Bunker 1.2.10

Bunker 1.2.10

Bunker can now email you when something important changes, and the settings page is tidier.

New: security alerts

Three optional alerts, all off until you tick them under Email alerts in Settings → Bunker:

• an account gains the administrator role
• a new plugin is installed through WordPress (upload, plugin directory or WP-CLI)
• a new theme is installed through WordPress

Each email names the site, the time, the account or plugin/theme, and who made the change when WordPress knows. Updates, reinstalls, activation and failed installs send nothing. Alerts go to the site administration email, or to an address you set in Send alert emails to, separate from hatch approvals. They work before you choose Lock it down. A paused Bunker, safe mode and multisite switch them off.

Alerts cover changes made through WordPress, not files copied over SFTP, and they report rather than prevent. An administrator account that is already compromised could switch them off.

Other changes since 1.2.8

• If an alert cannot be handed to mail, Settings shows a notice that clears after the next alert sends or when you save the settings.
• The settings sidebar has Email alerts and Uninstall links, and the red Bad badge always shows beside Same directory.
• The settings screenshot is in the README, and the plugin details tab has a donation link.
• Documentation and the project page describe the alerts, what they miss and how they behave.

Checked

Alerts were tested on WordPress 7.1.3 with PHP 8.2 and on the oldest supported stack, WordPress 6.9.4 with PHP 7.4, including real WP-CLI installs, hostile plugin and theme names, simultaneous installs and the settings permission checks. All 20 standalone test suites pass.

Install

Download thrg-bunker.1.2.10.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Installed copies update from the Plugins screen. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.