Hard-Guard-Security-1.18.14.5

= 1.18.14.5 =

• Adds an opt-in Settings > Email notifications choice: "Check new admin in phpMyAdmin".
• Every five minutes (WP-Cron, traffic dependent), checks administrator capabilities directly in wp_usermeta without using stale WordPress caches. Detects new administrator assignments made through phpMyAdmin or SQL outside WordPress.
• Initializes a baseline on enable, records new detections as critical audit events and emails configured recipients when global email alerts are enabled. Existing administrators are not alerted on first enable.
• Updates the baseline on normal WordPress user/role hooks to prevent duplicate emails from scheduled monitoring. Does not claim to identify who performed a direct database change.
• Preserves all changes from 1.18.14.4. Local build, not upstream release.

= 1.18.14.4 =

• Adds an opt-in-per-event administrator creation/promotion notification (enabled when global email notifications are on).
• Detects role grants to existing users and creation of new administrator accounts; captures target account and request actor details.
• Notification triggers independently of Audit Log; preserves original logging and avoids duplicate email for creation/role assignment in the same request.
• Preserves corrected ZIP structure, database-only scanner, and anonymous wp-admin blocking. Local build, not upstream release.

= 1.18.14.3 =

• Packaging-only hotfix: remove nested outdated plugin copy inside assets/ so the WordPress installer chooses the correct main PHP entry point and activation link.
• Preserves anonymous wp-admin block and standalone database-only scanner from 1.18.14.2. Local build, not upstream release.

= 1.18.14.2 =

• Local patch: standalone read-only Database Scan mode, covering wp_options, wp_posts and wp_postmeta without file discovery or scanning.
• Separate scan button, progress, results and history; Quick and Full Scan retain their optional database checkbox.
• Includes previous 1.18.14.1 wp-admin anonymous-access blocking change. Not an official upstream release.

= 1.18.14.1 =

• Local patch (not an official upstream release): added an opt-in 404 for unauthenticated wp-admin page requests when a custom login URL is enabled.
• Blocks redirects that disclose the custom login URL, preserves authenticated admin access and frontend WordPress AJAX/admin-post requests.
• Uses the existing five-minute safety test, rollback and emergency bypass; imported configuration leaves wp-admin blocking disabled.

Hard-Guard-Security-1.18.14

= 1.18.14 =

• Maintenance version based on the repaired 1.18.12 package; no new malware-scanning features or database schema changes.
• Retains the behavioural heuristics module, PHP sibling-loader detection and activation migration safeguards.
• Allows reactivation of version 1.18.14 without re-running redundant database migrations on an already configured installation.
• Local corrected build; not an official upstream release.

Hard-Guard-Security-1.18.12

= 1.18.12 =

• Local maintenance build based on the corrected 1.18.11 v2 package; not an official upstream release.
• Includes the restored behavioural heuristics module and correction for bare relative PHP sibling loader paths.
• Bumped plugin metadata and version constant to 1.18.12. No further scanner feature changes.

Hard-Guard-Security-1.18.11

= 1.18.11 =

• WordPress-aware malware heuristics detect hidden administrator persistence, self-replicating PHP, secret WordPress REST access, plugin loader injection, Wordfence scan exclusion tampering and concealed Wordfence settings.
• Parent PHP loaders are promoted to critical findings when their referenced local siblings contain high-confidence backdoor behavior.
• Read-only database posture checks run with every completed scan: privileged default registration and wide Wordfence scan exclusions.
• Optional full database scans can additionally detect serialized multi-file backdoor manifests without deserializing unknown input.
• All ordinary scans inspect uploads/.htaccess for unsafe PHP handler settings, regardless of the separate daily monitor toggle.
• New installations enable the existing suspicious .htaccess monitor by default; existing site preferences remain intact.

Hard-Guard-Security-1.18.10

= 1.18.10 =

• Database scanner: a generic sc_* option name without other indicators is now a Low (score 10) finding instead of an automatic High warning.
• Exact SC-family artifacts known from confirmed incidents and content-based indicators retain their prior ratings.
• Low-severity database findings are visible in the scan results and the severity summary.

= 1.18.9 =

• Malware Scanner: added a Suspicious-level heuristic for WordPress plugins that hide their own entry from the installed Plugins list using the all_plugins filter and plugin_basename( __FILE__ ).
• Malware Scanner: added a Critical-level heuristic for obfuscated inline JavaScript loaders combining large numeric arrays, XOR character decoding, Base64 (atob()), and dynamic execution (new Function()).
• The JavaScript detection inspects inline script blocks emitted by PHP and avoids matching inert examples in PHP comments or string literals, reducing false positives.
• Both new rules identify suspicious behavior without relying on a specific malicious plugin filename or file hash.

Hard-Guard-Security-1.18.8

= 1.18.8 =

• Added Tools > Plugins file integrity directly below File Integrity.
• Verifies installed WordPress.org plugins against official exact-version checksum manifests from downloads.wordpress.org/plugin-checksums/.
• Uses SHA-256 when available, with MD5 as a compatibility fallback; installed file contents and hashes remain local.
• Reports modified, missing, added, and symbolic-link plugin files, with executable PHP-like differences elevated to Critical.
• Adds per-plugin Good, Warning, Critical, Unverified, and Error summaries without treating a missing checksum manifest as malware.
• Skips checksum requests for plugins that explicitly declare a non-WordPress.org update source.
• Added privacy documentation for the WordPress.org plugin checksum service and neutralized the checksum request User-Agent.

= 1.18.7 =

• Malware Scanner now strips PHP comments before persistence/signature severity analysis so documentation, IOC notes, and code examples cannot be promoted to High/Critical malware findings.
• Comment stripping preserves byte offsets and line numbers for accurate excerpts and source locations.
• High-confidence signatures found only inside PHP comments are reported, when applicable, as Informational (score 5) rather than executable malware.
• Real executable matches keep their existing severity and detection behaviour; non-PHP configuration checks remain unchanged.

Hard-Guard-Security-1.18.6

= 1.18.6 =

• File Permissions Scan now records every checked item, including Good results, instead of listing only selected healthy paths and problem findings.
• Permission results are ordered by severity: Critical first, then Warning, then Good; paths within the same severity are sorted naturally.
• Raised the dedicated File Permissions safety scan ceiling from 30,000 to 100,000 checked items while keeping the stricter malware/integrity result limits unchanged.
• Added pagination to the File Permissions report (200 rows per page) so large complete reports do not overload the WordPress admin screen.
• Replaced the generic file/result truncation notice for File Permissions with a precise message that appears only if the dedicated 100,000-item scan ceiling is reached.

= 1.18.5 =

• Added a read-only Admin username check under Settings > Data hiding. It detects whether an administrator account uses the common default login admin and recommends changing it to a unique username without modifying users, passwords, roles, or capabilities.
• Hardened the admin_footer_text integration so Hard Guard Security safely accepts null or other non-string values returned by earlier third-party filters, preventing a PHP TypeError in the WordPress admin.
• The footer compatibility change preserves existing footer text outside Hard Guard Security screens and does not alter scanner, firewall, login-protection, or authentication behaviour.

Hard-Guard-Security-1.18.4

= 1.18.4 =

• Database Scanner: recognise native WordPress oEmbed markup so its intentionally hidden wp-embedded-content iframe is not misclassified as a High-risk hidden external iframe.
• The exemption requires the full WordPress oEmbed marker set; generic hidden external iframes remain High and other malware rules still analyse the same database value.

= 1.18.3 =

• Scanner: flag unexpected PHP files directly in wp-content as Suspicious while keeping known WordPress drop-ins and common cache config paths location-allowlisted.
• Scanner: flag hidden dot-prefixed PHP-like files in wp-content/mu-plugins as High without treating normal must-use plugin PHP files as suspicious.
• Scanner: location allowlisting does not skip content analysis, so known drop-ins remain fully malware-scanned.

= 1.18.2 =

• Fixed false-positive self-detection of the SC auto-prepend marker in Hard Guard Security scanner source files.
• Detection still matches the real contiguous marker in scanned files and database values; only the scanner source representation was split so it no longer matches itself.

= 1.18.1 =

• Added automatic scanner-engine state migration during updates.
• Resets only transient scanner queue/state while preserving completed scan findings, settings, quarantine records, and ignored hashes.
• Closes unfinished scans cleanly and retries migration if the database operation fails.

= 1.18.0 =

• Rebuilt scanner startup as a local-only incremental engine with no WordPress checksum API dependency.
• Bounded file discovery across AJAX requests and bulk-queued discovered files to avoid shared-hosting timeouts.
• Kept Core integrity checks separate from malware scanning and preserved legacy scan-state migration.

= 1.17.7 =

• Harden scanner AJAX responses against output pollution before/after scanner handlers.
• Recover valid WordPress JSON embedded in warning/proxy output and automatically reconnect after lost responses.
• Batch core allowlist database inserts to reduce the 2% checksum stage from thousands of queries to a few batched inserts.

= 1.17.6 =

• Made scanner step/status AJAX responses resilient to PHP notices, warnings, and stray output that would otherwise corrupt JSON while the scan itself continues.
• Scanner UI now recovers from a single lost/invalid step response by re-reading the active scan status and continuing automatically instead of stopping at a stale percentage.
• Unexpected AJAX output is discarded from the browser response and, when WP_DEBUG_LOG is enabled, recorded in the PHP debug log for diagnosis.

= 1.17.5 =

• Added SC detection for the hidden wp-content/.anything directory observed on an infected site, including an alert even when the directory is empty.
• Added generic detection for executable PHP-like files inside any hidden dot-prefixed directory directly under wp-content, so randomized hidden directory names remain detectable.
• Hidden-directory findings are informational scan objects and are not offered to bulk quarantine; contained suspicious files remain individually actionable.

= 1.17.4 =

• Added targeted detection for the SC self-healing WordPress malware family described by Sucuri in September 2026.
• File Scanner now checks hidden wp-content PHP loaders, SC auto-prepend marker, suspicious auto_prepend_file directives, known hyper-engine-kit paths, random hex ZIP restore bundles, drop-in/theme rebuild behavior, and shared-memory API use.
• Database Malware Scanner now flags sc_*, _transient_sc_*, and _transient_timeout_sc_* option names, detects gzip+Base64 option payloads that decompress to PHP, checks SC markers in cron/options, and performs a best-effort read-only audit of database triggers on WordPress user tables.
• SC option-name matches are High by themselves to limit false positives; stronger payload/loader indicators can elevate the same infection to Critical.

Hard-Guard-Security-1.17.3

• Added optional Antispam protection for the classic WooCommerce My Account registration form.
• Added optional Antispam protection and a separate per-IP rate limit for the classic WooCommerce lost-password request form.
• Extended Math CAPTCHA to protected registration and lost-password forms while leaving WooCommerce checkout and Store API flows untouched.
• Updated the WordPress.org compatibility declaration to Tested up to WordPress 7.1.

Hard-Guard-Security-1.17.2

• Added an optional Math CAPTCHA for native WordPress comments and WooCommerce reviews with Off, Always, and Only for suspicious visitors modes.
• Suspicious mode uses recent local spam/reject history for the visitor IP and proximity to the configured comment rate limit without external CAPTCHA services.
• Math challenges are signed, time-limited, and validated server-side without exposing the expected answer in HTML or JavaScript.