Rapid Security Manager
| 开发者 | rapidplugins |
|---|---|
| 更新时间 | 2026年9月18日 20:34 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
Rapid Security Manager is a local-first WordPress security plugin with a source-aware Web Application Firewall, encrypted TOTP two-factor authentication, structured Content Security Policy, security headers, WordPress hardening, local WAF and CSP logs, optional local GeoIP enrichment, and diagnostics.
No Rapid Security Manager account or online security service is required. Security events and uploaded GeoIP data remain on the WordPress installation. Rapid Security Manager does not include telemetry, does not send logs to the developer, does not bundle a GeoIP database, and does not use an online GeoIP lookup API.
The Free plugin owns the shared request engine and WAF event handling used by compatible add-ons. Optional hourly CSP Log email notifications use a shared Free/Core mail service and one Rapid Security Manager WordPress Cron task. The Diagnostics page performs no external HTTP self-tests and does not automatically change security settings.
Current Free features include:
- Optional per-user TOTP two-factor authentication using standard authenticator apps.
- Pre-authentication login challenge: after a correct password, WordPress authentication cookies are issued only after the required TOTP/recovery verification succeeds.
- Authenticated encryption for stored TOTP secrets using AES-256-GCM or Sodium Secretbox; Rapid Security Manager intentionally has no plaintext/Base64 secret-storage fallback.
- Ten one-time recovery codes by default, stored only as password hashes and shown in plaintext only once through a short-lived display token.
- Optional 30-day trusted devices with random browser tokens stored only as keyed hashes, User-Agent binding, per-user management, rename/removal, and automatic revocation after password changes.
- TOTP replay protection using the last successfully consumed time step, plus per-user/per-client-IP failed-attempt throttling.
- Account-owner setup and management from the WordPress user profile; administrators may reset another user’s 2FA for recovery but cannot view or provision that user’s secret.
- Basic Web Application Firewall with Log Only and Enforce modes.
- Source-aware SQL injection, XSS, LFI/directory traversal, sensitive request-path and malicious scanner User-Agent rules.
- Editable one-pattern-per-line User-Agent and suspicious-request lists with current-default restoration and non-destructive migration of earlier additional patterns.
- Manual IPv4/IPv6 IP/CIDR allow and block rules using the centralized Client IP resolver.
- Narrow WordPress classic editor, block editor, comment and WordPress 7.1 media field exemptions that do not create a broad authenticated/admin/REST bypass.
- Grouped local WAF Log with 30-day default retention, a 10,000-row hard cap, search, pagination and configurable display columns.
- WAF Log stores rule metadata, short evidence labels and redacted request targets including query strings; DB-IP country enrichment is added when a local database is installed.
- Optional, off-by-default redacted samples of the original field that triggered a detection, up to 16 KiB, with a configurable Payload display column and display-only Default Settings restoration.
- Configurable observation-only logging for excessive request rates, failed authentication, password-reset requests and unique-path 404 reconnaissance. These Free monitors never block requests or IP addresses, even in Enforce mode.
- Short-lived keyed-hash counters in a separate Free/Core table, with bounded grouped WAF Log updates at every completed threshold batch and per-feature handoff only while a compatible add-on actively replaces that monitor. The settings page shows only monitors still owned by Free/Core.
- Extensible Free/Core WAF rule registry for later Pro rules without a duplicate WAF engine.
- Central Client IP resolver shared by security modules.
- REMOTE_ADDR trust anchor with opt-in trusted proxy detection.
- Verified Cloudflare CF-Connecting-IP handling and right-to-left X-Forwarded-For trust-chain evaluation.
- IPv4/IPv6 address and CIDR support with additional administrator-defined trusted proxy ranges.
- Background Cloudflare IPv4/IPv6 range refresh with bundled fallback ranges and no remote lookup during normal requests.
- Dedicated Network admin page for client-IP detection and trusted proxy configuration.
- GeoIP admin page with secure DB-IP Lite Country .mmdb upload, replacement and removal.
- Staged DB-IP validation before replacement, including MMDB type and country lookup self-tests.
- Local DB-IP Lite Country lookup is the only built-in provider; compatible add-ons can register another local provider through the shared fallback-aware GeoIP engine.
- Request-local GeoIP cache plus external persistent object-cache support without creating per-IP WordPress transients.
- Security Headers with Runtime and Apache/LiteSpeed Cache Compatibility delivery.
- X-Content-Type-Options, optional X-Frame-Options, Referrer-Policy, optional HSTS and Permissions-Policy.
- Structured front-end Content Security Policy.
- Report Only and Enforce CSP modes.
- WordPress 7.1 compatible worker-src support that retains blob: for client-side media processing.
- Local same-site CSP report endpoint with exact site-host validation.
- CSP report request-size and batch limits.
- Atomic database-backed CSP report rate limiting.
- Grouped local CSP Log with retention and a maximum of 200 grouped entries.
- Security-focused CSP logging stores the client IP address and User-Agent locally while discarding URL query strings, fragments and credentials.
- Guided CSP source review from clickable Blocked URI values, with a nonce-protected modal and global allowances for network origins and other valid CSP source expressions.
- Frame-ancestors violations use best-effort short-lived iframe request correlation: the protected site origin is shown as Blocked URI, the observed embedding origin is shown as Source, and a correlated HTTP(S) origin can be manually added to frame-ancestors after an explicit security warning.
- Optional CSP Log email notifications checked hourly through one shared Rapid Security Manager WordPress Cron event; existing log history is baselined when notifications are enabled, so only later new or updated browser reports are summarized.
- CSP notification emails use the Free/Core plain-text mail service, default to the WordPress administrator email address, and intentionally omit client IP addresses, User-Agent values and raw CSP report payloads.
- The Free CSP Log displays the latest reporting client IP stored for each grouped entry. No Pro add-on or license is required, and add-on display preferences cannot hide this Core column.
- WordPress Hardening with opt-in XML-RPC, REST user enumeration, author-query enumeration, generator output and file-editor protections.
- Grouped Basic Diagnostics with OK, Warning, Issue and Info states, system summary, navigation links and a sanitized support report.
- Public add-on API used by the separate Rapid Security Manager Pro plugin.
安装:
- Upload the
rapid-security-managerfolder to/wp-content/plugins/, or install Rapid Security Manager through the WordPress Plugins screen. - Activate Rapid Security Manager from the Plugins screen. On multisite, use Network Activate only when the same Free/Core protection should be available across the network.
- Open Rapid Security Manager > Diagnostics and review the detected environment and registered modules.
- Configure Network & GeoIP before trusting proxy-provided client IP headers. Leave trusted proxy detection disabled unless the site is actually behind a supported proxy or explicitly configured proxy range.
- Start the WAF in Log Only mode, review legitimate traffic, and switch to Enforce only after the enabled rules have been tested on the site.
- Build the CSP gradually in Report Only mode before enabling enforcement.
- Users can enable TOTP two-factor authentication from their WordPress profile and should store their one-time recovery codes safely.
- Optionally upload a current DB-IP Lite Country MMDB file on Network & GeoIP for local country enrichment.
屏幕截图:
常见问题:
Does Rapid Security Manager require an account or license key?
No. Rapid Security Manager Free works without registration, a Rapid Security Manager account, or a license key.
Does Rapid Security Manager send telemetry, logs, visitor data, or site content to the developer?
No. Rapid Security Manager does not include telemetry and does not send WAF logs, CSP logs, visitor IP addresses, site content, credentials, cookies, or two-factor secrets to the developer.
When does Rapid Security Manager contact Cloudflare?
Only when both trusted proxy detection and Cloudflare support are enabled. A scheduled request then refreshes Cloudflare's published proxy IP ranges. Normal security requests never perform an online Cloudflare lookup. See the External services section for the exact endpoints and transmitted data.
Is a GeoIP database bundled with the plugin?
No. An administrator may separately obtain and upload a DB-IP Lite Country MMDB database. Lookups are performed locally, and the uploaded database remains subject to DB-IP's license and attribution terms.
Where are WAF and CSP logs stored?
They are stored in bounded custom tables in the site's WordPress database. Depending on the log, records can include an IP address, a bounded User-Agent, request or document metadata, rule information and short evidence labels. Observation-only WAF thresholds use a separate table of automatically expiring keyed-hash counters; account names and raw request paths are not stored in that counter table. WAF targets retain the path and query after pre-storage redaction, up to 16 KiB. Optional payload recording is disabled by default and records only the original triggered field, not an entire HTTP request. Known password fields, tokens, authorization values and session/cookie data are masked regardless of whether the user exists or authentication succeeds; opaque raw bodies are omitted. CSP URL query strings and fragments remain excluded. Payload recording and the Payload display column are separate settings. Turning recording off does not delete already retained samples. Every grouped row represents the latest event/sample in that group, not a per-request history. Historical query strings and payloads that were not recorded cannot be reconstructed. Samples may still contain personal data or unrecognized custom secrets: enable recording only when needed, review your test inputs and privacy notices, and keep an appropriate retention period. Truncated and unavailable samples are explicitly labelled.
Is Rapid Security Manager Pro required?
No. All features described as Free work independently. Rapid Security Manager Pro is a separately installed add-on that extends the shared Free/Core services with additional controls and analysis.
Can Rapid Security Manager Free download or install Rapid Security Manager Pro?
No. The Free plugin contains only an informational Upgrade to Pro page. It does not download, install, activate, update, or execute Pro packages. Those operations belong to the separately installed Pro add-on.
Does Rapid Security Manager automatically import data from a plugin with a different slug?
No. Rapid Security Manager uses only its own final identifiers and starts as an independent installation. It does not read, rename, delete or import settings, logs, two-factor metadata, uploaded GeoIP files or other data owned by a differently named plugin.
What happens when Rapid Security Manager Free is uninstalled?
The uninstall routine removes Free/Core settings, scheduled tasks, transients, custom WAF and CSP tables, uploaded DB-IP files, Rapid Security Manager-managed Apache/LiteSpeed marker blocks, and Free/Core two-factor user metadata. Data owned by a separately installed compatible add-on is not removed by the Free plugin.
更新日志:
1.1.9
- Hide each Free threshold-logging setting while an active compatible add-on owns the matching protection, and hide the complete settings box when all four monitors are replaced.
- Keep unrelated Free monitor settings visible and editable when only some matching add-on protections are active.
- Preserve every omitted Free threshold setting server-side during WAF saves so disabling an add-on protection restores the previously saved Free configuration.
- Retain existing WAF logs, counters and settings without a database schema migration or any change to runtime protection ownership.
- Refresh each passive monitor's grouped WAF Log counter and Last Seen time at every completed threshold batch, such as 3, 6 and 9 failed logins within one fixed window.
- Group request-rate and 404 reconnaissance observations independently of changing request paths while retaining the latest redacted target sample.
- Continue counting unique 404 paths after the first threshold with the existing keyed fingerprints and global cardinality cap, without logging or writing on every request.
- Raise the declared minimum WordPress version from 7.0 to 7.1 while retaining PHP 8.1 as the minimum.
- Preserve existing WAF logs, settings and counters without a database schema migration; Free observations remain non-blocking in every WAF mode.
- Add independently configurable Free observation-only thresholds for request activity, failed authentication, password-reset requests and unique-path 404 reconnaissance below the existing WAF logging settings.
- Write at most one grouped WAF Log observation per threshold window and never block a request or IP address because of these Free detections, including in Enforce mode.
- Store temporary keyed-hash counters in a separate bounded Free/Core table, expire them automatically, and remove them on uninstall without changing existing logs or settings.
- Let compatible add-ons replace only the matching active monitor while retaining the saved Free configuration and allowing unrelated Free monitors to continue.
- Preserve schema-1 WAF settings imports by supplying the new defaults, update Hungarian catalogs, and require no destructive migration.
- Display stored IPv4/IPv6 client addresses in the Free CSP Log as safely escaped text, independently of Pro and earlier add-on column preferences.
- Require shared-file authorization for Security Headers and CSP marker writes and removals, including multisite activation, deactivation and legacy cache-policy upgrade paths.
- Protect global CSP source allowance with multisite Cache Compatibility authorization, verify successful source insertion before deleting resolved logs, and report cache rollback failures.
- Remove Tested up to from the main PHP header while retaining the readme field, and align Contributors with the submitting WordPress.org account.
- Refresh Hungarian PO/POT/MO files without changing database schemas, existing settings, logs, two-factor data or GeoIP files.
- Retain redacted full WAF targets including query strings and show them as escaped text, with the encoded target available separately.
- Add opt-in, bounded, pre-redacted original triggered-field payload samples and an independently configurable Payload display column.
- Mask known passwords for every account, tokens, authorization values and cookie/session fields before storage; omit opaque raw bodies and label truncation or unavailable data.
- Preserve grouped fingerprints and existing logs, updating each row with its latest target/sample without creating per-request log rows.
- Add nonce- and capability-protected Default Settings restoration for WAF Log display columns only, including persistence-failure feedback.
- Verify additive request-sample columns before using schema v2; retain legacy metadata logging during partial upgrades and retry non-destructively.
- Update Hungarian translations and local-data documentation.
- Rename the plugin to Rapid Security Manager and adopt the
rapid-security-managerWordPress.org slug, package root, main plugin basename and text domain. - Rename PHP namespaces, public API functions, constants, hooks, options, user metadata, transients, cron events, database tables, REST routes, admin slugs and asset identifiers consistently.
- Start with a clean Rapid Security Manager data namespace without reading, migrating or deleting data belonging to an earlier plugin identity.
- Coordinate the renamed public extension API and internal integration points with Rapid Security Manager Pro 0.6.0.
- Complete the preceding product-identity transition across the plugin-owned data namespace and public extension API.
- Keep the transition clean by leaving data belonging to differently named plugins untouched.
- Coordinate the Free/Core integration boundary with its matching Pro release.
- Prevent stale GeoIP lock cleanup and lock release from deleting a replacement operation lock.
- Serialize security-sensitive 2FA state changes, reserve verification attempts atomically, and fail closed when rate-limit state cannot be stored safely.
- Commit two-factor enrollment only after every secret, recovery-code, replay-step and trusted-device write succeeds, with rollback on partial failure.
- Persist and update trusted-device records before accepting their browser cookies, without losing concurrent mutations or reviving records after password-change revocation; use a revocation epoch to invalidate in-flight writers.
- Normalize WordPress request arrays exactly once while preserving raw, JSON-decoded and server-provided WAF input.
- Require POST for every non-FIM Free/Core administrative action and affected AJAX operation before nonce or request-data processing.
- Avoid repeated per-request database table checks by caching a versioned schema-health result and rechecking it at a bounded interval.
- Keep forced, non-destructive schema verification on activation and retry failed setup safely without registering the security runtime.
- Clear Free/Core scheduled events and cache-compatibility state for every site during network-wide multisite deactivation.
- Finalize the clean-start data model for the then-current plugin identity: the plugin reads and writes only its own identifiers.
- Remove automatic migration of settings, logs, two-factor metadata, GeoIP files, scheduled events and Apache/LiteSpeed marker blocks from differently named plugins.
- Remove legacy two-factor cryptographic and trusted-device cookie compatibility; new enrollments use only the current plugin security contexts.
- Leave data belonging to differently named plugins untouched so administrators can archive or import selected records independently.
- Complete the previous product-identity transition and adopt its then-current WordPress.org slug and text domain.
- Rename the PHP namespace, public API, constants, hooks, options, database tables, REST namespace, admin slugs, assets and other plugin-owned identifiers consistently for that transition.
- Prepare the Free/Core add-on API for the separately installed Pro add-on.
- Rewrite the readme introduction around Rapid Security Manager's local-first security model and remove the stale version-specific preview sentence.
- Add installation guidance, privacy and local-data documentation, and answers covering accounts, external communication, GeoIP data, logs, Pro separation and uninstall cleanup.
- Add a consolidated third-party notice for the MaxMind DB Reader source, optional DB-IP data, local QR encoder and bundled Pro screenshots.
- Clarify that Rapid Security Manager Free does not download or install Pro packages and that protected activation and updates belong to the separately installed Pro add-on.
- Add an explicit GPL source header to the readable local two-factor QR encoder.
- Refine and simplify Hungarian admin descriptions across Diagnostics, Registered Modules, Network & GeoIP, and Security Headers.
- Remove redundant explanatory text from Diagnostics while keeping sanitized report generation unchanged.
- Clarify DB-IP attribution, cache-compatible header delivery, MIME sniffing, framing, HSTS, Permissions-Policy, WebUSB, and Payment Request API descriptions.
- Add keyboard-accessible, vertically scrollable Upgrade to Pro image frames that preserve each screenshot's original aspect ratio.
- Allow feature cards to reuse one screenshot with an initial vertical position specified in source-image pixels and scaled responsively at runtime.
- Keep the CSP Dashboard widget table inside its container and truncate long Blocked URI / Source values to one line with an ellipsis while retaining the full value as a hover tooltip.
- Fix the malformed GeoIP cleanup block in uninstall.php so complete removal can run without a PHP syntax error.
- Use the WordPress metadata API for network-global 2FA user-meta cleanup and keep uninstall variables consistently prefixed.
- Remove the discouraged manual load_plugin_textdomain() call and rely on WordPress just-in-time translation loading.
- Sanitize and bound request-header values used for CSP frame-context correlation.
- Make Cloudflare proxy-range refresh explicitly opt-in by default on new installations while preserving existing saved settings and bundled fallback ranges.
- Document intentional nonce-free WAF inspection, read-only administrator routing, atomic custom-table operations, the core wp_login hook and exception chaining for Plugin Check.
- Move the Registered modules box below System Status on the Diagnostics page and hide the retired Modules submenu.
- Merge the complete GeoIP administration into Network, rename the shared page to Network & GeoIP and hide the retired GeoIP submenu.
- Preserve the old Modules and GeoIP admin URLs as hidden compatibility aliases for their new destinations.
- Rename only the WordPress Hardening submenu to WP Security while keeping its page, form and save transaction unchanged.
- Shorten only the Content Security Policy submenu label to CSP while keeping its page title and behavior unchanged.
- Keep the Free versus Pro comparison as a compact three-column table on mobile screens.
- Reduce the mobile Free and Pro columns to icon-only availability indicators while preserving accessible labels.
- Add a responsive Upgrade to Pro page with an accurate overview of the current premium feature set.
- Add a mobile-friendly Free versus Pro comparison table and accessible links to the official Rapid Security Manager information page.
- Bundle all ten promotional images locally instead of loading marketing assets from an external server.
- Load the dedicated presentation stylesheet only on the Upgrade to Pro page.
- Add the
Rapid Security Manager - WAF LogWordPress Dashboard widget for administrators when stored grouped WAF entries exist. - Show grouped-entry, total-event, blocked-event and latest-event summaries plus non-empty attack-type categories.
- Read only aggregate attack-type counts; do not expose individual IP addresses, request targets, evidence or User-Agent values in the widget.
- Keep the existing shared Free/Core WAF Log table, retention, row cap and Pro event integration unchanged.
- Add general GeoIP provider-state and admin-page extension points for compatible add-ons without adding Pro-specific logic to Free/Core.
- Add ordered GeoIP page extension points before the DB-IP database box and after the DB-IP download guide.
- Reuse the Core MMDB reader for strict add-on database-type and IPv4/IPv6 validation.
- Add fallback-aware provider selection and cache validated DB-IP status without changing existing DB-IP files or settings.
- Render compatible add-on WAF statistics before the collapsed WAF Log display settings and shared firewall-event table.
- Preserve the existing display settings, filtering, pagination, event table and add-on extension hook without changing stored data.
- Keep the hidden legacy Diagnostics alias registered until WordPress completes its admin-page access check.
- Hide the compatibility alias after authorization so the old URL remains usable without adding a duplicate submenu item.
- Remove Free/Core tables, options, cron events, transients and uploaded GeoIP data from every site during a multisite network uninstall.
- Process site IDs in bounded batches of 100 so large networks do not load the complete site list into memory.
- Remove shared Apache/LiteSpeed marker blocks, global 2FA user metadata and the shared GeoIP cache group only once per installation.
- Escape literal transient-name prefixes before wildcard cleanup and remove empty Rapid Security Manager upload directories when possible.
- Derive the WordPress administration path from
admin_url()so root, subdirectory and network administration requests are identified consistently. - Preserve the signed-in administrator exemptions used by compatible WAF add-ons on subdirectory WordPress installations.
- Expose successful stored WAF events to compatible add-ons for bounded aggregate statistics without creating a second detailed request log.
- Add exact-IP grouped-log pagination, totals and rule-summary queries owned by the Free/Core WAF Log repository.
- Allow compatible add-ons to render statistics above the WAF Log and provide escaped same-site IP detail links.
- Notify compatible add-ons after an administrator clears the shared WAF Log so related aggregates can be removed too.
- Add a fixed, escaped extension schema that compatible add-ons can use to place lockout recovery controls on the HTML WAF block response.
- Add the
RAPID_SECURITY_MANAGER_WAF_RECOVERY_MODEwp-config.php emergency switch, which forces WAF findings into non-blocking log-only behavior without changing stored settings. - Display an administrator warning while emergency recovery mode is active and prevent new automatic bans through the shared enforcement flag.
- Display the complete active User-Agent and suspicious-request pattern lists in editable one-pattern-per-line fields.
- Add separate Restore Defaults controls while retaining the shared WAF save action.
- Preserve existing site-specific additional patterns during the settings migration.
- Allow compatible add-ons to render export/import actions below the WAF form.
- Add shared danger-box and mobile temporary-ban card styles with visible field labels.
- Add a shared late WAF finding handler for authentication and resolved-response events.
- Keep the Free/Core WAF module, allowlist, mode, grouped log and block response authoritative for add-on findings.
- Reuse the same finding handler for the initial request-rule runtime.
- Add compatible add-on sections inside the existing WAF form.
- Add an atomic shared WAF save transaction with commit and rollback callbacks.
- Expose detected WAF findings so compatible add-ons can implement temporary blocks without duplicating the engine or log.
- Mark only narrowly authenticated content operations for add-on rate-limit exemptions.
- Add a compatible add-on section hook inside the existing WordPress Hardening form.
- Add a coordinated WordPress Hardening save transaction with prepared add-on commit and rollback callbacks.
- Keep one WordPress Hardening save button while Free/Core and compatible add-on settings are saved atomically.
- Replace the visible GeoIP file input with a single database upload button.
- Open the file picker from that button and automatically submit the selected MMDB file.
- Move client-IP detection, Cloudflare trust and additional proxy settings from GeoIP to a dedicated Network submenu without changing stored option keys.
- Redirect relevant Diagnostics links to the new Network page.
- Stack the unified Security Headers and CSP save, export and import actions as full-width buttons on WordPress mobile admin screens.
- Hide the CSP security warning after an allowance has been saved successfully.
- Keep the completed state focused on the save confirmation and OK button.
- Ensure CSP allowance confirmation buttons reliably honor their hidden state under WordPress admin button styles.
- Show only Continue and Cancel before saving, then only OK after a successful allowance.
- Add backward-compatible CSP Log extension points for add-on notices, display controls, table columns and allowance workflows.
- Expose exact-document CSP Log matching and cleanup helpers without changing the existing global Free allowance behavior.
- Keep the standalone Free CSP Log columns and interface unchanged when no compatible add-on is active.
- Explain the purpose of every CSP source directive directly below its field.
- Warn when CSP Cache Compatibility remains enabled on an Nginx server.
- Add a backward-compatible CSP section hook before local reporting controls.
- Simplify the grouped CSP report retention description and remove redundant compatibility text from the page header.
- Add validated source-directive and cache-rule CSP extension points for compatible add-ons.
- Add a coordinated CSP save transaction with staged add-on values, commit and rollback callbacks.
- Keep one CSP save button while Free and compatible Pro settings are saved atomically.
- Add a public CSP cache-refresh helper for Apache/LiteSpeed integrations.
- Add concise descriptions for Delivery mode, Basic headers and HSTS controls.
- Warn administrators when Cache Compatibility remains enabled while Nginx is detected.
- Clarify when server- or CDN-level header configuration is required.
- Reorganize Permissions-Policy presets into a clearer settings table.
- Add backward-compatible extension points for Permissions-Policy rows and actions beside the single save button.
- Keep the legacy below-form extension action available for existing add-ons.
- Add backward-compatible hooks for add-on fields inside the original Security Headers form.
- Add a coordinated add-on save transaction with staged values, commit, rollback and request cleanup callbacks.
- Keep one Security Headers save button while allowing compatible add-ons to participate atomically in cache and option updates.
- Add a backward-compatible Security Headers admin-page extension action for add-on-owned settings sections.
- Keep add-on forms, nonces, validation and storage separate from the existing Free/Core save transaction.
- Add validated standard and front-end-only Security Headers extension groups for compatible add-ons in runtime and Apache/LiteSpeed cache modes.
- Exclude front-end-only add-on headers from WordPress admin, login and REST requests, including request-aware
.htaccessrules. - Add public permission and cache-refresh helpers for backwards-compatible Pro integration.
- Require a Super Admin for multisite Cache Compatibility changes and prevent non-Super-Admin saves from rewriting a shared
.htaccessblock.
- Make WAF and CSP custom-table queries use direct, clearly prepared database calls without changing their atomic logging or rate-limit behavior.
- Normalize and bound User-Agent values before using them in two-factor challenge and trusted-device fingerprints.
- Document the optional Cloudflare proxy-range refresh as an external service, including transmitted data and fallback behavior.
- Shortened two Hungarian button labels on Diagnostics and GeoIP pages so they fit cleanly on narrow mobile screens.
- Reworked the complete bundled Hungarian translation for more natural, professional WordPress and security terminology while preserving the original technical meaning.
- Standardized Hungarian WAF, CSP, GeoIP, Security Headers, diagnostics and two-factor authentication wording, including notices, plural forms and security-sensitive guidance.
- Added a complete bundled Hungarian (hu_HU) translation for the current Free plugin strings, including plural forms.
- Increased and vertically balanced the collapsed WAF Log Display Settings box spacing on desktop and mobile.
- WAF Log now defaults to Last Seen, IP Address, Country, Attack Type, Target and Rule ID columns when no custom display preference is saved.
- WAF Log Display Settings is now collapsed by default to prioritize the event list on mobile and desktop.
- Added consistent spacing for stacked radio-button choices on admin settings pages.
- UI: Applies the requested admin.css layout and Diagnostics spacing adjustments exactly.
- Remove the manual horizontal offset from Diagnostics status badges so their position is controlled consistently by the existing layout on both desktop and mobile.
- Make all Diagnostics status badges use the same subtle 2px corner radius as the rest of the Rapid Security Manager controls.
- Correct the desktop Diagnostics summary/group status badge alignment so the indicator no longer sits slightly too far to the right.
- Standardize Rapid Security Manager interactive buttons to a subtle 2px corner radius instead of pill-shaped controls.
- Move Diagnostics group status accents from the right edge to the left edge for consistency with the admin box visual system.
- Fix the mobile WAF Log paginator layout so it stays in normal document flow below the responsive event cards.
- Make the Allow CSP Source modal reliably scrollable on mobile using the dynamic viewport when available and additional safe-area spacing.
- Replace Continue and Cancel with a single OK button after a CSP source is saved; the log page refreshes only when the completed modal is closed.
- Make Diagnostics the Rapid Security Manager landing page and remove the redundant Overview submenu while retaining the previous Diagnostics URL as a hidden compatibility alias.
- Keep WordPress & Server collapsed by default and add right-edge Diagnostics status accents for OK, Warning, Issue and Info groups.
- Add a blue-accented Registered modules box with nonce- and capability-protected module state buttons for Free-owned modules.
- Add purple log-box accents, yellow information-box accents and responsive mobile card layouts for Modules, Diagnostics, WAF Log and CSP Log tables.
- Keep the existing module option format and runtime checks unchanged; module state changes take effect on the next request.
- Fix the 0.8.0 add-on bootstrap sequencing regression by adding a separate translation-free runtime readiness state and
rapid_security_manager_runtime_readyhook. - Add the public
rapid_security_manager_is_runtime_ready()helper so add-ons that load after the early hook can still attach request-time providers and WAF rules beforeinit. - Keep the existing full
rapid_security_manager_readyhandshake at translation-safeinitfor translated module, admin and Diagnostics registration. - Keep WAF inspection at
initpriority 0; the fix does not delay the security runtime.
- Fix the WordPress 6.7+
_load_textdomain_just_in_timenotice for therapid-security-managertext domain. - Keep early security/runtime hook registration on
plugins_loadedwhile deferring translated module, admin and Diagnostics registry setup toinit. - Move the Free/Core ready handshake to the translation-safe
initphase so the Pro add-on also connects after localization is safe. - Keep the native WordPress Dashboard CSP Log widget introduced in 0.7.9.
- Add regression coverage that fails if the
rapid-security-managertext domain is invoked beforeinit.
- Add a native WordPress Dashboard widget for the CSP Log.
- Show the grouped CSP Log entry count, latest violation time and the five most recent grouped entries.
- Use Count, Directive and Blocked URI / Source columns; frame-ancestors rows show the observed embedding Source.
- Register the widget only when the CSP Log contains at least one stored grouped entry.
- Keep the 0.7.5 runtime/bootstrap behavior unchanged apart from the Dashboard widget hook and version metadata.
- Fix the downloaded sanitized Diagnostics TXT report for Windows and other clients that do not reliably auto-detect UTF-8.
- Prefix the downloaded report with an UTF-8 BOM while keeping the HTTP charset declaration.
- Use an ASCII hyphen as the diagnostic value/status separator so the report remains readable even in conservative plain-text viewers.
- Add a shared Free/Core plain-text mail service and public
rapid_security_manager_send_mail()helper for current and future Rapid Security Manager notifications. - Add one shared
rapid_security_manager_hourlyWordPress Cron task owned by the Free Core. - Add optional CSP Log email notifications, disabled by default, with a configurable recipient initially defaulting to the WordPress administrator email address.
- Check the grouped CSP Log hourly and email only when new browser violations arrive or an existing grouped report count increases; manual deletions and cleanup do not trigger a notification.
- Establish a baseline when notifications are first enabled so existing historical CSP Log rows are not emailed as new events.
- Summarize at most the newest changed CSP entries without including client IP addresses, User-Agent values or raw CSP report payloads; frame-ancestors summaries use the observed Source origin when available.
- Add bounded retry handling for a failed WordPress mail handoff and Diagnostics checks for the shared mail service, hourly schedule and last CSP notification result.
- Refine frame-ancestors CSP Log rows so Blocked URI shows the protected document origin and Source shows the observed embedding origin.
- Remove the separate Embedding origin table column.
- Allow a correlated HTTP(S) embedding origin to be reviewed through the normal Blocked URI modal and manually added to frame-ancestors after a high-risk clickjacking warning.
- Keep frame-ancestors Allow Source unavailable when no usable embedding origin was observed.
- Keep frame-ancestor cleanup grouped by the approved embedding origin rather than the browser's blocked-uri value.
- Add best-effort frame-ancestor request context correlation using Fetch Metadata and an origin-only Referer value.
- Never derive or offer an automatic CSP Allow Source action from a frame-ancestors violation.
- Show the observed embedding origin/context for frame-ancestors reports when correlation is available.
- Store only a short-lived HMAC client fingerprint and origin-level frame context; no full external Referer URL is persisted.
- Added the missing translator comments for placeholder-based two-factor profile strings.
- Shortened the WordPress.org short description to remain within the supported 150-character limit.
- Lowered the declared minimum WordPress version to 7.0 while keeping Tested up to at 7.1 and PHP 8.1.
- Added compatibility regression coverage for WordPress 7.0.x, WordPress 7.1 RC versions, and rejection of WordPress 6.9.x.
- Left intentional custom-table SQL, public-request WAF inspection, read-only admin query parameters, core hook names, and uninstall schema operations unchanged where Plugin Check reports static-analysis warnings rather than real defects.
- Added Milestone 7 Basic Diagnostics with a central grouped diagnostics registry and normalized OK, Warning, Issue and Info states.
- Added a System Status summary with issue/warning counts and collapsible full-width diagnostics groups.
- Added lightweight checks for WordPress/server state, PHP security extensions, Rapid Security Manager modules, Security Headers/CSP, Basic WAF, Client IP/DB-IP, TOTP/recovery/trusted devices, database/storage health and scheduled tasks.
- CSP Report Only and WAF Log Only modes are reported as warnings while intentionally disabled optional modules remain informational rather than errors.
- Added navigation links from diagnostics findings to the relevant Rapid Security Manager settings/log pages without changing configuration from the Diagnostics page.
- Added a nonce- and capability-protected sanitized diagnostic report download that omits IP addresses, request payloads, filesystem paths, TOTP secrets, recovery codes, trusted-device tokens, cookies and nonces.
- Kept Basic Diagnostics lightweight: no external HTTP requests, loopback probes, automatic repair or menu warning badge were added.
- Added Milestone 6 Free TOTP two-factor authentication, one-time recovery codes and trusted devices.
- Added a true pre-authentication second-factor challenge so standard WordPress authentication cookies are not created until TOTP or recovery verification succeeds.
- Added RFC 6238 compatible SHA-1/30-second/6-digit TOTP with a narrow time window and replay protection.
- Added authenticated TOTP secret encryption using AES-256-GCM or Sodium Secretbox and intentionally omitted the legacy plaintext/Base64 fallback.
- Added separately hashed, single-use recovery-code records with one-time plaintext display after setup or regeneration.
- Added trusted-device tokens using random browser secrets, keyed server-side hashes, User-Agent binding, expiry, labels and per-user revocation controls.
- Added password-change invalidation for active login challenges and trusted-device records.
- Added fail-closed handling for enrolled accounts whose encrypted TOTP secret becomes unreadable; recovery codes remain available instead of silently downgrading to password-only login.
- Added client-IP-aware 2FA attempt throttling through the shared Milestone 4 Client IP resolver.
- Added local QR provisioning with no external QR service. Force 2FA remains reserved for Rapid Security Manager Pro.
- Added Milestone 5 Basic WAF + WAF Log.
- Added a Free/Core WAF rule registry and source-aware request context for future Pro extensions without a duplicate firewall engine.
- Added Log Only and Enforce modes with SQL injection, XSS, LFI/directory traversal, suspicious request and malicious scanner User-Agent detection.
- Added bounded source-aware request scanning with a request-wide inspection budget and safe multipart/binary body handling.
- Added manual IPv4/IPv6 IP/CIDR allow and block rules based on the centralized trusted-proxy-aware Client IP resolver.
- Preserved the hardened legacy false-positive protections for WordPress post/comment free-text fields and added narrow WordPress 7.1 media REST upload/sideload/finalize handling.
- Added a grouped WAF Log using binary IPv4/IPv6 storage, optional DB-IP country enrichment, retention cleanup, a 10,000-row cap, search, pagination and configurable display columns.
- WAF Log stores minimal security metadata and evidence labels instead of complete request payloads.
- Valid Rapid Security Manager admin settings and CSP report payloads receive only narrow signature-scan exemptions; IP access rules remain active.
- Added an information panel below the DB-IP Lite Country Database settings with step-by-step instructions and a link to the official DB-IP Lite Country download page.
- Clarified that Rapid Security Manager Free requires the MMDB download and that the downloaded .mmdb.gz archive must be extracted before uploading the .mmdb file.
- Added the Milestone 4 centralized Client IP + GeoIP Core.
- Added trusted-proxy-aware IPv4/IPv6 client IP resolution with REMOTE_ADDR as the trust anchor.
- Added verified Cloudflare proxy handling and strict right-to-left X-Forwarded-For chain evaluation.
- Added optional additional trusted proxy IP/CIDR ranges and conditional Cloudflare range refresh scheduling.
- Added a dedicated GeoIP admin page.
- Rapid Security Manager Free now supports administrator-uploaded DB-IP Lite Country databases only; no GeoIP database is bundled.
- Added staged DB-IP Lite Country validation and safe replacement/rollback behavior.
- Added local MMDB country lookup without online GeoIP APIs or per-IP WordPress transients.
- Added an extensible Free/Core GeoIP provider registry for future Pro providers without duplicating the Free engine.
- Added Client IP and DB-IP Lite Country diagnostics.
- Unified all Rapid Security Manager admin pages into full-width functional panels, with WordPress-blue left borders on settings groups.
- Reduced the vertical padding of the CSP Allow Source explanation and confirmation panels for a more compact modal layout.
- Removed the duplicated CSP log-cleanup sentence from the confirmation panel in the Allow CSP Source modal.
- Extended clickable Blocked URI handling beyond external image sources to all supported CSP source types.
- Added Allow CSP Source support for external HTTP(S)/WS(S) origins, inline code, eval, WebAssembly eval, data:, blob:, same-origin and valid URI-scheme sources.
- Added strong risk warnings for unsafe-inline, unsafe-eval and other security-sensitive CSP changes.
- Generalized resolved-log cleanup to match the same effective directive and normalized CSP source expression.
- Kept the Free workflow global-only; URL-specific CSP allowances remain reserved for the Pro add-on.
- Tightened the default img-src policy to allow self, data: and secure.gravatar.com instead of all HTTPS image origins.
- Tightened the default frame-src policy to self only.
- Added a non-destructive upgrade step that changes only untouched 0.3.1 img-src and frame-src defaults.
- Removed the IP address and Action columns from the Free CSP Log interface while retaining IP storage for later Pro analysis.
- Made supported Blocked URI values clickable and added a professional Allow CSP Source modal.
- Limited the Free source workflow to origin-level global allowances; URL-specific allowances remain reserved for the Pro add-on.
- Added server-side log-ID revalidation, source-origin validation, risk-aware warnings, preview confirmation and resolved-log counts.
- After a successful policy update, matching log rows with the same effective directive and blocked origin are removed.
- Added structured Content Security Policy settings for public front-end responses.
- Added Report Only and Enforce modes with conservative defaults.
- Preserved blob: in worker-src for WordPress 7.1 client-side media processing.
- Added Runtime and Apache/LiteSpeed Cache Compatibility CSP delivery without applying CSP to WordPress admin/editor routes.
- Added a local same-site CSP report REST endpoint with exact home/site host validation, payload limits, batch limits and atomic rate limiting.
- Added a bounded local CSP Log with Unix timestamps, WordPress-formatted display, client IP/User-Agent context, duplicate aggregation, retention cleanup and privacy-conscious URL normalization.
- Added guided, nonce-protected source suggestions with CSP fallback-aware directive updates.
- Added CSP and CSP Log diagnostics.
- Kept the Rapid Security Manager Pro add-on API at version 1; Pro 0.1.1 remains compatible.
- Added Security Headers with conservative defaults and structured validation.
- Added Runtime and Apache/LiteSpeed Cache Compatibility delivery modes.
- Added opt-in WordPress Hardening controls for XML-RPC, REST user enumeration, author query enumeration, generator output and the built-in file editors.
- Preserved WordPress 7.1 Document-Isolation-Policy ownership on wp-admin editor screens.
- Added non-destructive 0.1.1 to 0.2.0 settings provisioning and expanded diagnostics/regression tests.
- Updated Plugin URI and Author URI metadata.
- Added the languages directory to the Free and Pro package structure.
- Initial greenfield Core/Add-on architecture milestone.