted by Samuel Aguilera.
- Replaced myslqi fetch_all method with fetch_assoc to cover cases where some
servers do not have the correct mysql drivers.
- Added a new filter to allow manipulation of the htaccess rules from your custom
code. The name of the filter is 'aiowps_htaccess_rules_before_writing'.
- Added a "Delete All 404 Event Logs" button to purge all 404 logs from DB
- Added code to automatically send an email to the registrant when an account has
been manually "Approved" from the User Registration menu.

= 3.7.1 =
- Fixed a minor bug: dashboard link was pointing to the wrong tab for the "Logged
In Users" tab.
- Fix a bug with the login page captcha. The captcha wansn't shown if the rename
login page feature was enabled at the same time.

= 3.7 =
- Added new feature - 404 detection. This allows you to log 404 events and block
selected IPs. This feature can be found in the Firewall menu.
- Added new dashboard info box to display number of blocked IP addresses in the
lockout table.
- Fixed bug where user could not access login page when maintenance mode and rename
login page features were both active.
- Tweaked the hotlinking .htaccess directives to cover both http and https.
- Fixed code to prevent mysql errors due to some variables not having default value
in failed login and lockdown tables
- Replaced deprecated PHP function mysql_query with mysqli.
- Added language file for Spanish language. The Spanish translation was done by
Samuel Montoya.
- Added code to hide the "DB Prefix" menu for the non-main sites in multi-site
installation

= 3.6 =
- Added a new feature to prevent image hot-linking. (See the "Prevent Hotlinks" tab
in the firewall menu)
- Added a check in the Rename Login Page feature to prevent people from setting the
slug to "wp-admin"
- Fixed a small bug with Login Lockdown feature.

= 3.5.1 =
- Fixed a bug where the cookie-based brute force directives were not being deleted
from the .htaccess file when the Rename Login Page feature was being activated.

= 3.5 =
- Added new feature which will Block Fake Googlebots from crawling your site. Check
the Firewall menu for this new feature.
- Added code to prevent users from having both the Rename Login Page and Cookie-
Based Brute Force features active at the same time.
- Added some useful info boxes in the dashboard: 1) to inform the user if the
cookie based brute force or rename login page features are active, 2) last 5 logins
to your site.
- Fixed minor bug with .htaccess backup feature.
- Updated the from email address value used for sending backups and file change
notification. Thanks to @TheAssurer for the tip.
- Updated the warning message for the disable index view feature.

= 3.4 =
- Consolidated "Brute Force" features by moving all such features to the "Brute
Force" menu.
- Improved the file change detection scan feature: Introduced a button allowing
admin to view the file change results from the last scan and fixed small bug
whereby the change detected flag was not being cleared for applicable cases.
- Fixed a small bug with "rename login page" (hide admin login) feature.
- Made wp-config.php and .htaccess file backups more secure. Thanks to @TheAssurer
for the tip.
- Made the login code more robust by catering for cases where the "wp_login" action
was not passing 2 parameters.

= 3.3 =
- Added a brand new brute force prevention feature - Rename Login Page. This
feature can be found in the new menu item called "Brute Force".
- Modified the new unlock request feature so that the locked out user will only
have to enter email address when they submit an unlock request.
- Replaced the deprecated PHP function "mysql_list_tables" with alternative code.
- Added warning message regarding WordPress iOS app when pingback protection
feature in the firewall settings is active.
- Added Malware scan tab and information.
- Some minor html form and CSS corrections.

= 3.2 =
- Added new feature which allows users to generate an automated unlock request link
via email when they get locked out because of the login lockdown feature.
- Added a check to ensure that user cannot enter 0 minutes in the Force Logout
feature.
- Fixed translations so that various previously omitted strings can now be
translated.
- Added a new filter before locking down a user's IP address -
aiowps_before_lockdown.
- Generated a new translation (POT) file.

= 3.1 =
- Added a new feature that will allow you to add a captcha to the lost password
form (useful if you are allowing user registration on your site).
- Added ability to specify a system log file in the "Host System Logs" tab of the
"File System Security" menu
- Fixed a tab link bug. One link was going to the wrong menu tab.
- Updated the POT file of the plugin.

= 3.0 =
- Added a new feature which allows you to add captcha to the Wordpress user
registration page.
- Added some more helpful comments and link to video tutorial in the brute force
and white list features settings pages.

= 2.9 =
- Added new feature which automatically sets the status of newly registered
wordpress user accounts to "pending" and allows manual approval by an
administrator.
- Improved robustness of file change detection iteration code.
- WordPress 3.7 compatibility

= 2.8.1 =
- Improved the login captcha implementation
- Changed the management permission to manage_options

= 2.8 =
- Added a feature to insert a simple math captcha to the WordPress comment form (to
reduce comment spam). Check the spam prevention menu for this new feature.
- Fixed a minor bug with bulk unlock/delete in user login menu
- Fixed a minor bug with math captcha logic.

= 2.7 =
- Added a simple math captcha functionality for the WP login page. This is another
easy yet effective way to combat Brute Force Login Attacks. You can enable this new
feature from the user login security menu.

= 2.6 =
- Added a new Login Whitelist feature. This feature enables you to specify one or
more IP addresses in a special whitelist which will have access to your WP login
page.
All other IP addresses trying to access your WP login page which are not in the
whitelist will be automatically blocked.
- The IP address will also be included in the email that gets sent to the admin for
the ip address lockout notification.
- Language file loading fix for Chinese language.
- Tweaked the code which creates a .htaccess file in the backup directory to ensure
it gets run even if the directory already existed.
- Made DB backups more secure.
- Added more useful debug logs for .htaccess file manipulation failure scenarios.

= 2.5 =
- Added a new feature which will list the currently logged in users who have been
active within the last 15 minutes.
- Added a new feature in settings menu which will disable all firewall rules and
clear all applicable directives in the .htaccess file.
- Improved the way the wp-config.php file is handled when it contains an ending PHP
tag "?>" (older sites that were using PHP4 earlier).

= 2.4 =
- Added new feature/checkbox which will instantly lockout IP address ranges which
attempt to login with an invalid username.
- Fixed a bug in the Comment SPAM IP Monitoring page where trying to block one or
more IPs was failing.
- Removed the word "config" from the list of bad query strings check (to add
compatibility with a few more plugins)
- Added a notice in the dashboard menu to show you if there are any recent file
changes that the plugin detected.
- Fixed bug with php File Editing feature. Code now also handles older style wp-
config.php files which have the php end tag "?>"
- Fixed bug with "Disable All Security Features" button functionality. When
clicked, this will now also make the appropriate changes to the .htacces and wp-
config.php files if necessary.
- Changed the storage of backup files from the plugin's directory to the uploads
directory. Also added a .htaccess file for security.
- Fixed the way user-agent strings were written to the .htacess file from the
Blacklist feature. The code now will correctly identify and represent spaces and
escaped chars.
- Fixed a bug related to sending backup to correct email address.

= 2.3 =
- Added new menu called Scanner with a new feature called File Change Detection.
This feature will alert you if any files have changed, added or removed from your
system.
- Fixed "Deny Bad Query Strings" rules to not break the ability to drag components
in the WordPress "Appearance->Menus" page
- Fixed an activation time warning (on sites with WP_DEBUG option enabled)
- Re-implemented the wp-config.php file content backup feature. It now directly
downloads the contents of the file to your computer.
- Multi-site enhancements: Suppressed access to configuration settings for features
which are not allowed to be configured from subsites of multi-site installations.
- Fixed a bug with login lockdown feature.

= 2.2 =
- Added a new feature which will block some spambots from submitting comments.
- Moved Comment SPAM IP monitoring interface to the new "SPAM Prevention" menu.
- Fixed a bug with login lockdown feature for both multi and single site.
- Improved firewall feature for multi-site by making the "Firewall" menu available
only for the main site and not the sub-sites.
- Added random prefix to backup file names.
- Fixed a bug for WP multi-site install where DB tables do not get created when new
blog are created in the network.

= 2.1.1 =
- Fixed a version tagging issue.

= 2.1 =
- Fixed an issue with install time error on some sites for WordPress 3.6
- Fixed some WP Debug related errors for WordPress 3.6
- Replaced the deprecated $wpdb->escape() function calls with esc_sql() calls

= 2.0 =
- Fixed a bug for general DB backup functionality.
- Fixed multi-site DB backup - the plugin will now backup only the tables relevant
for the sub-site in question.
- Added blank index.html files in various folders inside the plugin.
- Disabled the wp-config.php file backup feature until we find a more secure method
of doing the backup.

= 1.9 =
- Added new WordPress PingBack Vulnerability Protection feature. This allows the
user to prohibit access to the xmlrpc.php file in order to protect against certain
vulnerabilities in the pingback functionality.
- Added a configuration item in the brute force login prevention feature to allow
ajax functionality to work properly when this feature is enabled.
- Added a POT file for language translations.
- Made the DB Prefix feature more robust by adding a check to ensure that plugin
can write to the wp-config.php file. This will prevent user from losing access to
their site in cases where the system changed the prefix but not the entry in the
wp-config.php file.
- Tightened the data validation for the cookie based brute force login feature to
ensure that the user must enter a secret word which consists of alphanumeric
characters.
- Added edit links to the user account list in the "User Acounts" menu.

= 1.8 =
- Moved the front end site lockout feature to a new menu called "Maintenance".
- Added a feature in the front-end lockout feature to allow people to specify their
own message which will be displayed on the front-end to visitors who try to access
the site when it is in lock out state.
- Fixed a bug in the front-end lockout feature by adding some checks which ensure
that the admin will not get locked if the feature is still active and their login
session expires or they log out.
- Added a widget in the dashboard menu to show the status of the "maintenance mode"
feature.

= 1.7 =
- Added a new feature which is a password strength tool which calculates how easy
it is for your chosen password to be cracked using a desktop PC and the appropriate
SW. This tool should help you create strong passwords.
- Added a front-end general visitor lockout feature. This feature allows you to
temporarily lock down the front end of your site while you do security
investigation, site upgrades, tweaks etc.

= 1.6 =
- Added a new option in the cookie-based Brute Force Login Attack prevention
feature to allow users to use this feature together with the WordPress's post/page
password protection feature.
- Fixed a bug in the 5G firewall rules to so that the printed rules include the
correct number of '\' characters.
- Fixed a minor bug in the "restore from backed up htaccess file" feature.
- Enhanced the "Save current wp-config.php file" feature so it will continue to
work with all of the firewall rules active on the site.
- Added extra checks to account for some error scenarios caused on some servers
when recursive file search is done.

= 1.5 =
- Added new feature - Cookie-based Brute Force Login Attack Prevention. Check under
the "Firewall" menu for this new feature.
This feature will stop hackers in their tracks when they try to access your wp-
admin or login pages. This feature will secure your WordPress backend by enforcing
the requirement that anybody trying to access these pages will require a special
cookie.

- Fixed bug related to setting of default configuration for first-time plugin

activation.

= 1.4 =
- Tweaked the "Deny Bad Query Strings" firewall rules so that plugin deletion and
update operations from the WordPress plugins menu are not affected.
- Fixed a minor bug related to scheduled database backups.
- Added some extra default settings to be applied to the plugin's configuration
pages upon activation for the first time.
- Plugin will now display a recommendation message if user sets scheduled backup
frequency to less than 24 hours.

= 1.3 =
- Added a new feature to remove the WordPress Generator Meta information from the
HTML source of your site.
- Tweaked the "Advanced Character String Filter" to fix issue which was affecting
plugins such as "Admin Management Xtended" and also pages with keywords such as
"password" in the URL.
- Updated one rule in the "Advanced Character String Filter" feature to make it
compatible with W3 Total Cache Plugin's minify feature.
- Added a "Delete All Failed Login Records" option in the "Failed Login Records"
tab. This will delete all entries in the failed logins table and will make it less
tedious for users who get a lot of brute force attacks on their site.

= 1.2 =
- Moved the rules which disable index views from the "basic firewall" rules to the
"additional rules" section. This will prevent any site breakage for
those who want to enable the basic firewall but do not have "AllowOverride" option
enabled in their httpd.conf

= 1.1 =
- Added the following new feature:
- Prevent people from accessing the readme.html, license.txt and wp-config-
sample.php files.

= 1.0 =
- First commit to the WP repository.