Version 2.6

[2.6] - 2026-04-24

Summary

Version 2.6 focuses on hardening and regression fixes across metaboxes, Wordfence integration, email verification suppression, action-scoping safety, and release/versioning consistency.

Added

• Email Verification runtime feature

  • New runtime class: features/class-feature-email-verification.php
  • Hooks:
    • admin_email_check_interval → forced to 0
    • admin_email_remind_interval → forced to 0
  • Wired into bootstrap and loader:
    • security-tools.php
    • includes/class-loader.php

• Expanded release verification coverage

  • Added session-level regression checks for reported and audit issues during the 2.6 hardening pass.
  • Covered action scoping, Hide Login behavior, Wordfence Users tabs, metabox scan buffering, option clearing, and policy-message cleanup.

• One-time comments closure marker

  • New option constant: Security_Tools_Utils::OPTION_COMMENTS_CLOSED_ONCE
  • Used to prevent repeat database work for comment closure on every request.

Fixed

• Metaboxes can now be unhidden reliably

  • Generalized empty-array preprocessing in includes/class-admin.php for checkbox-array options across:
    • Admins
    • Plugins
    • Themes
    • Widgets
    • Admin Bar
    • Metaboxes
  • Ensures Settings API receives explicit empty arrays when users uncheck all values.

• Wordfence Users tabs compatibility

  • Added handling for current Wordfence Users view links using wf2fa=active / wf2fa=inactive.
  • Added handling for wfls-active / wfls-inactive list item classes in CSS and JS fallbacks.
  • JS matching is now URL-marker based (no locale-dependent text matching).
  • Supports the full Wordfence plugin and standalone Wordfence Login Security, including network-active installs.
  • Supports Users screens in both site admin and network admin contexts.

• Hide Login custom URL warnings

  • Custom login slug requests now prepare the WordPress login globals expected by wp-login.php.
  • Prevents undefined-variable notices such as $user_login and $error when rendering the custom login URL.
  • Preserves normal login, logout, password reset, registration, and redirect handling through the custom slug.

• Hide Login blocked-route 404 safety

  • Default login routes such as /login, /wp-login.php, and unauthenticated /wp-admin/ now return a safe 404 response without directly including the active theme's 404 template.
  • Avoids theme fatal errors caused by loading theme templates from early login-blocking hooks.
  • Keeps the intended behavior: default WordPress login routes stay hidden from non-authenticated users.

• Disable Email Verification now works at runtime

  • Implemented real runtime enforcement instead of settings-only behavior.

• Theme controls no longer block Post/Page deletion

  • Theme action blocking is now scoped to theme-management contexts/pages.
  • Prevents false positives on post.php / edit.php workflows.

• User-facing policy message cleanup

  • Replaced non-plugin-UI phrases mentioning plugin name in block/error messages with site-policy wording.
  • Plugin UI copy continues to reference “Security Tools” where appropriate.

• Metabox discovery JS safety

  • Replaced direct wp global access checks with a safe typeof wp !== 'undefined' guard.

• Hide Admins query robustness

  • pre_get_users handling now uses WP_User_Query-appropriate checks and merges existing exclusions safely.

• Admin notices tracking alignment

  • Added missing change-tracking mappings for:
    • Login logo ID / URL
    • Hide login enabled / slug
    • Admin bar CSS IDs

Changed

• Comments closure behavior

  • Moved from request-wide repeated closure attempts to a one-time migration per enable cycle.
  • sanitize_disable_comments() resets one-time marker when the feature is enabled again.

• Settings-group mapping DRY improvement

  • Security_Tools_Admin_Settings::get_settings_group_for_page() now delegates to Security_Tools_Utils::get_settings_group_for_page().

• Legacy renderer cleanup

  • Removed deprecated Security_Tools_Admin_Page::render() legacy method.

• Versioning to single source of truth

  • Runtime version now comes from plugin header Version: in security-tools.php.
  • SECURITY_TOOLS_VERSION is derived from header version at runtime.
  • Removed distributed @version tags from source headers to avoid drift.

Internal Cleanup

• Removed orphaned/unreferenced internal getters with no in-repo usage:
  • Security_Tools_Admin::get_admin_page()
  • Security_Tools_Admin::get_admin_settings()
  • Security_Tools_Admin::get_admin_notices()
  • Security_Tools_Admin_Settings::get_sanitization()
  • Security_Tools_Loader::get_all_features()
• Kept Security_Tools_Feature_Hide_Login::get_custom_login_url() and integrated it into admin UI rendering.

Verification Notes

• Full PHP lint, JavaScript syntax checks, and session regression checks pass for the fixes above.
• Verified Hide Login locally:
  • Custom login URL returns the login form without undefined-variable notices.
  • /login, /wp-admin/, and /wp-login.php return 404 without theme fatal output.
• Verified Wordfence Users tab hiding against current Wordfence wf2fa view URLs and wfls-* list item classes.