Protect Uploads · Version history
Protect Uploads changelog and version history
- Latest version
- 0.8.0
- Oct 7, 2026 (1 month ago)
- Releases
- 10
- since 2015
- In the last year
- 4
- about one every 94 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
Releases each year
- 20151 release
- 20191 release
- 20201 release
- 20223 releases
- 20251 release
- 20263 releases
20263 releases
Protect Uploads 0.8.0Latest
- Security
- Fixed: a password-protected file stayed downloadable at its direct uploads URL. On Apache and LiteSpeed, direct requests for the file, its image sizes and its WebP/AVIF copies now go to the password prompt
- Fixed: failed passwords were logged but never limited; 5 failed attempts per visitor per file now lock that visitor out for 15 minutes
- Fixed: simultaneous password guesses cannot exceed the attempt limit; successful passwords refund only their own attempt
- Fixed: visitor IPs were read from forwarding headers anyone can set; REMOTE_ADDR is used, with a ‘protect_uploads_client_ip’ filter for sites behind a trusted proxy
- Fixed: IPv4-mapped IPv6 addresses use each visitor’s IPv4 limit instead of sharing a single network limit
- Fixed: SVG and HTML files are downloaded instead of opened, so they cannot run scripts on your site
- Fixed: the protected-file path check could be fooled by “../” segments or a sibling folder name
- Removed: an unused public endpoint that allowed unlimited password guessing
- Fixes
- Fixed: links to password-protected files stopped working after a day, or when served from a page cache (“Invalid security token”)
- Fixed: after entering the password, visitors got the full-size file instead of the image size they asked for
- Fixed: password-protected files were read fully into memory; they are now streamed
- Fixed: watermarking overwrote the original upload; an untouched copy is now kept in uploads/protect-uploads-originals/, blocked from web access
- Fixed: watermarking flattened animated GIFs and stored portrait photos sideways
- Fixed: thumbnails of password-protected images were broken in the Media Library
- Fixed: the settings page could take minutes to load; it makes one cached check of the uploads URL and shows “Could not verify” when that check fails
- Fixed: new year and month upload folders were not protected by the index.php method
- Fixed: messages from saving the settings were lost after the page reloaded
- Fixed: removing the index.php protection deleted other plugins’ index.php files
- Fixed: Site Health reported the uploads directory as protected when only password rules were present
- Fixed: Site Health marked the empty index.php files that block folder listings (this plugin’s and Protect Uploads Pro’s) as dangerous and told you to remove them
- Fixed: deleting the plugin left its settings, tables and .htaccess rules behind (copies of watermarked originals are kept)
- Fixed: on Nginx the settings were rewritten on every request
- Fixed: with Protect Uploads Pro active, the password rules are written after Pro’s rules
- Changes
- Added: Site Health check for password-protected files whose direct URL is not protected, and a notice when the rules cannot be written
- Added: protect_uploads_allow_file_download filter before a password-unlocked file is served
- Changed: the password box warns when the server cannot protect the direct URL (for example, Nginx)
- Changed: right-click protection is described honestly; Pro upgrade texts are accurate, cover Secure Send, the Client Portal and file requests, and link to pricing
Protect Uploads 0.7.1
- Compatibility verified with WordPress 7.1
- Fixed the bundled watermark font: text watermarks now render at the intended size using Open Sans instead of falling back to a small built-in bitmap font
Protect Uploads 0.7.0
- Added Site Health checks: uploads directory browsing protection status, detected server configuration (Apache/Nginx), and a bounded scan for sensitive file types in the uploads directory
- Added unobtrusive upgrade hints for Protect Uploads Pro (hidden entirely when Pro is active)
- Fixed the settings page title showing the plugin slug instead of the plugin name
- Compatibility verified with WordPress 7.0 and PHP 8.3
- Raised minimum requirements to WordPress 5.0 and PHP 7.4
20251 release
Protect Uploads 0.6.0
- Added image watermarking with customizable text, position, opacity, and font size
- Added right-click protection to prevent image downloads
- Added password protection for individual media files
- Added access logging for password-protected files
- Added multiple password support with custom labels
- Added security enhancements throughout the plugin
- Improved file serving with better security checks
- Added font size control for watermarks
- Enhanced error handling and logging
20223 releases
Protect Uploads 0.5.2
- Removed unused css
Protect Uploads 0.5.1
Protect Uploads 0.4
- Fix potential security issues.
- Remove recursive loop that creates indexes.
20201 release
Protect Uploads 0.3
- Simplify UI admin.
- check presence of index.html.
- Remove option value managing current protection status.
- Reorganizing code and making it more modular and simple.
- Remove useless pieces.
20191 release
Protect Uploads 0.2
- Add security check to form in admin page.
- Add sidebar for admin page
- Add Italian translation (thanks to Marko97).
- Try to fix the wrong message saying that Protection is disabled even though it is actually working.
20151 release
Protect Uploads 0.1
- Initial release
Questions about Protect Uploads’s releases
What is the latest version of Protect Uploads?
0.8.0, released on Oct 7, 2026 (1 month ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is Protect Uploads updated?
4 releases in the last year, about one every 94 days. Its first release on WordPress.org dates from April 2015.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in Protect Uploads’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.