9 versions
Secupress Pro history.
Every release of Secupress Pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
9 of 9 releases scanned clean
v2.7.2Latest
October 21, 20267.1 MBScanned
Other
- 19 Oct 2026
- Critical: Warn admins so they can check the backdoor and patch it.
- Removal: Ban Non-Existent Users Feature. Unknown identifiers are no longer blocked on the first try. Use Limit Login Attempts now.
Added
- Passwordless login now uses a 6-digit code instead of a magic link.
- Disable Application Passwords: refuse and log any Application Password authentication attempt.
- Move Login scanner checks whether the default login page is still reachable.
- Dashboard attacks widget lists attack types, trends and blocked IPs.
- Reading a WordPress option known as malware is logged as an "option" attack.
- Disallowed usernames are also refused as display names.
Improved
- A magic-code request for an unknown identifier shows the same form as a real account.
- Bad login attempts now count unknown identifiers the same way as real accounts.
- Enhance login error handling and disclosures in Login Errors Disclose feature.
- Learning Mode can review common page slugs (demo, beta, etc.) instead of treating them as critical.
- Backup folder can be set with the SECUPRESS_BACKUPS_PATH constant or the secupress.backups.path filter.
- Activating Bad URL Access now also enables Bad File Extensions (and the reverse on deactivation).
- Pro update checks also run outside wp-admin, so new versions are visible everywhere.
- Security Status shows the firewall state, blocked attacks and daily trends.
- Application Password usage can trigger a critical alert.
- Anti-spam obfuscates email addresses in front-end content.
- Remove the ssl_verify false from EDD class.
- Better detection of fake WP filename and fake WP option name.
- Allowed IPs from different providers (meta, google, rocket)
Fixed
- Escape sessions values late in Sessions Control feature, even if sanitized by WP first
- A double notice when you have 3 (??) security plugins active was visible
- Invisible login form when redirected from a Move Login page
- Better feedback message to differenciate whenever out server it out or your licence key is incorrect
- PHP Fatal error from JetFpack setting set_current_screen() during a REST Call
- Better JS selector for "Show all plugins" feature to prevent some other plugins popups to show too early.
- Security rules are no longer written when a previous SecuPress marker block has no closing marker, which could leave .htaccess or wp-config incomplete.
- Async scans are not queued twice, and their delay is applied correctly.
- Stop User Enumeration feature was blocking Editors to create or edit posts and pages.
- Fatal error in the dashboard attacks widget (wrong count passed to _nx, seen with Divi).
- File monitoring no longer reports the whole WordPress core as missing when the filetree is incomplete.
September 25, 20267.1 MBScanned
Other
- 25 Sep 2026
- Security Fix: Directory traversal in the class file loader (administrators).
Added
- Firewall Learning Mode for 8G (observe signatures, review hits, allow globally or per URL prefix, auto-calibrate).
Improved
- WAF revamp: 8G signatures are now optional per filter, with local exceptions.
- Block Bad Referers is now available in Free.
- Hide WP, WooCommerce and PHP session cookies from the Support ID.
- Malware scanner still lists malware files when WP core checksums are missing, and matches "file" signatures on the filename.
- Deactivating a wp-config module no longer leaves the file or the setting in a bad state.
- Anti-spam comment delay now finds the comment form via the WordPress core field, so custom theme form IDs no longer break the timer.
Fixed
- Mixed content replacement now handles namespaced XML/SVG.
- Authors and other lower roles could not edit or create content with Stop User Enumeration.
- Apache bad URL access rules were missing the "-" substitution, so flags were ignored.
- "Expired license" displayed incorrectly on the dashboard widget.
- PHP warning when headers are already sent.
- Undefined variable notice in the System Status widget.
- reset() call on the pointers tour steps.
v2.7Unavailable
September 15, 20263.4 MBScanned
Other
- 12 Sep 2026
- Security Fix: Unauthenticated Authentication Bypass via 'secupress_auto_login_token' Parameter.
- Security Fix: Possible RCE when writing constants into wp-config.php.
- Security Fix: SQL Injection by administrators when deleting logs.
Added
- Pause the security for 30 minutes (settings kept, auto-resume, email warning).
- Dashboard widget "System Status".
- Alerts when an application password is added to an account.
- Expert settings for Anti Hotlink (allowed referers, redirection type, webp/avif/svg).
- Password protection for backup ZIP files.
Improved
- Application Passwords alerts are no longer enabled by default.
- Firewall updated to 8G (query, URI, host, cookie, user-agent, referer).
- Store backups outside the web root when possible.
- Strong passwords are now enforced on the password reset form. PasswordLess users cannot reset.
- Export/import restricted to configuration keys only (no logs, transients, scans, or banned IPs).
- HTTPS redirection now generates IIS rules.
- Compatibility fallbacks when the mbstring PHP extension is missing.
- Hide sensitive COOKIE values in block reports.
- Self-unban emails no longer leak whether an address exists.
- Updated forbidden file extensions list.
Fixed
- Rewrite rules and current URL for subdirectory, subdomain, siteurl and own-directory installs (readme.html, changelogs, bad URL/file access, Move Login).
- User enumeration via REST routes, language URL prefixes like /fr/, and ?_embed=.
- Possible PasswordLess bypass after last fix from Protect User Creation.
- (again) Possible fatal error "Call to undefined method ::is_processing()" if WooCommerce loads an older async lib (file monitoring, bad plugins, bad themes).
- Bad themes deactivation hooks.
- Unlock admin callback used a wrong message.
- A plugin returning to the repository was still listed as closed/old.
- Fake Google Bots filter.
- Wrong return type in rewrite bases helper.
- String/array issue in the database malware scan.
- Safely remove the PasswordLess option and fix the affected role check.
v2.6.2Unavailable
July 5, 20263.4 MBScanned
Other
- 25 Juin 2026
Fixed
- Possible fatal error when the data files are not correctly extracted.
- Users with same email domain present before the activation of the same name module were still tagged as bad.
- Fatal error on empty JSON
- Users from REST API still visible, it's CASE SENSITIVE!?
- Require module tools on submodule activation
Improved
- User secupress.me instead of google.com for testing
- Do not unvalidate passwordless email on plugin deactivation or licence deco
v2.6.1Unavailable
April 14, 20263.4 MBScanned
Other
- 03 April 2026
Improved
- Remove the ping on google.com, set it to secupress.me.
- Refactored the database scan logic in SecuPress_File_Monitoring to use background processing for scanning posts, options, and custom post types for malware patterns. Better perf, quicker scans incoming on big sites.
Fixed
- (again) Possible fatal error "Call to undefined method SecuPress_Background_Process_Bad_Plugins::is_processing()" if WooCommerce is installed since THEY include the obsolete version of the async lib before us...
- Warning notice when saving captcha style.
- Re-add the "monthly" index for cron schedules.
- Do not unvalidate passwordless email on plugin deactivation or licence deconnection
- Remove the usage of shell_exec() and `host $ip` that can overconsume resources on your host, bringing down your site (even if this was in SecuPress since 8 years, only now this cause an issue)
v2.6Unavailable
January 19, 20263.4 MBScanned
Other
- 16 January 2026
Added
- GeoIP Location on Login
- Search field in admin UI.
- Scanner for malwares in our 35 scanners.
Improved
- UI for Malware Scanner has been improved, and will be again ;) You'll find a "WP File Integrity" which has always been there since 1.0, just not mentionned as is.
- Add WP 2FA compatibility to Easy Login scan
Fixed
- Dashboard Widget not displaying graphs
- PHP Version Scanner was saying that the last version was "ok tier"
- PasswordLess activation checkbox was not checked after reload
- Remove secupress-data directory on uninstall (I forgot, my bad)
- "wp-includes/version.php" should not be tagged "different" anymore if you use a localised zip (in malware scanners)
- Possible fatal error when deactivating the module "Disable all actions on plugins" + "disable all actions on FTP"
- Possible fatal error "Call to undefined method SecuPress_Background_Process_Bad_Plugins::is_processing()"
v2.4Unavailable
December 24, 20253.3 MBScanned
December 3, 20253.3 MBScanned
Other
- 02 December 2025
Added
- Colored notices can be added up in the plugins page to help you prioritize updates by showing you since when the update is available.
- The standalone "SF Move Login" is now renamed "SP Move Login" and since it's the same feature as the one here, it will be deactivated and this feature here activated.
- "Move Login" feature can now display a Honeypot instead of a message or page. This is an expert setting, also, only available if you only have Admins on your site (or lusers will be banned trying to log-in, I know them)
- Translations are now done using the new `.l10n.php` format
Improved
- "Move login" feature will now display every other slugs, it now depends on the login one. "Register" is only available is the registration is open.
- Dashboard widget finally get a skin, can display a graph to check evolution of monthly attacks.
- All the messages from the "unlock yourself as an admin" on login page have been set to the same one to prevent guessing an admin email. props to Lohen Florent
Fixed
- JS Error when Antispam Comment Timer module is active
- Correct custom validity for roles in some cases
- Warning for undefined SECUPRESS_INSTALLED_MUPLUGINS constant
- Warning when the distant DB was not accessible
- Passwords couldn't be updated when Passwordless was active, even if your role was not targeted, or module activatjon not validated yet
- Changelogs couldn't be opened in the iframe popup in plugins.php page when "Prevent Actions on Plugins" feature was activated
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Secupress Pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.