v1.3.0

Automated release built from tag v1.3.0.

Installation

Upload the rest-login-shield-1.3.0.zip asset below via Plugins → Add New → Upload Plugin, then configure under Settings → REST & Login Shield.

Changelog

= 1.3.0 =

• New protection: Login honeypot — adds a hidden text field to the login, registration, and password-reset forms. The field is positioned off-screen and marked with tabindex="-1", autocomplete="off", and aria-hidden="true", so real visitors and password managers leave it blank. Bots that submit a value for it are flagged as confirmed bots and added to the IP lockout list immediately, regardless of how many login attempts they have actually made. This is the right defense against distributed brute force: when a botnet uses hundreds of IPs that each try the login form only once or twice, the per-IP rate limiter never triggers, but the honeypot catches them on the first request. Default: enabled. Toggle in Settings → REST & Login Shield → "Login honeypot".
• Honeypot triggers are visible in the recent attempts log with a [honeypot] prefix on the username column, so admins can see at a glance which lockouts came from this rule rather than from the regular per-IP threshold.

= 1.2.1 =

• Update channel moved off the GitHub API — auto-update now reads a static metadata.json from GitHub Pages instead of calling api.github.com. The previous channel hit GitHub's 60-requests-per-hour-per-IP unauthenticated rate limit on shared hosting and triggered abuse detection when many client sites checked the same repository in the same window, leaving sites stuck on old versions with a "Could not determine if updates are available" error. The new channel is served from a static CDN with no rate limit, no token required, and no per-site configuration.
• No behavior changes, no settings changes. After upgrading once, every future release will be picked up automatically.

= 1.2.0 =

• Security fix: author enumeration protection was incomplete. With the toggle enabled, ?author=N was still being redirected by WordPress core's canonical redirect to /author/USERNAME/ before the plugin could intercept, leaking the user login. The handler now runs at priority 1 on template_redirect and additionally hooks redirect_canonical to override core's behavior.
• Author archives blocked: /author/USERNAME/ pages now return a 301 to the home page when the author enumeration toggle is enabled. Previously these pages returned 200 and confirmed the existence of a username.
• RSS feed leak fixed: <dc:creator> in RSS feeds now shows the site name instead of the user login. Previously the feed exposed the WordPress login of every post author to anonymous visitors.
• Upgrade is strongly recommended for any site visible on the public internet — the three vectors above were actively used to harvest usernames before brute-force attempts.

= 1.1.0 =

• New protection: Disable comments — optional toggle that completely removes the comment system sitewide. Blocks new submissions via forms, REST API (/wp-json/wp/v2/comments), and XML-RPC (wp.newComment, pingbacks). Hides the comment UI in the admin and on the frontend, disables pingbacks/trackbacks, and removes comment-related dashboard widgets. Existing comments are preserved (not deleted). Default: off.
• Translations for the new UI in all six supported languages.

= 1.0.1 =

• Security fix: get_client_ip() no longer trusts CF-Connecting-IP, X-Real-IP, or X-Forwarded-For headers by default. On a directly-exposed site these headers could be spoofed to bypass brute force lockout. A new Trusted proxy setting lets admins opt in (None / Cloudflare / X-Real-IP / X-Forwarded-For). Default is None — safe for sites not behind a proxy. Upgrade is strongly recommended.
• Added translations for the new setting in all six supported languages.

= 1.0.0 =

• Initial release.
• REST API user enumeration blocking.
• REST API metadata stripping.
• Author enumeration blocking.
• Brute force protection with IP whitelist (single IPs and CIDR).
• Settings page with blocked IPs table and recent attempt log.
• Translations: English, Polish, Danish, German, Czech, Slovak, French.
• Automatic updates from GitHub releases.

v1.2.1

Automated release built from tag v1.2.1.

Installation

Upload the rest-login-shield-1.2.1.zip asset below via Plugins → Add New → Upload Plugin, then configure under Settings → REST & Login Shield.

Changelog

= 1.2.1 =

• Update channel moved off the GitHub API — auto-update now reads a static metadata.json from GitHub Pages instead of calling api.github.com. The previous channel hit GitHub's 60-requests-per-hour-per-IP unauthenticated rate limit on shared hosting and triggered abuse detection when many client sites checked the same repository in the same window, leaving sites stuck on old versions with a "Could not determine if updates are available" error. The new channel is served from a static CDN with no rate limit, no token required, and no per-site configuration.
• No behavior changes, no settings changes. After upgrading once, every future release will be picked up automatically.

= 1.2.0 =

• Security fix: author enumeration protection was incomplete. With the toggle enabled, ?author=N was still being redirected by WordPress core's canonical redirect to /author/USERNAME/ before the plugin could intercept, leaking the user login. The handler now runs at priority 1 on template_redirect and additionally hooks redirect_canonical to override core's behavior.
• Author archives blocked: /author/USERNAME/ pages now return a 301 to the home page when the author enumeration toggle is enabled. Previously these pages returned 200 and confirmed the existence of a username.
• RSS feed leak fixed: <dc:creator> in RSS feeds now shows the site name instead of the user login. Previously the feed exposed the WordPress login of every post author to anonymous visitors.
• Upgrade is strongly recommended for any site visible on the public internet — the three vectors above were actively used to harvest usernames before brute-force attempts.

= 1.1.0 =

• New protection: Disable comments — optional toggle that completely removes the comment system sitewide. Blocks new submissions via forms, REST API (/wp-json/wp/v2/comments), and XML-RPC (wp.newComment, pingbacks). Hides the comment UI in the admin and on the frontend, disables pingbacks/trackbacks, and removes comment-related dashboard widgets. Existing comments are preserved (not deleted). Default: off.
• Translations for the new UI in all six supported languages.

= 1.0.1 =

• Security fix: get_client_ip() no longer trusts CF-Connecting-IP, X-Real-IP, or X-Forwarded-For headers by default. On a directly-exposed site these headers could be spoofed to bypass brute force lockout. A new Trusted proxy setting lets admins opt in (None / Cloudflare / X-Real-IP / X-Forwarded-For). Default is None — safe for sites not behind a proxy. Upgrade is strongly recommended.
• Added translations for the new setting in all six supported languages.

= 1.0.0 =

• Initial release.
• REST API user enumeration blocking.
• REST API metadata stripping.
• Author enumeration blocking.
• Brute force protection with IP whitelist (single IPs and CIDR).
• Settings page with blocked IPs table and recent attempt log.
• Translations: English, Polish, Danish, German, Czech, Slovak, French.
• Automatic updates from GitHub releases.

v1.2.0

Automated release built from tag v1.2.0.

Installation

Upload the rest-login-shield-1.2.0.zip asset below via Plugins → Add New → Upload Plugin, then configure under Settings → REST & Login Shield.

Changelog

= 1.2.0 =

• Security fix: author enumeration protection was incomplete. With the toggle enabled, ?author=N was still being redirected by WordPress core's canonical redirect to /author/USERNAME/ before the plugin could intercept, leaking the user login. The handler now runs at priority 1 on template_redirect and additionally hooks redirect_canonical to override core's behavior.
• Author archives blocked: /author/USERNAME/ pages now return a 301 to the home page when the author enumeration toggle is enabled. Previously these pages returned 200 and confirmed the existence of a username.
• RSS feed leak fixed: <dc:creator> in RSS feeds now shows the site name instead of the user login. Previously the feed exposed the WordPress login of every post author to anonymous visitors.
• Upgrade is strongly recommended for any site visible on the public internet — the three vectors above were actively used to harvest usernames before brute-force attempts.

= 1.1.0 =

• New protection: Disable comments — optional toggle that completely removes the comment system sitewide. Blocks new submissions via forms, REST API (/wp-json/wp/v2/comments), and XML-RPC (wp.newComment, pingbacks). Hides the comment UI in the admin and on the frontend, disables pingbacks/trackbacks, and removes comment-related dashboard widgets. Existing comments are preserved (not deleted). Default: off.
• Translations for the new UI in all six supported languages.

= 1.0.1 =

• Security fix: get_client_ip() no longer trusts CF-Connecting-IP, X-Real-IP, or X-Forwarded-For headers by default. On a directly-exposed site these headers could be spoofed to bypass brute force lockout. A new Trusted proxy setting lets admins opt in (None / Cloudflare / X-Real-IP / X-Forwarded-For). Default is None — safe for sites not behind a proxy. Upgrade is strongly recommended.
• Added translations for the new setting in all six supported languages.

= 1.0.0 =

• Initial release.
• REST API user enumeration blocking.
• REST API metadata stripping.
• Author enumeration blocking.
• Brute force protection with IP whitelist (single IPs and CIDR).
• Settings page with blocked IPs table and recent attempt log.
• Translations: English, Polish, Danish, German, Czech, Slovak, French.
• Automatic updates from GitHub releases.

v1.1.0

Automated release built from tag v1.1.0.

Installation

Upload the rest-login-shield-1.1.0.zip asset below via Plugins → Add New → Upload Plugin, then configure under Settings → REST & Login Shield.

Changelog

= 1.1.0 =

• New protection: Disable comments — optional toggle that completely removes the comment system sitewide. Blocks new submissions via forms, REST API (/wp-json/wp/v2/comments), and XML-RPC (wp.newComment, pingbacks). Hides the comment UI in the admin and on the frontend, disables pingbacks/trackbacks, and removes comment-related dashboard widgets. Existing comments are preserved (not deleted). Default: off.
• Translations for the new UI in all six supported languages.

= 1.0.1 =

• Security fix: get_client_ip() no longer trusts CF-Connecting-IP, X-Real-IP, or X-Forwarded-For headers by default. On a directly-exposed site these headers could be spoofed to bypass brute force lockout. A new Trusted proxy setting lets admins opt in (None / Cloudflare / X-Real-IP / X-Forwarded-For). Default is None — safe for sites not behind a proxy. Upgrade is strongly recommended.
• Added translations for the new setting in all six supported languages.

= 1.0.0 =

• Initial release.
• REST API user enumeration blocking.
• REST API metadata stripping.
• Author enumeration blocking.
• Brute force protection with IP whitelist (single IPs and CIDR).
• Settings page with blocked IPs table and recent attempt log.
• Translations: English, Polish, Danish, German, Czech, Slovak, French.
• Automatic updates from GitHub releases.

v1.0.1

Automated release built from tag v1.0.1.

Installation

Upload the rest-login-shield-1.0.1.zip asset below via Plugins → Add New → Upload Plugin, then configure under Settings → REST & Login Shield.

Changelog

= 1.0.1 =

• Security fix: get_client_ip() no longer trusts CF-Connecting-IP, X-Real-IP, or X-Forwarded-For headers by default. On a directly-exposed site these headers could be spoofed to bypass brute force lockout. A new Trusted proxy setting lets admins opt in (None / Cloudflare / X-Real-IP / X-Forwarded-For). Default is None — safe for sites not behind a proxy. Upgrade is strongly recommended.
• Added translations for the new setting in all six supported languages.

= 1.0.0 =

• Initial release.
• REST API user enumeration blocking.
• REST API metadata stripping.
• Author enumeration blocking.
• Brute force protection with IP whitelist (single IPs and CIDR).
• Settings page with blocked IPs table and recent attempt log.
• Translations: English, Polish, Danish, German, Czech, Slovak, French.
• Automatic updates from GitHub releases.

v1.0.0 — Initial release

Initial plugin implementation with settings panel, i18n, and GitHub a…