2.0.0 🚀 Scoring Firewall + Historical Tracking

Full Changelog: 1.8.1...2.0.0

1.8.1 🚀 AI Fraud Detection

• Add a new Fraud Review panel to the WordPress admin.
• Update documentation for extensive AI setup information.

Full Changelog: 1.8.0...1.8.1

1.8.0 🚀 AI Fraud Detection

What's Changed

• 1.8.0 by @tylerjohnsondesign in #16

Full Changelog: 1.6.0...1.8.0

1.6.0 IP Info + UI Updates

What's Changed

• (1.6.0) ✨ Add new updates to getting IP info + UI changes by @tylerjohnsondesign in #15

Full Changelog: 1.5.0...1.6.0

1.5.0 Role Whitelisting + Admin UI Overhaul

What's Changed

• (1.5.0) ✨ Add role whitelisting by @tylerjohnsondesign in #11
• (admin-ui) 🎨 Admin UI upgrade by @tylerjohnsondesign in #12
• RC/1.5.0 by @tylerjohnsondesign in #13

Full Changelog: 1.4.0...1.5.0

1.4.0 Whitelisting + Docs

Full Changelog: 1.3.0...1.4.0

Release 1.3.0

MightyShield 1.3.0

Hardening release in response to an automated card-testing attack. Focus: correctly identify the client IP behind Cloudflare, stop non-JavaScript bots that were slipping past the fingerprint/timing checks, and make silent failure modes loud. All changes are backward compatible — new options default to the previous ("flag") behavior, so upgrading changes no enforcement until you opt in.

🔒 Security & bug fixes

• Real client IP behind Cloudflare. get_client_ip() no longer trusts the spoofable X-Forwarded-For / X-Real-IP headers. It now reads Cloudflare's CF-Connecting-IP, trusted only when the connection actually originates from a published Cloudflare range, and otherwise falls back to REMOTE_ADDR. This closes IP-based evasion of the block list, rate limiter, velocity detector and failed-payment blocks, and a whitelist-bypass where X-Forwarded-For: 127.0.0.1 matched the auto-whitelisted loopback entry. Configurable via the mshield_trusted_proxies filter and an optional MSHIELD_IP_HEADER constant for non-Cloudflare proxies.
• Fixed a checkout-fatal CIDR bug. An IPv6 CIDR entry in the block/allow list caused an ArithmeticError (bit shift by a negative number) for every IPv4 visitor, breaking checkout. CIDR matching now requires matching address families and bounds-checks the mask.

🛡️ New protections

• Fail-closed on missing device data. New settings Action on Missing Fingerprint (mshield_fingerprint_missing_action) and Action on Missing Token (mshield_timing_missing_action) — flag (default) or block. Set to block to stop scripted, non-JavaScript checkouts, which previously bypassed both checks. A block on missing data (a weaker signal) intentionally does not apply the 24-hour IP temp-block, so a false positive can't lock out a real shopper; positive detections still do.
• Degraded-verification alerts. When the Smarty address API errors (e.g. HTTP 402 over-quota) and the plugin falls back to the basic ZIP/State check, it now logs a distinct degraded event, emails the admin (throttled to once/day), and shows a persistent admin notice until verification recovers — instead of silently downgrading.

🔧 Improvements

• Removed the DNS auto-whitelist. Activation no longer resolves the site hostname and whitelists the result (behind a CDN that whitelisted the edge IP). A one-time upgrade migration removes stale Server IP (DNS: …) entries.
• Forensic logging. Events now capture the user agent, billing email and request URI (previously the log stored none of these), surfaced in a new Details column in the log viewer.

⬆️ Upgrade notes

• No action required to upgrade; enforcement is unchanged until you set the new missing-data actions to block.
• Recommended when under active card-testing: set both missing-data actions to Block, and enable Cloudflare Turnstile (Fraud Checks → Bot Challenge) — the CAPTCHA fails closed and stops non-JS bots outright.
• The upgrade migration cleans any CDN-edge IP that a prior version auto-added to the whitelist.

Full compatibility: WooCommerce, classic and block checkout. No database schema changes.

1.2.0

What's Changed

• ✨ Add fraud actions, IP blocklist, CAPTCHA, checkout timing & device … by @tylerjohnsondesign in #1

New Contributors

• @tylerjohnsondesign made their first contribution in #1

Full Changelog: 1.1.2...1.2.0

1.1.2 👽 Smarty Address Validation Bugfix

Full Changelog: 1.1.1...1.1.2

1.1.1 👽 Smarty Address Validation Bugfix

Full Changelog: 1.1.0...1.1.1