Cisilino Site Defense Network: changelog and version history

Version history of Cisilino Site Defense Network, the WordPress security plugin. It defends the login, keeps an activity log and checks file integrity. It also offers optional hardening. Here you will find, for each release, what has changed. The current version is 1.0.15.

Version 1.0.15

• New “Debug log” tab. It records the site’s PHP errors in a file of its own. The administrator turns it on and off without editing wp-config.php. It switches itself off when the chosen time runs out: 1 hour, 24 hours or 7 days.
• No data loss. The log is added to debug.log and to the server log, and does not replace them. Files are never deleted or truncated automatically.
• A file that exceeds the chosen size, from 1 to 50 MB, is closed and compressed into a .zip. Before removing the original, the plugin verifies the zip. At the 200 MB cap the log stops and reports it.
• When logging is switched off, the files stay. They are deleted only from the admin area, one at a time or all together.
• The files sit in a randomly named folder inside uploads, protected by .htaccess. The log does not switch on if the folder is reachable from the internet. You can read the last 200 entries with a filter by level, and download the files.
• Security: the block on user enumeration (?author=N) did not work. The WordPress redirect to /author/<nome>/ ran before the check. Values such as 1a or author[]=1 also bypassed it. The check now runs first and applies to any value.
• Security: the block on PHP execution in uploads ignored uppercase extensions, for example shell.PHP, which many hosts execute. It also did not cover WordPress installed in a subfolder.
• Security: on multisite, the plugin settings write the .htaccess shared by the whole network. They are now reserved for the super admin and not for every sub-site administrator.
• Security: the reason for a ban received from the panel is written as a comment in .htaccess. It can no longer contain control characters or end with \. In Apache that character continues the line and cancelled the next blocking rule.
• Limits: the log sees errors generated after the plugin has loaded, and not those suppressed with @. On uninstall, the collected files remain in uploads.

Version 1.0.14

• Documentation: the readme now links to the guides and the version history on cisilino.com. The plugin’s behaviour does not change.

Version 1.0.13

• Author rate limiting: the default limit was 3 items in 5 minutes. It also suspended an administrator who was simply working, for example importing or duplicating several pages in a row. It did not hit only compromised accounts. The new default is 150 items in 5 minutes. It copes with real heavy use and still blocks anyone who publishes hundreds in one go. Anyone who had already customised the value is left untouched.

Version 1.0.12

• Author rate limiting: it no longer counts what happens inside a WordPress installation or in a temporary environment with a different table prefix. A real case: Plugin Check creates a test installation with a sample post, a sample page and a privacy notice. It suspended the administrator who was using it. Automatic drafts, revisions and items in the trash no longer count either.
• Dashboard notice while a suspension is active. The suspended user sees the reason and the end date. Administrators see the list of suspended users, with the link to revoke.
• The “Rate limiting” tab explains in concrete terms what is counted and what is not. It also explains what being suspended means and how to get out of it.

Version 1.0.11

• New “Rate limiting” tab with three safeguards that can be switched on and off separately. Authors: a user who creates or publishes more than N posts/pages in the window T is suspended for S seconds. The main administrator receives an email with the recent content to check. Visitors (guests): more than N comments or contact forms in the window T block the IP for S seconds. The block applies only to that type of submission. The count is kept in a dedicated table and also works with comments disabled. Required email (in the User registration tab): no user can be created without a valid email address, by any creation route. Each safeguard has two switches: rate limit on/off and email alert on/off. The author alert is on by default, the visitor alert is off. All the N, T and S values are configurable. Active suspensions are listed in the tab, with the option to revoke them.

Version 1.0.10

• Fixed another blocking ERROR from Plugin Check (WordPress.Security.EscapeOutput.OutputNotEscaped) that survived the previous fix. The phpcs:ignore on the multi-line echo in print_idle_script() covered only its own line. It did not cover the following ones with admin_url()/wp_create_nonce()/wp_login_url(). The call is now assigned to a variable before the single echo line, which carries the ignore in full.

Version 1.0.9

• Fixed a blocking ERROR from the official Plugin Check (PluginCheck.CodeAnalysis.Heredoc.NotAllowed). The admin auto-logout inline script used heredoc syntax, which the wordpress.org guidelines don’t allow. It is now a normal PHP string, with no change in behaviour.

Version 1.0.8

• Fixed a fatal error (Uncaught Error: Call to undefined function get_home_path()) that could occur during a failed login attempt. Csdn_Htaccess::htaccess_path() mistakenly loaded wp-admin/includes/misc.php instead of wp-admin/includes/file.php, the file that really defines get_home_path(). In an admin context the fatal error stayed invisible, because the function was already available another way. On wp-login.php, however, it could block access to the site with a fatal error. The plugin only had to record the attempt.

Version 1.0.7

• Security: fixed a race condition in brute force detection (Csdn_Detector::on_login_failed). It allowed the local blocking threshold to be bypassed by sending failed login attempts in parallel for the same IP. The counter is now an atomic upsert (INSERT … ON DUPLICATE KEY UPDATE), no longer a separate read and write.

Version 1.0.6

• New “Paranoic Hardening” tab: optional HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, HSTS). They are all off by default and applied via WordPress (send_headers), not via .htaccess. They therefore also work without mod_headers.
• HSTS is protected by an explicit guard. Activation is refused if the save request does not arrive over https. This avoids sending a header that would make the site unreachable for those who receive it, if the site stopped always being https.
• Each option has an inline explanation below its control. It says what the option does, when it is safe and what it can break.
• New “Check security headers” self-test: a real request to the home page to check which headers actually arrive in the response. It is useful when a CDN or an upstream reverse proxy removes them in transit.
• Paranoic Hardening: new auto-logout of administrators for inactivity, off by default. The timeout is configurable in seconds (60-86400). It is measured on the browser side (mouse, keyboard, scroll, shared across tabs), not server side. This way WP Heartbeat’s automatic requests are not mistaken for real activity. When the timeout expires the session is really closed with wp_logout(), not just a visual redirect.

Version 1.0.5

• Panel reorganisation: new dedicated tabs “Blocked IPs” (with a client-side JavaScript filter), “Hardening / IDS” and “Test” (PHP upload block check + file integrity). They are separate from the General tab.

Version 1.0.4

• PHP execution block in uploads: the .phar/.phps/.pht extensions are now covered too. Before, only .php/.phpN/.phtml were covered.
• Removed the php_admin_flag directive from the blocking rule. On PHP-FPM/CGI Apache hosting it rejects it with a 500 error on the whole site. Require all denied alone is already sufficient.
• Added a self-test from the panel to check that the block really works on the site. We no longer trust the saved configuration alone.

Version 1.0.3

• Security: fixed insufficient validation of the IP addresses received from the panel. A tampered response could insert arbitrary directives into the site’s .htaccess. Now only complete IP addresses and CIDRs are accepted, both on receipt and as a last check before writing the file. No IP source can bypass it any more, local overrides included.
• Security: the connection to the panel now requires https. The sync request carries the API key. Over http it could be read by anyone on the network path. http remains allowed only towards local development hosts.
• Security: upload monitoring now recognises .user.ini, which on PHP-FPM is equivalent to an .htaccess. It also recognises SVG files and names built with null bytes or trailing spaces to disguise an executable extension.
• New row cap for the activity log, 500 by default and configurable in Settings > Activity log. It limits the disk space taken by the log. The log also grows because of unauthenticated requests (failed logins, comments, file submissions). When you raise the cap, the page warns you of the higher consumption.
• Fixed a defect whereby retention never deleted anything, with the activity log on but no panel configured. The rows stayed waiting for delivery to a non-existent recipient. The table grew without limit.
• Custom paths in the hardening rules are now cleaned before being written. Quotes and control characters never reach the .htaccess, which could otherwise end up invalid. Previously the customisation was not filtered enough. A badly written path could make the site unreachable. We chose to discard those characters silently when the rule is written, to keep the user safe from errors. In the field they stay as typed, but have no effect.

Version 1.0.2

• New “User registration” section (Settings): three policies to limit the creation of new WordPress users. The policies are: no restriction, low-privilege roles only, or registration excluded altogether. With low-privilege roles, administrator, editor, author and shop_manager are never created. This is always enforced, even in case of a configuration error. It is ON BY DEFAULT with “low-privilege roles only”: high-privilege roles are already blocked as soon as the plugin is installed, with no configuration needed. The policy covers wp-admin, the REST API, XML-RPC, WP-CLI and direct calls from third-party plugins/themes. It uses the central WordPress filter that every user creation route goes through. There is also a safety net: it immediately revokes the permissions of an account created while the policy was active, whichever way it came in.

Version 1.0.1

• Readme clean-up: the changelog lists only the versions published on the official repository.

Version 1.0.0

• First public release.
• Login defence: detection of failed attempts, local blocking of nuisance IPs in .htaccess, whitelist and manual unblocking from the settings.
• Cisilino network: optional exchange of a digest of hostile IPs with the panel and with the other sites of the network. It is switched off until the connection is configured.
• Activity log: the site’s relevant events are recorded locally with configurable retention. They are logins, users, content, plugins, themes, core, options, media and uploads. They are sent to the panel right after the event, without slowing down the served page.
• Integrity check: the plugin compares the MD5 hashes of its own files with the manifest shipped in the release. It reports modified, missing or unexpected files in its own folder.
• Upload monitoring: it records files that enter the site even outside the media library. It recognises executable extensions, including double extensions like image.php.jpg, and can reject them.
• Optional hardening, all off by default.

Versions before 1.0.0 were never publicly distributed. For the features in detail, start from the plugin’s introductory article.