Bunker 1.2.13

Bunker 1.2.13

The Other THRG Plugins tab in View Details now also lists Stickies. Nothing changes in how Bunker behaves.

Installed copies update from the Plugins screen.

Bunker 1.2.12

Bunker 1.2.12

A friendlier introduction. Nothing changes in how Bunker behaves.

Changes

• The plugin description under View details now starts from the situation Bunker is built for: a static website at the front, with WordPress quietly behind it for the forms, and bots knocking on the WordPress parts nobody else visits.
• The security alerts are explained in a few short sentences instead of one long paragraph.
• The GitHub README and project description were rewritten in the same plainer voice.

Install

Download thrg-bunker.1.2.12.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Installed copies update from the Plugins screen. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.

Bunker 1.2.11

Bunker 1.2.11

A tidy-up release. Nothing changes in how Bunker behaves.

Changes

• Removed an unused debugging method, an unused loop variable and three redundant type casts.
• Removed the leftover handling of HTTPS settings from an unreleased 1.2.2 build. Bunker has not managed HTTPS since 1.2.3.

Checked

All 20 standalone test suites pass on PHP 7.4 and 8.4, PHPCS is clean, and static analysis (Psalm taint, PHPStan, Semgrep) and a secret scan report nothing new. A WordPress security-audit code scan found no real issues. The release was installed on a WordPress 7.1 test site with the alert settings intact.

Install

Download thrg-bunker.1.2.11.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Installed copies update from the Plugins screen. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.

Bunker 1.2.10

Bunker 1.2.10

Bunker can now email you when something important changes, and the settings page is tidier.

New: security alerts

Three optional alerts, all off until you tick them under Email alerts in Settings → Bunker:

• an account gains the administrator role
• a new plugin is installed through WordPress (upload, plugin directory or WP-CLI)
• a new theme is installed through WordPress

Each email names the site, the time, the account or plugin/theme, and who made the change when WordPress knows. Updates, reinstalls, activation and failed installs send nothing. Alerts go to the site administration email, or to an address you set in Send alert emails to, separate from hatch approvals. They work before you choose Lock it down. A paused Bunker, safe mode and multisite switch them off.

Alerts cover changes made through WordPress, not files copied over SFTP, and they report rather than prevent. An administrator account that is already compromised could switch them off.

Other changes since 1.2.8

• If an alert cannot be handed to mail, Settings shows a notice that clears after the next alert sends or when you save the settings.
• The settings sidebar has Email alerts and Uninstall links, and the red Bad badge always shows beside Same directory.
• The settings screenshot is in the README, and the plugin details tab has a donation link.
• Documentation and the project page describe the alerts, what they miss and how they behave.

Checked

Alerts were tested on WordPress 7.1.3 with PHP 8.2 and on the oldest supported stack, WordPress 6.9.4 with PHP 7.4, including real WP-CLI installs, hostile plugin and theme names, simultaneous installs and the settings permission checks. All 20 standalone test suites pass.

Install

Download thrg-bunker.1.2.10.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Installed copies update from the Plugins screen. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.

Bunker 1.2.8

Bunker 1.2.8

View details is shorter, with the development-build notice and repeated explanations removed. Feature descriptions, setup, recovery, privacy information and release history remain available.

This update changes documentation and version metadata.

Validation includes the standalone PHP suites, PHP syntax checks, JavaScript syntax, PHPCS and ZIP source/structure verification.

Bunker 1.2.7

Bunker 1.2.7

First public release of The Hack Repair Guy's Bunker, a WordPress Utility Lockdown for WordPress running behind a static website.

Highlights

• Fourteen lockdowns for a utility WordPress install: front end, XML-RPC, REST API, usernames, comments, registration, application passwords, an IP lock for the login page and dashboard, code editors, version files and logs, PHP in uploads, a scheduled-task watch, an optional form-action allowlist and an optional "404 everything" mode.
• Hatch link: a spare key that only opens after the administrator approves the request by email.
• Nothing is enforced until you confirm, and the IP lock waits until you have saved your list.

Changes since the 1.2.4 development build

• Rule files: a symbolic-link .htaccess is left alone, markers are checked before a backup is taken, a read-only folder is refused cleanly, and lock files are removed on deactivation.
• IP lock: IPv4 visitors reported as IPv4-mapped IPv6 addresses now match plain IPv4 entries and Cloudflare ranges.
• Hatch link: secrets must be entirely hexadecimal, and a second browser is told how long an earlier request has left.
• The known-actions lockdown now covers a bare admin-ajax.php request, and the database repair screen is limited to your IP list.
• With the 404 option on, refused REST requests get the 404 page, and setup-config.php, wp-admin/includes/*.php and wp-includes/*.php are covered.
• The server rules backup notice appears only when Bunker is actually holding a backup.

Install

Download thrg-bunker.1.2.7.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.