Intranet & Private Site · Version history
Intranet & Private Site changelog and version history
- Latest version
- 1.10.0
- Aug 3, 2026 (3 months ago)
- Releases
- 15
- since 2014
- In the last year
- 5
- about one every 38 days
- Tested up to
- WordPress 7.0.8
- PHP 7.0 or later
Releases each year
- 20141 release
- 20161 release
- 20172 releases
- 20191 release
- 20203 releases
- 20221 release
- 20241 release
- 20265 releases
20265 releases
Intranet & Private Site 1.10.0Latest
- Added: Compatibility with site management platforms: ManageWP (also GoDaddy Pro), MainWP, InfiniteWP, WP Umbrella and WP Remote.
- Changed: Auto-logout now applies only to browser sessions. A request that authenticates without a login cookie has no session to expire, so it is left alone and no longer resets anybody’s idle timer.
- Fixed: ManageWP – with auto-logout enabled, the Worker connector stopped answering its dashboard altogether, and its one-click login into wp-admin could log you straight back out.
- Fixed: ManageWP, MainWP and InfiniteWP – with auto-logout enabled, a connected dashboard kept resetting the idle timer of the administrator account it signs in as, so that person was never logged out for inactivity.
- Fixed: WP Umbrella – it could not reach a “Force private” site at all, because it works entirely through the REST API and met the private-site 401 before it could authenticate. Its own API namespace and the admin-ajax.php calls it makes to itself are now allowed through while it is installed.
- Fixed: WP Remote – it lost the part of its dashboard traffic that goes through admin-ajax.php on a “Force private” site. That one action is now allowed through, once WP Remote has authenticated the caller.
- Fixed: With auto-logout enabled, activity in one browser kept every other login of the same account signed in. Each browser session now keeps its own idle timer.
- Fixed: On a “Force private” site running WordPress 7.0, resetting a password failed at the last step with “Your password reset link appears to be invalid”.
Intranet & Private Site 1.9.2
- Fixed: Nobody could log in to a “Force private” site while a two-factor authentication plugin such as Wordfence was active.
- Fixed: On multisite, creating a sub-site logged a WordPress deprecation notice.
- Fixed: On multisite with a default sub-site role set, the creator of a new sub-site was demoted from administrator to that role.
- Fixed: With auto-logout enabled, users could be logged out again the moment they passed a two-factor check if it took them too long to enter their OTP code.
Intranet & Private Site 1.9.1
- Fixed: Fatal error “Call to undefined function getmypid()” on hosts where the PHP getmypid() function is disabled.
Intranet & Private Site 1.9.0
- Changed: Compatibility with WordPress 7.0.
- Changed: The “Force private” auth gate now works correctly when WordPress is installed in a subdirectory.
- Changed: On activation the plugin now plants a small must-use companion (wp-content/mu-plugins/aioi-installing-gate.php); deactivation removes it. It closes a /wp-activate.php content-leak surface that the main plugin cannot reach on its own (see Fixed).
- Changed: The post-login redirect URL is now sanitized and normalized when saved: a bare path such as dashboard is stored as /dashboard, while site-relative paths and full http(s) URLs are kept as entered.
- Fixed: Fixed multiple access-control bypasses in “Force private” mode that allowed unauthenticated visitors to read protected posts and feeds via crafted URLs.
- Fixed: Closed a content-leak on “Force private” sites where unauthenticated visitors could read protected posts, feeds, and REST output through /robots.txt by overriding its query string (for example /robots.txt?robots=0&feed=rss2 or ?robots=0&p=N).
- Fixed: Fixed unauthenticated post-slug enumeration via WordPress’s canonical redirect on pretty permalinks.
- Fixed: Closed an access-control bypass on “Force private” sites where unauthenticated visitors could post comments and trackbacks to protected posts via wp-comments-post.php and wp-trackback.php.
- Fixed: Closed a content-leak on single-site (and non-network-activated multisite) “Force private” installs where unauthenticated visitors could read RSS feeds and REST API output through /wp-activate.php (for example ?feed=rss2, ?p=N&feed=comments-rss2, or ?rest_route=/wp/v2/posts). WordPress core…
- Fixed: Closed a content-leak on “Force private” sites where unauthenticated visitors could read the site’s blogroll (the OPML links export), title, and WordPress version through /wp-links-opml.php, which loads WordPress without firing the normal page-render auth gate.
- Fixed: Closed an access-control bypass on “Force private” sites where unauthenticated visitors could reach the AJAX and form-handler endpoints (/wp-admin/admin-ajax.php and /wp-admin/admin-post.php). WordPress treats these as admin requests, so the normal page-render auth gate did not apply to them…
- Fixed: On “Force private” sites the REST API and comment/trackback gates now apply the same role and sub-site-membership checks as the rest of the site, so a logged-in user with no role (or who is not a member of the current sub-site) can no longer read REST API content or post comments that they w…
- Fixed: Additional “Force private” hardening: the inactivity auto-logout now bounces through a host-validated safe redirect instead of trusting the Host header, the network settings save now performs an explicit capability check, and the default sub-site member role is validated against the register…
- Fixed: Minor robustness and standards fixes: the private-site robots.txt now includes a User-agent: * line, the plugin’s PHP files guard against direct access, and corrected an internationalization issue in a registration warning notice.
Intranet & Private Site 1.8.1
- Changed: Compatibility with WordPress 6.9.
- Fixed: Made sure the XMLRPC is also safeguarded against unauthorized access.
20241 release
Intranet & Private Site 1.8.0
- IMPORTANT: The minimum WordPress version is now WordPress 5.5.
- IMPORTANT: The minimum PHP version is now PHP 7.0.
- Added: Multisite-specific options: “Require logged-in users to be members of a sub-site to view it”.
- Added: “Sub-site Membership” – assign a user role for newly added users.
- Changed: Compatibility with WordPress 6.6.
- Fixed: Several security-related improvements in various parts of the plugin.
- Fixed: Code style improvements.
20221 release
Intranet & Private Site 1.7.1
- Security update and added WordPress 5.7 compatibility.
20203 releases
Intranet & Private Site 1.7
- Security update and added WordPress 5.6 compatibility.
Intranet & Private Site 1.6.1
Intranet & Private Site 1.6
- Security update and added WordPress 5.4 compatibility.
20191 release
Intranet & Private Site 1.5
- Ready for WP 4.9. Disables unauthenticated calls to WP REST API by default.
20172 releases
Intranet & Private Site 1.4
- Now supports localization – please contribute your translations!
Intranet & Private Site 1.3
- Changed which WordPress hooks are used to check for auto-logout. This is to widen compatibility with certain Themes.
20161 release
Intranet & Private Site 1.2
- On non-multisite WordPress, now restricts access to users who have no role, as well as those who aren’t logged in at all.
20141 release
Intranet & Private Site 1.1
- Ready for public release.
Questions about Intranet & Private Site’s releases
What is the latest version of Intranet & Private Site?
1.10.0, released on Aug 3, 2026 (3 months ago). It’s tested up to WordPress 7.0.8 and needs PHP 7.0 or later.
How often is Intranet & Private Site updated?
5 releases in the last year, about one every 38 days. Its first release on WordPress.org dates from December 2014.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in Intranet & Private Site’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.