v1.0.6

• Lost-password guard actually fires. 1.0.5's hook looked for core's "no account" error code, but core adds that code after lostpassword_post runs, so the guard never matched (found on the staging smoke; 1.0.5 was never promoted). It now keys on no account having been found, and only on wp-login.php, so WooCommerce and other front-end account forms keep their own notices.
• Everything listed under 1.0.5 below ships in this release.

v1.0.5

Hardening round from the 2026-11-03 Dev Team audit. No new guards are on by default except the lost-password one; the rest fixes edges of the existing ones and the update pipeline.

• Updates require the release zip. The update checker now only accepts the omens-wp-plugin-security.zip asset of a release and skips a release that lacks it. Before, a release with no zip (an upload that failed after the release was created, or one made in the GitHub UI) would have fallen back to GitHub's source tarball, which unpacks to a folder named after the commit; auto-installing that would have deactivated the plugin on every site within a day.
• Auto-update switch anchored and named. omens_secplugin_auto_update() accepts only this plugin's own release-asset URLs (/omens-agency/omens-wp-plugin-security/releases/download/ on github.com, /repos/.../releases/assets/ on api.github.com) instead of any github.com path containing the name. New omens/security/auto_update filter lets a site opt out of unattended updates.
• Bylines no longer point at a redirect. With author archives off, author_link now returns the redirect target, so Astra, Elementor and WPBakery bylines link where the request would land instead of to an /author/<login>/ URL that 302s.
• Login errors keep core's codes. The generic "username or password is incorrect" message now replaces only the text of invalid_username, invalid_email and incorrect_password, not the codes. Limit Login Attempts Reloaded and similar plugins only append their lockout text when they see those codes, so 1.0.0 to 1.0.4 silenced it.
• Lost-password enumeration closed. An unknown username or email on the lost-password form gets the same "Check your email" confirmation a known one gets, instead of "There is no account with that username or email address".
• Constants are defined behind defined() guards, so a second copy of the plugin in a -main folder warns about nothing.
• tools/release.sh lints every shipped PHP file, requires a ## <version> CHANGELOG section (used as the release notes), refuses to run off main or out of sync with origin, builds the zip in a temp dir and checks its contents, pushes only main and the new tag, and publishes draft-then-upload-then-pre-release. New tools/promote.sh flips a verified pre-release to the full release and refuses one without its zip asset.
• README: install lines use releases/latest/download/, counts and timing corrected, the new checks added to "Verifying a site".

v1.0.4

Plugin icon for the WordPress Updates screen. No functional change.

v1.0.3

Releases now apply themselves on every site (auto_update_plugin for this slug, GitHub release assets only). Pre-release switch in tools/release.sh. No change to the guards.

v1.0.2

Unique function prefix: a theme declaring omens_security_* no longer fatals beside the plugin

v1.0.1

Yoast author sitemap guard, 302 on author redirects, public-repo docs

v1.0.0

First release. Username-enumeration guards on by default (author probes and archives redirect, anonymous /wp/v2/users refused, users sitemap dropped, oEmbed author fields stripped, generic login errors). Security headers, HSTS, pingback removal and DISALLOW_FILE_EDIT are off until a site opts in by filter. See README.