🌊 v1.0.0 — First wave

• Brute-force lockouts per address on every way in: login form, WooCommerce, XML-RPC and application passwords, with a longer lockout for repeat offenders.
• Visitor address read from trusted proxies only, with Cloudflare support.
• Blocklist, and logins allowed or refused by country with Gecka Geolocation.
• Account names kept private: author archives, REST users route, oEmbed, sitemap, login and lost password messages.
• Breached passwords refused through Have I Been Pwned, by k-anonymity.
• Reserved login names, refused at registration and counted double on a failed login.
• XML-RPC, pingback and trackback switches, security headers, file editors off.
• Password resets and registrations limited per address.
• Mail alerts on a new administrator, a login from a new network and, as an option, every login.
• Journal of the logins and the account changes, statistics by entry point, country, network and system, dashboard widget.
• Site Health tests, personal data export and erasure, privacy policy paragraph.
• WP-CLI unlock command, safelist constant in wp-config.php, multisite support.