Silver Assist Security Essentials v1.1.15

Changes in v1.1.15

🚨 Under Attack Mode & CAPTCHA Protection

• Login CAPTCHA: Math-based CAPTCHA challenge on WordPress login page when Under Attack Mode is active
  • Validates CAPTCHA answer server-side before authentication
  • Accessible design with ARIA labels and screen reader support
• CF7 CAPTCHA: CAPTCHA challenge injected into Contact Form 7 forms during Under Attack Mode
  • Automatic injection via wpcf7_form_elements filter
  • Server-side validation via wpcf7_validate hook
• Shared Template System: templates/captcha-field.php renders consistent CAPTCHA across all entry points
  • SecurityHelper::render_template() for output-buffered template rendering
  • JavaScript-powered refresh without page reload
  • Dedicated captcha.css and captcha.js assets with build pipeline integration
• Remember Me Removal: "Remember Me" checkbox hidden via CSS on login page
  • Session cookie lifetime enforced to match configured session timeout
  • Prevents users from bypassing session timeout policies
• Singleton Pattern: UnderAttackMode converted to singleton matching IPBlacklist pattern
  • getInstance() used consistently across LoginSecurity, ContactForm7Integration, and SecurityDataProvider

📊 Dashboard Card Enhancements

• Under Attack Mode Status: Real-time Active/Inactive indicator in General Security dashboard card
• IP Blacklisting Status: Enabled/Disabled indicator in General Security dashboard card
• Session Timeout Stat: Displays configured timeout value (minutes) in Admin Security card
• Dashboard Auto-Refresh: Switching to dashboard tab automatically refreshes security status and login stats
• Bot Protection Selector Fix: Updated JS selector from :last-child to :nth-child(2) after Session Timeout stat addition

🐛 Autosave Indicator Fix

• Persistent Indicator Bug: Fixed showSavingIndicator() only showing visual feedback on first save
  • Root cause: .fadeOut() left indicator in DOM with display:none, subsequent calls found existing div and did nothing
  • Fix: .stop(true, true).html(savingText).removeClass("error").show() on existing indicator
  • Changed $("form").append() to $("form").first().append() to prevent duplicates

🌍 Translations Update

• POT Regenerated: wp i18n make-pot — 791 → 1087 lines, all new translatable strings captured
• Spanish (es_ES): 82 new strings translated, 61 fuzzy flags resolved, 4 format errors fixed
• Binary Compiled: .mo file regenerated with msgfmt --check validation (234 translated messages)

📚 Documentation

• README.md: Added Under Attack Mode, CAPTCHA, IP Blacklisting, Session Timeout, Remember Me removal sections
• Test Coverage: Updated counts to reflect current test suite (350+ unit, 50+ integration)

🎨 Dashboard UI Overhaul

• Card-Based Layout: Complete redesign of the security dashboard with status cards
  • Login Security, Admin Security, GraphQL Security, General Security, and Form Protection cards
  • stat-value/stat-label components for consistent data display
  • Feature-status rows with enabled/disabled indicators and ::before icons
  • Security Statistics section: Blocked IPs, Failed Attempts (24h), Security Events (7d)
• Activity Tabs: New tabbed interface (Blocked IPs / Security Logs) in Recent Activity section
  • Loading spinners and loading-text placeholders for async content
  • Interactive tab switching with smooth transitions
• Settings Tabs Card Migration: All 4 settings tabs now use .status-card with .card-header/.card-content
  • Login Protection, GraphQL Security, Contact Form 7, and IP Management sections wrapped in styled cards
  • Consistent card structure with header icons across all tabs
• Status Indicator Semantics: Renamed .disabled to .inactive for clarity
• Toggle Switch Refactor: Native :checked selector with .toggle-slider class instead of JS class toggling

🛡️ Admin Hide Security Restored

• Toggle switch to enable/disable admin URL hiding
• Custom admin path input with real-time validation and preview
• Security warning notice with recovery instructions
• Path validation fallback for undefined error messages

📊 Security Logs & IP Management

• Security Logs Panel: New logs viewer in dashboard Recent Activity
  • AJAX-loaded table with timestamp, event type, and details columns
  • Secure DOM construction using jQuery .text() to prevent XSS
• IP Unblock Functionality: Unblock IPs directly from IP Management tab
  • unblock_ip AJAX endpoint in SecurityAjaxHandler
  • Full table view with per-IP unblock buttons
  • Compact dashboard summary (last 3 IPs) with "View all" link
• Blocked IPs Display: Split into compact dashboard summary and full IP Management table

🔒 Security Hardening

• DOM XSS Prevention: Added escapeHtml() helper to admin.js for all user-data DOM insertion
  • Blocked IPs table: IP addresses, reasons, timestamps all escaped
  • Security logs: Rebuilt with jQuery DOM construction (.text()) instead of template literals
  • CF7 blocked IPs: Table headers use esc_html__(), cell values use esc_html()
• AJAX Scope Fix: Resolved ReferenceError — ajaxurl/nonce now destructured in correct scope for unblock button handlers
• Smart Logging System: Severity-based security event logging
  • 58 event types classified as error (13), warning (33), or info (12)
  • WP_DEBUG gate — no log output when debugging is disabled
  • Test environment filtering — only errors logged during tests
  • [ERROR]/[WARNING]/[INFO] severity prefixes in log format
  • Eliminated ~70 noisy log lines from test output

🧩 New Components

• RenderHelper Utility Class (src/Admin/Renderer/RenderHelper.php): Shared static methods for UI rendering
  • render_feature_status() — Feature enabled/disabled rows
  • render_stat() — Numeric stat values with label and optional suffix
  • render_async_stat() — AJAX-loaded stat cards with loading spinner
• SecurityDataProvider Expanded: Added form_protection, GraphQL detail fields (query_depth_limit, query_complexity_limit, query_timeout, introspection_disabled), xmlrpc_disabled, version_hiding, and overall statistics
• StatisticsProvider: Cross-component stats with inlined log file reading to avoid circular dependency
• DashboardRenderer Refactored: All repetitive HTML blocks replaced with RenderHelper calls (8 feature-status, 7 stat, 3 async-stat)

🔒 Autosave / Submit Race-Condition Guard

• Submit buttons disabled with "Saving..." label during autosave
• Manual submit cancels pending autosave timer
• 15s fallback timeout re-enables buttons if autosave hangs
• CSS .is-saving class for visual feedback

🐛 Bug Fixes

• CF7 Detection (CF7 v6.x): Removed deprecated function_exists('wpcf7_get_contact_form_by_id') check — this function was removed in CF7 v6.x, causing the CF7 tab to not appear
• CF7 Blocked IPs Loading: loadCF7BlockedIPs() now targets both #cf7-blocked-ips-content and #cf7-blocked-ips-container
• CF7 Tab Data Loading: Added cf7-security case to switchToTab for CF7 tab activation
• CF7 Empty State Styling: Changed to .no-threats class for consistent green styling
• Admin Path Validation: Added fallback "Invalid path" for undefined error messages; removed static div (JS creates it dynamically)
• Toggle Switch Initialization: Skip checkboxes already inside .toggle-switch labels to prevent double-wrapping
• Blocked IPs Data Extraction: Handle both array and object response formats
• GraphQL Timeout Option Key: Fixed silver_assist_graphql_timeout → silver_assist_graphql_query_timeout to show correct dashboard value
• PHP Function Prefixes: Added \ to wp_json_encode(), removed unnecessary \ from round() (PHP built-in)
• SecurityDataProvider PHPDoc: Fixed mis-indented docblock for $stats_provider property
• Noisy Log Removed: Removed IP_CLEANUP_INITIALIZED log from Plugin.php

🧪 Test Suite

• AjaxTestHelper Trait: Reusable AJAX testing infrastructure
  • AjaxTestDieError extends \Error bypasses WordPress die handlers in tests
  • setup_ajax_environment(), call_ajax_handler(), teardown_ajax_environment() methods
• 36 Pre-Existing Test Failures Fixed across 5 categories:
  • UI structure mismatches — updated tab IDs, CSS classes, text labels
  • Removed/refactored methods — rewired tests to SettingsHandler::save_security_settings()
  • Hook registration issues — fixed test isolation and explicit component creation
  • Singleton/void/input ID — getInstance(), ob_start() buffering, correct field IDs
• 283 Tests Passing: Unit (122), Functional (42), Security (62), Integration (57+)

🎨 Code Quality

• PHPCS Compliance: Auto-fixed 223 violations via PHPCBF (0 errors, 3 pre-existing warnings remaining)
  • SettingsRenderer.php: 200 fixes (spacing, brace placement, indentation)
  • SecurityDataProvider.php: 23 fixes
• PHPStan Level 8: Resolved all 37 static analysis errors (100% compliance)

📚 Documentation & AI Config

• Copilot Instructions Updated: Documentation rule now distinguishes between project docs and Copilot config files
  • .github/skills/ — Copilot Skills (domain knowledge)
  • .github/prompts/ — Copilot Prompt Files (reusable workflows)
  • .github/instructions/ — Copilot Instruction Files (scoped context)
• Dashboard Styles Skill: .github/skills/dashboard-styles/SKILL.md — CSS classes, HTML patterns, component usage guide
• Dependabot Auto-Merge: Documented GitHub Actions limitation for workflow file modifications

Changed

• 📦 Contact Form 7 Stubs: Added miguelcolmenares/cf7-stubs ^6.1 for PHPStan static analysis
• 🔧 GitHub Workflow Permissions: Added contents: write and pull-requests: write to quality-checks workflow
• 🚀 Quality Checks Script: Improved non-interactive mode, CI/CD integration, WP_VERSION environment variable support
• ⚙️ GitHub Actions Workflow: Simplified to use unified run-quality-checks.sh script

Removed

• 🗑️ Deleted temporary documentation files (.github/FIX_SUMMARY.md, .github/GITHUB_APP_PERMISSIONS.md)

Package Information

• File: silver-assist-security-v1.1.15.zip
• Size: ~232KB
• License: Polyform Noncommercial License 1.0.0

Installation

1. Download the ZIP file below
2. Go to WordPress Admin → Plugins → Add New → Upload Plugin
3. Choose the downloaded ZIP file and click "Install Now"
4. Activate the plugin
5. Go to Settings → Security Essentials to configure

For detailed installation instructions, see the README.md file.

Security Features

• HTTPOnly cookie protection
• GraphQL security with rate limiting
• Login attempt limiting and session management
• WordPress hardening (XML-RPC blocking, version hiding)
• Real-time security dashboard with live statistics
• Multi-language support with comprehensive admin panel
• Automatic GitHub Updates - Powered by silverassist/wp-github-updater package