🐬 v1.1.1 — A little room between the waves

• Notices above the header of the admin pages spaced like those of Site Health.

🪸 v1.1.0 — Reef ready for the open ocean

• Author archives and the REST users route closed to subscribers and customers too: only the accounts that can write posts see them, a capability the gecka_security_enumeration_capability filter changes. An account keeps its own archive and routes.
• The journal names the account behind an enumeration refused to someone logged in.
• A scan of the author archives or of the users route is one journal row per hour, counted, instead of one row per request.
• Admin pages styled again on sites that install the plugin through their own Composer.
• The breached-password check is off until an administrator switches it on, and Site Health recommends it. Sites that never saved the settings had it on by default: switch it on again under Settings > Security.
• The breached-password warning shows on the dashboard, the profile and the screens of the plugin only.

🌊 v1.0.0 — First wave

• Brute-force lockouts per address on every way in: login form, WooCommerce, XML-RPC and application passwords, with a longer lockout for repeat offenders.
• Visitor address read from trusted proxies only, with Cloudflare support.
• Blocklist, and logins allowed or refused by country with Gecka Geolocation.
• Account names kept private: author archives, REST users route, oEmbed, sitemap, login and lost password messages.
• Breached passwords refused through Have I Been Pwned, by k-anonymity.
• Reserved login names, refused at registration and counted double on a failed login.
• XML-RPC, pingback and trackback switches, security headers, file editors off.
• Password resets and registrations limited per address.
• Mail alerts on a new administrator, a login from a new network and, as an option, every login.
• Journal of the logins and the account changes, statistics by entry point, country, network and system, dashboard widget.
• Site Health tests, personal data export and erasure, privacy policy paragraph.
• WP-CLI unlock command, safelist constant in wp-config.php, multisite support.