WPBruiser Security · Version history
WPBruiser Security changelog and version history
- Latest version
- 3.6.4
- Nov 7, 2026 (2 days ago)
- Releases
- 13
- since 2016
- In the last year
- 11
- about one every 2 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
Releases each year
- 20162 releases
- 202611 releases
202611 releases
WPBruiser Security 3.6.4Latest
- Fixed: if the plugin’s log table was missing (for example after a site migration), every form submission wrote a database error to the error log. The table is now recreated automatically.
WPBruiser Security 3.6.3
- Security: a successful login no longer cleared every failed login recorded for that IP address, so someone with any account could log in to it between guesses at another account’s password and never be locked out. Failed logins are now counted per account as well, and a login forgets only that acco…
- Security: failed logins against one account are now also counted across all IP addresses, so guesses spread over several addresses still reach the lockout.
WPBruiser Security 3.6.2
- Fixed: more text couldn’t be translated: the Reports screen (box titles, table headers, chart labels and tooltips, the map tooltip, “No records found”, Previous/Next and the block menu) and the allowed and blocked IP lists (the accepted formats and “Your IP Address is”). Chart dates now use the sit…
- Fixed: with no blocked attempts, the Reports pagination showed a page “0”.
- Fixed: the remaining English-only text can now be translated: the three alert emails, country names (in Reports, the IP lists and the security report), the “Brute Force” and “Country Blocking” names, the XML-RPC “disabled” message apps see, and “N/A”. Dates in Reports and in the alert emails now fo…
- Fixed: deleting the original WPBruiser Pro (sold on CodeCanyon until 2019) also deleted the current plugin’s settings and blocked-attempt logs, because both share them. They are now kept.
- Fixed: deleting WPBruiser and the original WPBruiser Pro together could stop with a PHP error.
- For developers: new filter wpbruiser_module_display_name, so add-ons can translate their module names.
- New: a notice when the original WPBruiser Pro is still installed. It bundles an old copy of WPBruiser and is no longer needed, so it can be deactivated and deleted.
WPBruiser Security 3.6.1
- Fixed: with Ultimate Member 2.6.7 or later, every login through an Ultimate Member form was refused once its protection was on. Ultimate Member moved the form’s details to a second argument of its validation hooks; WPBruiser now reads them from there (and still works with older versions). A refused…
- Fixed: on a translated site, links to WPBruiser’s screens (on the Checkup screen, in the security report and on the Dashboard widget) led to “Sorry, you are not allowed to access this page”. The screens’ addresses were built from their translated names; they now stay the same in every language (wp-…
- Fixed: on the Settings screen, the number of days in the log settings and most of the text in the Trusted Proxy Headers box couldn’t be translated.
WPBruiser Security 3.6.0
- New: Checkup screen. One page with everything that needs your attention, every WPBruiser protection grouped by area with whether it’s on and a link to turn it on, and the status of each installed plugin on WordPress.org.
- New: plugin check. Once a week WPBruiser looks up your installed plugins on the WordPress.org plugin directory and warns you about any that were closed (often for a security issue) or haven’t been updated in over two years. Closed plugins no longer get security fixes, and even an inactive one can b…
- Improved: the security report also says when other plugins have updates waiting.
- New: a Preview email button next to “Send a test report”, which opens the report in a new tab.
- For developers: new filters wpbruiser_plugin_health_enabled, to turn the plugin check off, and wpbruiser_checkup_protections, to add to the Checkup screen’s list.
WPBruiser Security 3.5.0
- New: security report email. Once a week or once a month, WPBruiser emails you what it blocked (with the change from the previous period), the forms bots went for, the IP addresses and usernames they used, and anything that needs your attention: Test Mode left on, an active form plugin that isn’t pr…
- Improved: the attack, administrator sign-in and Test Mode emails have a new, cleaner design that reads well on phones.
- Fixed: the administrator sign-in email greeted “Hi ,” when the account had no first or last name.
- The plugin is now called WPBruiser Security, since it covers login security and WordPress hardening as well as spam. Same plugin, same settings.
- For developers: new filters wpbruiser_report_frequencies, wpbruiser_report_data, wpbruiser_report_checks and wpbruiser_email_recipients, and actions wpbruiser_report_sent and wpbruiser_report_email_sections.
WPBruiser Security 3.4.0
- New: login lockouts. After 5 failed logins in 12 hours (you choose the number), an IP address is locked out for 20 minutes, and for 24 hours after its 4th lockout in a day. They cover the login form, XML-RPC, application passwords and the login forms of other plugins (WooCommerce, Easy Digital Down…
- New: banned usernames. An IP address that tries “admin”, “administrator”, “root” and similar names that no account on your site uses is locked out at once. You can edit the list.
- New, optional: lock out IP addresses that try any username that doesn’t exist, and a lockdown mode that, during a detected brute-force attack, accepts logins only from IP addresses each user has logged in from before.
- New: Reports show lockouts as “Too Many Failed Logins”, “Banned Username” and “Login Lockdown”.
- New, optional: a custom login URL. wp-login.php and, for visitors who are not logged in, wp-admin show a “not found” page; every login, logout and password reset link follows the new address, and it is emailed to the site admin when you set it. define('WPBRUISER_DISABLE_LOGIN_URL', true); in wp-con…
- New, optional: close the REST API to visitors who are not logged in. oEmbed, Contact Form 7, the WooCommerce Store API, Jetpack, LiteSpeed and Wordfence stay open by default, and you can add other namespaces.
- New, optional: turn off application passwords, and block PHP files in the uploads folder (Apache and LiteSpeed; the rules are removed again when you switch the option off or deactivate WPBruiser).
- Fix: Easy Digital Downloads’ lost password form was rejected while WordPress lost password protection was on, because the form never received WPBruiser’s token. It does now.
- New: an “Upgrade to Pro” item at the bottom of the WPBruiser menu, and every Pro link now leads to a page made for people already using the free plugin. Both disappear once WPBruiser Pro is active.
- New: a Documentation button in the Support box, linking to the new WPBruiser documentation on wpzoom.com.
- New: an Easy Digital Downloads card on the Integrations screen (protected with WPBruiser Pro).
- New: with WPBruiser Pro active, the sidebar shows that your site is protected: which plugins’ forms are checked, attempts blocked in the last 30 days, and whether the Pro license is active. When the license has expired or isn’t activated, the box, the Integrations cards and the Security screen say…
- New: the Security screen shows WPBruiser Pro’s country blocking and submission rate limit settings, locked, so you can see what Pro adds there.
- Improved: a lighter look for the settings screens, with underlined tabs, on/off switches instead of checkboxes and more spacing in the lists of accepted IP formats.
- Fix: the WPBruiser Dashboard widget showed its title at the far end of the header, away from its icon.
- Developer: an integration’s form can be marked as opt-in (‘EnableByDefault’ => false), so it is never switched on automatically or by the card’s main switch. When a form ends up with the token field twice, every copy is now filled.
WPBruiser Security 3.3.1
- New: WPZOOM Forms integration, free. Every form is protected whether it is placed as a block, with the [wpzf_form] shortcode or as an Elementor widget; a blocked submission is stopped before any email is sent or entry is stored, and Reports show its fields under their labels.
WPBruiser Security 3.3.0
- New: protection is on from the start. A new install protects WordPress login, registration, lost password and comments, plus every supported plugin that is already active.
- New: a Dashboard widget with blocked attempts for the last day, week and month, and the forms bots target most.
- New: administrators see a small “protected” note under every form WPBruiser covers, so it is easy to check what is protected. Visitors never see it, and it can be hidden in Settings.
- Fix: about one genuine visitor in ten could be rejected on any protected form. On sites without the old mcrypt extension (every PHP 7.2+ site), the bundled cipher library added no padding when the compressed token filled its last block exactly, and then removed real data from the end while decrypti…
- New: an Integrations screen. Every integration, free and Pro, is a card that shows whether its plugin is active, with a switch to turn protection on or off (and a switch per form where there are several), plus filters and search. It replaces the separate Contact Forms, Membership, eCommerce and Oth…
- New: an extension API for add-ons such as WPBruiser Pro. An add-on registers its own protection modules through the wpbruiser_register_modules filter and protects a form with wpbruiser_get_token_field_html(), wpbruiser_is_option_enabled() and wpbruiser_verify_submission(). Each add-on loads its own…
- New: the wpbruiser_loaded action, and the wpbruiser_country_id_for_ip filter for supplying your own IP-to-country data.
- New: the wpbruiser_reject_reason filter, which lets an add-on reject a submission that passed every other check (WPBruiser Pro uses it for rate limits), and add-on settings boxes on the Security screen.
- New: wpbruiser_get_token_field_names(), so integrations can keep the token fields out of stored submissions, and a wpbruiser:token browser event fired when a form receives its token, for forms that submit as JSON.
- Fix: Jetpack contact forms. Blocked submissions kept no fields in Reports, current Jetpack versions (which renamed the form class) were not recognised, and older ones could hit a PHP error on a blocked submission.
- Fix: a lost password request that fails the check now shows an error on the form. It used to redirect to the login page, which also broke WooCommerce’s lost password form.
- The Contact Forms, Membership, eCommerce and Others screens now list modules added by add-ons. The eCommerce screen stays hidden until an add-on adds a module to it.
- Removed leftover references to the old paid extensions from the settings screens, the AJAX setup and brute-force login detection.
- New: the WPBruiser ninja, redrawn as a vector icon, on every WPBruiser screen, in the admin menu (tinted to match your admin colour scheme) and in the Dashboard widget.
- New: Settings and Get Pro links on the Plugins screen, and a WPBruiser Pro box in the settings sidebar that lists the Pro integrations and points out which of those plugins are active on your site. Both disappear once WPBruiser Pro is active.
WPBruiser Security 3.2.1
- Audited every third-party integration against the plugin directory and removed those whose plugin is gone: ZM Ajax Login & Register (closed 2023), PlanSo Forms (closed 2021), UltraCommunity (30 installs, last updated 2020) and Seamless Donations (last updated 2024, tested only to 6.4). Support for…
- Bootstrap updated from 3.2.0 to 3.4.1
- Raphaël updated from 2.1.2 to 2.3.0 (minified build). The bundled morris.js was already the project’s final 0.5.1 release under an upstream banner that still read 0.5.0; the banner now states the real version and the file’s provenance.
- The client script is now a static file loaded with wp_enqueue_script() (deferred) and configured with wp_localize_script(). Previous versions printed an inline loader that fetched a PHP-generated script through a ?gdbc-client= parameter handled before WordPress had finished loading, which also requ…
- Forms injected by AJAX (Ultimate Member, ZM Ajax Login & Register) are detected with a MutationObserver; the inline “refresh tokens” scripts that used to travel with their markup are gone.
- The brute-force “site under attack” flag is stored as a transient. The plugin no longer writes any files: the file cache (which could fall back to wp-content itself), its .htaccess/index.php guards and seven unused cache back ends were removed.
- Every settings callback registered with register_setting() now runs the submitted values through a whitelist that drops unknown keys and coerces each field by its declared type before any module-specific validation.
- Admin styles that were printed inline from the settings partials and the Reports modal moved into the enqueued stylesheet; the Reports map data is localized instead of printed as an inline script.
- The browser fingerprint posted with each token request is unslashed and validated field by field; nonces are unslashed and sanitised before wp_verify_nonce(); a dead URL helper that read $_SERVER unsanitised was removed.
- Fixed – Made an implicitly nullable constructor parameter explicit and replaced a non-canonical cast, both deprecated by PHP 8.4/8.5. – Upgrade routines and first-run defaults run on the init action instead of plugins_loaded, which removes the last remaining trigger of the “translation loading was…
WPBruiser Security 3.1.43
- Fixed PHP 7.4 warnings
- Refreshed Country IPs
- Refreshed WebAttackers IPs
- Refreshed Proxy IPs
- Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges
20162 releases
WPBruiser Security 3.0.15
- Improvements
- Compatibility with Avada theme
- Refreshed Country IPs
- Refreshed WebAttackers IPs
- Refreshed Proxy IPs
WPBruiser Security 2.2.2
- Removed the MaxMind GeoIP Databases due to the licensing terms violation
Questions about WPBruiser Security’s releases
What is the latest version of WPBruiser Security?
3.6.4, released on Nov 7, 2026 (2 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is WPBruiser Security updated?
11 releases in the last year, about one every 2 days. Its first release on WordPress.org dates from March 2016.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in WPBruiser Security’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.