GemSecurity – Firewall, Malware Scanner, 2FA, Social Login & reCAPTCHA

Changelog

1.2.2 – 05/11/2026

• Fixed – The admin-bar styles are now added through WordPress’s style functions instead of a <style> tag printed in the page head.
• Changed – Updated the bundled StoreEngine SDK to 1.6.3. Its notices and license page now add their CSS and JS through WordPress’s style and script functions.

1.2.1 – 03/11/2026

• Fixed – Two-factor code checks are now handled one at a time per user, so several codes sent in parallel can no longer get extra guesses. A code is only accepted from the sign-in form itself, not from the address bar.
• Fixed – IP lists no longer treat a malformed range such as 1.2.3.4/abc as “every address”. Ranges are checked when you save and when they are matched.
• Fixed – Alert webhooks (Slack and generic) must be http(s) addresses that are not on your own network or loopback, and are sent with WordPress’s safe request function. The text of alert emails is now escaped, and the Telegram bot token is checked for the right format.
• Changed – Quarantine restore only puts back non-executable files in the uploads folder. PHP and other scripts, .htaccess, .user.ini, web.config and php.ini stay quarantined and must be reinstalled from their original source.
• Changed – Paths to WordPress core folders no longer rely on the WPINC and WP_LANG_DIR constants.
• Changed – Search terms in the Code & database finder are limited to 500 characters.
• Changed – Every Temporary Access route now declares its own capability check.
• Added – The FAQ lists which files the plugin changes and when.

1.2.0 – 01/11/2026

• Changed – Temporary Access now gives an existing user a role for a limited time and puts their previous role back when it ends. It no longer creates accounts or sign-in links.
• Changed – GemSecurity no longer writes to WordPress core, plugin, theme or must-use folders. Quarantine restores only to the uploads folder, and the core-file restore and chmod “Fix” buttons are gone; the core-file popup and permission audit remain read-only.
• Added – Magic Login: users can ask for a one-time sign-in link by email from the login form.
• Added – Plugin lock: a separate unlock password plus an emailed one-time code, not tied to any user account. It guards deactivating or deleting GemSecurity, turning the lock off and switching modules off, and while locked it blocks installing, uploading and editing code.
• Added – IP safelist: safelisted addresses are never blocked, banned or rate-limited, and your own IP is refused in the blocklist so you cannot lock yourself out.
• Added – A site-wide file upload switch on the Firewall page and in the admin bar. It blocks Media, REST, sideload and XML-RPC uploads.
• Added – Scanner: open a flagged WordPress core file to compare it line by line with the official WordPress.org copy (checksum-verified) and restore the original in one click. The replaced file is kept in quarantine.
• Added – Upload Shield bans the IP behind a refused executable upload (administrators and exempt IPs are spared), with a configurable ban length.
• Added – Security alerts and the ban list show where an IP is (city, region, country and network).
• Added – Alert emails include a “Request origin” table.
• Added – Two-Factor: an “All roles” option for enforced roles.
• Added – Social login buttons appear only after a provider’s keys pass a check, either “Test credentials” or a new “Verify with a sign-in” round trip. Changing a key un-verifies it. A provider whose keys are rejected twice in a row is switched off and you are alerted. The Social Login page shows Verified, Not verified or Switched off for each provider.
• Added – A “Plugin lock” check in the security score.
• Fixed – The plugin lock did not stop GemSecurity Pro from being deleted while inactive (WordPress never checks the per-plugin delete capability).
• Changed – Magic links and social login now go through Admin Guard.
• Changed – The confirm step of magic links only works in the browser that opened the link, so another site cannot sign a visitor in to someone else’s account.
• Changed – Quarantined files are now stored in the database and removed from disk, instead of being moved into the uploads folder. Files quarantined by earlier versions can still be restored.
• Changed – The 2FA encryption key is now kept in the database (or in GEMSECURITY_SECRET_KEY in wp-config.php, which is still preferred) instead of a key file. Key files created by earlier versions keep working.
• Changed – Plugin, must-use plugin, content and upload folders are always looked up through WordPress, so sites that move them are scanned correctly.
• Changed – IP location lookups use HTTPS only (ipapi.co).
• Changed – Rate limits (including magic link limits), lockouts, alert throttling and unlock codes are stored in the database, so they keep working on hosts with a broken object cache.
• Changed – Long scans are limited to 5 minutes instead of running without a time limit.
• Changed – Updated the bundled StoreEngine SDK to 1.6.2. Declining usage tracking now sends nothing, and no promotional notices are loaded.
• Changed – Every compiled JavaScript and CSS file names its source file and how to rebuild it.
• Fixed – “Throttle 404 floods” only logged the flood and never blocked it.
• Fixed – Unbanning an IP did not clear its strike count.
• Fixed – Permanent bans expired immediately.
• Fixed – The 2FA challenge signed out other sessions in the same browser. The challenge now runs before WordPress sets the login cookie.
• Fixed – Deleting an unapproved administrator caused PHP warnings from WordPress’s new-user email.
• Fixed – The Cloudflare Turnstile “Verify keys” test never showed the widget.
• Fixed – The core-file REST route now checks capabilities on each method, and restoring needs the update_core capability.

1.1.0 – 19/10/2026

• Added – Plugin Guard verifies every plugin against WordPress.org checksums with a trust list for premium, custom, theme and must-use plugins. With enforcement on, untrusted plugins are stopped before they load and deactivated, activation and non-.org installs are refused, unknown mu-plugins are quarantined, and a danger alert is sent. Runs from an early mu-plugin loader.
• Added – Install Lock blocks zip uploads, all installs, or every file modification for every account, with a logged 15-minute timed unlock.
• Added – Upload Shield (on by default) refuses executable files on every upload path, PHP hidden in images and scripted SVG, and writes uploads/.htaccess deny rules with a live PHP-execution probe and an nginx snippet.
• Added – A first-run setup wizard (welcome, protection level, features, alerts, summary) opens once after a fresh activation and is reachable again from the topbar; pre-wizard installs are marked legacy.
• Added – The admin menu is grouped into Dashboard, Firewall, Login & Access, Scanning, Logs & Monitoring and Settings. The WordPress sidebar shows one entry per group; existing module URLs keep working.
• Added – The audit log records how every event arrived (admin, REST, REST via application password, XML-RPC, AJAX, WP-CLI, cron), the user agent, and a short login session id, via a new gemsecurity/log_args filter.
• Added – Edits to live posts log a field-level diff (title, slug, content snippet, excerpt, author, date, parent, password, comments) and link the revision to compare or restore. New outbound links are listed and raise the event to warning.
• Added – SEO meta (title and description, canonical, robots, redirect, focus keyword), page template and featured image changes are logged. User creation, role changes (admin promotions at warning) and email or password changes are logged.
• Added – The Logs page lets you click a user to see everything they did, see the full history of a post, and expand a details row.
• Added – A public page picker for the custom login URL. Logged-out login, lost-password and register links on public pages point at the chosen public page (default: homepage) and the logout link at the homepage, so the secret address is no longer printed to visitors and bots. New filter gemsecurity/custom_login_public_url.
• Added – Front-end login forms outside wp-login.php are redirected to the 2FA challenge instead of skipping it. REST endpoints that run their own challenge (such as Academy’s /academy/v1/login) can opt out via gemsecurity/2fa_challenge_routes and gemsecurity/2fa_external_challenge.
• Changed – 2FA seeds are sealed with AES-256-GCM. The key lives in GEMSECURITY_SECRET_KEY or a wp-content key file, not the database and not the WordPress salts, so salt rotation can no longer lock users out. Existing seeds are migrated on admin load.
• Changed – Password logins that cannot show the 2FA challenge (XML-RPC, HTTP basic auth, REST, AJAX popups) are refused for 2FA users; application passwords still work.
• Changed – Security headers are now added to REST responses, served before send_headers ever fires; endpoint-set headers are kept.
• Changed – Upload Shield’s no-exec .htaccess now also covers wp-includes (core’s wp-tinymce.php and ms-files.php stay allowed), languages and upgrade; removing it leaves other tools’ rules byte-for-byte intact.
• Changed – Backups move back to the standalone GemBackup plugin. The Backup module, page, REST routes and tables are gone from GemSecurity. When GemBackup is active, the pre-update backup option, Incident Response roll back and the security score’s recent-backup check are kept and link to GemBackup. Uninstall no longer drops backup tables, archives or GemBackup’s cron events.
• Changed – Backup notification settings are removed from the Notifications page; they live in GemBackup’s own settings.
• Changed – Finder (database and site scan) now searches the whole install (web root, core directories, every theme and stray folders) and more database tables.
• Changed – Admin UI adopts the GemCRM color system in light and dark, with border-only surfaces, 8px card radius and 4px buttons and inputs. Hard-coded semantic tints (alerts, badges, breach rows, danger buttons, threat items) use color-mix() on tokens so they follow both themes; brand gradients are replaced with solid brand blue.
• Fixed – A self-posting front-end login form has no referer, so the 2FA challenge used to send users to the dashboard; it now returns them to the requested URL.
• Fixed – /logs never returned the user display name, so the log never showed who did anything (a by-reference loop over an (array) cast wrote to a copy).

1.0.0 – 28/09/2026

• Added – CAPTCHA is its own module, with its own page, instead of a card under Login Security. Sites that already use CAPTCHA keep it after the update.
• Added – A Notifications page for alert recipients, Slack, Telegram and webhook delivery, and scheduled reports. These used to be on the Settings page.
• Added – A daily report email, off by default. It lists every administrator and active plugin, and calls out any that were added or removed since the last report.
• Added – An alert when GemSecurity is deactivated, by email and through Slack, Telegram or the webhook when alerts are on. With extended protection on, the mu-plugin also sends a warning when the plugin is switched off without being deactivated normally, for example by editing the database.
• Added – Admin Guard removes administrators who are not on the whitelist every hour, and again whenever the whitelist changes. The “Check for unapproved admins” button lists who would be removed before anything happens.
• Added – Forced password resets, by role. A reset ends every session for those users and emails each of them a WordPress reset link. It can run on demand, or on a schedule for passwords older than a set number of days.
• Added – Test buttons for third-party settings, run before you save: CAPTCHA keys (with the real widget), social login app keys, Slack, Telegram, webhook, SIEM, alert email addresses, and the outside services the scanner and geolocation rely on.
• Added – The Scanner checks .htaccess files for rules that allow PHP to run or redirect visitors. A malicious file can be quarantined in one click and restored from Incident Response. The site’s root .htaccess is reported for hand-editing instead, because it holds the permalink rules.
• Added – A file you have reviewed can be marked safe in the Scanner. If the file changes later, it is reported again. Empty “Silence is golden” index.php files are no longer reported.
• Added – Every item under “What needs your attention” on the dashboard links to the page where it is fixed.
• Added – A guide for every module in a help drawer, and setup guides beside the fields that need keys from another service.
• Added – Social login buttons can ask for a role for new accounts, and the gemsecurity/social_login/role_registered action fires after such an account is created.
• Changed – Each setting now lives on one page. The WAF rules, rate limiting, 404 throttling and bad-bot switches moved to the Firewall page (they were on the Pro-only Threat Defense page), the audit log switches to the Logs page, and the backup settings to the Backup page. Features that existed twice, such as the comment honeypot, the application password switch, quarantine and force logout, are now one. Your settings are carried over on update.
• Changed – All emails use one HTML template, and each subject names the site and its domain.
• Changed – With a custom login URL, a logged-out visit to wp-admin goes to the home page. If you are locked out, adding define( 'GEMSECURITY_DISABLE_CUSTOM_LOGIN', true ); to wp-config.php turns the custom login URL off.
• Changed – A wrong CAPTCHA secret key no longer locks everyone out of the login form. Verification is skipped and the problem is logged as critical until the key is fixed.
• Changed – The Virtual Patch list is titled “Shields currently active” and no longer shows red severity badges, so it does not read as a list of problems.
• Changed – The StoreEngine license SDK is updated to 1.5.6. It now ships only in GemSecurity, and GemSecurity Pro uses this copy.
• Fixed – With a custom login URL, visiting wp-admin while logged out redirected to the secret login address.
• Fixed – A custom login URL with spaces or capitals was previewed as one address and served at another. A URL that became empty after cleaning left the switch on while wp-login.php stayed open.
• Fixed – A custom login URL broke two-factor and social login sign-ins.
• Fixed – A correct two-factor code could send the user back to the login form, and a correct emailed code could be reported as invalid, on hosts whose object cache is not shared between requests. Emailed codes are now limited to five attempts.
• Fixed – A failed social login always said “Sign-in could not be verified”. It now gives the real reason, including the provider’s own error.
• Fixed – Twitter/X sign-in stopped working after X retired its twitter.com sign-in addresses, and the credential test reported correct Twitter/X keys as wrong.
• Fixed – The CAPTCHA key test could fail with reCAPTCHA because the widget was drawn before Google’s script was ready.
• Fixed – Alerts were never emailed, only sent to Slack, Telegram and the webhook.
• Fixed – An administrator who was not on the Admin Guard whitelist could still sign in if the account was created outside WordPress’s normal user screens.
• Fixed – The Scanner reported WordPress core files as malware. After a core update, it showed every core file as modified until the next scan, and it did not scan again after the update when the daily scan was off.
• Fixed – Warnings alone could drop the security score to F.
• Fixed – Opening the Scanner page froze the admin, so no other menu item could be opened.
• Fixed – On a new site, the backup settings showed switches that are on by default as off, and saving that screen would have turned off the snapshot taken before a restore.
• Fixed – Switching a module on or off needed a page reload before the menu changed.
• Fixed – Virtual Patch, Payment Integrity, Incident Response and Monitoring appeared unlocked without GemSecurity Pro.
• Fixed – WordPress 6.7 and later logged a notice on every request because translations were loaded too early.

1.0-beta1 – 13/08/2026

First public beta. GemSecurity is an all-in-one, registry-driven security suite with a single-page React dashboard, live security score and a toggleable module manager.

• Added – Firewall & WAF: SQLi/XSS/LFI/RCE request inspection, IP blocklist (CIDR), request rate limiting, 404-flood throttling, bad-bot and AI-crawler blocking, search-bot verification.
• Added – Hardening: disable XML-RPC / file editor / author & REST user enumeration, hide WP version, application-password governance, and security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP).
• Added – Login Security: brute-force lockouts, session limits & idle timeout, password policy, custom login URL, admin-login email alerts, magic-link and lockdown.
• Added – Two-Factor Authentication: app-based TOTP, email OTP and one-time backup codes with per-role enforcement; login CAPTCHA (reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile).
• Added – Social Login: OAuth sign-in with Google, Facebook, GitHub and Twitter/X.
• Added – Admin Guard: rogue-admin auto-remediation, administrator whitelist and hidden-admin detection.
• Added – API & Access hardening: REST API rate limiting, application-password max-age, username-enumeration and generic-login-error protection.
• Added – Anti-Spam: frictionless bot checks on comments and registration with heuristic filtering.
• Added – Scanner: WordPress core file-integrity checks against official checksums, uploads malware/PHP-pattern scan, file-change detection, link scanning, and known-vulnerability scanning for core/plugins/themes.
• Added – Activity Logs & real-time Alerts with retention and CSV export.
• Added – Backups (these moved to the standalone GemBackup plugin in 1.1.0 and are no longer part of GemSecurity).
• Added – Module manager with a live security score and one-page dashboard.

Active threat defense, virtual patching, geolocation access control, payment-integrity monitoring, incident response, uptime/TLS monitoring, signature malware remediation & quarantine, database-injection scan, file integrity vs WordPress.org, recovery toolkit, and cloud backup storage with encryption & migration are available in GemSecurity Pro.