Vulnity Security

1. 

   Dashboard overview with real-time threat summary.

2. 

   Alert detail screen showing remediation steps.

3. 

   Settings page for configuring API credentials and scan schedules.

4. 
5. 
6. 

1.2.3

• Fixed firewall bootstrap blocking wp-login.php, wp-cron.php, admin-ajax.php, and xmlrpc.php for blocked IPs — admins can now recover access.
• Fixed firewall bootstrap returning HTML instead of JSON for REST API requests from blocked IPs.
• Fixed uninstall leaving broken .htaccess when file is read-only — now creates safe stub to prevent HTTP 500.
• Fixed early IP blocking (plugins_loaded:0) intercepting AJAX and REST requests, breaking admin panel functionality.
• Reduced SIEM alert timeout from 10s to 3s to prevent page hangs during attacks.
• Reduced inventory sync timeout from 30s to 8s to prevent random slow page loads via pseudo-cron.
• Improved file detection in Protect Common Paths — now handles query strings, trailing slashes, and dotted directory names correctly.
• Added PHP execution blocking rule for uploads directory in generated Nginx configuration snippet.
• Expanded REST API public route whitelist: added WooCommerce v3, UpdraftPlus, BackWPup, Elementor, Forminator, FluentForms, SureCart, MailPoet, and block editor endpoints.
• Added Options -Indexes to Protect Common Paths .htaccess rules as defense-in-depth measure.
• Updated Stable tag from 1.2.2 to 1.2.3.

1.2.2

• Fixed anti-collapse dedup system blocking subsequent auto-update state toggle events due to identical hash.
• Fixed wrong authentication headers for /real-time-alerts endpoint (now uses HMAC-SHA256 signature instead of token).
• Fixed missing remediation field in auto-update state events sent to the SIEM.
• Fixed version_old not captured in auto-update events; now recorded via upgrader_pre_install hook before files are replaced.
• Fixed auto-update trigger running on disable; updates now only fire for newly enabled component types.
• Fixed auto-update event detection using instanceof WP_Automatic_Updater instead of wp_doing_cron() for broader compatibility.
• Fixed single-file plugin slug resolving to . (e.g. hello-dolly) in update event payloads.
• Added triggered_by field to update events: siem_manual, siem_auto_update, or wp_auto_updater.
• Auto-update toggles in the admin panel are now read-only; changes must be made from the SIEM.
• Replaced parse_url() with wp_parse_url() for WordPress coding standards compliance.

1.2.1

• Plugin Check compatibility improvements for filesystem and nonce-related warnings.
• Runtime validation improvements for scanner detection, file editor monitoring, and firewall state serialization.

1.2.0

• Fixed login URL rename validation against existing pages/posts and reserved WordPress routes.
• Fixed uninstall cron cleanup to use wp_unschedule_hook() for complete removal.
• Fixed heartbeat, mitigation sync, and alert buffer crons not cancelled on plugin disconnect.

1.1.9

• Send whitelist IPs (user public IP + localhost) to the SIEM during pairing so the whitelist persists after synchronization.

1.1.8

• Fixed Nginx warning notice appearing repeatedly on every admin page load; it now displays only once.
• Improved notice format: each protected path is shown on its own line for better readability.
• Added link to solution documentation for Nginx .htaccess compatibility.

1.1.7

• Fixed deactivation not clearing all cron jobs (4 missing hooks, plus events re-scheduled by late-firing alert hooks).
• Added final_deactivation_cleanup at priority 9999 to ensure complete cron and .htaccess cleanup after all hooks fire.
• Replaced wp_clear_scheduled_hook with wp_unschedule_hook to clear single events with arguments.
• Added native PHP fallback for .htaccess marker removal when WP_Filesystem is unavailable.
• Fixed Plugin Check error: replaced direct is_writable() with vulnity_path_is_writable() and WP_Filesystem_Direct.

1.1.5

• Fix uninstall multisite cleanup query when sitemeta table is not available to prevent SQL warnings in debug.log.

1.1.4

• Ensure uninstall removes Vulnity firewall/log folders recursively so no plugin-owned folders are left behind.

1.1.3

• Ensure uninstall removes Vulnity firewall/log folders even when permissions are restrictive by attempting safe chmod before cleanup.

1.1.2

• Added a dedicated Vulnity log with line-based rotation and safe fallbacks when uploads are not writable.
• Added admin warning when firewall storage cannot be written, with clear remediation guidance.
• Expanded uninstall cleanup to remove Vulnity log files and firewall artifacts across fallback paths.

1.1.1

• Fixed deactivation cleanup so Vulnity hardening marker blocks are removed fully from .htaccess without modifying user-defined rules.
• Improved deactivation safety in shared hosting environments with conservative, marker-only rollback behavior.

1.1.0

• Improved admin UI consistency across Dashboard, Synchronization, Mitigation, Hardening, and Setup screens.
• Hardened plugin lifecycle behavior for shared hosting compatibility and safer deactivation/uninstall flows.
• Added conservative server integration safeguards to reduce side effects in Apache/Nginx environments.

1.0.5

• Version bump to 1.0.5.

1.0.4

• Version bump to 1.0.4.

1.0.3

• Standardized admin asset enqueues and AJAX URL localization for compliant loading.
• Hardened nonce and capability checks across alerts and admin handlers.
• Improved path resolution using WordPress APIs for non-default installs.
• Documented external Supabase services used for alerts and mitigation updates.

1.0.2

• Initial release.