vietshield-waf-v1.1.2.zip

= 1.1.2 =

• Improved: Core integrity scanner — zone labels and reason codes for easier triage
• Improved: Malware scanner — staged scanning (baseline hash, prefilter), risk scoring and severity mapping
• Improved: Database migration for new scanner columns on upgrade
• Improved: Scanner admin tables — zone, reason, risk score; malware scan scope includes mu-plugins
• Improved: Autoloader registers MalwareScanner for reliable loading
• Updated: Googlebot IP ranges have changed according to the Google Developers site.

vietshield-waf-v1.1.1.zip

Version 1.1.1 (2026-03-18)

New Features:

• Hide Admin Login: Replace default /wp-login.php and /wp-admin with a custom login URL slug, unauthorized access returns 403 Forbidden
• Admin Access Control: Restrict which administrator accounts can access the WordPress admin dashboard, preventing unauthorized admin accounts (e.g., created by exploits) from accessing admin
• Block page caching: 403 block pages are cached as static HTML files per IP per day, subsequent requests serve the cached file directly for better performance

Improvements:

• Block page cache auto-cleanup via daily cron job
• Safety check: current user is always included in authorized admins list to prevent self-lockout
• Reserved WordPress slugs (wp-admin, login, admin, etc.) are blocked from being used as custom login slug

vietshield-waf-v1.1.0.zip

= 1.1.0 =

• New: URL Whitelist - bypass WAF checks for specific URL paths (exact match and wildcard support)
• Improved: Renamed "Manual IP Lists" section to "Custom Whitelist" for clarity

vietshield-waf-1.0.9.zip

Version 1.0.9 (2026-03-10)

Critical Fixes:

• Fixed 500 error when early blocker writes .user.ini before blocker file exists
• Fixed IP spoofing vulnerability in WAF engine, login security, and rate limiter
• Fixed race condition in rate limiter with atomic database operations
• Fixed IPv6 CIDR matching for non-4-bit-aligned prefix lengths
• Fixed XSS vulnerability in admin AJAX notice rendering
• Fixed open redirect in CAPTCHA handler via unvalidated original_uri
• Fixed threat intelligence feed data validation before TRUNCATE (prevents empty table on bad data)

Bug Fixes:

• Fixed brute force time window using wrong multiplier (max_attempts*2 instead of configurable window)
• Fixed transient cleanup query deleting wrong entries
• Fixed wp_cache_flush() clearing entire object cache on every blocked request
• Fixed cron jobs rescheduling on every page load
• Fixed email notification flooding on repeated login failures
• Fixed Cloudflare IP sync overwriting manual trusted proxy entries
• Fixed wizard page too narrow and other plugin notices overlapping
• Fixed dead code in firewall mode switching and whitelist_admins not persisting

Improvements:

• Hide other plugins' admin notices on all VietShield pages
• Early blocker file existence check before enabling auto_prepend_file
• Improved uninstall cleanup (missing cron hooks, transients, options, blocker files)

vietshield-waf-v1.0.7.zip

vietshield-waf-v1.0.7.zip

vietshield-waf-1.0.3.zip

vietshield-waf-1.0.3.zip with Minor Bug Fixes

vietshield-waf-v1.0.2.zip

vietshield-waf-v1.0.2.zip with bugs fixed

vietshield-waf-v1.0.1.zip

vietshield-waf-v1.0.1 fix bugs

vietshield-waf-v1.0.0.zip

vietshield-waf-v1.0.0 first release