SecuPress with Simple SSL changelog and version history

20265 releases

1. SecuPress with Simple SSL 2.7.4Latest

   Nov 6, 2026
   • 6 Nov 2026
   • New: The secupress.notices.display filter can hide an admin notice. Its context is two or three words taken from the message.
   • New: Block scans for hidden content counts every 404 for one minute, then refuses further missing pages (HTTP 429). Missing PHP files stay blocked.
   • Improvement: PasswordLess always affects the Administrator role. The checkbox stays checked and cannot be unchecked.
   • Improvement: You can now fix legitimate “fake accounts” if needed.
   • Improvement: Anti-spam checks a disallowed-terms file (more than 20,000 words) in addition to the WordPress comment list, and obfuscates only visible email addresses and mailto links.
   • Improvement: The anti-spam disallowed-terms check is about 100 times faster: a few milliseconds per comment instead of about 200 ms.
   • Improvement: Forbid Same Email Domain also blocks a profile email change and a users REST update. Accounts that already use the site domain stay allowed.
   • Improvement: A disallowed username that contains a wildcard now blocks a new account, including registration and the REST API. An existing account can still be updated.
   • Improvement: Limit Login Attempts counts an unknown identifier even when user enumeration protection is off, and counts each failed XML-RPC authentication in the same request.
   • Improvement: Limit Login Attempts stores each unknown identifier on its own, for one month after its last failure. The shared list no longer grows forever and parallel attempts are no longer lost.
   • Improvement: A single banned IP is stored on its own, with an expiry that does not follow a later change of the ban length. IP ranges stay in the shared list. An IPv4 address written as IPv6 is treated as IPv4.
   • Improvement: SECUPRESS_ALLOW_LOGIN_ACCESS also skips Limit Login Attempts, Password Spraying, and Protect User Creation, so a fake user can log in while the constant is set. An admin notice stays visible until it is removed.
   • Fix: A verified-bot hostname is remembered, so a visit does not repeat the DNS lookup.
   • Fix: A request that claims to come from a SecuPress scan now carries a signature made with the master key.
   • Fix: A line break in a log or a 404 address can no longer forge an extra log line.
   • Fix: Firewall checks on the referer, the host, and the request method use the whole value. A list of request keys is read correctly on PHP 8.
   • Fix: A ban that must stop the request now really stops it (HTTP 403) and logs the attack, for example during an XML-RPC multicall or a password spraying attempt.
   • Fix: Move Login keeps the password-reset confirmation (checkemail=confirm) and the registration confirmation (checkemail=registered) on the custom login URL.
   • Fix: Block Bad User Agents, without the 8G signatures, refuses a user agent that contains HTML (HTTP 403). The bad user agent scan sees that block and no longer stays on a bad status.
   • Fix: The system status widget uses less memory.

2. SecuPress with Simple SSL 2.7.3

   Oct 22, 2026

3. SecuPress with Simple SSL 2.7.2

   Oct 19, 2026

4. SecuPress with Simple SSL 2.7.1

   Sep 25, 2026

5. SecuPress with Simple SSL 2.7

   Sep 15, 2026