Chaos Shield 1.15.0

Accounts: everything All-In-One Security offers for logins, free.

• Require two-factor or a passkey for administrators or everyone who can write posts. Each account gets a grace period, then can only reach its profile until it adds one.
• Trusted browsers: a user can skip the code step on their own browser for up to 90 days. A new password forgets every trusted browser.
• Idle sign out after the minutes you choose, for administrators, staff or everyone. An open dashboard tab does not count as activity.
• Approve new sign-ups: accounts visitors make cannot log in until approved from the Users screen, with an email for each one.
• Security keys: replace the wp-config.php keys in one click, from the Hardening tab or a serious incident. Everyone is signed out and two-factor, the hub and connected services keep working.
• A new check warns about authors who publish under their username.

Chaos Shield 1.14.1

WordPress.org Plugin Check cleanup.

• The GitHub copy now links to the plugin's real home page, and the WordPress.org copy leaves out the GitHub updater.
• Translations load the way WordPress.org language packs expect, without an extra loader on every page.
• Notes on each database query, time limit, core sign-in hook and .htaccess edit say why it is safe, so Plugin Check no longer flags them.

Chaos Shield 1.14.0

Security fixes from a review of everything added in 1.7 to 1.13.

• Under attack mode: the query string can no longer make a page look like the REST API, a solved check buys one pass for one network only, one network can no longer switch the mode on alone, and the redirect after the check stays on this site.
• Visitor help: Allow no longer adds firewall exceptions by itself. The inbox shows which rule, field and page blocked the visitor, and a separate button lets that one request through, only for a block of the sender's own IP and never on the front page. One network can no longer fill the inbox.
• Firewall: exceptions made from a blocked request cover that exact page only. Bodies the REST API reads from PUT, PATCH and DELETE requests are inspected, long values are read in full, field names are checked, and more data than the firewall reads is refused instead of skipped.
• Restore points: restoring the oldest point while the list is full no longer deletes it halfway and writes empty files.
• Settings imports go through the same checks as the settings forms.
• Quarantined files are stored under random names that can neither run nor be downloaded, also on Nginx.
• Critical file fingerprints: a planned change can no longer hide one already waiting for review, sub-sites no longer mark .htaccess as expected, and every quoted value in a changed wp-config.php line is hidden.
• Browser reports from the script policy are never approved in bulk, are capped, and send one alert at a time.
• The daily page check's pass only works while a check runs, never travels over plain http or to another host, and other hosts are fetched the safe way.
• HTTPS redirects never loop behind a proxy, such as Cloudflare's Flexible mode, that already used HTTPS.
• CAPTCHA: oversized tokens are refused, and only a real outage lets logins through without the check.
• Forcing a password reset for a whole group needs network admin rights on a network, and skips users the admin cannot edit.

Chaos Shield 1.13.0

• Updates from GitHub: new releases show up as normal plugin updates with one-click and automatic updating, View details with the release notes, and support for private repositories through a token in wp-config.php.
• The new Update URI header tells WordPress.org to skip this plugin, so a different plugin with the same name there can never replace it.