GoBuildWP 1.19.3

• New: gobuildwp/wporg-status-check reports installed plugins and themes WordPress.org has closed, with the date and reason, and those with no release in over two years. Components WordPress.org cannot vouch for are reported as unknown.
• New: website protection takes a trusted_proxies setting, so a site behind a load balancer or reverse proxy can name it from GoBuildWP Cloud. The protection status shows the address the guard sees, the trusted proxies in effect, and whether protection is switched off.
• New: define GOBUILDWP_DISABLE_PROTECTION as true in wp-config.php to switch all website protection off if it ever locks you out.
• New: an update GoBuildWP Pro held for review shows in the site issues report and in GoBuildWP Cloud.
• Fixed: X-Forwarded-For and CF-Connecting-IP were believed from any visitor. CF-Connecting-IP is now believed only from Cloudflare's addresses, and X-Forwarded-For only from proxies you name.
• Fixed: blocks wider than /16 (IPv4) or /48 (IPv6) and blocks covering your own address are refused.
• Fixed: restore points no longer copy wp-config.php, the zip is encrypted with a key derived from the site's salts, and an expired restore point's files are deleted.
• Fixed: undo refuses when the item changed since, unless you ask it to force.
• Fixed: cleaning an infected setting removes the option only when the injected code is all it holds.

Security fix: the firewall no longer trusts forwarded IP headers from any visitor. Adds a closed-plugin check, trusted proxies and encrypted restore points.