Changelog

4.3.0.9

• Fix incorrect constant for disabling last messages (h/t @kermina).
• Fix false positive with blocking user enumeration when a Contributor tries to list posts by another user.
• Fix index issue with ancient versions of MySQL. [Premium only]
• Fix harmless warning with a defined but empty WP_FAIL2BAN_PROXIES (h/t @stevegrunwell).
• Backport new Block event class.
• Update Freemius library.

4.3.0.8

• Workaround issue with user enumeration blocking being triggered by Gutenberg pre-loading Author list. (h/t @brrrrrrrt) [WordPress only]

4.3.0.7

• Finish refactoring to allow inclusion of constants in wp-config.php (h/t @iCounsellor).
• Fix MaxMind database update. [Premium only]

4.3.0.6

• Fix Forbidden error on Posts page for roles below Editor when user enum blocking enabled. [WordPress only]

4.3.0.5

• Fix empty username detection for multisite.
• Fix harmless warning when activating new multisite install.
• Fix esoteric edge-case where wp-load.php is loaded via a script run from the CLI in a directory with a functions.php file.

4.3.0.4 “Columbo”

• Add new dashboard widget: last 5 syslog messages.
• Add full multisite support.
• Add username login blocking (force login with email).
• Add separate logging for login attempts with an empty username.
• Improve user enumeration blocking compatibility with the WordPress block editor (Gutenberg).
• Bump the minimum PHP version to 5.6.

4.2.8

• Add link to new support forum.
• Fix user enumeration conflict with Gutenberg (h/t @dinghy).
• Fix notices wrt admin menu (h/t @marioivangf).
• Fix harmless XDebug notice (h/t @dinghy).
• Update Freemius library.

4.2.7.1

• Fix error when blocking user enumeration via oembed (h/t @wordpressfab).

4.2.7

• Fix error when blocking user enumeration via REST.
• Fix buttons on Settings tabs.

4.2.6

• Add support for Remote Tools add-on.
• Add support for the new ClassicPress security page.
• Improved user enumeration blocking.

4.2.5.1

• Fix premium activation issue with PHP < 7.0.

4.2.5

• Properly fix PHP 5.3 support; tested on CentOS 6. Does not support any UI or Premium features.
• Fix potential issue with WP_FAIL2BAN_BLOCK_USER_ENUMERATION if calling REST API or XMLRPC from admin area.

4.2.4

• Add filter for login failed message.
• Fix logging spam comments from admin area.
• Fix Settings link from Plugins page.
• Update Freemius library

4.2.3

• Workaround for some versions of PHP 7.x that would cause define()s to be ignored.
• Add config note to settings tabs.
• Fix documentation links.

4.2.2

• Fix 5.3 compatibility.

4.2.1

• Completed support for WP_FAIL2BAN_COMMENT_EXTRA_LOG.
• Add support for 3rd-party plugins; see Developers.
  • Add-on for Contact Form 7 (experimental).
  • Add-on for Gravity Forms (experimental).
• Change logging for known-user with incorrect password; previously logged as unknown user and matched by hard filters (due to limitations in older versions of WordPress), now logged as known user and matched by soft.
• Bugfix for email-as-username – now logged correctly and matched by soft, not hard, filters.
• Bugfix for regression in code to prevent Free/Premium conflict.

4.2.0

• Not released.

4.1.0

• Add separate logging for REST authentication.
• Fix conflict with earlier versions pre-installed in mu-plugins. See Is WPf2b Already Installed?.

4.0.5

• Add WP_FAIL2BAN_COMMENT_EXTRA_LOG.
• Add WP_FAIL2BAN_PINGBACK_ERROR_LOG (future functionality).
• Change WP_FAIL2BAN_LOG_SPAM to use LOG_NOTICE.
• Change WP_FAIL2BAN_SPAM_LOG to LOG_AUTH.
• Change WP_FAIL2BAN_LOG_COMMENTS_EXTRA events to use LOG_NOTICE by default.
• Fix conflict with 3.x in mu-plugins.

4.0.2

• Fix PHP 5.3 compatibility.
• Bugfix for WP_FAIL2BAN_LOG_COMMENTS_EXTRA.
• Bugfix for WP_FAIL2BAN_REMOTE_ADDR summary.

4.0.1

• Add extra features via Freemius. This is entirely optional. WPf2b works as before, including new features listed here.
• Add settings summary page (Settings -> WP fail2ban).
• Add WP_FAIL2BAN_PASSWORD_REQUEST_LOG.
• Add WP_FAIL2BAN_SPAM_LOG.
• Add WP_FAIL2BAN_LOG_COMMENTS_EXTRA – enable logging for attempted comments on posts which are:
  • not found,
  • closed for commenting,
  • in the trash,
  • drafts,
  • password protected
• Block user enumeration via REST API.

4.0.0

• Not released.

3.6.0

• The filter files are now generated from PHPDoc in the code. There were too many times when the filters were out of sync with the code (programmer error) – this should resolve that by bringing the patterns closer to the code that emits them.
• Added PHPUnit tests. Almost 100% code coverage, with the exception of WP_FAIL2BAN_PROXIES which is quite hard to test properly.
• Bugfix for wordpress-soft.conf.
• Add WP_FAIL2BAN_XMLRPC_LOG.
• Add WP_FAIL2BAN_REMOTE_ADDR.
• WP_FAIL2BAN_PROXIES now supports an array of IPs with PHP 7.
• Moved all documentation to https://docs.wp-fail2ban.com/.

3.5.3

• Bugfix for wordpress-hard.conf.

3.5.1

• Bugfix for WP_FAIL2BAN_BLOCK_USER_ENUMERATION.

3.5.0

• Add WP_FAIL2BAN_OPENLOG_OPTIONS.
• Add WP_FAIL2BAN_LOG_COMMENTS and WP_FAIL2BAN_COMMENT_LOG.
• Add WP_FAIL2BAN_LOG_PASSWORD_REQUEST.
• Add WP_FAIL2BAN_LOG_SPAM.
• Add WP_FAIL2BAN_TRUNCATE_HOST.
• WP_FAIL2BAN_BLOCKED_USERS now supports an array of users with PHP 7.

3.0.3

• Fix regex in wordpress-hard.conf.

3.0.2

• Prevent double logging in WP 4.5.x for XML-RPC authentication failure

3.0.1

• Fix regex in wordpress-hard.conf.

3.0.0

• Add WP_FAIL2BAN_SYSLOG_SHORT_TAG.
• Add WP_FAIL2BAN_HTTP_HOST.
• Log XML-RPC authentication failure.
• Add better support for MU deployment.

2.3.2

• Bugfix WP_FAIL2BAN_BLOCKED_USERS.

2.3.0

• Bugfix in experimental WP_FAIL2BAN_PROXIES code (thanks to KyleCartmell).

2.2.1

• Fix stupid mistake with WP_FAIL2BAN_BLOCKED_USERS.

2.2.0

• Custom authentication log is now called WP_FAIL2BAN_AUTH_LOG.
• Add logging for pingbacks; see WP_FAIL2BAN_LOG_PINGBACKS.
• Custom pingback log is called WP_FAIL2BAN_PINGBACK_LOG.

2.1.1

• Minor bugfix.

2.1.0

• Add support for blocking user enumeration; see WP_FAIL2BAN_BLOCK_USER_ENUMERATION.
• Add support for CIDR notation in WP_FAIL2BAN_PROXIES.

2.0.1

• Bugfix in experimental WP_FAIL2BAN_PROXIES code.

2.0.0

• Add experimental support for X-Forwarded-For header; see WP_FAIL2BAN_PROXIES.
• Add experimental support for regex-based login blocking; see WP_FAIL2BAN_BLOCKED_USERS.

1.2.1

• Update FAQ.

1.2

• Fix harmless warning.

1.1

• Minor cosmetic updates.

1.0

• Initial release.