Solutiontech Seguridad de acceso
| 开发者 | solutiontechcl |
|---|---|
| 更新时间 | 2026年9月16日 02:09 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Seguridad de acceso por Solutiontech protects WordPress access and reduces unnecessary public exposure without renaming core files or modifying .htaccess.
Main features:
- Generador de Informes Ejecutivos de Seguridad para Clientes (PDF / HTML): Reportes corporativos listos para imprimir o descargar como HTML autónomo, con métricas ejecutivas, score de seguridad, resumen de vectores neutralizados y personalización con nombre de agencia.
- Motor de Reglas WAF Personalizadas (Custom Firewall Rules): Reglas a medida por URI, Query String, User-Agent o contenido POST con operadores de coincidencia y expresiones regulares protegidas contra ReDoS.
- Procedencia Geográfica de Amenazas en Tiempo Real: Monitoreo y agregación de países de origen con banderas y porcentajes relativos en el Centro de Inteligencia de Amenazas.
- Breached Password Protection (HaveIBeenPwned k-Anonymity API): Validates new passwords against public breach databases using strict 5-character SHA-1 range queries with Add-Padding to guarantee zero password disclosure.
- Instant Lockout for Forbidden Dictionary Usernames: Immediately bans offending IPs on attempt #1 when attempting generic attacker usernames (admin, root, administrator, test, etc.) without waiting for standard retry limits.
- Global Session Kill-Switch / Panic Button: Emergency one-click button to revoke all active WordPress session tokens across the site in case of security incident or intrusion.
- Agency Threat Network & Central Hub Mode: Connect to Solutiontech distributed threat intelligence network or operate as a central agency hub to synchronize IP blacklists and whitelists across client websites.
- 2FA Emergency Backup Recovery Codes: Generates secure single-use recovery code sets in user profiles to prevent lockouts.
- Cloudflare Turnstile Anti-Bot Protection: Frictionless, privacy-first bot detection challenge across login, registration, and lost password forms.
- Malware Upload Shield (PHP File Scanner): Automatically scans /wp-content/uploads/ for suspicious executable PHP scripts and backdoors.
- Interactive Audit Log Filter & Live Search: Instant client-side search and category filtering across recorded security events.
- Authenticator App 2FA (TOTP - RFC 6238): Support for Google Authenticator, Microsoft Authenticator, and Authy with QR code pairing in user profiles.
- GeoIP Country Restriction: Allow or block access based on visitor country code from reverse proxies and Cloudflare.
- Security Email Alerts: Real-time HTML notifications with anti-flood rate limits for brute force, WAF blocks, and core discrepancies.
- WordPress Dashboard Widget: Overview widget with security score ring, status pills, and 24-hour threat metrics.
- Micro-WAF (Web Application Firewall): Early inspection and neutralisation of SQL Injections (SQLi), Cross-Site Scripting (XSS), Path Traversal (LFI), Remote Code Execution (RCE), and malicious security scanners.
- IP Whitelist & Permanent Blacklist: Allows instant exclusion for trusted IPs and permanent 403 blocking for malicious IPs and CIDR ranges across the entire website.
- WordPress Core File Integrity Checker: Verifies local core files against official WordPress.org cryptographic MD5 checksums to detect modified or missing CMS files.
- Two-Factor Authentication (2FA via Email OTP): Delivers a 6-digit one-time code to authorized user emails to secure privileged logins.
- Strong Password Policies & Expiration: Enforces 12+ character complexity and optional periodic password expiration reminders.
- Official Internationalization & Translation Template: Standard .pot file included in languages/ for seamless translation with Poedit, Loco Translate, or WordPress.org GlotPress.
- Invisible Honeypot Anti-Spam: Blocks automated bots across login, password recovery, registration, and comment forms without annoying CAPTCHAs.
- Pingback & XML-RPC DDoS Protection: Strips X-Pingback headers and disables XML-RPC pingback reflection methods.
- WordPress Core Hardening: Hide WordPress version from headers/feeds/asset query strings, remove legacy discovery tags (RSD, WLWManifest, oEmbed), and disable built-in file editing.
- Background automated cleanup with WP-Cron for expired audit logs and 404 entries.
- Secure CSV export for Audit Log and 404 Monitor with Excel UTF-8 BOM and formula injection protection.
- Runtime in-memory caching for faster settings retrieval without redundant database queries.
- Google reCAPTCHA v3 invisible bot protection with score threshold on login and lost-password forms.
- HTTP Security Headers injection (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS).
- Progressive brute-force lockout with escalating lockout tiers for repeat offenders.
- Optional WooCommerce catalog mode, including controls for administrators and variable products.
- Security status dashboard with an informative score and links to each setting.
- Responsive sidebar navigation organized by security area.
- Session and device management based on native WordPress session tokens.
- Individual session revocation, single-session policy, and optional inactivity timeout.
- Optional alerts when a user signs in from a new device.
- 404 monitor with retention, entry limits, and direct conversion to a redirect rule.
- Same-site redirect manager supporting 301, 302, 307, and 308 responses.
- Optional custom login URL and random URL regeneration.
- Protection against direct access to wp-login.php and wp-admin for visitors.
- Configurable login attempt limiting by IP address using WordPress transients.
- Generic login errors to reduce account enumeration.
- Optional author enumeration and public REST user endpoint protection.
- Optional XML-RPC restriction.
- Environment diagnostics for Multisite, subdirectories, proxy/CDN setups, WooCommerce, and recovery flows.
- Optional deterrents for casual copying of images and text.
- Local audit log for relevant authentication and administration events.
- Configurable audit-log retention from 1 to 365 days, limited to 500 events.
- Independent controls for new comments and pingbacks on posts and pages.
- Optional email alerts when the login-attempt limit is reached.
- Configurable response for blocked login routes: 404, home page, or a custom URL.
安装:
- Upload the plugin files to the
/wp-content/plugins/solutiontech-seguridad-de-accesodirectory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the 'Plugins' screen in WordPress.
- Use the 'Seguridad Solutiontech' screen to configure the plugin settings.
屏幕截图:
常见问题:
What happens if I forget the custom login URL?
Use the emergency recovery URL shown on the plugin settings page. Keep a secure copy of this address. If you also lose that address, you can access your hosting panel or FTP client and temporarily rename the plugin folder in /wp-content/plugins/ to disable it and sign in through /wp-login.php.
Does the plugin modify .htaccess or web server configuration files?
No. All protections, including login redirection, rate limiting, and session handling, are executed dynamically inside WordPress.
Does rate limiting affect all users?
Rate limiting applies to any IP address attempting to sign in. The default allows 5 attempts, followed by a temporary lockout. Legitimate users can wait for the lockout period to expire or request an administrator to clear their IP address from the lockout pool.
Can I use Two-Factor Authentication with Authenticator Apps?
Yes. Version 1.22.0 introduces Authenticator App 2FA (TOTP RFC 6238) supporting Google Authenticator, Microsoft Authenticator, Authy, and 1Password with pure PHP offline SVG QR code pairing.
How does Country Geolocation (GeoIP) work?
GeoIP lets you restrict access based on visitor country code. It works out of the box with Cloudflare (CF-IPCountry) and reverse proxies (X-Country-Code). You can set it to allowlist or blocklist mode.
What does the Micro-WAF protect against?
The built-in Web Application Firewall inspects incoming HTTP requests to block SQL Injection (SQLi), Cross-Site Scripting (XSS), Local File Inclusion / Remote Code Execution (LFI/RCE), and malicious penetration testing scanners (such as sqlmap, nikto, wpscan).
What is the difference between IP Whitelist and Permanent Blacklist?
The IP Whitelist excludes trusted IPs and CIDR ranges from rate limiting and WAF blocking. The Permanent Blacklist immediately rejects all traffic from designated IPs and subnets with a 403 Forbidden response.
How does the WordPress Core Integrity Checker work?
It fetches the official cryptographic MD5 checksums for your current WordPress version from WordPress.org and compares every local file in wp-admin, wp-includes, and the root directory to detect unauthorized modifications, malware injections, or missing files.
Does disabling XML-RPC affect Jetpack or the WordPress Mobile App?
Disabling XML-RPC prevents automated brute force and pingback DDoS attacks. If you use Jetpack or the mobile app, you can keep XML-RPC enabled or use the dedicated toggle in the Sites Protection tab.
What does content protection do?
It adds optional client-side controls that discourage casual visitors from right-clicking images, dragging images to their desktop, selecting and copying text, or using common copy shortcuts.
Can I disable new user registration while keeping the site open?
Yes. You can disable registration entirely or restrict new registrations to specific roles such as Subscriber or Customer.
Can I disable comments on all posts or pages at once?
Yes. The plugin includes toggles to disable comments across all published posts, all pages, or both.
Does disabling comments delete existing comments?
New comments and pingbacks are prevented for the selected content type. Existing comments are not deleted.
Can content protection completely prevent copying?
No. These controls are deterrents. Content downloaded by a browser may still be obtained by other means or captured in a screenshot.
Is the plugin compatible with Multisite, subdirectory installations, and WooCommerce?
The plugin includes diagnostics and dedicated handling for these environments. On Multisite, settings are stored per site. After changing the login URL, test sign-in, sign-out, and password recovery in a private browser window.
Which redirect types are supported?
The redirect manager supports 301, 302, 307, and 308. The source and destination must belong to the current site's domain. External hosts, duplicates, loops, and critical WordPress routes are rejected.
How does session management work?
The Sessions section uses native WordPress session tokens. Administrators can review devices, close an individual session, close other sessions for their own account, or revoke sessions for another accessible account. The current administrative session is protected against accidental revocation.
What information does the 404 monitor store?
It stores the requested path without query parameters, a referrer without query parameters, a general browser/device description, first and last detection times, and a hit count. It does not store IP addresses and excludes administration, REST, AJAX, cron, critical routes, and request methods other than GET or HEAD.
更新日志:
2.2.1
- Informes Ejecutivos en Red de Agencia: Generación de Informes Ejecutivos de Seguridad multi-sitio consolidados de la red de agencia y reportes individuales filtrados por cliente desde el panel central.
- Corrección de Error Crítico en Generador de Reportes: Resuelve la excepción en la invocación de la puntuación de seguridad en la exportación de informes ejecutivos.
- Integración de Accesos Directos de Reportes: Nuevos botones de acceso en el Hub de Agencia y en la tabla de clientes para emitir informes ejecutivos en 1 clic.
- Generador de Informes Ejecutivos de Ciberseguridad para Clientes (PDF / HTML): Vista corporativa ejecutiva imprimible (@media print / window.print()) y descargable como HTML autónomo, con índice de seguridad, resumen de amenazas neutralizadas por vector de ataque, estado de salud del CMS, distribución geográfica y recomendaciones técnicas personalizadas con el nombre de tu agencia.
- Motor de Reglas WAF Personalizadas (Custom Firewall Rules): Interfaz de creación y gestión de reglas perimetrales personalizadas sobre URI, Query String, User-Agent y cuerpo POST con operadores contiene, igual, comienza con y expresiones regulares seguras (anti-ReDoS), con opciones de bloqueo inmediato (HTTP 403) o modo monitor/registro forense.
- Procedencia Geográfica de Amenazas en Tiempo Real: Visualización gráfica de procedencia geográfica de los ataques neutralizados por el Firewall y las defensas de acceso, con banderas Unicode, conteo exacto de incidentes y porcentajes relativos en el Centro de Inteligencia de Amenazas.
- Enriquecimiento Forense de Auditoría: Registro automático del código de país ISO en cada evento de auditoría para trazabilidad geográfica avanzada.
- Protección contra Contraseñas Filtradas (HaveIBeenPwned k-Anonymity API): Valida en tiempo real durante la creación o cambio de clave que la contraseña no haya aparecido en filtraciones masivas de datos públicas, empleando k-Anonymity estricto donde solo se transmiten los primeros 5 caracteres del hash SHA-1 con encabezado Add-Padding.
- Bloqueo Instantáneo por Usuarios Prohibidos de Diccionario: Bloquea automáticamente en el 1er intento fallido a cualquier IP o bot que intente autenticarse con nombres genéricos de atacante (admin, administrator, root, test, guest, user, demo, etc.) sin esperar al agotamiento de reintentos.
- Botón de Pánico / Global Session Kill-Switch: Interruptor de emergencia en el panel de Dispositivos y Sesiones para invalidar masiva e instantáneamente todos los tokens de sesión activos en WordPress (con opción de preservar la sesión actual del administrador o revocar todo el sitio).
- Hardening Defensivo de Ciberseguridad: Auditoría integral de arquitectura con mitigación proactiva contra vectores OWASP y CWE.
- Blindaje contra SSRF en Webhooks: Migración al transporte seguro wp_safe_remote_post() para las alertas de seguridad instantáneas (Discord, Slack, Telegram y JSON), previniendo pivotes hacia subredes privadas o metadatos de computación en la nube.
- Rate-Limiting por IP en Endpoints REST: Control estricto de tasa en la Red de Amenazas (/hub/threat-feed, /hub/report-threat y /agency/push-rule) con bloqueo temporal (HTTP 429) tras 10 intentos fallidos continuos de API Key.
- Micro-WAF con Inspección de Cuerpos JSON: El Firewall analiza cargas útiles transmitidas en application/json (php://input) en llamadas dinámicas y APIs REST, filtrando SQLi, XSS y LFI/RCE sin exponer contraseñas.
- Resistencia a Evasión por Doble Codificación: Motor de decodificación profunda multinivel (Multi-Pass URL Decoding) en el WAF para desarticular vectores con secuencias anidadas (%252e%252e%252f).
- Purga Total en Desinstalación: Ciclo de vida robusto en uninstall.php que limpia exhaustivamente datos de la Red de Agencia, CVE Scanner, transitorios y tareas programadas en WP-Cron tanto en sitios individuales como en redes Multisite.
- Telemetría de Amenazas - Retención de 120 Días: Historial de telemetría de ataques conservado por al menos 120 días con poda automática diaria mediante WP-Cron.
- Telemetría de Amenazas - Filtro por Fechas: Selector de rango de fechas (desde y hasta) para consultar incidentes históricos neutralizados en el Hub.
- Telemetría de Amenazas - Paginación Numerada: Visualización paginada a 50 incidentes por vista con controles numéricos (« Anterior, 1, 2, 3..., Siguiente ») y preservación de navegación fluida.
- Exportación CSV de Red Filtrada: El reporte CSV de estadísticas de red respeta los filtros de fecha seleccionados en la pantalla.
- Auditoría de Seguridad Integral: Corrección de hallazgos de seguridad (A-01 a A-04, M-01 a M-08, B-03, B-04, B-06).
- Red Agencia - Descarga de Estadísticas: Nueva función para exportar informes completos en CSV con clientes autorizados, listas de IPs distribuidas y telemetría de eventos neutralizados.
- Telemetría de Amenazas en Vivo: Conexión automática de bloqueos de auditoría y Micro-WAF al stream de telemetría del Hub Central y nodos de la red.
- Hardening 2FA / TOTP: Aislamiento de códigos QR y secretos por usuario, códigos de respaldo de 40 bits de entropía con random_bytes(), verificación estricta de secrets antes de activación y prevención anti-replay RFC 6238.
- Verificación GeoIP Segura: Restricción de encabezados Cloudflare CF-IPCountry mediante verificación estricta de rangos IP CIDR oficiales de Cloudflare.
- Micro-WAF Anti-CSRF y Suspensión Temporal: Detección de Sec-Fetch-Site para prevenir autobloqueos accidentales por CSRF cruzado y suspensión temporal de 24 horas para atacantes reincidentes.
- Enlaces Directos de Configuración: Acceso directo en 1 clic a los paneles de control de Cloudflare Turnstile y Google reCAPTCHA v3.
- Limpieza de Interfaz: Remoción del pie de página "Gracias por crear con WordPress" en las pantallas del plugin.
- Modo Agencia y Red Global de Inteligencia de Amenazas (Threat Network): Conexión distribuida opcional para sincronizar listas negras y blancas de IPs en tiempo real con el servidor central de Solutiontech.
- Soporte de Rol Dual (Modo Nodo Cliente vs Modo Servidor Central Hub): Permite operar como sitio cliente receptor de directivas de seguridad o como servidor central Hub para agencias de desarrollo y mantenimiento web.
- Generador Criptográfico de Claves API de Clientes: Consola de administración en modo Hub para emitir, copiar con 1 clic, revocar y eliminar credenciales API seguras (
st_net_...) para sitios clientes conectados. - Jerarquía Estricta Anti-Autobloqueo: La lista blanca local del cliente mantiene prioridad absoluta (#1) sobre cualquier regla de red global para evitar autobloqueos accidentales, con banner de advertencia prominente en la interfaz.
- Endpoint REST API Seguro de Threat Feed y Telemetría: Endpoints autenticados vía
X-ST-Agency-Keypara entrega instantánea de feeds de ciberdefensa y stream de telemetría de ataques en vivo. - Cumplimiento Total de Directrices WordPress.org: Módulo 100% opt-in desactivado por defecto y sección formal de declaración de servicios externos en readme.txt.
- Escáner de Vulnerabilidades Conocidas (CVE): Audita el núcleo de WordPress, plugins y temas instalados contra la base de datos pública global de CVEs (WPVulnerability Intelligence) con soporte para evaluación de versiones afectadas, CVSS y enlaces oficiales.
- Nuevo Panel y Menú Lateral "Escáner CVE": Sección dedicada en la barra de navegación del plugin con métricas de severidad (Crítica, Alta, Media, Baja), botón de escaneo inmediato y tabla detallada con parches recomendados.
- Alertas Proactivas en WP-Cron: Escaneo diario en segundo plano con despacho automático de notificaciones por Correo y Webhooks (Discord, Slack, Telegram, JSON) al detectar vulnerabilidades críticas.
- Chequeo Oficial en Salud del Sitio: Integración del 6º control de seguridad certificado en Herramientas > Salud del sitio de WordPress.
- Perfiles de Configuración Rápida en 1 Clic (Presets): Permite aplicar perfiles preconfigurados (Básico, Recomendado, Tienda / WooCommerce y Blindaje Total) directamente desde el panel de Resumen sin sobreescribir claves API ni datos sensibles.
- Webhooks de Notificación Instantánea: Despacho asíncrono y en tiempo real de alertas de seguridad a canales de Discord (Embeds enriquecidos), Slack (Blocks interactivos), Telegram (Telegram Bot API con Chat ID) y Webhooks Genéricos (JSON REST) con botón de prueba en 1 clic.
- Integración Oficial con Salud del Sitio (WP_Site_Health API): 5 chequeos certificados en la herramienta nativa Herramientas > Salud del sitio de WordPress (Micro-WAF, 2FA, Integridad del Core, Blindaje de Uploads y Protección de wp-login.php).
- Threat Defense Center & Forensic Reports: Dedicated intelligence and monitoring panel with live threat KPI cards, visual attack vector distribution, Top 5 recurring hostile IPs with 1-click blacklist action, and custom Date Range Forensic CSV Report Generator (filter by date from/to, attack category, and severity).
- Automatic IP Blacklist on Critical Attacks: Automatically adds offending IPs to permanent blacklist upon intercepting SQL Injection, Path Traversal / LFI / RCE, or hostile scanning tools.
- WordPress Auto-Updates Manager: Centralized toggles in site protection to force automatic updates for WordPress core security releases, all installed plugins, and active themes.
- Internationalization: Adds complete native translation packages for 12 locales: Spanish (Chile, Mexico, Argentina, Colombia, Peru, Spain), English (US), Brazilian Portuguese, European Portuguese, French, Italian, Russian, and Simplified Chinese.
- Usability: Protected login URL is now disabled by default on initial activation to prevent unintended lockouts, allowing administrators to explicitly activate and customize their desired login route.
- Adds 2FA Emergency Backup Recovery Codes (8 single-use codes) in user profiles with cryptographic hashing.
- Adds Cloudflare Turnstile anti-bot integration with support for login, registration, and lost-password forms.
- Adds Malware Upload Shield (suspicious executable PHP file scanner in /wp-content/uploads/) in diagnostics panel.
- Adds interactive real-time search and category filtering in the Audit Log panel.
- Adds Two-Factor Authentication via Authenticator Apps (TOTP - RFC 6238) with Google/Microsoft Authenticator and QR code pairing in user profiles.
- Adds real-time Security Email Alerts with HTML formatting and anti-flood throttling for Brute Force lockouts, WAF attacks, and Core Integrity modifications.
- Adds Country Geolocation Filtering (GeoIP) with Allowlist/Blocklist modes and Reverse Proxy / Cloudflare header detection.
- Adds WordPress Dashboard Security Widget with score gauge, protection indicators, and 24h threat summary.
- Fully compliant with WordPress.org Plugin Check validation and standards.
- Adds Micro-WAF (Web Application Firewall) to detect and block SQL Injection, XSS, Path Traversal / LFI / RCE, and malicious scanner tools with forensic audit logging.
- Adds IP Whitelist and Permanent Blacklist management with support for IPv4, IPv6, and CIDR subnet notations.
- Adds WordPress Core File Integrity Checker comparing local core files against official WordPress.org cryptographic checksums with diagnostics dashboard integration.
- Integrates WAF, IP rules, and Core Integrity status into the security dashboard health score.
- Adds Two-Factor Authentication (2FA via Email OTP) with 6-digit cryptographic verification code and brute-force attempt limits.
- Adds Strong Password Policies enforcing 12+ characters, uppercase, lowercase, numbers, and symbols during user creation and password resets.
- Adds optional periodic password expiration reminders for privileged user accounts.
- Integrates 2FA and password policy health checks into the security dashboard status score.
- Adds official translation infrastructure with standard GNU gettext POT template (
languages/solutiontech-seguridad-de-acceso.pot). - Declares
Domain Path: /languagesin plugin headers for automatic native localization via WordPress Core. - Fully compatible with Poedit, Loco Translate, WP-CLI, and WordPress.org GlotPress translation platform.
- Adds Invisible Honeypot Anti-Spam protection across login, lost password, user registration, and comment forms to eliminate automated spam bot submissions.
- Adds Pingback protection: removes X-Pingback headers from server responses and disables XML-RPC pingback methods to mitigate DDoS amplification vectors.
- Adds optional Time-Gate submission speed filter to discard instant automated bot form submissions.
- Integrates anti-spam and honeypot indicators into the security dashboard score and administration panel.
- Adds WordPress Core Hardening module: hides generator meta tags, RSS/Atom version info, and removes ?ver= query strings matching the WordPress core version from public assets.
- Removes legacy and unnecessary discovery tags from HTML head (RSD link, WLWManifest link, and oEmbed discovery links).
- Adds theme and plugin file editor disabling (
DISALLOW_FILE_EDITenforcement and capability filtering) to prevent arbitrary PHP execution in case of account compromises. - Integrates Core Hardening items into the security dashboard health score and environment diagnostics panel.
- Adds daily scheduled WP-Cron task (
solutiontech_seguridad_acceso_daily_cleanup) for automated asynchronous pruning of audit logs and 404 monitor entries. - Adds secure CSV export functionality for Audit Log and 404 Monitor with UTF-8 BOM encoding for Excel compatibility and CSV formula injection protection.
- Implements runtime in-memory caching for settings retrieval to optimize database performance.
- Adds Google reCAPTCHA v3 invisible protection for login and lost-password forms with customizable confidence score threshold.
- Adds HTTP Security Headers module (X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and HSTS).
- Adds Progressive Brute-Force Lockout feature with escalating penalty tiers for recurring attack IPs (1x base duration -> 4x -> 24 hours).
- Integrates new protection modules into the security status score and diagnostics dashboard.
- Resolves Plugin Check update_modification_detected warning by removing core and plugin auto-update management to comply fully with WordPress.org guidelines.
- Clearly distinguishes deleting a 404 history row from permanently resolving the missing URL.
- Renames the redirect action to Resolve permanently and uses a permanent 301 redirect by default.
- Removes the monitored 404 entry after its redirect is saved successfully.
- Resolves the findings from Plugin Check concerning readme metadata, input handling, nonce analysis, and prefixed uninstall variables.
- Uses WordPress' native automatic-update preferences instead of filtering the plugin updater at runtime.
- Adds regression checks for packaging and WordPress.org compatibility metadata.
- Fixes an interpolated translation string in the temporary lockout email.
- Adds regression coverage for static translatable strings and placeholder substitution.
- Adds WooCommerce catalog mode under Content.
- Hides purchasing, cart, checkout, and optional variation controls.
- Can apply catalog mode to administrators while preserving existing order links.
- Resolves internationalization findings reported by Plugin Check.
- Adds translator comments and ordered placeholders.
- Prevents inactivity enforcement from intercepting REST requests used by the block editor.
- Masks IP addresses in the audit-log table.
- Restricts redirect sources and destinations to the current domain.
- Improves redirect normalization for omitted schemes and subdirectory installations.
- Uses the full available width on desktop displays.
- Adds individual session management for other accessible users.
- Strengthens route, redirect, import, IPv6, and Multisite handling.
- Improves diagnostic-card layout and responsive presentation.
- Removes the promotional header from the administration panel.
- Makes dashboard controls link directly to their related settings.
- Improves the Copy URL button and renames technical hardening labels.
- Adds the 404 monitor and refreshes the administration design.
- Adds sessions, device alerts, single-session policy, and inactivity timeout.
- Adds the same-site redirect manager.
- Adds responsive sidebar navigation.
- Adds emergency recovery, JSON import/export, reset tools, and an IP allowlist.