14 versions
Security Ninja Premium history.
Every release of Security Ninja Premium is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
0 of 14 releases scanned clean·14 flagged
v5.303Latest
September 8, 20268.9 MBSuspicious
Other
- 2026-09-08
Added
- Visitor IP detection - Choose how the firewall reads the visitor IP: Automatic, Cloudflare, proxy headers, or REMOTE_ADDR. Automatic trusts Cloudflare ranges by default. For another load balancer or reverse proxy, add its IPs under Trusted proxy CIDRs. Free and Pro.
Improved
- Vulnerability Scanner - Scheduled warning emails wait for a finished scan, skip plugins and themes that are gone or already patched, and do not repeat the same findings within 24 hours. Thank you Jamie.
- Deactivation - One central "Remove settings when deactivating" switch. Leave it off to keep settings, scans, logs, and cached files. Scheduled jobs still stop when the plugin is deactivated.
- Uninstall - Removing the plugin also clears module tables, settings, cached files, and related user metadata.
- Events Logger - Administrator emails now cover new accounts and role promotions.
- Events Logger - Speed improvement - When logging is off, event hooks and database writes are skipped. Broad REST API error logging stays off by default; turn it on in Events settings if you need those diagnostics.
- Settings import/export and MainWP - Events REST logging and visitor IP settings, including trusted proxy CIDRs, are included when you copy settings between sites.
- Malware Scanner - Removed the unused legacy scanner.
- MainWP - Applying settings remotely now reschedules the scanner cron when the schedule changes, and applies the same wp-config updates as the Fixes page (file editor, debug, secure cookies).
- MainWP - Remote settings now include WooCommerce rate-limit numbers, 2FA grace period and login copy, and satellite/ASN soft-mode lists.
- Frontend - Speed improvement - Premium no longer loads unused Pro modules on public page views. Free modules are unchanged. Thank you Jose.
September 1, 20268.9 MBSuspicious
Other
- 2026-09-01
Fixed
- Firewall - Per-visitor reverse-DNS, ASN, and GeoIP caches no longer fill the WordPress options table with one row per IP. On busy sites without Redis/Memcached that could grow to hundreds of thousands of rows and cause intermittent downtime. After update, leftover rows are removed automatically in small batches. Thank you Davina.
- Firewall - Search-engine and crawler checks only run reverse-DNS when the User-Agent looks like a known crawler. Normal browser traffic no longer triggers a DNS lookup on every page view. AI crawlers (OpenAI, Perplexity, Claude) are checked against published IP ranges only.
- Firewall - Hostname-based "blocked hosts" matching (part of Filter Suspicious Queries) is off by default. URI, query string, user agent, and referrer rules still run. Developers can re-enable hostname checks with the secnin_cf_check_blocked_hosts filter.
- Firewall - Satellite/ASN softening (Pro) no longer calls the remote ASN API on every miss when the site has no object cache. With Redis or Memcached, results are cached there instead of in the database.
- Firewall - The list of remembered validated crawler IPs is limited to 200 entries so it cannot grow without bound.
- Fixes - Disable Username Enumeration now blocks anonymous REST user listing (/wp/v2/users and ?rest_route=), not only by removing the endpoint. The username enumeration security test checks that path as well. Thank you Elias.
August 15, 20268.9 MBSuspicious
Other
- 2026-08-14
Fixed
- Compatibility - Removed a chillerlan Settings class_alias that broke LatePoint (and similar) booking confirmation QR codes after the 5.294 Imposter isolation fix. Thank you Daniel.
- MainWP - Copying Malware Scanner whitelist settings now keeps filename, hash, and pattern entries instead of flattening them into strings the scanner ignores.
- Core Scanner - Deactivating the plugin on a Multisite subsite no longer deletes network-wide scan results, ignore lists, or the main-site daily scan schedule.
- MainWP - Malware whitelist path sanitization now accepts the stored `filename` field when settings are copied between sites.
Improved
- Security headers - Default Referrer-Policy is now strict-origin-when-cross-origin (browser-aligned; better embed compatibility). Existing saved settings are not changed. Thank you Heath.
- MainWP - Remote vulnerability refreshes now return clear scheduled, already-pending, unavailable, and scheduling-failed responses.
- MainWP - Remote settings apply accepts blocked-country lists, Malware Scanner whitelist paths, and Core Scanner ignore paths with Security Ninja for MainWP 2.2.0+.
Added
- MainWP - Added the remote `update_vulnerabilities` action for free and Pro sites. It schedules a dedicated one-off database refresh even when the normal daily or weekly vulnerability job already exists.
v5.294Unavailable
August 2, 20269.0 MBSuspicious
Other
- 2026-08-02
Fixed
- Vulnerability Scanner - Local vulnerability database files are stored compressed so host malware scanners no longer false-positive on known-issue descriptions (e.g. wp-config). Thank you Lee.
- Compatibility - Imposter-prefixed vendor autoload no longer claims unprefixed chillerlan namespaces, fixing a fatal when LatePoint (and similar plugins) generate booking QR codes. Thank you Daniel.
- Core Scanner - Scheduled (cron) scans no longer fail with "Insufficient permissions". Manual scans were fine; background runs now complete as expected. Thank you Mirco.
- AI Security Advisor - Prevent a critical error on Overview when WordPress AI Client connector checks fail (e.g. TypeError from getModelMetadataMap). Admin stays usable; thank you Tyson.
- AI Security Advisor - WordPress Abilities register on plugin load so REST and other AI tools can discover them reliably.
- AI Security Advisor - Abilities load their data when invoked outside the Advisor screen (no fatal on REST/MCP calls).
- Vulnerability Scanner - Admin menu badge and other admin hot paths no longer load the full vulnerability database on every wp-admin request (could time out / 502 on slower hosts). Counts are served from cache; scans run in the background via WP-Cron. Thank you Christopher.
- Vulnerability Scanner - Opening Security Ninja no longer sync-downloads the vulnerability database when files are missing; updates are scheduled in the background. Pending scans no longer show a false "no vulnerabilities" message.
- Cloud Firewall (Pro) - "Only block these countries from login functionality" now works when "Prevent Banned IPs from Accessing the Site" is ON. Previously, country login-only could still full-site block via the visitor check path. Thank you Jamie.
Improved
- Cloud Firewall - Faster visitor checks with less DNS and disk work on each page load.
- Vulnerability Scanner - Lighter scheduled vulnerability list updates with lower memory use.
- AI Security Advisor - WordPress Abilities exposure is on by default for new installs (can be turned off in AI settings).
- Vulnerability Scanner - Plugin/theme and vulnerability-database updates keep the last known results until the background rescan finishes (no empty badge gap).
- Cloud Firewall - Logged-in admins skip expensive ban checks in wp-admin and admin-ajax; local banned-IP list is cached per request.
- sn-global.js loads only on Security Ninja admin pages; AI Security Advisor class files load on demand instead of every request.
- Cloud Firewall (Pro) - Added GetTerms cookie scanner IP (45.55.125.144) to the built-in automatic whitelist (always on; no checkbox required). Thank you Jamie.
v5.293Unavailable
July 22, 20269.0 MBSuspicious
Other
- 2026-07-22
Added
- File Viewer - Safely preview common images (PNG, JPG, JPEG, GIF, WebP, ICO) from Core and Malware Scanner results. SVG is not supported. Images are verified before display and shown only in the admin viewer (they are not executed).
Fixed
- File Viewer - Extensionless and rotated log files such as error_log and error_log.1 open more reliably, including case-insensitive name matching.
- Fixes - Disable Username Enumeration no longer blocks URLs with parameters like book_author= (e.g. store search). It now matches only the WordPress author= parameter, and skips the block for logged-in users.
Improved
- File Viewer - Very large text/log files show a truncated preview instead of failing when over the size limit.
- Core Scanner - The View File button only appears when the file can actually be opened in the viewer.
- Security Tests - The unused-themes check no longer treats keeping an extra default WordPress (Twenty*) theme as required. Any inactive theme can be flagged for removal, matching the auto-fixer behavior. Thank you for the feedback.
v5.291Unavailable
July 6, 20266.7 MBSuspicious
Other
- 2026-07-06
Added
- Overview tab - AI Security Advisor card, next best actions, what changed since your last AI review, and quick action links to key modules.
- Security Advisor - Suggested next steps and "what changed since last report" panels use scan snapshots without an extra AI call.
- Cloud Firewall (Pro) - MonSpark uptime monitoring IPs are included in the built-in automatic whitelist (always on; no checkbox required). Thank you Heath.
- Malware Scanner (Pro) - Flags suspicious plugin and theme folder structure when wordpress.org checksums are unavailable (review recommended, separate from malware signatures).
Fixed
- AI Security Advisor - Database upgrade on update adds the snapshot column to existing AI report tables so comparisons work on upgraded sites.
- 2FA (Pro) - Email code verification works when you press Verify or Enter.
- AI Security Advisor - Your selected AI connector applies when you generate a report.
- Setup wizard - Opens automatically on first install only.
- Cloud Firewall - Filter Suspicious Queries no longer false-positives on s2Member loader URLs.
Improved
- 2FA (Pro) - Login verification updates apply immediately after plugin updates.
- 2FA (Pro) - Administrator is pre-selected under Required Roles when 2FA is not yet enabled; clearer grace period help for required roles.
- AI Security Advisor - Model selection follows WordPress AI Client settings.
- Cloud Firewall (Pro) - Added more WP Compress service IPs to the built-in automatic whitelist (always on; no checkbox required).
- Core Scanner - Detects unexpected files in the WordPress root and hidden dotfiles in wp-admin and wp-includes.
- Malware Scanner (Pro) - Clearer integrity messaging; structural findings included in issue counts, whitelist, scheduled reports, and AI advisor context.
- Core Scanner - OS metadata files (e.g. .DS_Store) are excluded from scan results.
- Core Scanner - Severity levels (critical, warning, notice) with guidance for phpinfo and dev-tool files; table-based results UI.
- Core Scanner - Live scan results without page reload; summary stats; Overview Core Integrity widget.
- White Label (Pro) - Security Advisor and Overview use your white label plugin name in the UI and AI reports. Thank you Davina.
- Visitor Log (Pro) - Cleaner Refresh button on the visitor log page.
- Core Scanner - Summary strip with scan context, status banner, and last-scan metadata; delete or restore individual rows without a full rescan.
- Core Scanner - Findings action buttons match Malware Scanner styling (View File, Diff, Restore, Delete).
- Malware Scanner (Pro) - Issue counter on the Malware tab when suspicious files are found.
- Malware Scanner (Pro) - Summary strip with last-scan context, status banner, and Whitelist all; streamlined results header.
- Malware Scanner (Pro) - Findings use the same table layout as Core Scanner (file, severity, guidance, actions) with location group headers.
- Core Scanner and Malware Scanner - Cleaner findings list layout.
v5.290Unavailable
June 30, 20266.6 MBSuspicious
Other
- 2026-06-30 *
Added
- 2FA (Pro) - Optional mode: enable 2FA without requiring any role; leave all required roles unchecked for opt-in only (with an admin notice when saved).
- 2FA (Pro) - Users can enable 2FA from their profile (authenticator app or email, when allowed) even if their role is not required.
- 2FA (Pro) - Admins can allow authenticator app and/or email; users choose their method at login when both are enabled (preference is remembered).
Improved
- 2FA (Pro) - Required roles can be fully unchecked and stay saved (previously Administrator was forced back on).
- 2FA (Pro) - Grace period "Skip for now" applies only to role-required users who have not voluntarily enrolled.
- 2FA (Pro) - Grace period can be set to 0 days to enforce setup immediately
- CSS on wizard installation.
v5.287Unavailable
June 2, 20266.6 MBSuspicious
Other
- 2026-06-02
Fixed
- Change Login URL (Pro) — Works when Cloud Firewall is disabled; only “Change login URL” and the slug need to be enabled under Login Protection.
- Change Login URL (Pro) — `/your-slug/` login URLs work even when permalinks are Plain (fixes 404 when the Preview link used a path-style URL).
- Change Login URL (Pro) — Reliable path matching for subdirectory installs; fallback serves login if WordPress resolved the request as a 404.
- Change Login URL (Pro) — wp-admin blocking applies to `/wp-admin` with or without a trailing slash.
Improved
- Change Login URL (Pro) — Admin Preview shows the same URL the plugin uses (`?slug` on Plain permalinks, `/slug/` otherwise).
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Security Ninja Premium to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.