GPLCoffee
Get Started
Really Simple Security pro icon

14 versions

Really Simple Security pro history.

Every release of Really Simple Security pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.

14 of 14 releases scanned clean
v9.8.4Latest
October 26, 20267.3 MBScanned
Other
  • Security: Passkeys could be skipped by logging in with an email address instead of a username.
  • Security: Users with an authenticator app (TOTP) or passkey could be offered the weaker email code instead.
  • Security: On multisite, only network admins can now deactivate the plugin network-wide.
  • Security: License and update requests now always verify the SSL certificate.
  • Security: Passkey setup now only starts after all other login checks, such as captcha, have passed.
  • Security: The Mixed Content Scan fixer now only changes files found by the scan and blocks unsafe downloads.
Fixed
  • A fatal error with a custom login URL when a specific page was set as the failure page.
  • The file permissions check now skips deleted files and detects all incorrect permissions.
v9.8.3
September 22, 20267.4 MBScanned
Other
  • Security: Fixed a remaining 2FA bypass in XML-RPC authentication.
  • Security: Fixed an issue where unauthenticated visitors could bloat the database via the 404 interceptor. Thanks to Naoki Kawahigashi via WPScan for reporting.
Fixed
  • A possible error when processing plugins that were no longer available in Other Plugins.
Improved
  • Removed SimplyBook.me from onboarding and Other Plugins.
  • Standardized punctuation in task and notice messages.
v9.8.2Unavailable
September 10, 20267.4 MBScanned
Fixed
  • A JavaScript error on user profile pages when passkeys were disabled.
  • Users required to use 2FA could extend their own grace period.
  • A fatal error caused by an invalid author query parameter.
  • 2FA onboarding after logging in through WooCommerce.
  • Horizontal scrolling in Content Security Policy and region blocking tables.
  • The firewall could reference `advanced-headers.php` when the file did not exist.
  • Possible fatal errors caused by invalid data in public CSP and 2FA requests.
Improved
  • Updated the default Content Security Policy for WordPress 7.1 compatibility.
  • Improved database table checks.
v9.8.1Unavailable
August 31, 20267.4 MBScanned
* Security: Prevented deletion of the login nonce. * Security: Prevented changing the 2FA status from active to open. * Security: Prevented XML-RPC login without 2FA for users with 2FA configured.
v9.7.0
July 21, 20267.4 MBScanned
Fixed
  • The firewall event log now shows the correct region and country names.
  • The dashboard now shows the correct number of hardening tasks that still need attention.
  • Prevented a possible PHP warning during plugin activation.
Improved
  • Moved the code for deactivating other Really Simple Security versions.
  • Removed unused code.
  • Removed an empty directory from the plugin ZIP file.
  • Updated the color used for Metricool in the Other Plugins section.
v9.6.1
July 1, 20267.4 MBScanned
Fixed
  • Password expiration now works correctly with 2FA and passkeys.
  • Button styling in Content Security Policy and Permissions Policy tables.
  • Alignment of the e-mail validation status icon.
  • Vulnerability data is included in uninstall cleanup.
Improved
  • Updated translations to use the l10n PHP format.
  • User agent blocking now supports wildcard matching.
  • Removed an unused passkey log message.
  • Updated the Other Plugins section in onboarding and settings.
v9.6.0Unavailable
June 9, 202610.8 MBScanned
Fixed
  • 2FA grace period reminder emails could be sent unexpectedly.
  • Content Security Policy now follows the setting toggle correctly.
  • PHP 8.4 deprecation warning.
  • DNS verification issue in the Let's Encrypt wizard.
Improved
  • Vulnerability details now load only for the plugin or theme being activated.
  • Improved rule writing with file locking to avoid race conditions.
  • Uninstall cleanup now removes plugin options and transients more reliably.
  • Added a login page notice for invalid login sessions.
  • Improved 2FA user lookup performance on multisite.
  • Improved license check reliability.
  • Improved DirectAdmin Let's Encrypt certificate generation.
  • Improved several interface texts.
  • Event logs now support larger log tables.
  • Added RSSSL_INFO_LOG for extra debugging details.
  • Added more prerequisite checks before features can be enabled.
v9.5.11
May 5, 20269.5 MBScanned
Fixed
  • fatal error that could occur when a plugin uses admin_enqueue_scripts incorrectly.
  • a bug where the wrong settings value could be saved.
v9.5.10.1
April 30, 20269.5 MBScanned
Fixed
  • Undefined variable during cron.
Improved
  • Updated 2FA login flow to address inconsistent verification behavior.
v9.5.10Unavailable
April 14, 20269.5 MBScanned
Fixed
  • An issue that could cause a crash when activating alongside the Perfmatters plugin.
  • Some styling (CSS) issues to improve compatibility with WordPress 7.0.
Improved
  • Removed an unused AJAX callback.
  • Tested up to WordPress 7.0.

Why archive

Sometimes the latest release isn't the one you need. The archive lets you pin Really Simple Security pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.