Nahnu Login Shield

Changelog

1.0.15

• Changed: the account security panel in right-to-left languages (Arabic, Hebrew, Persian): the sign-in arrow icon is mirrored, and email addresses stay readable inside right-to-left text.
• Fixed: on some themes and with translation plugins, the account security panel’s card icons sat above the title instead of beside it. The icon and its text now always share one row.
• Changed: the plugin description on WordPress.org is shorter (under the 2,500-word limit, so it is no longer cut off), with the same features listed more compactly.

1.0.14

• Changed: the front-end account security panel (WooCommerce My Account > Security and the [nahnls_account_security] shortcode) has a cleaner, store-style design: each section is a card with an icon and a one-line summary, and every sign-in method and two-factor method is a row with its status (On, Always on, Not set up) or a switch. Email login links are turned on and off with a switch. The two-factor section no longer repeats the email address four times: one status line, one row per method, backup codes as a row, and a short tip when email codes are the only method. Works with phone screens and right-to-left languages, and follows the existing colour variables and dark palette.

1.0.13

• New: Cloudflare WAF sub-tab on Edge Blocking, with the same tools as Bunny Shield.
• New: Cloudflare login rate limit. An on/off switch adds a rate limiting rule to your zone (through the Cloudflare API) that blocks any IP flooding wp-login.php, xmlrpc.php or your custom login path. It is added next to any rate limiting rules you already have, never replacing them. On the Free plan the limits are Cloudflare’s fixed ones (more than 10 requests in 10 seconds → blocked for 10 seconds); on Pro and up you choose the requests, the time window and the block length (up to 1 hour on Pro, 1 day on Business). The rule follows your custom login path, including subdirectory installs. Needs the API token permission Zone → Zone WAF → Edit; the tab says so if it is missing.
• New: blocked IPs on Cloudflare are listed on the Cloudflare WAF tab with an Unblock button, and unlocking an IP on the Lockout tab now lifts its Cloudflare block right away instead of waiting for it to expire.
• New: “Block network…” blocks attacker networks (AS numbers) on Cloudflare too, on every Cloudflare plan (IP Access Rules). With Bunny Shield Advanced and Cloudflare both connected, one click blocks the network on both.
• New: the Cloudflare WAF tab warns when the zone is paused in Cloudflare (nothing is blocked then).
• Fixed: Cloudflare blocks were never lifted when they expired: the scheduled unblock task failed. Blocks now end on time.
• Fixed: blocking an IP that was already blocked on Cloudflare lost the record of its rule, so it could not be unblocked from the plugin.
• Fixed: status shown on the settings page now follows a save without a reload: the custom login path On/Off badge, the paths the Bunny rate limit covers and the cache note, “API key is set” notes and placeholders, the 2FA status box, the header status and the blocked-IP log (unblocking on the Bunny Shield tab also removes the row on the IP Blocking tab).
• Fixed: the Cloudflare “Test connection” button appears right after saving the token and zone, without a reload.
• Changed: the custom login path cache note on the Bunny Shield tab links to Nahnu Cache Connector for Bunny.net on WordPress.org.

1.0.12

• New: Bunny Shield login rate limit. An on/off switch on the Edge Blocking tab creates a Shield rate-limit rule (directly through the Bunny API, no other plugin needed) that blocks any IP flooding wp-login.php, xmlrpc.php or your custom login path. On the free Shield Basic plan the limits are fixed at what Bunny allows there (more than 10 requests in 10 seconds → blocked for 1 minute); on Shield Advanced and up you choose the requests, time window and block length (up to 1 hour). Floods are stopped at the edge before they reach your server. When you change the custom login path, the rule is updated automatically.
• Fixed: after saving the Bunny API key or pull zone, the key line could show “✗ Request failed” and the Bunny Shield tab still said “Connect Bunny.net first” until a reload. Both now update right away, and the Test connection button appears without a reload.
• New: blocked IPs on the edge. When your pull zone has Bunny Shield, lockouts go to a Shield access list (“Nahnu Login Shield lockouts”, action Block) automatically: it propagates globally within seconds, the Bunny Shield tab lists every blocked IP with an Unblock button, entries are removed when the lockout expires or you unlock the IP, and the pull-zone IP block list stays as the automatic fallback. The list is created with the first blocked IP (Bunny does not accept an empty list) and removed when it empties. Bunny error messages are now shown in full instead of a bare HTTP code.
• New: “Block network…” on active lockouts looks up the IP’s network (AS number) and, after you confirm, blocks the whole network on a Shield access list. Attackers rotate IPs but usually stay on the same hosting network. Blocked networks are listed (and can be unblocked) on the Edge Blocking tab. Needs Shield Advanced: the free plan allows one custom access list, which is used for blocked IPs.
• New: the Bunny Shield tab shows your Shield plan and warns when Shield is in learning mode or the WAF is set to “Log only”, the two settings that silently stop Shield from blocking. Each warning has a one-click fix (“Turn off learning mode”, “Switch the WAF to Block”).
• New: works with the Nahnu Cache Connector for Bunny.net. Reuse its Bunny connection instead of entering the API key twice, and the custom login path is kept out of its edge HTML cache automatically (updated as soon as you change the path). Without the Cache Connector, the Bunny Shield tab reminds you to exclude the custom login path from Bunny’s HTML cache yourself.
• Changed: the Edge Blocking tab has two sub-tabs: IP Blocking (the Bunny.net and Cloudflare IP blocks and the blocked-IP log, as before) and Bunny Shield (rate limit, lockout access list and blocked networks). The tab you used last is remembered.
• Changed: the “Access temporarily restricted” and geo-block pages are now sent with HTTP 403 and no-cache headers instead of 200, so no CDN or page cache can store a block page and serve it to other visitors.

1.0.11

• Changed: real usernames on the honeypot list are blocked again. Usernames are public, so you can put your own on the list and sign in with your email address instead; bots that try the username are locked out. Email addresses of real accounts are never treated as honeypots. The Lockout tab shows which entries are real accounts and warns you when your own username is on the list.
• New: define( 'NAHNLS_DISABLE_HONEYPOT', true ); in wp-config.php switches the honeypot username list off (emergency recovery, see FAQ).
• Fixed: SureForms. The widget was added by a browser-side scan that looked for a submit button SureForms 2.x no longer marks as type=”submit”, so nothing was ever injected and the check could not pass. The JS marker and CAPTCHA are now printed by the server inside each SureForms form (above the submit button, or after the fields for inline buttons).
• New: protect all SureForms forms or only the ones you tick (Integrations tab, shown while the SureForms integration is on).
• Fixed: with reCAPTCHA v3 or invisible Turnstile, a SureForms form could not submit; inside SureForms forms the token is now kept fresh in the form at all times.
• Fixed: the hidden form nonce was tied to the logged-in user, so a logged-in administrator testing a form that submits over the REST API (SureForms) always got “Security check expired”. The nonce now depends on the site and time only.

1.0.10

• New: white-label emails. Settings > Email branding sets the sender name and address, a logo from the media library, accent and header colours, footer text and the subject / heading / intro (with placeholders) of the 2FA code, magic link and signup confirmation emails, which now share one template. Includes a browser preview and a “Send test email” button. The “Nahnu Shield” badge and “Sent by Nahnu Login Shield” footer are gone; an opt-in “Protected by Nahnu Login Shield” line is available (off by default). New filters nahnls_email_args and nahnls_email_html.
• Changed: two-factor authentication now protects everyone it applies to. With 2FA on, every user in the roles selected under “Apply to roles” (all roles by default; roles added later are covered too) is asked for a code on every password login. Email codes are always on as the baseline; users can add an authenticator app or passkey for stronger protection, and the code is emailed automatically only to users with nothing stronger. Users can no longer turn 2FA off for themselves; administrators can “Reset 2FA” for another user (falls back to email codes). The Remind / Enforce mode is gone: sites that used Enforce keep their selected roles, every other site now applies 2FA to all roles. New wp-config.php recovery switch NAHNLS_DISABLE_2FA (see FAQ).
• Security: every form the plugin protects (wp-login.php, WooCommerce, comments, SureForms, Bricks, nahnls_widget_html()) now carries a hidden form nonce that is verified before any protection field is read; the 2FA challenge form, the emailed magic-link and signup-verification links and the 2FA challenge URLs carry their own nonces, verified before the token or key is read. Developers rendering their own CAPTCHA markup must echo nahnls_form_nonce_field() (see docs/API.md). The nonce is refreshed by JavaScript on page load, so cached pages keep working (see FAQ).
• Fixed: a honeypot entry that is also a real account (the default list includes admin, support, info@* and admin@*) locked that account’s owner out for 24 hours as soon as they signed in with it. Real usernames and emails are no longer treated as honeypots; the Lockout tab shows which entries are ignored for that reason, and “Add to honeypot” in the log refuses real accounts.
• Fixed: with REST protection on, every anonymous REST request that carried an Authorization header WordPress does not understand (Bearer / JWT tokens from other plugins, server-level HTTP auth) counted as a failed login, so five ordinary API calls could lock out an IP. Only credentials WordPress actually rejected count now.
• Fixed: on servers with APCu, the failed-attempt counter was not reset by a successful login.
• Changed: the signup confirmation email’s subject, heading and message are edited on the Access tab, directly below the signup verification settings, with their own Preview and “Send test” buttons. Sender, logo and colours stay under Settings > Email branding, which now holds the two-factor and magic-link wording.
• Fixed: on the Edge Blocking tab, the status badge could say “Not configured” right after saving a key that was saved fine (it reflected a momentary API check instead of the saved settings) and then “Active” after a reload. The badge now shows the saved state, with a new “Key saved, choose a zone” step; the API check result is shown under the key field.
• Improved: the “Active IP lockouts” table has a “Triggered by” column (form or API, number of failed attempts, username, time) and marks your own IP.
• Changed: the username lockout and honeypot-username checks on wp-login.php now run from the wp_authenticate action with the username WordPress hands over, instead of reading the posted form on login_init.
• Changed: plugin prefix renamed from the three-letter “n”+”ls” to “nahnls” to meet the WordPress.org prefix guideline. Functions, classes, options, the log table, user meta, cron hooks, shortcodes, hooks, the REST namespace (now nahnls/v1) and JavaScript globals (window.NAHNLSAuth etc.) all use the new prefix. A one-time migration runs automatically on upgrade and carries over settings, the event log, user 2FA/passkey data and cron schedules. The wp-config constant is now NAHNLS_BYPASS_IP (the old name is still honoured). Developers integrating via docs/API.md must update their hook, shortcode, REST and JS names.
• Removed: the server-side handlers for ~40 form, membership, LMS and community plugins that were present in the code but not exposed in the UI. The supported integrations are Bricks Builder, SureForms and WordPress comments; everything else integrates through the developer API.
• Changed: the early-block mu-plugin is now strictly opt-in. It is no longer copied into the must-use plugins directory on activation, update or settings-page load; install, update or remove it with the explicit buttons on the General tab. Existing installs: the old copy is removed during migration, so click “Install early-block mu-plugin” if you want it back.
• Changed: the mu-plugin’s per-IP rate-limit counters now live in wp-content/uploads/nahnu-login-shield/ratelimit/ (with index.php and .htaccess) instead of the system temp directory, and are removed on uninstall.
• Changed: every script and style is a static file loaded with wp_enqueue_script / wp_enqueue_style; dynamic values are passed with wp_localize_script. The plugin prints no inline in the injector; the JS-presence marker is now set on injected forms and the OOPSpam widget initialises on them.
• Fixed: Unchecked toggles in the Forms tab could inherit their previously saved value.
• Performance: removed per-request opcache invalidation (it was disabling opcache for the whole plugin); now runs once on activation/update.
• Performance: WAF pushes (Bunny/Cloudflare) and notification emails on lockouts and honeypot hits now run asynchronously via WP-Cron instead of inside the attacker’s request.
• Performance: widget CSS/JS and CAPTCHA provider scripts are only enqueued on pages that actually render a protected form.
• Performance: added (event, created_at) index to the log table; schema version 1.1.
• Performance: DB-version check and mu-plugin install no longer run on every front-end request.
• Performance: analytics queries and Chart.js only load on the Analytics tab and are cached for 5 minutes; username-lockout scan only on the Lockout tab.
• Performance: log table geo/lockout lookups batched into a single query; fixed a geo cache key that never matched.
• Performance: idle-timeout activity write throttled to once per minute.
• Fixed: dashboard widget and CSV export were silently capped at 50 rows; MainWP stats queried a non-existent table.

1.0.3

• Fixed: WooCommerce checkout captcha showing when “Protect WC checkout” toggle is off.
• Fixed: WC checkout/order-tracking only active when another WC option was also enabled.
• Fixed: OOPSpam widget CSS/JS not enqueued on the WC checkout page (assets were only loaded on My Account pages).

1.0.2

• Security hardening: json_validate() guards on all external API responses.
• Fixed void function return type error in nahnls_ajax_bunny_fetch_zones().
• Fixed parse errors caused by PHP string escaping in settings and form-protector classes.
• Fixed multi-value match arm syntax for broader PHP 8.x compatibility.

1.0.1

• Minor stability and compatibility fixes.

1.0.0

• Initial public release.
• Brute-force lockout with escalation, per-username lockout, and honeypot usernames.
• CAPTCHA providers: OOPSpam, reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile (managed/invisible), Friendly Captcha.
• Two-factor authentication (TOTP) with per-role enforcement.
• Geo-blocking via CDN headers (Cloudflare, Bunny, CloudFront, Vercel, Fastly) with IP API fallback.
• Edge WAF integration for Bunny.net and Cloudflare with auto-expiry and block log.
• JavaScript presence check.
• Custom login URL with configurable 404/redirect behaviour.
• REST API protection: username enumeration block, lockout enforcement, Application Password toggle.
• Session security: idle timeout with warning dialog, force-logout all sessions.
• Login notifications: per-login email, admin alerts, new-country alerts, weekly digest.
• WooCommerce My Account integration: login, registration, lost-password, checkout, order tracking.
• Form protection framework with CAPTCHA + JS marker for form plugins and WooCommerce.
• Full event log with search, filter, date range, CSV export, and source-form detail column.
• Analytics: daily chart, time-of-day heatmap, event breakdown, top IPs, top usernames.
• Early-block mu-plugin: locked-out IPs blocked before WordPress loads.
• APCu support for attempt counters (100x faster than DB transients on supported hosts).
• MainWP extension companion plugin available separately.