v3.6.0 — Safe Cloudflare defense adoption

Safe Cloudflare defense adoption

The hardening installer now verifies the deployed defense policies without replacing rules by description. This preserves combined protections, legacy rule references and retained rate-limit exceptions.

• Explicit new-zone onboarding checks ownership and quota before additive changes, checks for concurrent drift, and verifies readback.
• Unknown conflicts and partial failures stop for review. Existing policies are never automatically replaced, consolidated or rolled back.
• Legacy hardening controls are replaced with Verify / Onboard Defense Baseline.
• Targeted WP Engine-before-Cloudflare purges and paced maintenance are unchanged. Upgrades, edits and purges do not run the firewall installer.

Upgrade

Back up the installed plugin and update one installation first. Hold for updates is optional if you want to prevent this upgrade from starting an enabled maintenance batch; review pending work before resuming. When upgrading from v3.4.4, temporarily disable its automatic broad-purge triggers and review pending jobs first.

Do not run combined cache installation just to verify compatibility. Existing deployed zones need no account-wide reinstall. New-zone onboarding is an explicit separate action.

Validation

All 153 rollout fixtures verified. Mocked API, quota, drift, partial-failure, expression, standalone/multisite WordPress, WP Engine purge and paced-maintenance tests passed. No live firewall changes or cache purges were used for testing. Cloudflare additions are not transactional; interrupted requests can leave a partial addition requiring review.