7 versions
WP Cerber Security history.
Every release of WP Cerber Security is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
7 of 7 releases scanned clean
v9.8.3Latest
July 2, 20261.2 MBScanned
Added
- The Activity log and Traffic log CSV exports now report the date range they cover, adding the oldest and newest record timestamps to the export header.
Improved
- Activity log and Traffic log CSV exports now stream matching rows in a single unbuffered pass, keeping memory usage flat and avoiding deep-offset scanning, which makes exporting large logs faster and more reliable.
- Activity log and Traffic log exports now send the `X-Accel-Buffering: no` response header so an Nginx proxy in front of PHP-FPM forwards each chunk immediately instead of buffering the whole export, improving time-to-first-byte on large exports.
- Decoding of stored Traffic Inspector request field data is now more robust, consistently treating nullable legacy values, empty values, invalid JSON, and unsupported serialized payloads as an empty array.
Fixed
- Corrected memory limit handling during Activity log and Traffic log exports, where a numeric limit such as `512` could be applied as bytes instead of megabytes, preventing WP Cerber from raising the available memory and causing exports to stop earlier than expected.
- In the Traffic Inspector Log "Advanced Search", combining the "Any software error" option with other filters could return requests with recorded PHP errors that did not match the other criteria; results now match all selected filters.
- Dashboard links in Activity alert notification emails could carry mismatched query parameters, for example the IP filter receiving an IP-range boundary value, which opened an unrelated filtered view; the links now use the correct values.
- Activity alerts that match on a search string now resolve the user of the logged event instead of falling back to the current administrator, so user-based alert matching behaves correctly.
- Prevented an undefined array key notice in `CRB_Activity::is_modified_since()` when the `data_modified` status value was missing, and corrected an operator-precedence error so a missing modification timestamp is correctly treated as modified.
Other
- Security: Sanitized user-controlled profile display names (first name, last name, and display name) before they are concatenated into `Name ` mail recipient strings, closing an email header injection vector that could add an extra recipient to the two-factor authentication PIN email and to Activity alert notification emails.
- Security: Plugin ownership-change messages on the scanner page are now rendered through WP Cerber's UI layer with contextual output escaping instead of raw HTML, removing a potential stored admin XSS vector from externally supplied plugin ownership metadata provided by the WordPress.org plugin repository.
- Security: Activity log and Traffic log CSV exports now send the `Cache-Control: no-store` response header to prevent a sensitive security-log export from being cached by the browser or an intermediate proxy.
June 12, 20261.2 MBScanned
Improved
- Renamed the "White IP Access List" and "Black IP Access List" terms to "Allowed IP Access List" and "Blocked IP Access List" across the admin UI for clearer access-control terminology.
- Client IP address detection now converts IPv4-mapped IPv6 addresses to standard IPv4 notation in proxy and IPv6 environments. ACL entries using mapped IPv6 notation no longer match these normalized client IP addresses.
- Client IP address detection no longer falls back to the `HTTP_CLIENT_IP` header when the `X-Forwarded-For` proxy header is empty or does not contain a valid address.
- The integrity scanner now records detailed database error information in the log when diagnostic logging is enabled in the settings.
Fixed
- Geolocation data for IPv6 addresses is now cached correctly, so country names appear immediately in the Activity log and Traffic log instead of being re-fetched from the geolocation service on each view, which previously caused extra AJAX requests and a noticeable delay.
- Eliminated the `ERROR 1062` ("Duplicate entry") messages that the IPv6 geolocation caching bug wrote to the server error log on each IPv6 lookup.
- If more than one IPv6 range or IPv6 network defined in IP Access Lists, the Traffic and Activity logs could display comments or labels belonging to a different IPv6 Access List entry, for example showing the label "IP whitelisted" for a request that was actually denied. The logs now show details that match the Access List entry involved.
- Database operations now compatible with WordPress table prefixes starts with a digit, such as `123_`. This resolves a regression introduced by the stricter database operation validation in WP Cerber 9.7.4, where affected sites could fail to run integrity scanner.
May 29, 20261.2 MBScanned
Added
- Timestamps in the fail2ban log now follow the operating system timezone instead of UTC, so fail2ban can correctly evaluate failed login attempts on servers using a non-UTC timezone.
- Added the constant CERBER_LOG_TIMEZONE to force an explicit timezone identifier for the fail2ban log when automatic detection cannot determine the system timezone.
Improved
- Hostnames written to the fail2ban log on failed login attempts are now sanitized to strip log-forging characters, allow only hostname-safe characters, and keep each entry on a single well-formed line.
- WP Cerber's admin interface now uses WordPress's --wp-admin-theme-color custom property instead of hardcoded accent colors, aligning tabs, focus states, and changelog callouts with the selected admin color scheme.
- The Tools / License page now shows localized, non-contradictory notices for empty, malformed, invalid, expired, or temporarily unverifiable license keys.
- Refactored database operations with the new CRB_Database and CRB_Query_Builder classes for more consistent query execution, transactions, safe value quoting, and validation.
- Added the Revalt result/error type as an internal foundation for more consistent operation results, diagnostic chains, and error logging.
- Traffic Inspector now validates decoded JSON request payloads and captures decoding errors for more reliable request logging.
- Sensitive-field masking and request-field preparation now use stricter validation, normalization, and escaping before database insertion.
- Admin notices emitted by WP Cerber are now rendered through crb_purify_message(), which allows only a defined set of HTML elements and attributes.
- The login security setting "Write failed login attempts to the system log file" has been renamed to "Log failed logins in a syslog-style format for automated IP banning tools". Behavior is unchanged.
v9.7.3Unavailable
April 24, 20261.1 MBScanned
Improved
- Plugin settings that accept REGEX patterns are now validated for syntax errors when an administrator saves settings, helping detect invalid patterns before they cause configuration problems.
- The Readiness widget now detects when required PHP functions are disabled even if a required extension is installed, and they provide more precise diagnostic messages.
Fixed
- Translation updates no longer attempt to download non-existent locales, which prevents the misleading error message Updating translations for WP Cerber Security (haz)… Download failed. Not Found.
- Regular expression patterns in the Traffic Inspector setting "Do not log these locations" now work correctly when they contain forward slashes, so matching requests are excluded from logging as intended.
- A minor bug that could cause the server error log message preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated.
- A minor bug that could cause the server error log message Constant CRB_DOING_BG_TASK already defined. Fixed: A minor bug that could cause the server error log message Attempt to read property "ID" on null.
- A minor bug that could cause the server error log message Call to undefined function curl_init().
- A minor bug that could cause the server error log message Undefined array key "primary_ip".
- A minor bug that could cause the server error log message Undefined array key "local_ip".
v9.7Unavailable
February 28, 20261.1 MBScanned
Added
- Implemented a "System Readiness" dashboard widget that surfaces configuration and environment issues impacting security and stability, with quick links to relevant settings and documentation.
Improved
- Enforced stricter Content-Security-Policy (CSP) measures in the plugin admin area by adding additional security directives.
- Enhanced the detection of obfuscated malicious JavaScript to better identify hidden security threats.
- More efficient analysis of suspicious requests by the firewall, resulting in better performance and fewer false positives.
- Implemented batch processing and timestamp formatting for spam comment cleanup to improve performance and prevent resource issues.
- Refactored database operations to use stricter identifier validation, improving SQL safety and compliance with MySQL standards.
- Updated HTTP header validation methods used for whitelisting requests in the anti-spam engine and traffic firewall settings. These settings now support entries with an empty value after the colon.
- Added exception logging and enhanced error handling to the continuous code quality assurance process.
- File handling operations are now more fault-tolerant with the implementation of explicit permission checks and thread-safe file locks.
- To prevent accidental movement dashboard widgets can now be reorganized using drag-and-drop via their headings only.
Other
- Compatibility: Refactored code to address deprecated features and ensure compatibility with PHP 8.5.
Fixed
- A minor bug where escaped HTML tags were not properly handled when rendering the settings pages user interface.
- A minor bug that caused the server error log message: preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /wp-cerber/cerber-common.php:4267.
- A minor bug that caused the server error log message: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated.
- A minor bug that caused the server error log message: Undefined array key "REQUEST_METHOD".
- A minor bug that caused the server error log message: preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated.
- A minor bug that caused the server error log message: Undefined array key "HTTP_HOST".
v9.6.10Unavailable
December 24, 20252.2 MBScanned
Other
- Important: WP Cerber now requires PHP 7.4 or newer to run, with PHP 8.x recommended for optimal performance and security.
Improved
- Optimized email alert links and admin navigation, improved handling of admin URLs for Cerber.Hub sites, and refined escaping in rare edge cases.
Fixed
- When a user entered a wrong password in the login form, the message showing how many login attempts remained would disappear.
- When the site was restricted to logged-in users only, the custom message above the login form would disappear after a user entered a wrong password.
December 23, 20251.3 MBScanned
Added
- Added detection of AI bots and LLM scrapers (OpenAI, Claude, Meta, Apple, etc.) to easily identify AI-driven traffic in logs and alerts.
Improved
- Browser detection now provides better accuracy in the logs, triage, and email notifications.
- Enhanced precision in identifying mobile OS and their versions, including better support for iOS and Android.
- Better detection of service agents (PayPal, Stripe) and automation tools (curl, Python, Wget) for more efficient analysis of background requests.
- Localization and translation logic has been rebuilt for better translation quality in non-English languages.
- Optimized server security by rewriting .htaccess rules to mitigate CVE-2018-6389.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin WP Cerber Security to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.