Release v2.7.2
Secupress Pro v2.7.2
Latest versionWhat's new in v2.7.2
Secupress Pro v2.7.2 was released on . Like many Security Plugins, SecuPress has a bunch of awesome features. See the full changelog below and compare with the complete version history.
Release details
Released
7.1 MB
File available
Changelog
Other
- 19 Oct 2026
- Critical: Warn admins so they can check the backdoor and patch it.
- Removal: Ban Non-Existent Users Feature. Unknown identifiers are no longer blocked on the first try. Use Limit Login Attempts now.
Added
- Passwordless login now uses a 6-digit code instead of a magic link.
- Disable Application Passwords: refuse and log any Application Password authentication attempt.
- Move Login scanner checks whether the default login page is still reachable.
- Dashboard attacks widget lists attack types, trends and blocked IPs.
- Reading a WordPress option known as malware is logged as an "option" attack.
- Disallowed usernames are also refused as display names.
Improved
- A magic-code request for an unknown identifier shows the same form as a real account.
- Bad login attempts now count unknown identifiers the same way as real accounts.
- Enhance login error handling and disclosures in Login Errors Disclose feature.
- Learning Mode can review common page slugs (demo, beta, etc.) instead of treating them as critical.
- Backup folder can be set with the SECUPRESS_BACKUPS_PATH constant or the secupress.backups.path filter.
- Activating Bad URL Access now also enables Bad File Extensions (and the reverse on deactivation).
- Pro update checks also run outside wp-admin, so new versions are visible everywhere.
- Security Status shows the firewall state, blocked attacks and daily trends.
- Application Password usage can trigger a critical alert.
- Anti-spam obfuscates email addresses in front-end content.
- Remove the ssl_verify false from EDD class.
- Better detection of fake WP filename and fake WP option name.
- Allowed IPs from different providers (meta, google, rocket)
Fixed
- Escape sessions values late in Sessions Control feature, even if sanitized by WP first
- A double notice when you have 3 (??) security plugins active was visible
- Invisible login form when redirected from a Move Login page
- Better feedback message to differenciate whenever out server it out or your licence key is incorrect
- PHP Fatal error from JetFpack setting set_current_screen() during a REST Call
- Better JS selector for "Show all plugins" feature to prevent some other plugins popups to show too early.
- Security rules are no longer written when a previous SecuPress marker block has no closing marker, which could leave .htaccess or wp-config incomplete.
- Async scans are not queued twice, and their delay is applied correctly.
- Stop User Enumeration feature was blocking Editors to create or edit posts and pages.
- Fatal error in the dashboard attacks widget (wrong count passed to _nx, seen with Divi).
- File monitoring no longer reports the whole WordPress core as missing when the filetree is incomplete.
Compatibility
- Requires WordPress
- 5.5
- Tested up to
- 7.1.3
- Requires PHP
- 7.3
Verified safe
Secupress Pro v2.7.2 scanned clean with no security threats detected.
View full scan report