Version 3.3.0-RC2

= Version 3.3.0 – September 8, 2026 =

• Compatible with WordPress 7.1.
• New Request Rate Limit setting in Risk Assessment extension.
  • Limits the number of request (by IP address) within 10 minutes.
  • Added Retry-After header on status = 429.
• New Whitelist IP Addresses setting in Risk Assessment extension.
  • To bypass risk assessment for given IP addresses.
• New is_non_code_request() function to determine non-code request from url using wp_get_ext_types().
  • Extensions, by default, do not load for non-code requests.
  • If needed, extension must specify self::ALLOW_NON_CODE on parent::__construct().
• New 'plugin_reinstall' extension enables the re-installation of current plugins.
  • getReinstallLink() method provides html link to trigger a plugin reinstall.
  • reinstall_plugin_action() method used by eacDoojigger_reinstall_plugin action.
  • Adds 'Trigger Reinstall' link to tools page.
  • Adds 'Trigger Reinstall' links to plugins page using plugin_auto_update_setting_html filter.
• Moved admin-only extensions to admin folder.
• Use case-insensitive search for readme.txt/md file.
• Admin page tool-tips now converts new-line to break.
• Fix: Pass full/un-truncated blog version in plugin_update.trait.
• Fix: decryption in eacKeyValue::get()
• Fix/improve maintenance mode with accurate retry-after and [UntilTime] shortcode.
• Updated IpGeoLocation API to v3.
• Updated IpGeoLocation plans for rate limits and credits.
• Always respect Retry-After header in risk assessment APIs.
• Aesthetic/Nonstructural changes...
  • Enhanced getDocumentationLink().
  • Enhanced getSupportLink() with use of Support Link in readme.txt.
  • Removed 'Registration' link added 'Support' and 'Sponsor' to plugins page listing.
  • Updated readme and other documentation.
• Allow single option passed to add_admin_action_link then passed through url to triggered action.
• Allow passing alternate url to add_admin_action_link (override current uri);

Version 3.2.5

= Version 3.2.5 – August 6, 2026 =

• Fix: dashicons info icon left: unset.
• In cookie_consent.trait.php...
  • Validate plugin_or_service using wp_validate_consent_service().
  • Enhanced has_cookie_consent() to check category and/or service name for allowed/denied.
  • Add filter wp_get_consent_type earlier to prevent defaulting to 'allow' consent.
  • New wp_setcookie_service filter.

Updated readme and this release to reflect WP 7.1 compatibility

Version 3.2.4

= Version 3.2.4 – July 31, 2026 =

• Don't wait for rest_pre_serve_request in CORS origin check.
  • Prevents rest execution when forbidden.
• Use send_headers action for CORS headers.
• Fix: check return of parse_url for array.
• Fix: currentURL() for WP-CLI.
• Updated (finally) for PHP 8.4+
• Removed reference to E_STRICT constant.
• Implement explicit nullable types (?string).

Version 3.2.3

= Version 3.2.3 – June 5, 2026 =

• Compatible with WordPress 7.0.
• Fixed getVariable() when using derivative plugin(s).
  • Get default from eacDoojigger filter before derivative filter.
• Do not start a new session from an ajax call.
• Fixed error with allowed_http_origin filter when $origin_arg is an array.
• Fixed error when enabling output file for AbuseIPDB.
• Support wp_has_service_consent() from WP Consent API 2.0.

Version 3.2.2

= Version 3.2.2 – October 1, 2025 =

• Fixed SQL select for sitewide transient (meta_key) in eacKeyValue.
• Ignore (return default) options with ['-','_','.'] prefix in get_option().
• Pass $context array in logging methods.
• Force string return in getRequestParts(...) when null.
• Don't repeatedly set visitor cookie, only set if not found.
• Fix error in upgrader_process_complete when $hook_extra['plugins'] is null.
• Check headers_sent() in set_cookie() to prevent error.
• Option to bypass kses in minifyString() since typically is not html.
• Automatically strip invalid characters in minifyString().

Version 3.2.1

= Version 3.2.1 – August 1, 2025 =

• Fixed issues with uninstall and added support for keyvalue table(s).
• Fix for plugin update, not network activated, on multisite.
• Admin notice/settings errors recognize and eliminate duplicate notices.
• Risk assessment looks for "ip_allow_list.conf" file to reset assessment by IP address.
• datetime trait now uses DateTimeImmutable instead of DateTime, still returns \DateTime.
• Moved extension loading code to load_extensions trait.
• Fixed getRequestParts() using PHP_URL_* component.
• Add (and use) getRequestScheme() method.
• Add allow_request_origin() method, sets http_origin and allowed_http_origins filters.
• Add error_log on access_denied().
• Use Anonymous function to send headers in access_denied().
• Load theme extensions/doolollys after plugin extensions/doohickies.
• New isDeveloperLicense() and isUnlimitedLicense() methods.
• Add 'developer' and 'unlimited' to advanced mode settings array.
• Updated swRegistrationUI trait.
• Updated registration SDK.
• Updated license (for github distribution).

Version 3.2.0

= Version 3.2 – July 1, 2025 =

• Added eacDoojigger_risk_assessment_data filter allowing actors to filter risk assessment result.
• Fixed potential 1-second error in rate limit check of Risk Assessment.
• New eacKeyValue helper class for key/value pair storage.
  • see: https://github.com/EarthAsylum/eacKeyValue
• Internal transient methods use key/value helper instead of WP transient API.
• Internal options methods use key/value helper instead of WP options API.
• Reworked internal option backup/restore.
• Added 'Key/Value storage' as session manager option.
• Session 'transient' option uses WP transient functions (not internal).
• Make sure we have FS_CHMOD_FILE/FS_CHMOD_DIR set in autoload.php.
• Added doTask() method and do_cron_task action to event_scheduler extension.
• Delay scheduling events until init action, allows routing to Action Scheduler.
• Do Risk Assessment a bit earlier on wp_headers not wp.
• access_denied() checks for send_headers action.
• Strip tags when logging admin_notice warnings/error.
• Debug log entry for Action Scheduler tasks.

Version 3.1.1

= Version 3.1.1 – May 6, 2025 =

• Session extension:
  • Add wp_cache as supported session manager.
  • check for doing or did init on session_init.
  • session_init() returns bool (required).
• Include debugging filtered array in QueueMonitor (qm) output.
• Limit flush_caches() to once per minute.
• after_flush_caches filter allows return of cache name(s) flushed.
• Disable security extension for WP-cli.
• Added X-Kinsta-Edge-Incomingip to HTTP_IP_HEADERS.
• Check for string when overriding enable_option in extensions.
• Added isExtension flag (true) on registerExtension.

Version 3.1

= Version 3.1 – April 29, 2025 =

• Tweak admin loading actions to load before extensions.
• Added CORS override/allow by IP address or CIDR subnet.
• Improved/fixed extension loading and registration.
  • Prevent _load_textdomain_just_in_time was called incorrectly notice from WordPress.
    • All extensions - delay option registration until admin_init.
    • swRegistrationUI - delay admin links until admin_init.
    • abstract_extension - force delay of registerExtension() until admin_init.
  • Fix potential 'enabled' extension that should be 'disabled'.
  • abstract_extension - save enable_option name when registered.
• Rework plugin environment check - limit when checked (on activate, updates, or daily).
• Due to new extension (event_scheduler) and external dependencies, version set to 3.1.0.
  • Version 3.0.4 was not released.
• Added EAC_ALLOWED_WP_SCHEDULES to limit intervals shown on admin screen.
• Added allowed_schedules filter to filter out any unwanted schedules/intervals.
• security_cors: Use daily cron (if scheduled) to get host IP addresses.
• security_cors: Suppress scheme/host warning.

= Version 3.0.4 – March 31, 2025 =

• Tested with WordPress 6.8.
• New event_scheduler (cron) extension.
  • Intervals - Manage custom intervals (aka schedules).
  • Events - Schedule WP Core or custom interval events.
  • Tasks - Add tasks (actions) to scheduled events.
• createScheduledEvents() and removeScheduledEvents() called on plugin install/update now do nothing.
• Added plugin_activated and plugin_deactivated actions.
• Session extension - wait for WP 'init' before setting cookie.
• Visitor Id - wait for WP 'init' before setting cookie.
• Removed obsolete delete_option(...) statements.
• Optimized forEachNetworkSite() method.
• Removed schedule to purge transients, WP will do it (delete_expired_transients).
• Don't flush object cache (wp_cache_flush()) when using external cache.
• Added eacDoojigger_log_info|notice|warning|error|debug|always actions.
• Debugging extension enhancements.
  • Added wp-cron debugging options.
  • Added support for Queue Monitor.
  • Combined settings to single switch option.
• explode_with_keys() now accepts array of strings to explode.

Version 3.0.3

= Version 3.0.3 – March 11, 2025 =

• Remove check for 'X-Requested-With' in ajax request (cors).
• Fix inclusion of security_ra.abstract.php.