Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WP-Ban · Version history

WP-Ban changelog and version history

Latest version
2.0.0
Aug 9, 2026 (3 months ago)
Releases
19
since 2007
In the last year
1
Tested up to
WordPress 7.0.8
PHP 8.2 or later

Releases each year

  • 20074 releases
  • 20082 releases
  • 20091 release
  • 20111 release
  • 20143 releases
  • 20153 releases
  • 20161 release
  • 20221 release
  • 20231 release
  • 20251 release
  • 20261 release

20261 release

  1. WP-Ban 2.0.0Latest

    • FIXED: One IP address had several spellings and the lists compare strings, so 2001:DB8::1 and 2001:db8::1 were two different ban entries, and an IPv4-mapped ::ffff:203.0.113.5 matched neither an IPv4 entry nor an IPv4 range. Where the visitor chooses the spelling that is a ban evasion; where they d…
    • FIXED: The banned message may contain a <style> element — the shipped one does — and kses has no opinion about CSS, only about markup. On multisite a site administrator holds manage_options and deliberately does not hold unfiltered_html, so they could make every banned visitor fetch a stylesheet of…
    • FIXED: A forwarding header was read from the left, which is the end the visitor writes. Every proxy appends — nginx’s $proxy_add_x_forwarded_for is literally "$http_x_forwarded_for, $remote_addr" — so a banned visitor on a site that had named a header could send any address they liked and walk stra…
    • FIXED: wp_ban_stats grew one entry per distinct address for ever, and the whole array was unserialised, incremented and written back on every banned request — so the cost of a request grew with the number of addresses ever seen, and neither half needed any authentication to reach: a visitor opts in…
    • FIXED: A ban pattern with several wildcards backtracks quadratically against a long subject, and the subjects are the user agent and the referrer, which the visitor writes — and both lists are walked on every request, not only on banned ones. Subjects are capped at 2,048 characters before matching;…
    • FIXED: The reverse DNS lookup for %USER_HOSTNAME% ran on every ban whether or not the message used the variable, and the shipped message does not. Whoever owns the address’s reverse zone decides how long that blocking call takes
    • BREAKING: Requires WordPress 6.8 and PHP 8.2, up from 6.0 and 7.4.
    • BREAKING: Proxy headers are no longer trusted by default. If your site is behind Cloudflare, a load balancer or any reverse proxy, name the header your proxy sets in the new Header That Contains The IP field, or define WP_BAN_TRUST_PROXY. See the FAQ.
    • BREAKING: The This site is behind a reverse proxy checkbox is removed. It trusted whichever of seven forwarding headers happened to arrive; naming the one header your proxy sets is both safer and what the four sibling plugins offer. A site that had the box ticked and no header named is migrated to…
    • BREAKING: The ban page is now served as 403 Forbidden instead of 200 OK. Filter wp_ban_status_code to restore the old behaviour. See the FAQ.
    • BREAKING: The pre-2.0.0 global functions (banned(), ban_get_ip(), print_banned_message(), process_ban(), is_admin_ip(), preg_match_wildcard() and friends) have been removed. They were unprefixed and declared unconditionally; any code calling them must be updated.
    • BREAKING: The option rows are renamed. banned_options is now wp_ban_options, banned_stats is now wp_ban_stats, and ban_db_version is replaced by wp_ban_version. The ten pre-2.0.0 rows are folded into those three automatically and then deleted.
    • NEW: Settings moved to the Settings API, under Settings -> Ban, split across three tabs: Stats, Settings and Templates. All three write one option row, and saving one leaves the other two untouched.
    • NEW: Ban stats are now a sortable, paginated list table with bulk delete. The old table rendered every recorded address on a single page.
    • NEW: IPv6 IP ranges are supported.
    • NEW: A Header That Contains The IP setting naming the one header to trust, plus the WP_BAN_TRUST_PROXY constant and wp_ban_trust_proxy filter.
    • NEW: wp_ban_capability, wp_ban_denied, wp_ban_enabled, wp_ban_ipaddress, wp_ban_protect_self and wp_ban_status_code hooks.
    • NEW: A wp ban WP-CLI command: list, add, remove, check, stats and reset. wp ban check <ip> reports whether an address would be banned and by which list, which is the quickest way to find out what a wildcard or a range actually covers.
    • NEW: Dropped jQuery; the admin script is vanilla JavaScript.
    • NEW: The ban check no longer runs for WP-CLI or cron.
    • CHANGED: Restructured into includes/, with every class prefixed WP_Ban_.
    • CHANGED: The ban stats row is no longer autoloaded, so an unbounded list of every address ever turned away is no longer read on every page view.
    • FIXED: A malformed IP range banned every visitor. ip2long() returns false for an unparseable bound, and PHP compared the address against that boolean as true.
    • FIXED: IPv6 ranges silently matched nobody.
    • FIXED: Network activation and multisite uninstall fatalled, because wp_get_sites() was removed in WordPress 5.1. Both now page through every site rather than stopping at the hundredth.
    • FIXED: Ban entries were stored HTML-escaped, so a referrer pattern containing & could never match a real Referer header, and re-saving compounded it. Existing entries are repaired by the upgrade.
    • FIXED: The banned message was stored slashed and unslashed on every read. The upgrade corrects the stored value.
    • FIXED: Bans stopped applying entirely when proxy headers were trusted and none was present, or when the visitor’s address was on a private network.
    • FIXED: The banned message preview was readable by any logged-in user, including subscribers. It now requires manage_options and a nonce.
    • FIXED: Self-ban protection only worked if your username was literally “admin”. It now protects whoever is saving.

20251 release

  1. WP-Ban 1.69.2

20231 release

  1. WP-Ban 1.69.1

20221 release

  1. WP-Ban 1.69

20161 release

  1. WP-Ban 1.68

20153 releases

  1. WP-Ban 1.67

  2. WP-Ban 1.66

  3. WP-Ban 1.65

20143 releases

  1. WP-Ban 1.64

  2. WP-Ban 1.63

  3. WP-Ban 1.62

20111 release

  1. WP-Ban 1.50

20091 release

  1. WP-Ban 1.40

20082 releases

  1. WP-Ban 1.31

  2. WP-Ban 1.30

20074 releases

  1. WP-Ban 1.20

  2. WP-Ban 1.11

  3. WP-Ban 1.10

  4. WP-Ban 1.00

Questions about WP-Ban’s releases

What is the latest version of WP-Ban?

2.0.0, released on Aug 9, 2026 (3 months ago). It’s tested up to WordPress 7.0.8 and needs PHP 8.2 or later.

How often is WP-Ban updated?

One release in the last year. Its first release on WordPress.org dates from March 2007.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WP-Ban’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.