Changelogs
Stay up to date with the latest changes and enhancements.
Stay up to date with the latest changes and enhancements.
15. Oct 2026
Share
- Improvement : 2FA (Authenticator) : the authenticator secret is now stored encrypted; secrets saved by earlier versions are encrypted the first time they are read, so nobody has to set the authenticator up again
- Improvement : Security : 2FA signs the user out of their other sessions when the authenticator is set up or removed
- Improvement : removed unused code, unused helper functions and unused images
- Fixed : Security : 2FA authenticator setup now refuses a secret shorter than 16 characters
- Fixed : 2FA : a stored secret that can no longer be read now fails the sign-in instead of throwing an error on the login screen
- Fixed : 2FA (Email) : the code mail now states the real lifetime of the code instead of a fixed 10 minutes, and the code field offers one-time-code autofill
- Fixed : Security : Hide Author URLs : ?author=ID now redirects to the random author URL, the author-<login> body class is removed, and links of the retired slug scheme no longer resolve; plain permalinks and unknown users are left untouched
- Fixed : Redirect 404 : no more redirect loop when the target page is itself missing, and missing images, scripts, stylesheets, fonts, media and .well-known files now stay 404
- Fixed : Admin Menu Organizer : custom menu titles containing commas are kept, a page restriction now works wherever the page parameter sits in the URL, and a damaged saved option no longer breaks the admin
- Fixed : Right Click Disable : no longer active inside page-builder and Customizer previews
- Fixed : Clean User Profile : the hidden-field list is now encoded safely
- Fixed : Login Email Notification : the alert text in the plain-text mail shows & and < as typed
- Fixed : the development country constants are no longer defined by the plugin, so every private-IP visitor is not treated as being in India; minimum WordPress is now 5.9
- Fixed : Security : Hide Author URLs : visiting an author URL whose slug doesn't resolve to a real user now returns a real 404 instead of the "Page not found" template with a 200 OK status.