Skip to content

Bunker 1.2.7

Choose a tag to compare

View all tags
@tvcnet tvcnet released this 02 Nov 05:33
· 23 commits to main since this release
v1.2.7
bbcdd18

Bunker 1.2.7

First public release of The Hack Repair Guy's Bunker, a WordPress Utility Lockdown for WordPress running behind a static website.

Highlights

  • Fourteen lockdowns for a utility WordPress install: front end, XML-RPC, REST API, usernames, comments, registration, application passwords, an IP lock for the login page and dashboard, code editors, version files and logs, PHP in uploads, a scheduled-task watch, an optional form-action allowlist and an optional "404 everything" mode.
  • Hatch link: a spare key that only opens after the administrator approves the request by email.
  • Nothing is enforced until you confirm, and the IP lock waits until you have saved your list.

Changes since the 1.2.4 development build

  • Rule files: a symbolic-link .htaccess is left alone, markers are checked before a backup is taken, a read-only folder is refused cleanly, and lock files are removed on deactivation.
  • IP lock: IPv4 visitors reported as IPv4-mapped IPv6 addresses now match plain IPv4 entries and Cloudflare ranges.
  • Hatch link: secrets must be entirely hexadecimal, and a second browser is told how long an earlier request has left.
  • The known-actions lockdown now covers a bare admin-ajax.php request, and the database repair screen is limited to your IP list.
  • With the 404 option on, refused REST requests get the 404 page, and setup-config.php, wp-admin/includes/*.php and wp-includes/*.php are covered.
  • The server rules backup notice appears only when Bunker is actually holding a backup.

Install

Download thrg-bunker.1.2.7.zip, upload it under Plugins → Add New → Upload Plugin, activate it and open Settings → Bunker. Requires WordPress 6.9.4 or newer and PHP 7.4 or newer.

Assets 3
Loading