WordPress.org
Get WordPress

Plugin Directory

Changeset 3395378


Ignore:
Timestamp:
11/13/2025 10:44:37 PM (5 months ago)
Author:
TCattd
Message:

1.7.1

Location:
fuerte-wp/trunk
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • fuerte-wp/trunk

    • Property svn:ignore

      •  

        old new  
        11deploy.sh
        22.claude
         3.config-tcattd
        34.wp-org-assets
        45sftp-config.json
        … …  
        1011CODE_OF_CONDUCT.md
        1112CONTRIBUTING.md
         13FAQ.md
         14README.md
         15SECURITY.md
        1216TODO.md
        1317.php-cs-fixer.cache

  • fuerte-wp/trunk/CHANGELOG.md

    r3395361 r3395378  
    11# Changelog
    22
    3 # 1.7.0 / 2025-11-13
     3# 1.7.1 / 2025-11-13
    44- Added comprehensive Login Security system with rate limiting and IP lockout functionality.
    55- Implemented failed login attempt tracking with configurable thresholds and lockout durations.

  • fuerte-wp/trunk/README.txt

    r3395361 r3395378  
    22Contributors: tcattd
    33Tags: security, login, protection, admin, brute-force, GDPR, privacy, access-control, multisite
    4 Stable tag: 1.7.0
     4Stable tag: 1.7.1
    55Requires at least: 6.0
    66Tested up to: 6.9
    … …  
    107107== Frequently Asked Questions ==
    108108
    109 = Is this plugin safe for beginners? =
    110 Absolutely! Fuerte-WP is designed with smart defaults. Simply install, add yourself as a super user, and you're protected. Advanced features are optional.
     109= Where is the FAQ? =
     110You can [read the full FAQ at GitHub](https://github.com/EstebanForge/Fuerte-WP/blob/master/FAQ.md).
    111111
    112 = Will this slow down my website? =
    113 No! Fuerte-WP is optimized for performance with intelligent caching and background processing. You won't notice any speed difference.
     112= Suggestions, Support? =
     113Please, open [a discussion](https://github.com/EstebanForge/Fuerte-WP/discussions).
    114114
    115 = What if I get locked out? =
    116 Super users can never be locked out. Always add your email to the Super Users list immediately after installation.
     115= Found a Bug or Error? =
     116Please, open [an issue](https://github.com/EstebanForge/Fuerte-WP/issues).
    117117
    118 = Does this work with multisite networks? =
    119 Yes! Fuerte-WP is fully compatible with WordPress multisite installations and can be network-activated.
    120 
    121 = Can other administrators disable this plugin? =
    122 No! Fuerte-WP self-protects and can only be disabled by super users or users with server access (FTP, SSH, etc.).
    123 
    124 = Is GDPR compliance included? =
    125 Yes! Built-in privacy notices and logging help with GDPR compliance requirements.
    126 
    127 = Do I need technical knowledge? =
    128 Basic WordPress knowledge is sufficient. The interface is intuitive with helpful explanations for every feature.
    129 
    130 = What about support? =
    131 We offer excellent support through GitHub discussions. Documentation and FAQs are available for self-help.
    132 
    133 = Is my login URL really hidden? =
    134 Yes! Your wp-login.php becomes inaccessible, and attackers are redirected away from your site.
    135 
    136 = Can I customize the restrictions? =
    137 Absolutely! Every security feature can be customized to fit your specific needs.
    138 
    139 = What if I forget my custom login URL? =
    140 Super users can still access wp-admin directly. Always keep your super user email safe!
    141118
    142119== Screenshots ==
    143120
    144 1. **Security Dashboard** - Real-time monitoring of login attempts and security events
    145 2. **Login Security Settings** - Configure custom login URLs and protection settings
    146 3. **Super User Configuration** - Manage who has full access to your WordPress site
    147 4. **Access Control Panel** - Customize restrictions for different administrator roles
    148 5. **Live Attack Monitoring** - Watch security events unfold in real-time
    149 6. **GDPR Compliance Settings** - Configure privacy notices and compliance features
     1211. Main options page.
     1222. Emails configuration.
     1233. Restrictions.
     1244. Advanced restrictions.
    150125
    151126== Changelog ==
    152127
    153 = 1.7.0 / 2025-11-06 =
    154 🚀 **MAJOR SECURITY UPDATE**
     128[Check the changelog at GitHub](https://github.com/EstebanForge/Fuerte-WP/blob/master/CHANGELOG.md).
    155129
    156 **NEW LOGIN SECURITY FEATURES:**
    157 - ✨ **Login URL Hiding** - Hide wp-login.php and wp-admin from attackers
    158 - ✨ **Custom Login URLs** - Use pretty URLs or query parameters for login
    159 - ✨ **Brute-Force Protection** - Rate limiting and automatic IP lockouts
    160 - ✨ **Real-Time Monitoring** - Live dashboard showing login attempts
    161 - ✨ **GDPR Privacy Notices** - Customizable compliance messages
    162 - ✨ **Attack Logging** - Comprehensive security event logging
    163 - ✨ **Export Capabilities** - Download security data for analysis
    164 
    165 **ENHANCEMENTS:**
    166 - 🔧 Improved admin interface with better organization
    167 - 🔧 Enhanced configuration caching for better performance
    168 - 🔧 Better multisite compatibility
    169 - 🔧 Optimized database queries and logging
    170 - 🔧 Updated user interface with clearer security indicators
    171 
    172 **SECURITY IMPROVEMENTS:**
    173 - 🛡️ Added hidden field validation for login forms
    174 - 🛡️ Enhanced CSRF protection mechanisms
    175 - 🛡️ Improved IP detection and blocking
    176 - 🛡️ Better handling of proxy and CDN configurations
    177 - 🛡️ Strengthened protection against automated attacks
    178 
    179 **BUG FIXES:**
    180 - 🐛 Fixed GDPR message display duplication
    181 - 🐛 Resolved configuration caching issues
    182 - 🐛 Fixed redirect handling for custom login URLs
    183 - 🐛 Improved compatibility with various hosting environments
    184 - 🐛 Enhanced error handling and logging
    185 
    186 Previous changelog entries available at [GitHub](https://github.com/EstebanForge/Fuerte-WP/blob/master/CHANGELOG.md).
    187 
    188 == Upgrade Notice ==
    189 
    190 = 1.7.0 =
    191 🚨 **MAJOR SECURITY UPGRADE** - This release adds powerful new login security features! After upgrading, please visit Settings > Fuerte-WP to configure your custom login URL and review the new security features. Your WordPress site will be more secure than ever before!

  • fuerte-wp/trunk/SECURITY.md

    r3395361 r3395378  
    55| Version | Supported          |
    66| ------- | ------------------ |
    7 | 1.7.0   | :white_check_mark: |
    8 | <1.7.0  | :x:                |
     7| 1.7.1   | :white_check_mark: |
     8| <1.7.1  | :x:                |
    99
    1010## Reporting a Vulnerability

  • fuerte-wp/trunk/admin/class-fuerte-wp-admin.php

    r3395361 r3395378  
    1919 * @author     Esteban Cuevas <esteban@attitude.cl>
    2020 */
     21
     22// No access outside WP
     23defined('ABSPATH') || die();
     24
     25// Ensure Carbon Fields functions are available
     26require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
     27
    2128class Fuerte_Wp_Admin
    2229{
    … …  
    8188    {
    8289        global $fuertewp;
     90
     91        // Early exit if not a super admin - fallback capability check for migration compatibility
     92        if (!current_user_can('manage_options')) {
     93            return;
     94        }
    8395
    8496        /*
    … …  
    12261238        $super_users = carbon_get_theme_option('fuertewp_super_users');
    12271239
     1240        // Normalize to array format for consistency
     1241        if (is_string($super_users) && !empty($super_users)) {
     1242            $super_users = [$super_users];
     1243        }
     1244
    12281245        if (empty($super_users) || !is_array($super_users)) {
    12291246            // No users at all. Add current_user back as super user
    12301247            carbon_set_theme_option(
    12311248                'fuertewp_super_users',
    1232                 $current_user->user_email,
     1249                [$current_user->user_email],
    12331250            );
    12341251        } else {

  • fuerte-wp/trunk/fuerte-wp.php

    r3395361 r3395378  
    66 * Plugin URI:        https://github.com/EstebanForge/Fuerte-WP
    77 * Description:       Stronger WP. Limit access to critical WordPress areas, even other for admins.
    8  * Version:           1.7.0
     8 * Version:           1.7.1
    99 * Author:            Esteban Cuevas
    1010 * Author URI:        https://actitud.xyz
    … …  
    164164    $super_users = carbon_get_theme_option('fuertewp_super_users');
    165165
    166     if (empty($super_users) || !is_array($super_users)) {
     166    if (empty($super_users)) {
    167167        $current_user = wp_get_current_user();
    168168
    169169        if ($current_user && $current_user->ID > 0 && current_user_can('manage_options')) {
    170             // Add current user as super user
     170            // Add current user as super user - store as array for consistency
    171171            carbon_set_theme_option('fuertewp_super_users', [$current_user->user_email]);
    172172        }

  • fuerte-wp/trunk/includes/class-fuerte-wp-activator.php

    r3395361 r3395378  
    1010// No access outside WP
    1111defined('ABSPATH') || die();
     12
     13// Ensure Carbon Fields functions are available
     14require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
    1215
    1316/**

  • fuerte-wp/trunk/includes/class-fuerte-wp-enforcer.php

    r3395361 r3395378  
    1313defined('ABSPATH') || die();
    1414
     15// Ensure Carbon Fields functions are available
     16require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
     17
    1518/**
    1619 * Main Fuerte-WP Class.
    … …  
    7376
    7477        // Check if super users are already configured (check this first to avoid unnecessary work)
    75         $super_users = get_option('_fuertewp_super_users', '');
    76         if (!empty($super_users)) {
     78        $existing_super_users = carbon_get_theme_option('fuertewp_super_users');
     79
     80        if (!empty($existing_super_users)) {
    7781            return; // Super users already configured
    7882        }
    … …  
    9094                // Import super users from file to database
    9195                $first_super_user = reset($file_config['super_users']);
    92                 update_option('_fuertewp_super_users', $first_super_user);
     96                carbon_set_theme_option('fuertewp_super_users', $first_super_user);
    9397                Fuerte_Wp_Logger::info('Super users imported from file: ' . $first_super_user);
    9498                return;
    … …  
    99103        $current_user = wp_get_current_user();
    100104        if ($current_user && $current_user->ID > 0 && current_user_can('manage_options')) {
    101             update_option('_fuertewp_super_users', $current_user->user_email);
    102 
    103             // Also set plugin status if not already set
    104             if (get_option('_fuertewp_status') === false) {
    105                 update_option('_fuertewp_status', 'enabled');
     105            // Store as string for backward compatibility
     106            carbon_set_theme_option('fuertewp_super_users', $current_user->user_email);
     107
     108            // Also set plugin status if not already set using Carbon Fields
     109            $status = carbon_get_theme_option('fuertewp_status');
     110            if (empty($status)) {
     111                carbon_set_theme_option('fuertewp_status', 'enabled');
    106112            }
    107113
    … …  
    551557        if (function_exists('carbon_get_theme_option')) {
    552558            $options['fuertewp_status'] = carbon_get_theme_option('fuertewp_status');
    553             $options['_fuertewp_super_users'] = carbon_get_theme_option('fuertewp_super_users');
     559            $options['super_users'] = carbon_get_theme_option('fuertewp_super_users');
    554560            $options['fuertewp_access_denied_message'] = carbon_get_theme_option('fuertewp_access_denied_message');
    555561            $options['fuertewp_recovery_email'] = carbon_get_theme_option('fuertewp_recovery_email');

  • fuerte-wp/trunk/includes/class-fuerte-wp-ip-manager.php

    r3395361 r3395378  
    1818// Load the helper class
    1919require_once FUERTEWP_PATH . 'includes/class-fuerte-wp-helper.php';
     20
     21// Ensure Carbon Fields functions are available
     22require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
    2023
    2124/**

  • fuerte-wp/trunk/includes/class-fuerte-wp-login-logger.php

    r3395361 r3395378  
    1515// No access outside WP
    1616defined('ABSPATH') || die();
     17
     18// Ensure Carbon Fields functions are available
     19require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
    1720
    1821/**

  • fuerte-wp/trunk/includes/class-fuerte-wp-login-manager.php

    r3395361 r3395378  
    1515// No access outside WP
    1616defined('ABSPATH') || die();
     17
     18// Ensure Carbon Fields functions are available
     19require_once FUERTEWP_PATH . 'vendor/htmlburger/carbon-fields/core/functions.php';
    1720
    1821/**
Note: See TracChangeset for help on using the changeset viewer.